[pve-devel] [PATCH v3 manager 2/9] rest_handler: implement 'allowtoken' property

Fabian Grünbichler f.gruenbichler at proxmox.com
Tue Jan 21 13:54:22 CET 2020

to filter out API paths that are not available with API tokens for
security reasons, such as access control related endpoints.

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>

    pairs with patch in pve-common that adds this to the schema-schema. any modules
    setting that flag need a corresponding versioned depends on
    - rename to allowtoken, negate default value/semantics

 PVE/HTTPServer.pm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/PVE/HTTPServer.pm b/PVE/HTTPServer.pm
index 65f3a1d8..7859081b 100755
--- a/PVE/HTTPServer.pm
+++ b/PVE/HTTPServer.pm
@@ -7,7 +7,7 @@ use PVE::SafeSyslog;
 use PVE::INotify;
 use PVE::Tools;
 use PVE::APIServer::AnyEvent;
-use PVE::Exception qw(raise_param_exc raise);
+use PVE::Exception qw(raise_param_exc raise_perm_exc raise);
 use PVE::RPCEnvironment;
 use PVE::AccessControl;
@@ -148,6 +148,9 @@ sub rest_handler {
 	    $uri_param->{$p} = $params->{$p};
+	raise_perm_exc("URI '$rel_uri' not available with API token, need proper ticket.\n")
+	    if $auth->{api_token} && !$info->{allowtoken};
 	# check access permissions
 	$rpcenv->check_api2_permissions($info->{permissions}, $auth->{userid}, $uri_param);

More information about the pve-devel mailing list