[pve-devel] [PATCH storage 1/1] fix #1710: add retrieve method for storage

Thomas Lamprecht t.lamprecht at proxmox.com
Thu Apr 29 16:11:23 CEST 2021

On 29.04.21 16:01, Dominik Csapak wrote:
> On 4/29/21 15:22, Thomas Lamprecht wrote:
>> Maybe we can just allow it only for users with Sys.Modify + Sys.Audit on / ?
>> We could also enforce that it needs to be a hostname (no IP) and/or resolve
>> to something out of the priv. network ranges, at least if the aforementioned
>> privs are not set.
> yes, sounds good, but then we have to disallow redirects

true, or at least resolve them manually ourself.

>> Another idea would be enforcing the URL to match something like /\.(iso|img)$/
>> and being not to informative on errors to avoid allowing to see which hsot are
>> on/off line in a network. With that one could make this pretty safe I think.
> mhmm.. could work, but then we'd have to use a fixed timeout
> (like on authentication) to avoid timing based probes

had that in mind too, actually replied that to lorenz just now ^^

More information about the pve-devel mailing list