mirror of
https://github.com/webmin/webmin.git
synced 2026-10-29 06:31:04 +00:00
04b47e5815
This PR adds an `api_only` global permission that restricts a Webmin account to one supported API endpoint, such as virtual-server/remote.cgi. External integrations need credentials that can call an API without also granting access to the Webmin interface or generic RPC. Existing module permissions do not provide this endpoint-level restriction. The new setting allows administrators to create dedicated integration accounts while Webmin continues performing authorized operations through its privileged backend. The restriction is enforced in two places: - MiniServ checks the authenticated account's policy before dispatching CGI, static-file, DAV, or WebSocket requests. Requests outside the configured endpoint receive HTTP 403. - `init_config` requires the permitted CGI to explicitly opt in before initialization. This also protects Webmin-initializing CGIs hosted by another web server. Generic RPC is denied for API-only accounts, even when an existing RPC permission would otherwise allow it. The endpoint's own module and operation permissions still apply. Selecting an endpoint does not grant permission to execute every API command. Webmin Users gains an API-only setting for users and groups. Existing restrictions survive ordinary edits, resets, copies, cloning, renaming, group propagation, and cluster synchronization. Clearing a restriction requires an explicit permission edit. Group updates preserve restrictions already assigned to individual members. MiniServ reads the policy on each request from the account's existing storage backend: local files, MySQL, PostgreSQL, or LDAP. Policy-read errors deny access instead of treating the account as unrestricted. Validation passed with the four separately submitted supporting fixes (#2897, #2898, #2899, #2900) ,applied: 169 focused tests, syntax checks, and live Debian tests using file-backed and PostgreSQL accounts. Live checks covered account creation, lifecycle operations, both CGI modes, sessions, RPC, static files, DAV, and WebSockets. The supporting fixes remain separate PRs. This API-only branch currently has seven lifecycle test failures that depend on the file-cache and group ACL cleanup fixes landing.
120 lines
3.3 KiB
Perl
Executable File
120 lines
3.3 KiB
Perl
Executable File
#!/usr/local/bin/perl
|
|
# save_acl.cgi
|
|
# Save the ACL for a module for a user or group
|
|
|
|
require './cluster-webmin-lib.pl';
|
|
&ReadParse();
|
|
$who = $in{'_acl_user'} ? $in{'_acl_user'} : $in{'_acl_group'};
|
|
|
|
# Validate and parse inputs
|
|
&error_setup($text{'acl_err'});
|
|
$maccess{'noconfig'} = $in{'noconfig'};
|
|
if (-r "../$in{'_acl_mod'}/acl_security.pl") {
|
|
&foreign_require($in{'_acl_mod'}, "acl_security.pl");
|
|
&foreign_call($in{'_acl_mod'}, "acl_security_save", \%maccess, \%in);
|
|
}
|
|
|
|
# Setup error handler for down hosts
|
|
sub user_error
|
|
{
|
|
$user_error_msg = join("", @_);
|
|
}
|
|
&remote_error_setup(\&user_error);
|
|
|
|
# Write out on all hosts, or just one host
|
|
&ui_print_header(undef, $text{'acl_title'}, "");
|
|
@allhosts = &list_webmin_hosts();
|
|
@servers = &list_servers();
|
|
if ($in{'all'}) {
|
|
# Doing on all hosts that the user has the module on
|
|
foreach $h (@allhosts) {
|
|
local $w;
|
|
if ($in{'_acl_user'}) {
|
|
($w) = grep { $_->{'name'} eq $in{'_acl_user'} }
|
|
@{$h->{'users'}};
|
|
}
|
|
else {
|
|
($w) = grep { $_->{'name'} eq $in{'_acl_group'} }
|
|
@{$h->{'groups'}};
|
|
}
|
|
next if (!$w);
|
|
local %ingroup;
|
|
foreach $g (@{$h->{'groups'}}) {
|
|
map { $ingroup{$_}++ } @{$g->{'members'}};
|
|
}
|
|
local @m = $ingroup{$w->{'name'}} ? @{$w->{'ownmods'}}
|
|
: @{$w->{'modules'}};
|
|
push(@hosts, $h) if (&indexof($in{'_acl_mod'}, @m) >= 0 ||
|
|
!$in{'_acl_mod'});
|
|
}
|
|
print "<b>",&text('acl_doing', $who),"</b><p>\n";
|
|
}
|
|
else {
|
|
# Doing on just one host
|
|
@hosts = grep { $_->{'id'} == $in{'_acl_host'} } @allhosts;
|
|
local ($s) = grep { $_->{'id'} == $hosts[0]->{'id'} } @servers;
|
|
print "<b>",&text('acl_doing2', $who, &server_name($s)),"</b><p>\n";
|
|
}
|
|
$p = 0;
|
|
foreach $h (@hosts) {
|
|
local ($s) = grep { $_->{'id'} == $h->{'id'} } @servers;
|
|
local ($rh = "READ$p", $wh = "WRITE$p");
|
|
pipe($rh, $wh);
|
|
if (!fork()) {
|
|
close($rh);
|
|
&remote_foreign_require($s->{'host'}, "acl", "acl-lib.pl");
|
|
if ($user_error_msg) {
|
|
# Host is down
|
|
print $wh &serialise_variable([ 0, $user_error_msg ]);
|
|
exit;
|
|
}
|
|
|
|
# The remote ACL writer preserves an endpoint omitted by the form.
|
|
my $save = $in{'_acl_user'} ? 'save_module_acl' : 'save_group_module_acl';
|
|
&remote_foreign_call($s->{'host'}, "acl", $save,
|
|
\%maccess, $who, $in{'_acl_mod'}, 1);
|
|
|
|
# Recursively update the ACL for all member users and groups
|
|
if ($in{'_acl_group'}) {
|
|
local ($group) = grep { $_->{'name'} eq $in{'_acl_group'} }
|
|
@{$h->{'groups'}};
|
|
&remote_foreign_call($s->{'host'}, "acl", "set_acl_files",
|
|
$h->{'users'}, $h->{'groups'}, $in{'_acl_mod'},
|
|
$group->{'members'}, \%maccess);
|
|
}
|
|
|
|
print $wh &serialise_variable([ 1 ]);
|
|
exit;
|
|
}
|
|
close($wh);
|
|
$p++;
|
|
}
|
|
|
|
# Read back the results
|
|
$p = 0;
|
|
foreach $h (@hosts) {
|
|
local ($s) = grep { $_->{'id'} == $h->{'id'} } @servers;
|
|
local $d = &server_name($s);
|
|
local $rh = "READ$p";
|
|
local $line = <$rh>;
|
|
local $rv = &unserialise_variable($line);
|
|
close($rh);
|
|
|
|
if ($rv && $rv->[0] == 1) {
|
|
# It worked
|
|
print &text('acl_success', $d),"<br>\n";
|
|
}
|
|
else {
|
|
# Something went wrong
|
|
print &text('acl_failed', $d, $rv->[1]),"<br>\n";
|
|
}
|
|
$p++;
|
|
}
|
|
|
|
print "<p><b>$text{'acl_done'}</b><p>\n";
|
|
|
|
&remote_finished();
|
|
&ui_print_footer("", $text{'index_return'},
|
|
$in{'_acl_user'} ? ( "edit_user.cgi?user=$in{'_acl_user'}&host=$in{'_acl_host'}", $text{'user_return'} ) : ( "edit_group.cgi?group=$in{'_acl_group'}&host=$in{'_acl_host'}", $text{'group_return'} ));
|
|
|