protect also static files; allow badges to be offered with dashboard acl
Costa Tsaousis (ktsaou) committed
Oct 4, 2017 at 01:17 UTC
841afa7666e9a44fa6cf3f483decbe5f0a2b1ca1
3 files changed
+12
-3
src/web_api_v1.c
+8
-3
@@ -897,8 +897,13 @@ static struct api_command {
897
{ "data", 0, WEB_CLIENT_ACL_DASHBOARD, web_client_api_request_v1_data },
898
{ "chart", 0, WEB_CLIENT_ACL_DASHBOARD, web_client_api_request_v1_chart },
899
{ "charts", 0, WEB_CLIENT_ACL_DASHBOARD, web_client_api_request_v1_charts },
900
- { "registry", 0, WEB_CLIENT_ACL_NONE, web_client_api_request_v1_registry },
901
- { "badge.svg", 0, WEB_CLIENT_ACL_BADGE, web_client_api_request_v1_badge },
900
+
901
+ // registry checks the ACL by itself, so we allow everything
902
+ { "registry", 0, WEB_CLIENT_ACL_NOCHECK, web_client_api_request_v1_registry },
903
+
904
+ // badges can be fetched with both dashboard and badge permissions
905
+ { "badge.svg", 0, WEB_CLIENT_ACL_DASHBOARD|WEB_CLIENT_ACL_BADGE, web_client_api_request_v1_badge },
906
+
907
{ "alarms", 0, WEB_CLIENT_ACL_DASHBOARD, web_client_api_request_v1_alarms },
908
{ "alarm_log", 0, WEB_CLIENT_ACL_DASHBOARD, web_client_api_request_v1_alarm_log },
909
{ "alarm_variables", 0, WEB_CLIENT_ACL_DASHBOARD, web_client_api_request_v1_alarm_variables },
@@ -927,7 +932,7 @@ inline int web_client_api_request_v1(RRDHOST *host, struct web_client *w, char *
932
933
for(i = 0; api_commands[i].command ;i++) {
934
if(unlikely(hash == api_commands[i].hash && !strcmp(tok, api_commands[i].command))) {
930
- if(unlikely(api_commands[i].acl != WEB_CLIENT_ACL_NONE) && !(w->acl & api_commands[i].acl))
935
+ if(unlikely(api_commands[i].acl != WEB_CLIENT_ACL_NOCHECK) && !(w->acl & api_commands[i].acl))
936
return web_client_permission_denied(w);
937
938
return api_commands[i].callback(host, w, url);
src/web_client.c
+3
@@ -347,6 +347,9 @@ gid_t web_files_gid(void) {
347
int mysendfile(struct web_client *w, char *filename) {
348
debug(D_WEB_CLIENT, "%llu: Looking for file '%s/%s'", w->id, netdata_configured_web_dir, filename);
349
350
+ if(!web_client_can_access_dashboard(w))
351
+ return web_client_permission_denied(w);
352
+
353
// skip leading slashes
354
while (*filename == '/') filename++;
355
src/web_client.h
+1
@@ -110,6 +110,7 @@ struct response {
110
111
typedef enum web_client_acl {
112
WEB_CLIENT_ACL_NONE = 0,
113
+ WEB_CLIENT_ACL_NOCHECK = 0,
114
WEB_CLIENT_ACL_DASHBOARD = 1 << 0,
115
WEB_CLIENT_ACL_REGISTRY = 1 << 1,
116
WEB_CLIENT_ACL_BADGE = 1 << 2