135/netdisco
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

make safe the api calls with potential for demo site damage

Browse Source
This commit is contained in:
Oliver Gorwits
2023-06-05 17:28:34 +01:00
parent 65a908dcd3
commit 195f98dff1
3 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/App/Netdisco/JobQueue/PostgreSQL.pm
View File

@@ -324,7 +324,7 @@ sub jq_insert {
$jobs = [$jobs] if ref [] ne ref $jobs; $jobs = [$jobs] if ref [] ne ref $jobs;
# bit of a hack for heroku hosting to avoid DB overload # bit of a hack for heroku hosting to avoid DB overload
return true if setting('defanged_admin') eq 'false_admin'; return true if setting('defanged_admin') ne 'admin';
my $happy = false; my $happy = false;
try { try {

4
lib/App/Netdisco/Web/API/Objects.pm
View File

@@ -240,7 +240,7 @@ swagger_path {
}, },
], ],
responses => { default => {} }, responses => { default => {} },
}, put '/api/v1/object/device/:ip/nodes' => require_role api_admin => sub { }, put '/api/v1/object/device/:ip/nodes' => require_role setting('defanged_api_admin') => sub {
jq_insert([{ jq_insert([{
action => 'macsuck', action => 'macsuck',
@@ -317,7 +317,7 @@ swagger_path {
}, },
], ],
responses => { default => {} }, responses => { default => {} },
}, put '/api/v1/object/device/:ip/arps' => require_role api_admin => sub { }, put '/api/v1/object/device/:ip/arps' => require_role setting('defanged_api_admin') => sub {
jq_insert([{ jq_insert([{
action => 'arpnip', action => 'arpnip',

1
share/config.yml
View File

@@ -263,6 +263,7 @@ check_userlog: false
devport_vlan_limit: 150 devport_vlan_limit: 150
login_logo: "" login_logo: ""
defanged_admin: 'admin' defanged_admin: 'admin'
defanged_api_admin: 'api_admin'
hide_deviceports: [] hide_deviceports: []
# ------------- # -------------