mirror of
https://github.com/taylanbakircioglu/haproxy-openmanager.git
synced 2026-10-23 20:45:41 +00:00
taylanbakircioglu
b49db4aff7
A user on the built-in viewer role got 403 from the SSL API while clusters,
frontends, backends, WAF rules, agents and VIPs were readable.
The UI never fills in user_pool_access, so every non-admin user created there
has no pool access. The SSL list with ?cluster_id= and the SSL detail required
pool access on read; the other read endpoints do not. The check also protected
little: the SSL list without cluster_id already returned every certificate.
- New auth_middleware.validate_cluster_read_access: a role that grants
<resource>.read reads that resource on every cluster, otherwise the
router's pool check still applies. Used by the SSL list, SSL detail and
GET /api/waf/stats. Write endpoints are unchanged.
While tracing this, GET /api/ssl/certificates/{id} and the SSL change diff in
Apply Management turned out to return the private key to any authenticated
user, viewer included.
- The key is now included only with ssl.download (already in the role
catalog, never enforced) plus the pool check that guarded the detail route
before. Otherwise the detail returns private_key_content: null with
private_key_redacted: true, and the diff shows a redaction line.
- SSL Management shows the key as hidden, and on edit the key field becomes
optional; an empty field keeps the stored key (the PUT already falls back).
Also: GET /api/waf/stats re-wrapped its 403/404 as 500 and leaked the
connection on that path.
No schema change, so the built-in roles are not re-seeded. Custom roles with
ssl.update but no ssl.download no longer see the key.
6 lines
154 B
JSON
6 lines
154 B
JSON
{
|
|
"version": "1.11.2",
|
|
"releaseName": "Read-only roles read SSL without pool access; private keys need ssl.download",
|
|
"releaseDate": "2026-10-01"
|
|
}
|