Hi,
I'm querying the PDM API and ran into what looks like a bug on the firewall status endpoint.
GET /api2/json/pve/firewall/status always returns permission check failed (403), no matter which token I use. I first hit it with a user that has Auditor on / with propagate, which works fine for everything else I query. Then I created a token on root@pam with Administrator on / and propagate, and got the same 403. As far as I can tell there aren't any higher privileges than that, so I don't think this is an ACL problem on my side.
The parent path /api2/json/pve/firewall returns 200 and lists status as its only subdir, so the route itself resolves. And other endpoints that need Resource.Audit on /resource/{remote} work fine with the same tokens, for instance /pve/remotes/{remote}/resources?kind=node.
Looking at the API viewer, the documented check is {"path":["resource","{remote}"],"privs":["Resource.Audit"]}. But the endpoint doesn't take any parameters, and it's documented as returning the firewall status of all PVE remotes. So my guess is that {remote} can't be resolved when the check runs, and it ends up failing every time.
Seen on both 1.1.1 and 1.1.7.
Anyone else run into this, or am I missing something obvious?
I'm querying the PDM API and ran into what looks like a bug on the firewall status endpoint.
GET /api2/json/pve/firewall/status always returns permission check failed (403), no matter which token I use. I first hit it with a user that has Auditor on / with propagate, which works fine for everything else I query. Then I created a token on root@pam with Administrator on / and propagate, and got the same 403. As far as I can tell there aren't any higher privileges than that, so I don't think this is an ACL problem on my side.
The parent path /api2/json/pve/firewall returns 200 and lists status as its only subdir, so the route itself resolves. And other endpoints that need Resource.Audit on /resource/{remote} work fine with the same tokens, for instance /pve/remotes/{remote}/resources?kind=node.
Looking at the API viewer, the documented check is {"path":["resource","{remote}"],"privs":["Resource.Audit"]}. But the endpoint doesn't take any parameters, and it's documented as returning the firewall status of all PVE remotes. So my guess is that {remote} can't be resolved when the check runs, and it ends up failing every time.
Seen on both 1.1.1 and 1.1.7.
Anyone else run into this, or am I missing something obvious?
