From 1107a3c703880d6059d89d840e4cec6bb8489704 Mon Sep 17 00:00:00 2001 From: Colin Coe Date: Tue, 3 Mar 2009 07:28:27 +0900 Subject: [PATCH] Add API Call 'read_or_write_ks_snippet' This API call reads the named snippet from disk or writes a new/modified snippet. --- cobbler/remote.py | 34 ++++++++++++++++++++++++++++++++++ 1 files changed, 34 insertions(+), 0 deletions(-) diff --git a/cobbler/remote.py b/cobbler/remote.py index 87d8bad..3a82464 100644 --- a/cobbler/remote.py +++ b/cobbler/remote.py @@ -1473,6 +1473,40 @@ class CobblerXMLRPCInterface: fileh.close() return True + def read_or_write_ks_snippet(self,snippet,is_read,new_data,token): + """ + Allows the WebUI to be used as a snippet editor. For security reasons + we will only allow snippet files to be edited if they reside in + /var/lib/cobbler/snippets/. This limits the damage doable by Evil who + has a cobbler password but not a system password. + """ + + + if is_read: + what = "read_snippet" + else: + what = "write_snippet" + + self._log(what,name=snippet,token=token) + self.check_access(token,what,snippet,is_read) + + if snippet.find("..") != -1 or not snippet.startswith("/"): + raise CX(_("tainted file location")) + + if not snippet.startswith("/var/lib/cobbler/snippets/"): + raise CX(_("unable to view or edit snippet in this location")) + + if is_read: + fileh = open(snippet,"r") + data = fileh.read() + fileh.close() + return data + else: + fileh = open(snippet,"w+") + fileh.write(new_data) + fileh.close() + return True + def power_system(self,object_id,power=None,token=None): """ Allows poweron/poweroff/reboot of a system -- 1.5.5.1