TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-16 03:31:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/localapi: make serveTKASign require write permission (#10094)

Browse Source 
The existing read permission check looks like an oversight. Write seems
more appropriate for sining new nodes.

Updates https://github.com/tailscale/corp/issues/15506

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
This commit is contained in:
Andrew Lytvynov 2023-11-02 17:01:26 -06:00 committed by GitHub
parent 191e2ce719
commit f0bc95a066
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ipn/localapi/localapi.go
View File

@ -1685,8 +1685,8 @@ func (h *Handler) serveTKAStatus(w http.ResponseWriter, r *http.Request) {
} }
func (h *Handler) serveTKASign(w http.ResponseWriter, r *http.Request) { func (h *Handler) serveTKASign(w http.ResponseWriter, r *http.Request) {
if !h.PermitRead { if !h.PermitWrite {
http.Error(w, "lock status access denied", http.StatusForbidden) http.Error(w, "lock sign access denied", http.StatusForbidden)
return return
} }
if r.Method != httpm.POST { if r.Method != httpm.POST {