saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

When making auth calls, only username, password, auth, and token are valid, so we strip anything else out.

Browse source
This commit is contained in:
Gareth J. Greenaway 2019-01-24 12:45:35 -08:00
parent d6f4f055f5
commit 3dbe8dc8be
No known key found for this signature in database
GPG key ID: 10B62F8A7CAD7A41
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
salt/auth/__init__.py
View file

@ -93,9 +93,14 @@ class LoadAuth(object):
fstr = '{0}.auth'.format(load['eauth'])
if fstr not in self.auth:
return False
# When making auth calls, only username, password, auth, and token
# are valid, so we strip anything else out.
_valid = ['username', 'password', 'eauth', 'token']
_load = {key: value for (key, value) in load.items() if key in _valid}
fcall = salt.utils.args.format_call(
self.auth[fstr],
load,
_load,
expected_extra_kws=AUTH_INTERNAL_KEYWORDS)
try:
if 'kwargs' in fcall:

14
tests/integration/netapi/rest_cherrypy/test_app.py
View file

@ -191,6 +191,20 @@ class TestRun(cptc.BaseRestCherryPyTest):
})
assert response.status == '401 Unauthorized'
def test_run_extra_parameters(self):
'''
Test the run URL with good auth credentials
'''
cmd = dict(self.low, **dict(self.auth_creds))
cmd['id_'] = 'someminionname'
body = urlencode(cmd)
request, response = self.request('/run', method='POST', body=body,
headers={
'content-type': 'application/x-www-form-urlencoded'
})
self.assertEqual(response.status, '200 OK')
class TestWebhookDisableAuth(cptc.BaseRestCherryPyTest):