From: Remi Gacogne <remi.gacogne@powerdns.com>
Date: Tue, 22 Aug 2017 09:48:07 +0000 (+0200)
Subject: auth: Deny cache flush, zone retrieve and notify if the API is RO
X-Git-Tag: auth-4.1.0~8^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F6007%2Fhead;p=thirdparty%2Fpdns.git

auth: Deny cache flush, zone retrieve and notify if the API is RO
---

diff --git a/pdns/ws-auth.cc b/pdns/ws-auth.cc
index d30bd6d771..70f4ce779d 100644
--- a/pdns/ws-auth.cc
+++ b/pdns/ws-auth.cc
@@ -1443,7 +1443,7 @@ static void apiServerZoneExport(HttpRequest* req, HttpResponse* resp) {
 static void apiServerZoneAxfrRetrieve(HttpRequest* req, HttpResponse* resp) {
   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
 
-  if(req->method != "PUT")
+  if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
     throw HttpMethodNotAllowedException();
 
   UeberBackend B;
@@ -1462,7 +1462,7 @@ static void apiServerZoneAxfrRetrieve(HttpRequest* req, HttpResponse* resp) {
 static void apiServerZoneNotify(HttpRequest* req, HttpResponse* resp) {
   DNSName zonename = apiZoneIdToName(req->parameters["id"]);
 
-  if(req->method != "PUT")
+  if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
     throw HttpMethodNotAllowedException();
 
   UeberBackend B;
@@ -1824,7 +1824,7 @@ static void apiServerSearchData(HttpRequest* req, HttpResponse* resp) {
 }
 
 void apiServerCacheFlush(HttpRequest* req, HttpResponse* resp) {
-  if(req->method != "PUT")
+  if(req->method != "PUT" || ::arg().mustDo("api-readonly"))
     throw HttpMethodNotAllowedException();
 
   DNSName canon = apiNameToDNSName(req->getvars["domain"]);