v0.24.13

src/admin/api_token_access.rs

@@ -21,17 +21,14 @@ fn general_api_token_allowed(method: &Method, path: &str, permission: &str) -> b
                 | "/api/metrics/json"
                 | "/api/metrics/summary"
                 | "/api/cache/bans"
-        );
+        ) || (method == Method::GET
+            && path.strip_prefix("/api/config/")
+                .is_some_and(|section| ConfigSection::from_name(section).is_some()));
     let write = permission == "rw"
         && ((method == Method::PUT
             && (path == "/api/config"
-                || path.strip_prefix("/api/config/").is_some_and(|part| {
-                    !part.is_empty()
-                        && part != "history"
-                        && part != "reload"
-                        && part != "storage"
-                        && !part.contains('/')
-                })))
+                || path.strip_prefix("/api/config/")
+                    .is_some_and(|section| ConfigSection::from_name(section).is_some())))
             || (method == Method::POST
                 && matches!(
                     path,
@@ -39,7 +36,7 @@ fn general_api_token_allowed(method: &Method, path: &str, permission: &str) -> b
                         | "/api/config/history/restore"
                         | "/api/cache/purge"
                         | "/api/cache/invalidate"
-                        | "/api/geoip/update"
+                        | "/api/config/geoip/update"
                         | "/api/docker/refresh"
                         | "/api/certificates/reload"
                 ))