cern-fts / fts-rest-flask Goto Github PK

If I create a transfer where the destination URLs include a username/password (e.g. ftp://username:[email protected]/path/file.zip) then the credentials are exposed in the FTS dashboard, as the full URL is shown there. The dashboard must strip the credentials from the URLs. This is a very serious security vulnerability.

@mpatrascoiu

The documentation for endpoints https://fts3-docs.web.cern.ch/fts3-docs/fts-rest/docs/api.html#post-dmmkdir , https://fts3-docs.web.cern.ch/fts3-docs/fts-rest/docs/api.html#post-dmrmdir and https://fts3-docs.web.cern.ch/fts3-docs/fts-rest/docs/api.html#post-dmunlink incorrectly states that the surl parameter is a query parameter. In fact, these requests need the parameter to be passed in the body, in the form

{
    "surl": "https:///..."
}

The documentation for mkdir also says it creates a remote file, which is incorrect.

The documentation for endpoint https://fts3-docs.web.cern.ch/fts3-docs/fts-rest/docs/api.html#post-dmrename incorrectly states that this operation will stat a file. In fact it will rename a file. It also says the old and new parameters are query parameters. In fact, these parameters are to be passed in the body, in the form

{
    "old": "https:///...",
    "new": "https:///..."
}

The documentation is also incomplete, as it says this only works for files, although it works for both files and folders.

The docuementation for API endpoint https://fts3-docs.web.cern.ch/fts3-docs/fts-rest/docs/api.html#get-dmstat says that it will return stats for a file. But it works equally as good for folders too. So maybe say that in the documentation.

I am trying to register (then configure) an S3 host in FTS. I am using the FTS instance fts3-public.cern.ch:8446. I am trying this from Postman, before doing it from code. I configured a client certificate in Postman for the above hostname:port.

• If I try to register new S3 hostname the call does not even return (but the S3 hostname shows up in the FTS configuration).
• If I try to register a valid S3 hostname (but which was already registered), the call returns with status code 500.

As a side note, if I call to configure an already registered S3 host, the call succeeds (validates that my client certificate is OK).

Help!