Users can not update VM config

Description When a regular user tries to update the VM’s config (for example, a context var), it gets the following error:

one.vm.updateconf result FAILURE [one.vm.updateconf] User [2] : Template includes a restricted attribute DISK.

The specific setting from oned.conf creating the issue is:

VM_RESTRICTED_ATTR = "DISK/ORIGINAL_SIZE"

The weird part is that this setting exists also in older versions (for example, 5.10.5), but this issue is non existent on that version.

To Reproduce Create a user (not belonging to oneadmin group), allow this user to use a specific vm (use permission, change owner, whatever). Try to update the VM’s context.

Details

• Affected components: core
• Version: 5.12.3

Additional context Add any other context about the problem here.

Progress Status

• Branch created
• Code committed to development branch
• Testing - QA
• Documentation
• Release notes - resolved issues, compatibility, known issues
• Code committed to upstream release/hotfix branches
• Documentation committed to upstream release/hotfix branches

[dfelsch]

I also just stumbled upon this. Is there any workaround? Removing DISK/ORIGINAL_SIZE from the VM_RESTRICTED_ATTR list does not seem to be a good idea as this value directly ends in shell scripts and would possibly allow RCE, correct?

[tinova]

fixed in ba9983bd7dab47267ed77731fcd0d7ecdb1e9c04 and 7814dc597a3d16cb8274c5d4a5992cf2f7a9eac8