Merge pull request #86 from apache/post

Use POST for user sensitive calls

Author: mlsorensen

cloudstack/UserService.go

@@ -297,7 +297,7 @@ func (s *UserService) NewCreateUserParams(account string, email string, firstnam
 
 // Creates a user for an account that already exists
 func (s *UserService) CreateUser(p *CreateUserParams) (*CreateUserResponse, error) {
-	resp, err := s.cs.newRequest("createUser", p.toURLValues())
+	resp, err := s.cs.newPostRequest("createUser", p.toURLValues())
 	if err != nil {
 		return nil, err
 	}
@@ -1718,7 +1718,7 @@ func (s *UserService) NewUpdateUserParams(id string) *UpdateUserParams {
 
 // Updates a user account
 func (s *UserService) UpdateUser(p *UpdateUserParams) (*UpdateUserResponse, error) {
-	resp, err := s.cs.newRequest("updateUser", p.toURLValues())
+	resp, err := s.cs.newPostRequest("updateUser", p.toURLValues())
 	if err != nil {
 		return nil, err
 	}

cloudstack/VPNService.go

@@ -221,7 +221,7 @@ func (s *VPNService) NewAddVpnUserParams(password string, username string) *AddV
 
 // Adds vpn users
 func (s *VPNService) AddVpnUser(p *AddVpnUserParams) (*AddVpnUserResponse, error) {
-	resp, err := s.cs.newRequest("addVpnUser", p.toURLValues())
+	resp, err := s.cs.newPostRequest("addVpnUser", p.toURLValues())
 	if err != nil {
 		return nil, err
 	}

generate/generate.go

@@ -58,6 +58,20 @@ var detailsRequireZeroIndex = map[string]bool{
 	"updateAccount":    true,
 }
 
+// requiresPost is a prefilled set of API names that require POST
+// for security or size purposes
+var requiresPostMethod = map[string]bool{
+	"login":                            true,
+	"deployVirtualMachine":             true,
+	"updateVirtualMachine":             true,
+	"createUser":                       true,
+	"updateUser":                       true,
+	"addVpnUser":                       true,
+	"registerUserData":                 true,
+	"setupUserTwoFactorAuthentication": true,
+	"validateUserTwoFactorAuthenticationCode": true,
+}
+
 var mapRequireList = map[string]map[string]bool{
 	"deployVirtualMachine": map[string]bool{
 		"dhcpoptionsnetworklist": true,
@@ -1705,7 +1719,7 @@ func (s *service) generateNewAPICallFunc(a *API) {
 		pn("		time.Sleep(500 * time.Millisecond)")
 		pn("	}")
 	} else {
-		if a.Name == "deployVirtualMachine" || a.Name == "login" || a.Name == "updateVirtualMachine" {
+		if requiresPostMethod[a.Name] {
 			pn("	resp, err := s.cs.newPostRequest(\"%s\", p.toURLValues())", a.Name)
 		} else {
 			pn("	resp, err := s.cs.newRequest(\"%s\", p.toURLValues())", a.Name)

generate/listApis.json

@@ -44786,7 +44786,7 @@
       ]
     },
     {
-      "description": "Lists OpenDyalight controllers",
+      "description": "Lists OpenDaylight controllers",
       "isasync": false,
       "name": "listOpenDaylightControllers",
       "params": [
@@ -55892,7 +55892,7 @@
       "since": "4.15.0"
     },
     {
-      "description": "Removes an OpenDyalight controler",
+      "description": "Removes an OpenDaylight controller",
       "isasync": true,
       "name": "deleteOpenDaylightController",
       "params": [
@@ -117752,7 +117752,7 @@
       ]
     },
     {
-      "description": "Adds an OpenDyalight controler",
+      "description": "Adds an OpenDaylight controller",
       "isasync": true,
       "name": "addOpenDaylightController",
       "params": [