"Local" command line parameter is only for stopping

a server that has been started by the desktop GUI

gns3server/api/routes/compute/compute.py

@@ -25,7 +25,7 @@ import psutil
 from gns3server.config import Config
 from gns3server.utils.cpu_percent import CpuPercent
 from gns3server.version import __version__
-from gns3server.utils.path import get_default_project_directory
+from gns3server.utils.path import get_default_project_directory, is_safe_path
 from gns3server.compute.port_manager import PortManager
 from gns3server.compute.project_manager import ProjectManager
 from gns3server.utils.interfaces import interfaces
@@ -81,8 +81,7 @@ def compute_version() -> dict:
     Retrieve the server version number.
     """
 
-    local_server = Config.instance().settings.Server.local
-    return {"version": __version__, "local": local_server}
+    return {"version": __version__}
 
 
 @router.get("/statistics")
@@ -155,12 +154,17 @@ async def create_qemu_image(image_data: schemas.QemuImageCreate) -> Response:
     Create a Qemu image.
     """
 
-    if os.path.isabs(image_data.path):
-        if Config.instance().settings.Server.local is False:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
+    #FIXME: move to controller
+    raise NotImplementedError()
+
+    # Raise error if user try to escape
+    #if not is_safe_path(image_data.path, project.path):
+    #    raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
 
     await Qemu.instance().create_disk(
-        image_data.qemu_img, image_data.path, jsonable_encoder(image_data, exclude_unset=True)
+        image_data.qemu_img,
+        image_data.path,
+        jsonable_encoder(image_data, exclude_unset=True, exclude={"qemu_img", "path"})
     )
 
     return Response(status_code=status.HTTP_204_NO_CONTENT)
@@ -176,9 +180,12 @@ async def update_qemu_image(image_data: schemas.QemuImageUpdate) -> Response:
     Update a Qemu image.
     """
 
-    if os.path.isabs(image_data.path):
-        if Config.instance().settings.Server.local is False:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
+    #FIXME: move to controller
+    raise NotImplementedError()
+
+    # Raise error if user try to escape
+    #if not is_safe_path(image_data.path, project.path):
+    #    raise HTTPException(status_code=status.HTTP_403_FORBIDDEN)
 
     if image_data.extend:
         await Qemu.instance().resize_disk(image_data.qemu_img, image_data.path, image_data.extend)

gns3server/api/routes/controller/images.py

@@ -85,7 +85,6 @@ async def upload_image(
     if os.path.commonprefix([base_images_directory, full_path]) != base_images_directory:
         raise ControllerForbiddenError(f"Cannot write image, '{image_path}' is forbidden")
 
-    print(image_path)
     if await images_repo.get_image(image_path):
         raise ControllerBadRequestError(f"Image '{image_path}' already exists")
 

gns3server/api/routes/controller/projects.py

@@ -342,10 +342,10 @@ async def import_project(
     Import a project from a portable archive.
     """
 
-    controller = Controller.instance()
-    if Config.instance().settings.Server.local is False:
-        raise ControllerForbiddenError("The server is not local")
+    #TODO: import project remotely
+    raise NotImplementedError()
 
+    controller = Controller.instance()
     # We write the content to a temporary location and after we extract it all.
     # It could be more optimal to stream this but it is not implemented in Python.
     try:
@@ -385,16 +385,9 @@ async def duplicate_project(
     Duplicate a project.
     """
 
-    if project_data.path:
-        if Config.instance().settings.Server.local is False:
-            raise ControllerForbiddenError("The server is not a local server")
-        location = project_data.path
-    else:
-        location = None
-
     reset_mac_addresses = project_data.reset_mac_addresses
     new_project = await project.duplicate(
-        name=project_data.name, location=location, reset_mac_addresses=reset_mac_addresses
+        name=project_data.name, reset_mac_addresses=reset_mac_addresses
     )
     await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/projects/{new_project.id}/*")
     return new_project.asdict()
@@ -423,7 +416,7 @@ async def get_file(file_path: str, project: Project = Depends(dep_project)) -> F
 @router.post("/{project_id}/files/{file_path:path}", status_code=status.HTTP_204_NO_CONTENT)
 async def write_file(file_path: str, request: Request, project: Project = Depends(dep_project)) -> Response:
     """
-    Write a file from a project.
+    Write a file to a project.
     """
 
     file_path = urllib.parse.unquote(file_path)