From 2b21d19e4cb5b51d057fd8656863f94b7b6723cd Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Mon, 11 May 2026 13:50:19 -0700 Subject: [PATCH] volume: require admin auth on ReadAllNeedles and VolumeNeedleStatus (#9437) Both RPCs hand out raw needle bytes / cookies. Run them through checkGrpcAdminAuth like the rest of the volume-server admin handlers. --- weed/server/volume_grpc_admin.go | 4 ++++ weed/server/volume_grpc_read_all.go | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/weed/server/volume_grpc_admin.go b/weed/server/volume_grpc_admin.go index 631992a81..cc52919fc 100644 --- a/weed/server/volume_grpc_admin.go +++ b/weed/server/volume_grpc_admin.go @@ -398,6 +398,10 @@ func (vs *VolumeServer) VolumeNeedleStatus(ctx context.Context, req *volume_serv resp := &volume_server_pb.VolumeNeedleStatusResponse{} + if err := vs.checkGrpcAdminAuth(ctx); err != nil { + return resp, err + } + volumeId := needle.VolumeId(req.VolumeId) n := &needle.Needle{ diff --git a/weed/server/volume_grpc_read_all.go b/weed/server/volume_grpc_read_all.go index 190082a6f..43334d7ad 100644 --- a/weed/server/volume_grpc_read_all.go +++ b/weed/server/volume_grpc_read_all.go @@ -11,6 +11,10 @@ import ( func (vs *VolumeServer) ReadAllNeedles(req *volume_server_pb.ReadAllNeedlesRequest, stream volume_server_pb.VolumeServer_ReadAllNeedlesServer) (err error) { + if err := vs.checkGrpcAdminAuth(stream.Context()); err != nil { + return err + } + for _, vid := range req.VolumeIds { if err := vs.streamReadOneVolume(needle.VolumeId(vid), stream); err != nil { stats.VolumeServerFileReadFailures.Inc()