From 16f5b2834e7b76bf49c7e17f615ac4f57453eafb Mon Sep 17 00:00:00 2001
From: Thomas Lamprecht <t.lamprecht@proxmox.com>
Date: Fri, 28 Jun 2019 19:29:46 +0200
Subject: [PATCH] api: backup pool: enforce VM.Backup permissions on pool

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
---
 PVE/API2/Backup.pm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/PVE/API2/Backup.pm b/PVE/API2/Backup.pm
index 9a2171cc..87781ecc 100644
--- a/PVE/API2/Backup.pm
+++ b/PVE/API2/Backup.pm
@@ -427,6 +427,11 @@ __PACKAGE__->register_method({
 	my $rpcenv = PVE::RPCEnvironment::get();
 	my $user = $rpcenv->get_user();
 
+	if (my $pool = $param->{pool}) {
+	    $rpcenv->check_pool_exist($pool);
+	    $rpcenv->check($user, "/pool/$pool", ['VM.Backup']);
+	}
+
 	my $update_job = sub {
 	    my $data = cfs_read_file('vzdump.cron');