From 5661a68106e6b0744b5d7262783db8e001aa2b7e Mon Sep 17 00:00:00 2001 From: Dominik Csapak Date: Mon, 9 Dec 2019 15:27:00 +0100 Subject: [PATCH] move vmstate check to check_vm_modify_config_perm so that it gets checked before the special case of removing the vmstate Signed-off-by: Dominik Csapak --- PVE/API2/Qemu.pm | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm index 25c28360..3c7ef30d 100644 --- a/PVE/API2/Qemu.pm +++ b/PVE/API2/Qemu.pm @@ -315,7 +315,6 @@ my $check_vm_modify_config_perm = sub { # some checks (e.g., disk, serial port, usb) need to be done somewhere # else, as there the permission can be value dependend next if PVE::QemuServer::is_valid_drivename($opt); - next if $opt eq 'vmstate'; next if $opt eq 'cdrom'; next if $opt =~ m/^(?:unused|serial|usb)\d+$/; @@ -338,6 +337,10 @@ my $check_vm_modify_config_perm = sub { $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']); } elsif ($cloudinitoptions->{$opt} || ($opt =~ m/^(?:net|ipconfig)\d+$/)) { $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']); + } elsif ($opt eq 'vmstate') { + # the user needs Disk and PowerMgmt privileges to change the vmstate + # also needs privileges on the storage, that will be checked later + $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk', 'VM.PowerMgmt' ]); } else { # catches hostpci\d+, args, lock, etc. # new options will be checked here @@ -1152,8 +1155,6 @@ my $update_vm_api = sub { } } elsif ($opt eq 'vmstate') { PVE::QemuConfig->check_protection($conf, "can't remove vmstate '$val'"); - # the user needs Disk and PowerMgmt privileges to remove the vmstate - $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk', 'VM.PowerMgmt' ]); if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, { file => $val }, $rpcenv, $authuser, 1)) { delete $conf->{$opt}; PVE::QemuConfig->write_config($vmid, $conf);