From ee9255601e8b676fb048683b4bcc13582834b4d1 Mon Sep 17 00:00:00 2001 From: Aaron Lauterer Date: Fri, 12 Feb 2021 16:57:50 +0100 Subject: [PATCH] API: update_vm_api: check for CDROM on disk delete Since CDRoms and disks share the same config keys, we need to check if it actually is a CDRom and then check the permissions accordingly. Otherwise it is possible for someone without VM.Config.CDROM permissions, but with VM.Config.Disk permissions to remove a CD drive while being unable to create a CDRom drive. Signed-off-by: Aaron Lauterer --- PVE/API2/Qemu.pm | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm index 3571f5ef..feb9ea8b 100644 --- a/PVE/API2/Qemu.pm +++ b/PVE/API2/Qemu.pm @@ -1235,7 +1235,12 @@ my $update_vm_api = sub { } } elsif (PVE::QemuServer::is_valid_drivename($opt)) { PVE::QemuConfig->check_protection($conf, "can't remove drive '$opt'"); - $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']); + my $drive = PVE::QemuServer::parse_drive($opt, $val); + if (PVE::QemuServer::drive_is_cdrom($drive)) { + $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.CDROM']); + } else { + $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk']); + } PVE::QemuServer::vmconfig_register_unused_drive($storecfg, $vmid, $conf, PVE::QemuServer::parse_drive($opt, $val)) if $is_pending_val; PVE::QemuConfig->add_to_pending_delete($conf, $opt, $force);