Proxmox/pve-manager
5
0
Fork 0
Code Pull Requests Releases Activity

fix bug #379: allow to overwrite existing CTs if user has VM.Backup permissions

Browse Source 
The requirement to have VM.Allocate it non-obvious and confusing
if the VM already exists. If the user can backup, he should also be able
to restore that backup.
This commit is contained in:
Dietmar Maurer 2013-06-20 07:18:12 +02:00
parent a88002cf76
commit d721d4dfd2
1 changed files with 17 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
PVE/API2/OpenVZ.pm
View File

@ -232,11 +232,10 @@ __PACKAGE__->register_method({
method => 'POST',
description => "Create or restore a container.",
permissions => {
description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}, and 'Datastore.AllocateSpace' on the storage.",
check => [ 'or',
[ 'perm', '/vms/{vmid}', ['VM.Allocate']],
[ 'perm', '/pool/{pool}', ['VM.Allocate'], require_param => 'pool'],
],
user => 'all', # check inside
description => "You need 'VM.Allocate' permissions on /vms/{vmid} or on the VM pool /pool/{pool}. " .
"For restore, it is enough if the user has 'VM.Backup' permission and the VM already exists. " .
"You also need 'Datastore.AllocateSpace' permissions on the storage.",
},
protected => 1,
proxyto => 'node',
@ -306,6 +305,8 @@ __PACKAGE__->register_method({
my $private = PVE::Storage::get_private_dir($storage_cfg, $storage, $vmid);
my $basecfg_fn = PVE::OpenVZ::config_file($vmid);
if (defined($pool)) {
$rpcenv->check_pool_exist($pool);
$rpcenv->check_perm_modify($authuser, "/pool/$pool");
@ -313,6 +314,17 @@ __PACKAGE__->register_method({
$rpcenv->check($authuser, "/storage/$storage", ['Datastore.AllocateSpace']);
if ($rpcenv->check($authuser, "/vms/$vmid", ['VM.Allocate'], 1)) {
# OK
} elsif ($pool && $rpcenv->check($authuser, "/pool/$pool", ['VM.Allocate'], 1)) {
# OK
} elsif ($param->{restore} && $param->{force} && (-f $basecfg_fn) &&
$rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup'], 1)) {
# OK: user has VM.Backup permissions, and want to restore an existing VM
} else {
raise_perm_exc();
}
&$check_ct_modify_config_perm($rpcenv, $authuser, $vmid, $pool, [ keys %$param]);
PVE::Storage::activate_storage($storage_cfg, $storage);
@ -356,8 +368,6 @@ __PACKAGE__->register_method({
$param->{hostname} .= ".$param->{searchdomain}";
}
my $basecfg_fn = PVE::OpenVZ::config_file($vmid);
my $check_vmid_usage = sub {
if ($param->{force}) {
die "cant overwrite mounted container\n"