[pmg-devel] [PATCH pmg-api 1/1] api/quarantine: allow 'listattachments' for quarantine users

[Dominik Csapak]

we use 'get_attachments' which uses 'get_and_check_mail'. that already
checks the correct permsissions (quser are only able to retriever their
own mails/attachments) so it's ok here to allow it

Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
---
 src/PMG/API2/Quarantine.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/PMG/API2/Quarantine.pm b/src/PMG/API2/Quarantine.pm
index dc52029..3d5b2c8 100644
--- a/src/PMG/API2/Quarantine.pm
+++ b/src/PMG/API2/Quarantine.pm
@@ -1005,7 +1005,7 @@ __PACKAGE__->register_method ({
     name => 'listattachments',
     path => 'listattachments',
     method => 'GET',
-    permissions => { check => [ 'admin', 'qmanager', 'audit'] },
+    permissions => { check => [ 'admin', 'qmanager', 'audit', 'quser'] },
     description => "Get Attachments for E-Mail in Quarantine.",
     parameters => {
 	additionalProperties => 0,
-- 
2.30.2