[pve-devel] [PATCH v2 manager 1/3] api: vzdump: extract config: check for VM.Backup privilege

[Fabian Ebner]

In preparation to have check_volume_access() always allow access for
users with Datastore.Allocate privilege. As to not automatically give
all such users permission to extract the config too.

Signed-off-by: Fabian Ebner <f.ebner at proxmox.com>
---

New in v2.

 PVE/API2/VZDump.pm | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/PVE/API2/VZDump.pm b/PVE/API2/VZDump.pm
index 2c0df4c3..a6c4d111 100644
--- a/PVE/API2/VZDump.pm
+++ b/PVE/API2/VZDump.pm
@@ -269,6 +269,11 @@ __PACKAGE__->register_method ({
 	my $storage_cfg = PVE::Storage::config();
 	PVE::Storage::check_volume_access($rpcenv, $authuser, $storage_cfg, undef, $volume);
 
+	if (PVE::Storage::parse_volume_id($volume, 1)) {
+	    my (undef, undef, $ownervm) = PVE::Storage::parse_volname($storage_cfg, $volume);
+	    $rpcenv->check($authuser, "/vms/$ownervm", ['VM.Backup']);
+	}
+
 	return PVE::Storage::extract_vzdump_config($storage_cfg, $volume);
     }});
 
-- 
2.30.2