[pve-devel] [PATCH manager] ui: cloudinit: disallow unprivileged users to regenerate images

[pve-devel] [PATCH manager] ui: cloudinit: disallow unprivileged users to regenerate images

[Daniel Kral]

Disables the "Regenerate image" button in the VM CloudInit tab for
users, which lack the necessary permissions to do so, which are
"VM.Config.CloudInit" and "VM.Config.CDROM". This is checked by the VM
config update API endpoint in qemu-server, when ejecting and re-adding
CloudInit drive images.

This is consistent with the permissions restricting access to adding
CloudInit drives in the Hardware tab.

This is a cosmetic change as the VM config update API endpoint would
fail because of insufficient permissions anyway.

Signed-off-by: Daniel Kral <d.kral@proxmox.com>
---
I stumbled upon this while checking on BugZilla #3105 and trying to use
the "Regenerate image" button with a user, that had only VM.Audit and
VM.Config.CloudInit permissions. where the user missed the
"VM.Config.CDROM" permission and the action couldn't be completed.

 www/manager6/qemu/CloudInit.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/www/manager6/qemu/CloudInit.js b/www/manager6/qemu/CloudInit.js
index 49519726..aeef8c15 100644
--- a/www/manager6/qemu/CloudInit.js
+++ b/www/manager6/qemu/CloudInit.js
@@ -142,7 +142,10 @@ Ext.define('PVE.qemu.CloudInit', {
 		}
 	});
 
-	me.down('#savebtn').setDisabled(!found);
+	let caps = Ext.state.Manager.get('GuiCap');
+	let canSaveImage = !!caps.vms['VM.Config.CDROM'] && !!caps.vms['VM.Config.Cloudinit'];
+	me.down('#savebtn').setDisabled(!found || !canSaveImage);
+
 	me.setDisabled(!found);
 	if (!found) {
 	    me.getView().mask(gettext('No CloudInit Drive found'), ['pve-static-mask']);
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel