[PATCH storage v2 2/2] api: prune backups: allow Datastore.Allocate even without VM.Backup

[Fiona Ebner <f.ebner@proxmox.com>]

A user with 'Datastore.Allocate' permissions for the storage can prune
all backups on the storage. If the same user specifies an explicit
guest ID, additionally the 'VM.Backup' permission for the VM was
required. Remove this restriction, since removing a subset should not
require more permissions and is also at odds with the logic in
check_volume_access().

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/API2/Storage/PruneBackups.pm | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/PVE/API2/Storage/PruneBackups.pm b/src/PVE/API2/Storage/PruneBackups.pm
index 7863c36e..5f62e2b7 100644
--- a/src/PVE/API2/Storage/PruneBackups.pm
+++ b/src/PVE/API2/Storage/PruneBackups.pm
@@ -4,6 +4,7 @@ use strict;
 use warnings;
 
 use PVE::Cluster;
+use PVE::Exception qw(raise_perm_exc);
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::RESTHandler;
 use PVE::RPCEnvironment;
@@ -15,11 +16,13 @@ use base qw(PVE::RESTHandler);
 my sub assert_prune_permission {
     my ($rpcenv, $authuser, $storeid, $vmid) = @_;
 
+    return if $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.Allocate'], 1);
+
     if (defined($vmid)) {
         $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.AllocateSpace']);
         $rpcenv->check($authuser, "/vms/$vmid", ['VM.Backup']);
     } else {
-        $rpcenv->check($authuser, "/storage/$storeid", ['Datastore.Allocate']);
+        raise_perm_exc("/storage/$storeid, Datastore.Allocate");
     }
 
     return;
-- 
2.47.3