api: backup: update: check permissions of delete params too

[pve-manager.git] / PVE / API2 / Backup.pm

diff --git a/PVE/API2/Backup.pm b/PVE/API2/Backup.pm
index 6aef5bb78cebaba23b73e778842b92b5db663cc0..684a078e785dc6f307725b83f277a20fe7e50f4d 100644 (file)
--- a/PVE/API2/Backup.pm
+++ b/PVE/API2/Backup.pm
@@ -54,6 +54,14 @@ sub assert_param_permission_common {
     }
 }
 
+my sub assert_param_permission_update {
+    my ($rpcenv, $user, $update, $delete) = @_;
+    return if $user eq 'root@pam'; # always OK
+
+    assert_param_permission_common($rpcenv, $user, $update);
+    assert_param_permission_common($rpcenv, $user, $delete);
+}
+
 my $convert_to_schedule = sub {
     my ($job) = @_;
 
@@ -424,8 +432,6 @@ __PACKAGE__->register_method({
        my $rpcenv = PVE::RPCEnvironment::get();
        my $user = $rpcenv->get_user();
 
-       assert_param_permission_common($rpcenv, $user, $param);
-
        if (my $pool = $param->{pool}) {
            $rpcenv->check_pool_exist($pool);
            $rpcenv->check($user, "/pool/$pool", ['VM.Backup']);
@@ -435,9 +441,9 @@ __PACKAGE__->register_method({
 
        my $id = extract_param($param, 'id');
        my $delete = extract_param($param, 'delete');
-       if ($delete) {
-           $delete = [PVE::Tools::split_list($delete)];
-       }
+       $delete = { map { $_ => 1 } PVE::Tools::split_list($delete) } if $delete;
+
+       assert_param_permission_update($rpcenv, $user, $param, $delete);
 
        my $update_job = sub {
            my $data = cfs_read_file('vzdump.cron');
@@ -445,7 +451,7 @@ __PACKAGE__->register_method({
 
            my $jobs = $data->{jobs} || [];
 
-           die "no options specified\n" if !scalar(keys %$param);
+           die "no options specified\n" if !scalar(keys $param->%*) && !scalar(keys $delete->%*);
 
            PVE::VZDump::verify_vzdump_parameters($param);
            my $opts = PVE::VZDump::JobBase->check_config($id, $param, 0, 1);
@@ -472,7 +478,7 @@ __PACKAGE__->register_method({
                'repeat-missed' => 1,
            };
 
-           foreach my $k (@$delete) {
+           for my $k (keys $delete->%*) {
                if (!PVE::VZDump::option_exists($k) && !$deletable->{$k}) {
                    raise_param_exc({ delete => "unknown option '$k'" });
                }