api/resume: make nocheck root-only

this is only used for migration via 'qm mtunnel', regular users should
never need to resume a VM that does not logically belong to the node it
is running on

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index ec4c18cde6e04810e5ef7acd87e3bd0cb90737ba..7ffc5381f085f0f944331377113c1517c1b42124 100644 (file)
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -2589,6 +2589,8 @@ __PACKAGE__->register_method({
            if $skiplock && $authuser ne 'root@pam';
 
        my $nocheck = extract_param($param, 'nocheck');
+       raise_param_exc({ nocheck => "Only root may use this option." })
+           if $nocheck && $authuser ne 'root@pam';
 
        my $to_disk_suspended;
        eval {