fix wrong permissions for subscription info

workaround to keep the subscription popup on login even without 'Sys.Audit'
permissions but remove the subscription details in the GUI for unauthorized
users.

diff --git a/PVE/API2/Subscription.pm b/PVE/API2/Subscription.pm
index 9d24dce866ce560e230448b0ea7688980a831835..efbe70c275d6d1af01c6f94a990b09099e1415fe 100644 (file)
--- a/PVE/API2/Subscription.pm
+++ b/PVE/API2/Subscription.pm
@@ -91,9 +91,6 @@ __PACKAGE__->register_method ({
     name => 'get',
     path => '',
     method => 'GET',
-    permissions => {
-       check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
-    },
     description => "Read subscription info.",
     proxyto => 'node',
     permissions => { user => 'all' },
@@ -110,12 +107,25 @@ __PACKAGE__->register_method ({
        my $server_id = PVE::API2Tools::get_hwaddress();
        my $url = "http://www.proxmox.com/products/proxmox-ve/subscription-service-plans";
 
+       my $rpcenv = PVE::RPCEnvironment::get();
+       my $authuser = $rpcenv->get_user();
+       my $has_permission = PVE::AccessControl::check_permissions($authuser, '/nodes/{node}', 'Sys.Audit');
+
        my $info = PVE::INotify::read_file('subscription');
        if (!$info) {
-           return {
+           my $no_subscription_info = {
                status => "NotFound",
                message => "There is no subscription key",
-               serverid => $server_id,
+               url => $url,
+           };
+           $no_subscription_info->{serverid} = $server_id if $has_permission;
+           return $no_subscription_info;
+       }
+
+       if (!$has_permission) {
+           return {
+               status => $info->{status},
+               message => $info->{message},
                url => $url,
            }
        }