From 4fb85adc656197e999b37d0de2feeea303c5485c Mon Sep 17 00:00:00 2001
From: =?utf8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
Date: Mon, 27 Apr 2020 09:19:13 +0200
Subject: [PATCH] api/resume: make nocheck root-only
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

this is only used for migration via 'qm mtunnel', regular users should
never need to resume a VM that does not logically belong to the node it
is running on

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
 PVE/API2/Qemu.pm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index ec4c18c..7ffc538 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -2589,6 +2589,8 @@ __PACKAGE__->register_method({
 	    if $skiplock && $authuser ne 'root@pam';
 
 	my $nocheck = extract_param($param, 'nocheck');
+	raise_param_exc({ nocheck => "Only root may use this option." })
+	    if $nocheck && $authuser ne 'root@pam';
 
 	my $to_disk_suspended;
 	eval {
-- 
2.39.2