From a5616d5c6e903109c13b9cae2889c4cf3743ec04 Mon Sep 17 00:00:00 2001 From: Alexandre Derumier Date: Tue, 6 Jun 2023 15:19:24 +0200 Subject: [PATCH 1/1] rpcenvironnment: add check_sdn_bridge check if user have access to 1 vlan of the bridge or the bridge itself Signed-off-by: Alexandre Derumier --- src/PVE/RPCEnvironment.pm | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/PVE/RPCEnvironment.pm b/src/PVE/RPCEnvironment.pm index 0de746a..ae2702c 100644 --- a/src/PVE/RPCEnvironment.pm +++ b/src/PVE/RPCEnvironment.pm @@ -324,6 +324,24 @@ sub check_full { } } +sub check_sdn_bridge { + my ($self, $username, $zone, $bridge, $privs, $noerr) = @_; + + my $path = "/sdn/zones/$zone/$bridge"; + my $cfg = $self->{user_cfg}; + my $bridge_acl = PVE::AccessControl::find_acl_tree_node($cfg->{acl_root}, $path); + if ($bridge_acl) { + my $vlans = $bridge_acl->{children}; + for my $vlan (keys %$vlans) { + my $vlanpath = "$path/$vlan"; + return 1 if $self->check_any($username, $vlanpath, $privs, $noerr); + } + # check access to bridge itself + return 1 if $self->check_any($username, $path, $privs, $noerr); + } + return; +} + sub check_user_enabled { my ($self, $user, $noerr) = @_; -- 2.39.2