let all users read user data

but qmanager only their own

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

diff --git a/PMG/API2/Users.pm b/PMG/API2/Users.pm
index 6c19137e9d78b2a8d8fc7491d590e999c0a9f02f..f7e8287ac055b3d3c9ca8d3859e57959a659296e 100644 (file)
--- a/PMG/API2/Users.pm
+++ b/PMG/API2/Users.pm
@@ -9,6 +9,7 @@ use PVE::Tools qw(extract_param);
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::RESTHandler;
 use PVE::INotify;
+use PVE::Exception qw(raise_perm_exc);
 
 use PMG::RESTEnvironment;
 use PMG::UserConfig;
@@ -118,6 +119,7 @@ __PACKAGE__->register_method ({
     path => '{userid}',
     method => 'GET',
     description => "Read User data.",
+    permissions => { check => [ 'admin', 'qmanager', 'audit' ] },
     proxyto => 'master',
     protected => 1,
     parameters => {
@@ -135,6 +137,13 @@ __PACKAGE__->register_method ({
 
        my $cfg = PMG::UserConfig->new();
 
+       my $rpcenv = PMG::RESTEnvironment->get();
+       my $authuser = $rpcenv->get_user();
+       my $role = $rpcenv->get_role();
+
+       raise_perm_exc()
+           if $role eq 'qmanager' && $authuser ne $param->{userid};
+
        my $data = $cfg->lookup_user_data($param->{userid});
 
        my $res = $extract_userdata->($data);