do not allow to change system user passwords

[pve-access-control.git] / PVE / API2 / AccessControl.pm

diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm
index 6136ae5af83c85da0ffb1da3c7a58a066aedde21..0ef31fa2068a70c0349fd7d1222dea96505f0367 100644 (file)
--- a/PVE/API2/AccessControl.pm
+++ b/PVE/API2/AccessControl.pm
@@ -48,6 +48,9 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "Directory index.",
+    permissions => { 
+       user => 'all',
+    },
     parameters => {
        additionalProperties => 0,
        properties => {},
@@ -132,7 +135,10 @@ __PACKAGE__->register_method ({
     name => 'create_ticket', 
     path => 'ticket', 
     method => 'POST',
-    permissions => { user => 'world' },
+    permissions => { 
+       description => "You need to pass valid credientials.",
+       user => 'world' 
+    },
     protected => 1, # else we can't access shadow files
     description => "Create or verify authentication ticket.",
     parameters => {
@@ -210,7 +216,16 @@ __PACKAGE__->register_method ({
     name => 'change_passsword', 
     path => 'password', 
     method => 'PUT',
-    permissions => { user => 'all' },
+    permissions => { 
+       description => "Each user is allowed to change his own password. A user can change the password of another user if he has 'Realm.AllocateUser' (on the realm of user <userid>) and 'User.Modify' permission on /access/groups/<group> on a group where user <userid> is member of.",
+       check => [ 'or', 
+                  ['userid-param', 'self'],
+                  [ 'and',
+                    [ 'userid-param', 'Realm.AllocateUser'],
+                    [ 'userid-group', ['User.Modify']]
+                  ]
+           ],
+    },
     protected => 1, # else we can't access shadow files
     description => "Change user password.",
     parameters => {
@@ -234,8 +249,7 @@ __PACKAGE__->register_method ({
 
        my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
 
-       my $usercfg = $rpcenv->{user_cfg};
-       PVE::AccessControl::check_user_exist($usercfg, $userid);
+       $rpcenv->check_user_exist($userid);
 
        if ($authuser eq 'root@pam') {
            # OK - root can change anything
@@ -244,14 +258,10 @@ __PACKAGE__->register_method ({
                $rpcenv->check_user_enabled($userid);
                # OK - each user can change its own password
            } else {
+               # only root may change root password
                raise_perm_exc() if $userid eq 'root@pam';
-
-               my $privs = [ 'Sys.UserMod', 'Sys.UserAdd' ];
-               if (!$rpcenv->check_any($authuser, "/access", $privs, 1)) {
-                   my $groups = $rpcenv->filter_groups($authuser, sub { return "/access/groups/" . shift; }, $privs, 1);
-                   my $allowed_users = $rpcenv->group_member_join([keys %$groups]);      
-                   raise_perm_exc() if !$allowed_users->{$userid};
-               }
+               # do not allow to change system user passwords
+               raise_perm_exc() if $realm eq 'pam';
            }
        }