add pool API

[pve-access-control.git] / PVE / API2 / AccessControl.pm

diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm
index 6046a8aeb3bf984f763f8dc183e32a3f4019f08b..913bdd81a8fea82fd6ed71735ba696be80734b08 100644 (file)
--- a/PVE/API2/AccessControl.pm
+++ b/PVE/API2/AccessControl.pm
@@ -15,6 +15,7 @@ use PVE::API2::User;
 use PVE::API2::Group;
 use PVE::API2::Role;
 use PVE::API2::ACL;
+use PVE::API2::Pool;
 
 use base qw(PVE::RESTHandler);
 
@@ -43,6 +44,11 @@ __PACKAGE__->register_method ({
     path => 'domains',
 });
 
+__PACKAGE__->register_method ({
+    subclass => "PVE::API2::Pool",  
+    path => 'pools',
+});
+
 __PACKAGE__->register_method ({
     name => 'index', 
     path => '', 
@@ -132,7 +138,10 @@ __PACKAGE__->register_method ({
     name => 'create_ticket', 
     path => 'ticket', 
     method => 'POST',
-    permissions => { user => 'world' },
+    permissions => { 
+       description => "You need to pass valid credientials.",
+       user => 'world' 
+    },
     protected => 1, # else we can't access shadow files
     description => "Create or verify authentication ticket.",
     parameters => {
@@ -210,7 +219,13 @@ __PACKAGE__->register_method ({
     name => 'change_passsword', 
     path => 'password', 
     method => 'PUT',
-    permissions => { user => 'all' },
+    permissions => { 
+       description => "Each user is allowed to change his own password. A user can change the password of another user if he has modify permission on /access/groups/<group> on a group where user <userid> is member of.",
+       check => [ 'or', 
+                  ['userid-param', 'self'],
+                  ['userid-group', ['User.Modify']],
+           ],
+    },
     protected => 1, # else we can't access shadow files
     description => "Change user password.",
     parameters => {
@@ -234,8 +249,7 @@ __PACKAGE__->register_method ({
 
        my ($userid, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
 
-       my $usercfg = $rpcenv->{user_cfg};
-       PVE::AccessControl::check_user_exist($usercfg, $userid);
+       $rpcenv->check_user_exist($userid);
 
        if ($authuser eq 'root@pam') {
            # OK - root can change anything
@@ -244,14 +258,8 @@ __PACKAGE__->register_method ({
                $rpcenv->check_user_enabled($userid);
                # OK - each user can change its own password
            } else {
+               # only root may change root password
                raise_perm_exc() if $userid eq 'root@pam';
-
-               my $privs = [ 'Sys.UserMod', 'Sys.UserAdd' ];
-               if (!$rpcenv->check_any($authuser, "/access", $privs, 1)) {
-                   my $groups = $rpcenv->filter_groups($authuser, $privs, 1);
-                   my $allowed_users = $rpcenv->group_member_join([keys %$groups]);      
-                   raise_perm_exc() if !$allowed_users->{$userid};
-               }
            }
        }