userid-group check: distinguish create and update

[pve-access-control.git] / src / PVE / API2 / User.pm

diff --git a/src/PVE/API2/User.pm b/src/PVE/API2/User.pm
index 244264e88e4136d52bbc27eb36e47b411eae6624..6495a12f225d28881468b1d6a791e131c7034645 100644 (file)
--- a/src/PVE/API2/User.pm
+++ b/src/PVE/API2/User.pm
@@ -221,7 +221,7 @@ __PACKAGE__->register_method ({
        check => [
            'and',
            [ 'userid-param', 'Realm.AllocateUser'],
-           [ 'userid-group', ['User.Modify'], groups_param => 1],
+           [ 'userid-group', ['User.Modify'], groups_param => 'create'],
        ],
     },
     description => "Create new user.",
@@ -345,7 +345,7 @@ __PACKAGE__->register_method ({
     path => '{userid}',
     method => 'PUT',
     permissions => {
-       check => ['userid-group', ['User.Modify'], groups_param => 1 ],
+       check => ['userid-group', ['User.Modify'], groups_param => 'update' ],
     },
     description => "Update user configuration.",
     parameters => {