bump version to 8.1.4

[pve-access-control.git] / src / PVE / AccessControl.pm

diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index 4e3b0776ebcccc3d76ca871e20a5aa8d26f20931..47f2d38b09c7f267e74978de506cb47cbdf8ae41 100644 (file)
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -16,6 +16,7 @@ use JSON;
 use Scalar::Util 'weaken';
 use URI::Escape;
 
+use PVE::Exception qw(raise_perm_exc raise_param_exc);
 use PVE::OTP;
 use PVE::Ticket;
 use PVE::Tools qw(run_command lock_file file_get_contents split_list safe_print);
@@ -950,7 +951,7 @@ sub iterate_acl_tree {
 
     my $children = $node->{children};
 
-    foreach my $child (keys %$children) {
+    foreach my $child (sort keys %$children) {
        iterate_acl_tree("$path/$child", $children->{$child}, $code);
     }
 }
@@ -1065,6 +1066,7 @@ my $privgroups = {
            'Sys.PowerMgmt',
            'Sys.Modify', # edit/change node settings
            'Sys.Incoming', # incoming storage/guest migrations
+           'Sys.AccessNetwork', # for, e.g., downloading ISOs from any URL
        ],
        admin => [
            'Sys.Console',
@@ -1150,24 +1152,25 @@ my $special_roles = {
 
 sub create_roles {
 
-    foreach my $cat (keys %$privgroups) {
+    for my $cat (keys %$privgroups) {
        my $cd = $privgroups->{$cat};
-       foreach my $p (@{$cd->{root}}, @{$cd->{admin}},
-                      @{$cd->{user}}, @{$cd->{audit}}) {
-           $valid_privs->{$p} = 1;
+       # create map to easily check if a privilege is valid
+       for my $priv (@{$cd->{root}}, @{$cd->{admin}}, @{$cd->{user}}, @{$cd->{audit}}) {
+           $valid_privs->{$priv} = 1;
        }
-       foreach my $p (@{$cd->{admin}}, @{$cd->{user}}, @{$cd->{audit}}) {
-
-           $special_roles->{"PVE${cat}Admin"}->{$p} = 1;
-           $special_roles->{"PVEAdmin"}->{$p} = 1;
+       # create grouped admin roles and PVEAdmin
+       for my $priv (@{$cd->{admin}}, @{$cd->{user}}, @{$cd->{audit}}) {
+           $special_roles->{"PVE${cat}Admin"}->{$priv} = 1;
+           $special_roles->{"PVEAdmin"}->{$priv} = 1;
        }
+       # create grouped user and audit roles
        if (scalar(@{$cd->{user}})) {
-           foreach my $p (@{$cd->{user}}, @{$cd->{audit}}) {
-               $special_roles->{"PVE${cat}User"}->{$p} = 1;
+           for my $priv (@{$cd->{user}}, @{$cd->{audit}}) {
+               $special_roles->{"PVE${cat}User"}->{$priv} = 1;
            }
        }
-       foreach my $p (@{$cd->{audit}}) {
-           $special_roles->{"PVEAuditor"}->{$p} = 1;
+       for my $priv (@{$cd->{audit}}) {
+           $special_roles->{"PVEAuditor"}->{$priv} = 1;
        }
     }
 
@@ -1529,7 +1532,21 @@ sub parse_user_config {
            }
 
            # make sure to add the pool (even if there are no members)
-           $cfg->{pools}->{$pool} = { vms => {}, storage => {} } if !$cfg->{pools}->{$pool};
+           $cfg->{pools}->{$pool} = { vms => {}, storage => {}, pools => {} }
+               if !$cfg->{pools}->{$pool};
+
+           if ($pool =~ m!/!) {
+               my $curr = $pool;
+               while ($curr =~ m!^(.+)/[^/]+$!) {
+                   # ensure nested pool info is correctly recorded
+                   my $parent = $1;
+                   $cfg->{pools}->{$curr}->{parent} = $parent;
+                   $cfg->{pools}->{$parent} = { vms => {}, storage => {}, pools => {} }
+                       if !$cfg->{pools}->{$parent};
+                   $cfg->{pools}->{$parent}->{pools}->{$curr} = 1;
+                   $curr = $parent;
+               }
+           }
 
            $cfg->{pools}->{$pool}->{comment} = PVE::Tools::decode_text($comment) if $comment;