X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=blobdiff_plain;f=PVE%2FAPI2%2FUser.pm;h=5cfb155fca8dafaf577900975ebb97969125d660;hp=0637f765fda580392562bdfd35a175aa098e2a1e;hb=b9180ed235f8ae6d7517fb232a1ed1986082e88f;hpb=2c3a6c0aaac7fbdaeb26bc5a596d21e897f3343a

diff --git a/PVE/API2/User.pm b/PVE/API2/User.pm
index 0637f76..5cfb155 100644
--- a/PVE/API2/User.pm
+++ b/PVE/API2/User.pm
@@ -2,6 +2,7 @@ package PVE::API2::User;
 
 use strict;
 use warnings;
+use PVE::Exception qw(raise raise_perm_exc);
 use PVE::Cluster qw (cfs_read_file cfs_write_file);
 use PVE::Tools qw(split_list);
 use PVE::AccessControl;
@@ -36,9 +37,16 @@ __PACKAGE__->register_method ({
     path => '', 
     method => 'GET',
     description => "User index.",
+    permissions => { user => 'all' },
     parameters => {
 	additionalProperties => 0,
-	properties => {},
+	properties => {
+	    enabled => {
+		type => 'boolean',
+		description => "Optional filter for enable property.",
+		optional => 1,
+	    }
+	},
     },
     returns => {
 	type => 'array',
@@ -53,14 +61,31 @@ __PACKAGE__->register_method ({
     code => sub {
 	my ($param) = @_;
     
+	my $rpcenv = PVE::RPCEnvironment::get();
+	my $usercfg = $rpcenv->{user_cfg};
+	my $authuser = $rpcenv->get_user();
+
 	my $res = [];
 
-	my $usercfg = cfs_read_file("user.cfg");
- 
+	my $privs = [ 'Sys.UserMod', 'Sys.UserAdd' ];
+
+	my $canUserMod = $rpcenv->check_any($authuser, "/access", $privs, 1);
+	my $groups = $rpcenv->filter_groups($authuser, $privs, 1);
+	my $allowed_users = $rpcenv->group_member_join([keys %$groups]);      
+
 	foreach my $user (keys %{$usercfg->{users}}) {
-	    next if $user eq 'root';
+
+	    if (!($canUserMod || $user eq $authuser)) {
+		next if !$allowed_users->{$user};
+	    }
 
 	    my $entry = &$extract_user_data($usercfg->{users}->{$user});
+
+	    if (defined($param->{enabled})) {
+		next if $entry->{enable} && !$param->{enabled};
+		next if !$entry->{enable} && $param->{enabled};
+	    }
+
 	    $entry->{userid} = $user;
 	    push @$res, $entry;
 	}
@@ -78,7 +103,13 @@ __PACKAGE__->register_method ({
    	additionalProperties => 0,
 	properties => {
 	    userid => get_standard_option('userid'),
-	    password => { type => 'string', optional => 1 },
+	    password => {
+		description => "Initial password.",
+		type => 'string', 
+		optional => 1, 
+		minLength => 5, 
+		maxLength => 64 
+	    },
 	    groups => { type => 'string', optional => 1, format => 'pve-groupid-list'},
 	    firstname => { type => 'string', optional => 1 },
 	    lastname => { type => 'string', optional => 1 },
@@ -113,7 +144,7 @@ __PACKAGE__->register_method ({
 		    if $usercfg->{users}->{$username};
 			 
 		PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password})
-		    if $param->{password};
+		    if defined($param->{password});
 
 		my $enable = defined($param->{enable}) ? $param->{enable} : 1;
 		$usercfg->{users}->{$username} = { enable => $enable };
@@ -170,11 +201,9 @@ __PACKAGE__->register_method ({
 	    PVE::AccessControl::verify_username($param->{userid});
 
 	my $usercfg = cfs_read_file("user.cfg");
- 
-	my $data = $usercfg->{users}->{$username};
-
-	die "user '$username' does not exist\n" if !$data;
 
+	my $data = PVE::AccessControl::check_user_exist($usercfg, $username);
+ 
 	return &$extract_user_data($data, 1);
     }});
 
@@ -188,7 +217,6 @@ __PACKAGE__->register_method ({
    	additionalProperties => 0,
 	properties => {
 	    userid => get_standard_option('userid'),
-	    password => { type => 'string', optional => 1 },
 	    groups => { type => 'string', optional => 1,  format => 'pve-groupid-list'  },
 	    append => { 
 		type => 'boolean', 
@@ -215,27 +243,23 @@ __PACKAGE__->register_method ({
     returns => { type => 'null' },
     code => sub {
 	my ($param) = @_;
+
+	my ($username, $ruid, $realm) = 
+	    PVE::AccessControl::verify_username($param->{userid});
 	
 	PVE::AccessControl::lock_user_config(
 	    sub {
-
-		my ($username, $ruid, $realm) = 
-		    PVE::AccessControl::verify_username($param->{userid});
 	
 		my $usercfg = cfs_read_file("user.cfg");
 
-		die "user '$username' does not exist\n" 
-		    if !$usercfg->{users}->{$username};
-
-		PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password})
-		    if $param->{password};
+		PVE::AccessControl::check_user_exist($usercfg, $username);
 
 		$usercfg->{users}->{$username}->{enable} = $param->{enable} if defined($param->{enable});
 
 		$usercfg->{users}->{$username}->{expire} = $param->{expire} if defined($param->{expire});
 
 		PVE::AccessControl::delete_user_group($username, $usercfg) 
-		    if (!$param->{append} && $param->{groups});
+		    if (!$param->{append} && defined($param->{groups}));
 
 		if ($param->{groups}) {
 		    foreach my $group (split_list($param->{groups})) {
@@ -264,6 +288,7 @@ __PACKAGE__->register_method ({
     path => '{userid}', 
     method => 'DELETE',
     description => "Delete user.",
+    permissions => { user => 'all' },
     parameters => {
    	additionalProperties => 0,
 	properties => {
@@ -273,23 +298,33 @@ __PACKAGE__->register_method ({
     returns => { type => 'null' },
     code => sub {
 	my ($param) = @_;
+	
+	my $rpcenv = PVE::RPCEnvironment::get();
+	my $authuser = $rpcenv->get_user();
+
+	my ($userid, $ruid, $realm) = 
+	    PVE::AccessControl::verify_username($param->{userid});
 
 	PVE::AccessControl::lock_user_config(
 	    sub {
 
-		my ($username, $ruid, $realm) = 
-		    PVE::AccessControl::verify_username($param->{userid});
-
 		my $usercfg = cfs_read_file("user.cfg");
 
-		die "user '$username' does not exist\n" 
-		    if !$usercfg->{users}->{$username};
+		PVE::AccessControl::check_user_exist($usercfg, $userid);
 
-		delete ($usercfg->{users}->{$username});
+		my $privs = [ 'Sys.UserAdd' ]; # there is no Sys.UserDel
+		if (!$rpcenv->check($authuser, "/access", $privs, 1)) {
+		    my $groups = $rpcenv->filter_groups($authuser, sub { return "/access/groups/" . shift; }, $privs, 1);
+		    my $allowed_users = $rpcenv->group_member_join([keys %$groups]);      
+		    raise_perm_exc() if !$allowed_users->{$userid};
+		}
+
+		delete ($usercfg->{users}->{$userid});
 
 		PVE::AccessControl::delete_shadow_password($ruid) if $realm eq 'pve';
-		PVE::AccessControl::delete_user_group($username, $usercfg);
-		PVE::AccessControl::delete_user_acl($username, $usercfg);
+
+		PVE::AccessControl::delete_user_group($userid, $usercfg);
+		PVE::AccessControl::delete_user_acl($userid, $usercfg);
 
 		cfs_write_file("user.cfg", $usercfg);
 	    }, "delete user failed");