From: Dominik Csapak <d.csapak@proxmox.com>
Date: Fri, 31 Jan 2020 10:54:33 +0000 (+0100)
Subject: fix #2575: die when trying to edit built-in roles
X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=commitdiff_plain;h=deb63acf3f5c6b10fc39082bbe8991031b740948;ds=sidebyside

fix #2575: die when trying to edit built-in roles

instead of silently ignoring the change

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---

diff --git a/PVE/API2/Role.pm b/PVE/API2/Role.pm
index 83e4a9d..70a92b6 100644
--- a/PVE/API2/Role.pm
+++ b/PVE/API2/Role.pm
@@ -126,11 +126,14 @@ __PACKAGE__->register_method ({
     code => sub {
 	my ($param) = @_;
 
+	my $role = $param->{roleid};
+
+	die "auto-generated role '$role' cannot be modified\n"
+	    if PVE::AccessControl::role_is_special($role);
+
 	PVE::AccessControl::lock_user_config(
 	    sub {
 
-		my $role = $param->{roleid};
-
 		my $usercfg = cfs_read_file("user.cfg");
 
 		die "role '$role' does not exist\n"