api: backup pool: enforce VM.Backup permissions on pool

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/PVE/API2/Backup.pm b/PVE/API2/Backup.pm
index 9a2171cc0817a4274157ef5710744ed7cd8d87e0..87781ecc39a25a1cea297c1447b56752581d16c3 100644 (file)
--- a/PVE/API2/Backup.pm
+++ b/PVE/API2/Backup.pm
@@ -427,6 +427,11 @@ __PACKAGE__->register_method({
        my $rpcenv = PVE::RPCEnvironment::get();
        my $user = $rpcenv->get_user();
 
+       if (my $pool = $param->{pool}) {
+           $rpcenv->check_pool_exist($pool);
+           $rpcenv->check($user, "/pool/$pool", ['VM.Backup']);
+       }
+
        my $update_job = sub {
            my $data = cfs_read_file('vzdump.cron');