move vmstate check to check_vm_modify_config_perm

so that it gets checked before the special case of removing the vmstate

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 25c2836071b810547ab6ce17d807faf1bbd2d981..3c7ef30d320e99d958c172c9421a658953c55a62 100644 (file)
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -315,7 +315,6 @@ my $check_vm_modify_config_perm = sub {
        # some checks (e.g., disk, serial port, usb) need to be done somewhere
        # else, as there the permission can be value dependend
        next if PVE::QemuServer::is_valid_drivename($opt);
-       next if $opt eq 'vmstate';
        next if $opt eq 'cdrom';
        next if $opt =~ m/^(?:unused|serial|usb)\d+$/;
 
@@ -338,6 +337,10 @@ my $check_vm_modify_config_perm = sub {
            $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk']);
        } elsif ($cloudinitoptions->{$opt} || ($opt =~ m/^(?:net|ipconfig)\d+$/)) {
            $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Network']);
+       } elsif ($opt eq 'vmstate') {
+           # the user needs Disk and PowerMgmt privileges to change the vmstate
+           # also needs privileges on the storage, that will be checked later
+           $rpcenv->check_vm_perm($authuser, $vmid, $pool, ['VM.Config.Disk', 'VM.PowerMgmt' ]);
        } else {
            # catches hostpci\d+, args, lock, etc.
            # new options will be checked here
@@ -1152,8 +1155,6 @@ my $update_vm_api  = sub {
                    }
                } elsif ($opt eq 'vmstate') {
                    PVE::QemuConfig->check_protection($conf, "can't remove vmstate '$val'");
-                   # the user needs Disk and PowerMgmt privileges to remove the vmstate
-                   $rpcenv->check_vm_perm($authuser, $vmid, undef, ['VM.Config.Disk', 'VM.PowerMgmt' ]);
                    if (PVE::QemuServer::try_deallocate_drive($storecfg, $vmid, $conf, $opt, { file => $val }, $rpcenv, $authuser, 1)) {
                        delete $conf->{$opt};
                        PVE::QemuConfig->write_config($vmid, $conf);