api: update: also check access for currently configured bridge

Relevant when modifying or removing an existing network device.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index 593071331b82880fbb1bace2c2c37dae6c395ad9..fd718f93322546d19f6bfa8489bef5eb759451a3 100644 (file)
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -1792,6 +1792,13 @@ my $update_vm_api  = sub {
                    assert_tag_permissions($vmid, $val, '', $rpcenv, $authuser);
                    delete $conf->{$opt};
                    PVE::QemuConfig->write_config($vmid, $conf);
+               } elsif ($opt =~ m/^net\d+$/) {
+                   if ($conf->{$opt}) {
+                       PVE::QemuServer::check_bridge_access(
+                           $rpcenv, $authuser, { $opt => $conf->{$opt} });
+                   }
+                   PVE::QemuConfig->add_to_pending_delete($conf, $opt, $force);
+                   PVE::QemuConfig->write_config($vmid, $conf);
                } else {
                    PVE::QemuConfig->add_to_pending_delete($conf, $opt, $force);
                    PVE::QemuConfig->write_config($vmid, $conf);
@@ -1860,6 +1867,12 @@ my $update_vm_api  = sub {
                } elsif ($opt eq 'tags') {
                    assert_tag_permissions($vmid, $conf->{$opt}, $param->{$opt}, $rpcenv, $authuser);
                    $conf->{pending}->{$opt} = PVE::GuestHelpers::get_unique_tags($param->{$opt});
+               } elsif ($opt =~ m/^net\d+$/) {
+                   if ($conf->{$opt}) {
+                       PVE::QemuServer::check_bridge_access(
+                           $rpcenv, $authuser, { $opt => $conf->{$opt} });
+                   }
+                   $conf->{pending}->{$opt} = $param->{$opt};
                } else {
                    $conf->{pending}->{$opt} = $param->{$opt};