moved permission check code to RPCEnvironment.pm

PVE/REST.pm

@@ -271,93 +271,6 @@ sub proxy_handler {
     return OK;
 }
 
-sub exec_perm_check {
-    my ($rpcenv, $check, $username, $param, $noerr) = @_;
-
-    # syslog("info", "CHECK " . join(', ', @$check));
-
-    my $ind = 0;
-    my $test = $check->[$ind++];
-    die "no permission test specified" if !$test;
- 
-    if ($test eq 'and') {
-	while (my $subcheck = $check->[$ind++]) {
-	    exec_perm_check($rpcenv, $subcheck, $username, $param); 
-	}
-	return 1;
-    } elsif ($test eq 'or') {
-	while (my $subcheck = $check->[$ind++]) {
-	    return 1 if exec_perm_check($rpcenv, $subcheck, $username, $param, 1); 
-	}
-	return 0 if $noerr;
-	raise_perm_exc();
-    } elsif ($test eq 'perm') {
-	my ($t, $tmplpath, $privs, %options) = @$check;
-	my $any = $options{any};
-	die "missing parameters" if !($tmplpath && $privs);
-	my $path = PVE::Tools::template_replace($tmplpath, $param);
-	if ($any) {
-	    return $rpcenv->check_any($username, $path, $privs, $noerr);
-	} else {
-	    return $rpcenv->check($username, $path, $privs, $noerr);
-	}
-    } elsif ($test eq 'userid-group') {
-	my $userid = $param->{userid};
-	my ($t, $privs, %options) = @$check;
-	return if !$options{groups_param} && !$rpcenv->check_user_exist($userid, $noerr);
-	if (!$rpcenv->check_any($username, "/access", $privs, 1)) {
-	    my $groups = $rpcenv->filter_groups($username, $privs, 1);
-	    if ($options{groups_param}) {
-		my @group_param = PVE::Tools::split_list($param->{groups});
-		raise_perm_exc("/access, " . join("|", @$privs)) if !scalar(@group_param);
-		foreach my $pg (@group_param) {
-		    raise_perm_exc("/access/groups/$pg, " . join("|", @$privs))
-			if !$groups->{$pg};
-		}
-	    } else {
-		my $allowed_users = $rpcenv->group_member_join([keys %$groups]);
-		if (!$allowed_users->{$userid}) {
-		    return 0 if $noerr;
-		    raise_perm_exc();
-		}
-	    }
-	}
-	return 1;
-    } elsif ($test eq 'userid-param') {
-	my $userid = $param->{userid};
-	return if !$rpcenv->check_user_exist($userid, $noerr);
-	my ($t, $subtest) = @$check;
-	die "missing parameters" if !$subtest;
-	if ($subtest eq 'self') {
-	    return 1 if $username eq 'userid';
-	    return 0 if $noerr;
-	    raise_perm_exc();
-	} else {
-	    die "unknown userid-param test";
-	}
-    } else {
-	die "unknown permission test";
-    }
-};
-
-my $check_permissions = sub {
-    my ($rpcenv, $perm, $username, $param) = @_;
-
-    return 1 if !$username && $perm->{user} eq 'world';
-
-    raise_perm_exc("user != null") if !$username;
-
-    return 1 if $username eq 'root@pam';
-
-    raise_perm_exc('user != root@pam') if !$perm;
-
-    return 1 if $perm->{user} && $perm->{user} eq 'all';
-
-    return exec_perm_check($rpcenv, $perm->{check}, $username, $param) if $perm->{check};
-
-    raise_perm_exc();
-};
-
 sub rest_handler {
     my ($rpcenv, $clientip, $method, $abs_uri, $rel_uri, $ticket, $token) = @_;
 
@@ -394,7 +307,7 @@ sub rest_handler {
 		    path => "/storage/$storeid",
 		    privs => [ 'Datastore.AllocateSpace' ],
 		};
-		&$check_permissions($rpcenv, $perm, $username, {});
+		$rpcenv->check_api2_permissions($perm, $username, {});
 		$isUpload = 1;
 	    }
 
@@ -448,7 +361,7 @@ sub rest_handler {
     }
 
     # check access permissions
-    eval { &$check_permissions($rpcenv, $info->{permissions}, $username, $uri_param); };
+    eval { $rpcenv->check_api2_permissions($info->{permissions}, $username, $uri_param); };
     if (my $err = $@) {
 	return { 
 	    status => HTTP_FORBIDDEN,