From d452bf1f1c22810b122e0485c73b0a0693600253 Mon Sep 17 00:00:00 2001
From: Pierre <pierre.donias@gmail.com>
Date: Fri, 26 Feb 2016 12:02:11 +0100
Subject: [PATCH] vm.set(): only admins can change cpuWeight if VM in a
 resource set

---
 src/api/vm.coffee | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/api/vm.coffee b/src/api/vm.coffee
index d7be1f38a..98d14627a 100644
--- a/src/api/vm.coffee
+++ b/src/api/vm.coffee
@@ -478,6 +478,8 @@ set = $coroutine (params) ->
       yield xapi.call 'VM.remove_from_other_config', ref, 'auto_poweron'
 
   if 'cpuWeight' of params
+    if resourceSet? and this.user.permission isnt 'admin'
+      throw new Unauthorized()
     yield xapi.setVcpuWeight(VM._xapiId, params.cpuWeight)
 
   # Other fields.