ensure change access for adding team roles

awx/api/views.py

@@ -834,9 +834,12 @@ class TeamRolesList(SubListCreateAttachDetachAPIView):
             raise PermissionDenied()
         return Role.filter_visible_roles(self.request.user, team.member_role.children.all())
 
-    # XXX: Need to enforce permissions
     def post(self, request, *args, **kwargs):
         # Forbid implicit role creation here
+        team = get_object_or_404(Team, pk=self.kwargs['pk'])
+        if not self.request.user.can_access(Team, 'change', team):
+            raise PermissionDenied()
+
         sub_id = request.data.get('id', None)
         if not sub_id:
             data = dict(msg='Role "id" field is missing')