michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-05-04 22:30:33 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix permission checks for adding users to group https://sourceforge.net/p/webadmin/bugs/5123/

Browse Source
This commit is contained in:
Jamie Cameron
2018-05-06 22:03:54 -07:00
parent e508ff3e66
commit 5d3c794b80
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
acl/delete_users.cgi
View File

@@ -7,7 +7,6 @@ require './acl-lib.pl';
our (%in, %text, %config, %access, $base_remote_user);
&ReadParse();
&error_setup($in{'joingroup'} ? $text{'udeletes_jerr'} : $text{'udeletes_err'});
$access{'delete'} || &error($text{'delete_ecannot'});
# Validate inputs
my @d = split(/\0/, $in{'d'});
@@ -25,6 +24,11 @@ foreach my $user (@d) {
if ($in{'joingroup'}) {
# Add users to a group
my $newgroup = &get_group($in{'group'});
if ($access{'gassign'} ne '*') {
my @gcan = split(/\s+/, $access{'gassign'});
&indexof($in{'group'}, @gcan) >= 0 ||
&error($text{'save_egroup'});
}
foreach my $user (@d) {
my $uinfo = &get_user($user);
next if (!$uinfo);
@@ -77,6 +81,7 @@ if ($in{'joingroup'}) {
}
elsif ($in{'confirm'}) {
# Do it
$access{'delete'} || &error($text{'delete_ecannot'});
foreach my $user (@d) {
&delete_user($user);
&delete_from_groups($user);
@@ -88,6 +93,7 @@ elsif ($in{'confirm'}) {
}
else {
# Ask the user if he is sure
$access{'delete'} || &error($text{'delete_ecannot'});
&ui_print_header(undef, $text{'udeletes_title'}, "");
print &ui_confirmation_form(