michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-09-20 04:20:39 +01:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Extra protection against creating a user called 'webmin' https://www.virtualmin.com/node/65058

Browse Source
This commit is contained in:
Jamie Cameron
2019-03-17 18:39:49 -07:00
parent 989bb25c7d
commit ce196d6b8b
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
acl/acl-lib.pl
View File

@@ -362,6 +362,7 @@ sub create_user
my ($user, $clone) = @_;
my %miniserv;
my @mods = &list_modules();
$user->{'name'} eq "webmin" && &error("Invalid username webmin for new user");
&get_miniserv_config(\%miniserv);
@@ -530,6 +531,8 @@ sub modify_user
my ($username, $user) = @_;
my (%miniserv, @pwfile, @acl, @mods, $m);
&get_miniserv_config(\%miniserv);
$user->{'name'} eq "webmin" &&
&error("Invalid username webmin for modified user");
if ($user->{'proto'}) {
# In users and groups DB

1
web-lib-funcs.pl
View File

@@ -4134,6 +4134,7 @@ sub save_module_acl
{
my $u = defined($_[1]) ? $_[1] : $base_remote_user;
my $m = defined($_[2]) ? $_[2] : &get_module_name();
$u eq "webmin" && &error("Invalid username webmin for ACL");
if (!$_[3] && &foreign_check("acl")) {
# Check if this user is a member of a group, and if he gets the
# module from a group. If so, update its ACL as well