Fix MySQL manual editor ACL bypass

This fixes missing permission checks in the MySQL manual configuration editor, with both read and write endpoints now require full configuration permissions to match the existing checks used by the configuration editor.

CHANGELOG.md

@@ -4,6 +4,7 @@
 * Fix HTML escaping of module, script and session fields on the Webmin Actions Log details page
 * Fix mailbox attachment option injection
 * Fix path traversal and command injection in parameterized Custom Commands file editors
+* Fix MySQL/MariaDB manual editor ACL bypass
 
 #### 2.670 (September 20, 2026)
 * Add new Hardware Information module for inspecting system, firmware, security, PCI, USB, storage, network, processor, sensor, driver, and kernel module details

mysql/edit_manual.cgi

@@ -2,6 +2,7 @@
 # Show a config file for manual editing
 
 require './mysql-lib.pl';
+$access{'perms'} == 1 || &error($text{'cnf_ecannot'});
 &ReadParse();
 &ui_print_header($header_subtext, $text{'manual_title'}, "");
 

mysql/save_manual.cgi

@@ -2,6 +2,7 @@
 # Save a manually edited config file
 
 require './mysql-lib.pl';
+$access{'perms'} == 1 || &error($text{'cnf_ecannot'});
 &ReadParseMime();
 &error_setup($text{'manual_err'});