mirror of
https://github.com/webmin/webmin.git
synced 2026-07-24 18:30:38 +01:00
301722b572
This PR addresses privately reported issue and tries to restricts root/UID 0 user mutations and Custom Commands definition editing to full, non-safe Webmin admins. This closes privilege-escalation paths for restricted operators while preserving execution of pre-approved Custom Commands under existing cmds ACLs.
43 lines
1.2 KiB
Perl
Executable File
43 lines
1.2 KiB
Perl
Executable File
|
|
do 'custom-lib.pl';
|
|
|
|
sub cgi_args
|
|
{
|
|
my ($cgi) = @_;
|
|
my @cust = grep { &can_run_command($_) } &list_commands();
|
|
if ($cgi eq 'edit_cmd.cgi') {
|
|
# Custom command editor
|
|
return 'none' if (!&custom_can_edit_commands());
|
|
my ($cmd) = grep { !$_->{'edit'} && !$_->{'sql'} } @cust;
|
|
return $cmd ? 'id='.&urlize($cmd->{'id'}) : 'new=1';
|
|
}
|
|
elsif ($cgi eq 'form.cgi') {
|
|
# Custom command form
|
|
my ($cmd) = grep { !$_->{'edit'} && !$_->{'sql'} } @cust;
|
|
return $cmd ? 'id='.&urlize($cmd->{'id'}) : 'none';
|
|
}
|
|
elsif ($cgi eq 'edit_file.cgi') {
|
|
# File editor editor
|
|
return 'none' if (!&custom_can_edit_commands());
|
|
my ($cmd) = grep { $_->{'edit'} } @cust;
|
|
return $cmd ? 'id='.&urlize($cmd->{'id'}) : 'new=1';
|
|
}
|
|
elsif ($cgi eq 'view.cgi') {
|
|
# Custom command form
|
|
my ($cmd) = grep { $_->{'edit'} } @cust;
|
|
return $cmd ? 'id='.&urlize($cmd->{'id'}) : 'none';
|
|
}
|
|
elsif ($cgi eq 'edit_sql.cgi') {
|
|
# SQL query
|
|
return 'none' if (!&custom_can_edit_commands());
|
|
my ($cmd) = grep { $_->{'sql'} } @cust;
|
|
return $cmd ? 'id='.&urlize($cmd->{'id'}) : 'new=1';
|
|
}
|
|
elsif ($cgi eq 'sqlform.cgi') {
|
|
# SQL query form
|
|
my ($cmd) = grep { $_->{'sql'} } @cust;
|
|
return $cmd ? 'id='.&urlize($cmd->{'id'}) : 'none';
|
|
}
|
|
return undef;
|
|
}
|