michael/webmin
1
0
Fork 0
mirror of https://github.com/webmin/webmin.git synced 2026-07-23 10:00:34 +01:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
Files
dev/fix-acls-tightening
webmin/useradmin
History
Ilia Ross 301722b572 Fix to tighten privileged ACL checks 
This PR addresses privately reported issue and tries to restricts root/UID 0 user mutations and Custom Commands definition editing to full, non-safe Webmin admins.

This closes privilege-escalation paths for restricted operators while preserving execution of pre-approved Custom Commands under existing cmds ACLs.
2026-06-28 00:05:21 +02:00
..
help
Add editable SSH public keys for existing Unix users
2026-06-22 01:34:40 +02:00
images
Remove small icons that are never used
2018-11-25 17:16:12 -08:00
lang
Add editable SSH public keys for existing Unix users
2026-06-22 01:34:40 +02:00
acl_security.pl
Fix to use proper API for ACL pages
2026-04-23 22:07:13 +02:00
aix-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
backup_config.pl
…
batch_exec.cgi
Fix to tighten privileged ACL checks
2026-06-28 00:05:21 +02:00
batch_form.cgi
…
cgi_args.pl
…
CHANGELOG
…
config-aix
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-cobalt-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-coherent-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-corel-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-debian-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-freebsd
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-generic-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-gentoo-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-hpux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-irix
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-macos
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-mandrake-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-msc-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-netbsd
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-open-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-openbsd
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-openmamba-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-openserver
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-openSUSE-Linux-15.0-ALL
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-osf1
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-pardus-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-redhat-linux-15.0-ALL
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-redhat-linux-ALL-14.9
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-slackware-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-sol-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-solaris
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-suse-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-suse-linux-9.0-ALL
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-trustix-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-turbo-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-united-linux
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config-unixware
Fix to set default last to 1000
2024-10-23 01:29:23 +03:00
config.info
Fix to drop an option to enable paginating and let it just work
2023-05-12 11:27:02 +03:00
config.info.bg
Add support for yescrypt password hashing scheme
2022-05-28 19:26:32 +03:00
config.info.ca
Add support for yescrypt password hashing scheme
2022-05-28 19:26:32 +03:00
config.info.cs
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.da
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.de
Add support for yescrypt password hashing scheme
2022-05-28 19:26:32 +03:00
config.info.es
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.fa
Fix most (or even all errors) in human-translated configs
2020-04-10 00:12:39 +03:00
config.info.fr
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.hu
Restore incorrectly transcoded configs
2020-04-09 18:52:05 +03:00
config.info.ja
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.nl
Add support for yescrypt password hashing scheme
2022-05-28 19:26:32 +03:00
config.info.no
Add support for yescrypt password hashing scheme
2022-05-28 19:26:32 +03:00
config.info.pl
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.pt_BR
Add support for yescrypt password hashing scheme
2022-05-28 19:26:32 +03:00
config.info.ru
Fix most (or even all errors) in human-translated configs
2020-04-10 00:12:39 +03:00
config.info.sv
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.tr
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.uk
Fix most (or even all errors) in human-translated configs
2020-04-10 00:12:39 +03:00
config.info.zh
Add proper "config.info" (configs) transcoding
2020-04-09 22:15:10 +03:00
config.info.zh_TW
Fix most (or even all errors) in human-translated configs
2020-04-10 00:12:39 +03:00
cpan_modules.pl
…
defaultacl
…
delete_group.cgi
…
delete_user.cgi
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
edit_group.cgi
…
edit_user.cgi
Fix to read SSH key from real home path
2026-06-24 00:54:26 +02:00
export_exec.cgi
Batch file export format on BSD needs to have the same format as expected for import https://github.com/webmin/webmin/issues/1230
2020-04-11 11:21:52 -07:00
export_form.cgi
…
freebsd-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
gbatch_exec.cgi
Switch all calls to open() to explicitly open for read
2020-03-14 17:20:54 -07:00
gbatch_form.cgi
…
gexport_exec.cgi
…
gexport_form.cgi
…
help.html
…
hpux-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
index.cgi
Fix to drop an option to enable paginating and let it just work
2023-05-12 11:27:02 +03:00
irix-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
linux-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
list_logins.cgi
Fix to display more accurate heading
2024-10-20 16:16:38 +03:00
list_who.cgi
…
log_parser.pl
…
macos-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
mass_delete_group.cgi
Add HTML escape for the names of groups being deleted
2023-05-15 21:32:18 +03:00
mass_delete_user.cgi
Check permission to delete home dirs in batch operations
2026-06-14 13:29:54 -07:00
md5-lib.pl
Fix SHA512/yescrypt error messages to reflect crypt() support
2026-04-17 14:36:27 +02:00
module.info
Add minimal Alpine Linux compatibility
2026-06-06 23:11:25 +02:00
module.info.ar
Arabic translation update
2018-03-31 11:12:20 -07:00
module.info.ar.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.bg
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.bg.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ca
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.ca.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.cs
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.cs.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.da
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.da.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.de
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.de.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.el
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.el.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.es
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.es.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.eu
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.eu.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.fa
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.fa.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.fi
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.fi.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.fr
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.fr.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.hr
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.hr.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.hu
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.hu.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.it
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.it.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ja
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ja.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ko
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ko.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ms
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ms.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.nl
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.nl.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.no
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.no.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.pl
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.pl.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.pt
Extract language-specific module descriptions into separate files
2018-02-04 15:49:39 -08:00
module.info.pt_BR
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.pt_BR.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.pt.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ru
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.ru.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.sk
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.sk.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.sv
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.sv.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.tr
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.tr.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.uk
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.uk.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.zh
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.zh_TW
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.zh_TW.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
module.info.zh.auto
Language Transform: All modules transcode/translate (module) to utf-8 3/3
2020-02-29 07:48:18 +03:00
my_group_chooser.cgi
Fix to get safely using wrapper sub 2/2
2021-09-28 16:30:05 +03:00
my_user_chooser.cgi
Fix to get safely using wrapper sub 2/2
2021-09-28 16:30:05 +03:00
netbsd-lib.pl
…
openbsd-lib.pl
…
openserver-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
osf1-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
prefs.info
Fix to undo dropped key
2023-05-13 11:57:10 +03:00
rbac-mapping
…
save_group.cgi
Add some more sensible username checks
2023-05-15 11:16:30 -07:00
save_user.cgi
Fix to tighten privileged ACL checks
2026-06-28 00:05:21 +02:00
search_group.cgi
…
search_user.cgi
…
solaris-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
unixware-lib.pl
Fix to use quotemeta to prevent shell injection in Useradmin module
2026-02-11 13:03:27 +02:00
user-lib.pl
Fix to tighten privileged ACL checks
2026-06-28 00:05:21 +02:00