mirror of
https://github.com/webmin/webmin.git
synced 2026-11-04 17:40:39 +00:00
80738aaab6
This patch fixes saved credentials appearing in the Servers Index JSON response and missing permission checks during bulk deletion. The JSON response now contains only id, host and desc. Bulk deletion checks every selected server before removing any, using existing permissions.
45 lines
1.0 KiB
Perl
Executable File
45 lines
1.0 KiB
Perl
Executable File
#!/usr/local/bin/perl
|
|
# Delete several servers at once
|
|
|
|
use strict;
|
|
use warnings;
|
|
no warnings 'redefine';
|
|
no warnings 'uninitialized';
|
|
require './servers-lib.pl';
|
|
our (%text, %access, %in);
|
|
&ReadParse();
|
|
&error_setup($text{'delete_err'});
|
|
|
|
# Validate inputs
|
|
my @del = split(/\0/, $in{'d'});
|
|
@del || &error($text{'delete_enone'});
|
|
$access{'edit'} || &error($text{'delete_ecannot'});
|
|
|
|
# Check every selected server before removing any, including forged IDs.
|
|
foreach my $d (@del) {
|
|
my $server = &get_server($d);
|
|
$server && &can_use_server($server) || &error($text{'delete_ecannot'});
|
|
}
|
|
|
|
if ($in{'confirm'}) {
|
|
# Go ahead and delete
|
|
foreach my $d (@del) {
|
|
&delete_server($d);
|
|
}
|
|
&webmin_log("deletes", undef, scalar(@del));
|
|
&redirect("");
|
|
}
|
|
else {
|
|
# Ask first
|
|
&ui_print_header(undef, $text{'delete_title'}, "");
|
|
|
|
print &ui_confirmation_form(
|
|
"delete_servs.cgi",
|
|
&text('delete_rusure', scalar(@del)),
|
|
[ map { [ "d", $_ ] } @del ],
|
|
[ [ 'confirm', $text{'delete_confirm'} ] ],
|
|
);
|
|
|
|
&ui_print_footer("", $text{'index_return'});
|
|
}
|