mirrors/MeshCentral
2
0
Fork 0
mirror of https://github.com/Ylianst/MeshCentral.git synced 2025-10-26 11:27:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

enh: hide icon customization link for non-admin users and enforce admin check in web server

Browse Source
This commit is contained in:
Sammy Ndabo 2025-10-17 17:53:01 +03:00
parent 7fc7bda548
commit 6ca5b1aeb2
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
views/default3.handlebars
View File

@ -597,7 +597,7 @@
</span>
<span id="accountCreateLoginTokenSpan" style="display:none"><a href=# onclick="return account_createLoginToken()">Create login token</a><br /></span>
<a href=# onclick="return account_showThemesSwitcher()">Switch theme</a><br />
<a href=# onclick="return showIconCustomization()">Icons Customization</a><br />
<span id="accountCustomIconsSpan" style="display:none"><a href=# onclick="return showIconCustomization()">Icons Customization</a><br /></span>
</p>
<br style=clear:both />
</div>
@ -2806,6 +2806,7 @@
QV('p2ServerActions', (siteRights & 21) && ((serverFeatures & 143) != 0));
QV('LeftMenuMyServer', (siteRights & 21) && ((serverFeatures & 64) != 0)); // 16 + 4 + 1
QV('MainMenuMyServer', siteRights & 21);
QV('accountCustomIconsSpan', (userinfo.siteadmin === 0xFFFFFFFF));
QV('p2ServerActionsBackup', (siteRights & 1) && ((serverFeatures & 1) != 0));
QV('p2ServerActionsRestore', (siteRights & 4) && ((serverFeatures & 2) != 0));
QV('p2ServerActionsVersion', (siteRights & 16) && ((serverFeatures & 4) != 0));

1
webserver.js
View File

@ -4575,6 +4575,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
if ((req.session == null) || (typeof req.session.userid !== 'string')) { res.sendStatus(401); return; }
const user = obj.users[req.session.userid];
if (user == null) { res.sendStatus(401); return; }
if (user.siteadmin !== SITERIGHT_ADMIN) { res.sendStatus(401); return; }
const multiparty = require('multiparty');
const form = new multiparty.Form();