mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make widget privilege matching more specific. Fixes #9512

Browse Source 
(cherry picked from commit bc319bc01a)
This commit is contained in:
jim-p 2019-05-09 16:39:46 -04:00
parent a8a07cfbb4
commit 2d7ec8bfdd
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/etc/inc/priv/user.priv.inc
View File

@ -21,7 +21,7 @@ $priv_list['page-dashboard-all']['name'] = gettext("WebCfg - Dashboard (all)");
$priv_list['page-dashboard-all']['descr'] = gettext("Allow access to all pages required for the dashboard.");
$priv_list['page-dashboard-all']['match'] = array();
$priv_list['page-dashboard-all']['match'][] = "index.php*";
$priv_list['page-dashboard-all']['match'][] = "*.widget.php*";
$priv_list['page-dashboard-all']['match'][] = "widgets/widgets/*.widget.php*";
$priv_list['page-dashboard-all']['match'][] = "graph.php*";
$priv_list['page-dashboard-all']['match'][] = "graph_cpu.php*";
$priv_list['page-dashboard-all']['match'][] = "getstats.php*";
@ -32,7 +32,7 @@ $priv_list['page-dashboard-widgets'] = array();
$priv_list['page-dashboard-widgets']['name'] = gettext("WebCfg - Dashboard widgets (direct access).");
$priv_list['page-dashboard-widgets']['descr'] = gettext("Allow direct access to all Dashboard widget pages, required for some widgets using AJAX.");
$priv_list['page-dashboard-widgets']['match'] = array();
$priv_list['page-dashboard-widgets']['match'][] = "*.widget.php*";
$priv_list['page-dashboard-widgets']['match'][] = "widgets/widgets/*.widget.php*";
$priv_list['user-config-readonly'] = array();
$priv_list['user-config-readonly']['name'] = gettext("User - Config: Deny Config Write");