From 4de15854384e28004b0dc571dc8a40fda7eae694 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Tue, 23 Oct 2018 14:17:57 -0400
Subject: [PATCH] Fix processing of the 'all' group. Fixes #9051

All the 'all' group to the list of groups at the end, rather than the
start. This way it will be considered no matter how users login. This
also fixes issues some users had with the original changes.
---
 src/etc/inc/auth.inc | 18 +++++++++++-------
 src/etc/inc/priv.inc |  8 +++++++-
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/src/etc/inc/auth.inc b/src/etc/inc/auth.inc
index ad228492be..78b9d69caa 100644
--- a/src/etc/inc/auth.inc
+++ b/src/etc/inc/auth.inc
@@ -331,7 +331,7 @@ function get_user_privileges(& $user) {
 	global $config, $_SESSION;
 
 	$authcfg = auth_get_authserver($config['system']['webgui']['authmode']);
-	$allowed_groups = array('all');
+	$allowed_groups = array();
 
 	$privs = $user['priv'];
 	if (!is_array($privs)) {
@@ -369,12 +369,16 @@ function get_user_privileges(& $user) {
 		$allowed_groups = local_user_get_groups($user, true);
 	}
 
-	if (is_array($allowed_groups)) {
-		foreach ($allowed_groups as $name) {
-			$group = getGroupEntry($name);
-			if (is_array($group['priv'])) {
-				$privs = array_merge($privs, $group['priv']);
-			}
+	if (!is_array($allowed_groups)) {
+		$allowed_groups = array('all');
+	} else {
+		$allowed_groups[] = 'all';
+	}
+
+	foreach ($allowed_groups as $name) {
+		$group = getGroupEntry($name);
+		if (is_array($group['priv'])) {
+			$privs = array_merge($privs, $group['priv']);
 		}
 	}
 
diff --git a/src/etc/inc/priv.inc b/src/etc/inc/priv.inc
index a06217c11c..730b672f01 100644
--- a/src/etc/inc/priv.inc
+++ b/src/etc/inc/priv.inc
@@ -239,7 +239,7 @@ function getAllowedPages($username, &$attributes = array()) {
 	}
 
 	$allowed_pages = array();
-	$allowed_groups = array('all');
+	$allowed_groups = array();
 
  	phpsession_begin();
 	if ($_SESSION['remoteauth']) {
@@ -283,6 +283,12 @@ function getAllowedPages($username, &$attributes = array()) {
 		}
 	}
 
+	if (!is_array($allowed_groups)) {
+		$allowed_groups = array('all');
+	} else {
+		$allowed_groups[] = 'all';
+	}
+
 	// build a list of allowed pages
 	if (is_array($config['system']['group']) && is_array($allowed_groups)) {
 		foreach ($config['system']['group'] as $group) {