From bdbd8534eef5b93370065340de225a1cd5e5faa8 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Fri, 24 May 2019 15:47:43 -0400
Subject: [PATCH] Privilege matching -- allow JS anchors. Fixes #9550

Attempts to detect a special case where a file does not actually
exist, and yet should be allowed since it is used by JavaScript.

So long as the anchor name doesn't contain any characters that might let
it evade other checks, allow it through.
---
 src/etc/inc/auth_func.inc | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/etc/inc/auth_func.inc b/src/etc/inc/auth_func.inc
index 795ccdbdf1..e142e4f42c 100644
--- a/src/etc/inc/auth_func.inc
+++ b/src/etc/inc/auth_func.inc
@@ -42,6 +42,16 @@ function cmp_page_matches($page, & $matches, $fullwc = true) {
 	$file = realpath( $g['www_path'] . '/' . ltrim($file, '/'));
 	if (empty($file)) {
 		/* File does not exist, or other path shenanigans */
+
+		/* Some tabs are just JS anchors, detect this case. */
+		if ((substr($page, 0, 1) == "#") &&
+		    (strpos($page, '.') === false) &&
+		    (strpos($page, '/') === false) &&
+		    (strpos($page, '?') === false)) {
+			return true;
+		}
+
+		/* Tried to query a path that does not exist */
 		return false;
 	}
 	$page = str_replace($g['www_path'] . '/', '', $file);