mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't allow deletion when spoofing another userkey

Browse Source 
(cherry picked from commit 3fd4f32c34)
This commit is contained in:
Steve Beaver 2018-09-17 16:22:34 -04:00
parent b1aa39323e
commit da266efdbc
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/usr/local/www/services_acb.php
View File

@ -31,10 +31,6 @@ $legacy = false;
if (isset($_REQUEST['legacy'])) {
$legacy = true;
} else {
if (isset($_REQUEST['userkey'] )) {
$userkey = $_REQUEST['userkey'];
}
}
// Encryption password
@ -537,7 +533,11 @@ if (!$legacy) {
<td>
<a class="fa fa-undo" title="<?=gettext('Restore this revision')?>" href="services_acb.php?hostname=<?=urlencode($hostname)?>&userkey=<?=urlencode($userkey)?>&newver=<?=urlencode($cv['time'])?><?=($legacy ? "&legacy=true":"")?>" onclick="return confirm('<?=gettext("Are you sure you want to restore {$cv['localtime']}?")?>')"></a>
<a class="fa fa-download" title="<?=gettext('Show info')?>" href="services_acb.php?download=<?=urlencode($cv['time'])?>&hostname=<?=urlencode($hostname)?>&userkey=<?=urlencode($userkey)?>&reason=<?=urlencode($cv['reason'])?><?=($legacy ? "&legacy=true":"")?> "></a>
<a class="fa fa-trash" title="<?=gettext('Delete config')?>" href="services_acb.php?hostname=<?=urlencode($hostname)?>&userkey=<?=urlencode($userkey)?>&rmver=<?=urlencode($cv['time'])?><?=($legacy ? "&legacy=true":"")?>"></a>
<?php
if ($userkey == $origkey) {
?>
<a class="fa fa-trash" title="<?=gettext('Delete config')?>" href="services_acb.php?hostname=<?=urlencode($hostname)?>&rmver=<?=urlencode($cv['time'])?><?=($legacy ? "&legacy=true":"")?>"></a>
<?php } ?>
</td>
</tr>
<?php $counter++;