Remote API: Check client modules against interface_modules_enabled setting in conf.

Add is_admin check beside the existing is admin module check in edit and delete functions of the admin module.

Author: tbrehm

interface/lib/classes/remoting_lib.inc.php

@@ -296,7 +296,14 @@ function ispconfig_sysuser_add($params, $insert_id){
 		if(!isset($params['modules'])) {
 			$modules = $conf['interface_modules_enabled'];
 		} else {
+			// Check if modules are allowed
+			$allowed_modules = explode(',', $conf['interface_modules_enabled']);
 			$modules = $params['modules'];
+			foreach(explode(',', $modules) as $module) {
+				if(!in_array($module, $allowed_modules)) {
+					throw new SoapFault('Invalid modules', 'Module '.$module.' is not allowed.');
+				}
+			}
 		}
 		if(isset($params['limit_client']) && $params['limit_client'] > 0) {
 			$modules .= ',client';
@@ -306,7 +313,7 @@ function ispconfig_sysuser_add($params, $insert_id){
 			$startmodule = 'dashboard';
 		} else {
 			$startmodule = $params["startmodule"];
-			if(!preg_match('/'.$startmodule.'/', $modules)) {
+			if(!in_array($startmodule, explode(',', $modules))) {
 				$_modules = explode(',', $modules);
 				$startmodule=$_modules[0];
 			}

interface/web/admin/directive_snippets_del.php

@@ -44,6 +44,7 @@
 
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 $app->load("tform_actions");
 

interface/web/admin/directive_snippets_edit.php

@@ -43,6 +43,7 @@
 
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 // Loading classes
 $app->uses('tpl,tform,tform_actions');

interface/web/admin/extension_edit.php

@@ -33,6 +33,7 @@
 
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 //* load language file
 $lng_file = 'lib/lang/'.$app->functions->check_language($_SESSION['s']['language']).'_extension_install_list.lng';

interface/web/admin/firewall_del.php

@@ -45,6 +45,7 @@
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
 $app->auth->check_security_permissions('admin_allow_firewall_config');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 $app->uses("tform_actions");
 $app->tform_actions->onDelete();

interface/web/admin/firewall_edit.php

@@ -44,6 +44,7 @@
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
 $app->auth->check_security_permissions('admin_allow_firewall_config');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 // Loading classes
 $app->uses('tpl,tform,tform_actions');

interface/web/admin/groups_del.php

@@ -45,6 +45,7 @@
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
 $app->auth->check_security_permissions('admin_allow_cpuser_group');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 $app->uses("tform_actions");
 $app->tform_actions->onDelete();

interface/web/admin/groups_edit.php

@@ -44,6 +44,7 @@
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
 $app->auth->check_security_permissions('admin_allow_cpuser_group');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 // Loading classes
 $app->uses('tpl,tform,tform_actions');

interface/web/admin/iptables_del.php

@@ -44,6 +44,7 @@
 
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 $app->uses("tform_actions");
 $app->tform_actions->onDelete();

interface/web/admin/iptables_edit.php

@@ -44,6 +44,7 @@
 
 //* Check permissions for module
 $app->auth->check_module_permissions('admin');
+if(!$app->auth->is_admin()) $app->error('This function needs admin privileges');
 
 // Loading classes
 $app->uses('tpl,tform,tform_actions');