Restrict modification and deletion of default package

Author: Kristan Kenney

web/edit/package/index.php

@@ -14,7 +14,7 @@
 }
 
 // Check package argument
-if (empty($_GET['package'])) {
+if (empty($_GET['package']) || ($_GET['package'] === 'default')) {
     header("Location: /list/package/");
     exit;
 }

web/templates/admin/list_packages.html

@@ -68,22 +68,35 @@
         <div class="clearfix l-unit__stat-col--left super-compact">
           <input id="check<?=$i?>" class="ch-toggle" type="checkbox" name="user[]" value="<?=$key?>">
         </div>
-            <div class="clearfix l-unit__stat-col--left wide-2 truncate"><b><a href="/edit/package/?package=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Package')?>: <?=$key?>"><?=$key?></b></a></div>
+            <? if ($key == 'default') { ?>
+              <div class="clearfix l-unit__stat-col--left wide-2 truncate"><b><?=$key?></b></div>
+            <? } else {?>
+              <div class="clearfix l-unit__stat-col--left wide-2 truncate"><b><a href="/edit/package/?package=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Package')?>: <?=$key?>"><?=$key?></b></a></div>
+            <? } ?>
             <!-- START QUICK ACTION TOOLBAR AREA -->
             <div class="clearfix l-unit__stat-col--left text-right compact-3">
                   <div class="l-unit-toolbar__col l-unit-toolbar__col--right noselect">
                       <div class="actions-panel clearfix">
-                        <div class="actions-panel__col actions-panel__edit shortcut-enter" key-action="href"><a href="/edit/package/?package=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Package')?>"><i class="fas fa-pencil-alt status-icon orange status-icon dim"></i></a></div>
+                        <? if ($key == 'default') { ?>
+                          <!-- Restrict editing default package -->
+                        <? } else {?>
+                          <div class="actions-panel__col actions-panel__edit shortcut-enter" key-action="href"><a href="/edit/package/?package=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Package')?>"><i class="fas fa-pencil-alt status-icon orange status-icon dim"></i></a></div>
+                        <? } ?>
+                        
                         <div class="actions-panel__col actions-panel__edit" key-action="href"><a href="/copy/package/?package=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Copy')?>"><i class="fas fa-clone status-icon teal status-icon dim"></i></a></div>
-                        <div class="actions-panel__col actions-panel__delete shortcut-delete" key-action="js">
-                          <a id="delete_link_<?=$i?>" class="data-controls do_delete" title="<?=_('Delete')?>">
-                            <i class="fas fa-trash status-icon red status-icon dim do_delete"></i>
-                            <input type="hidden" name="delete_url" value="/delete/package/?package=<?=$key?>&token=<?=$_SESSION['token']?>" />
-                            <div id="delete_dialog_<?=$i?>" class="confirmation-text-delete hidden" title="<?=_('Confirmation')?>">
-                              <p class="confirmation"><?=sprintf(_('DELETE_PACKAGE_CONFIRMATION'),$key)?></p>
-                            </div>
-                          </a>
-                        </div>
+                        <? if ($key == 'default') { ?>
+                          <!-- Restrict deleting default package -->
+                        <? } else {?>
+                          <div class="actions-panel__col actions-panel__delete shortcut-delete" key-action="js">
+                            <a id="delete_link_<?=$i?>" class="data-controls do_delete" title="<?=_('Delete')?>">
+                              <i class="fas fa-trash status-icon red status-icon dim do_delete"></i>
+                              <input type="hidden" name="delete_url" value="/delete/package/?package=<?=$key?>&token=<?=$_SESSION['token']?>" />
+                              <div id="delete_dialog_<?=$i?>" class="confirmation-text-delete hidden" title="<?=_('Confirmation')?>">
+                                <p class="confirmation"><?=sprintf(_('DELETE_PACKAGE_CONFIRMATION'),$key)?></p>
+                              </div>
+                            </a>
+                          </div>
+                        <? } ?>
                       </div>
                     </div>
             </div>