tyler.durden/pandorafms
1
0
Fork 0
mirror of https://github.com/pandorafms/pandorafms.git synced 2025-07-28 00:04:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix users vulnerabilities

Browse Source
This commit is contained in:
Calvo 2022-03-03 16:35:31 +01:00
parent a4d7653cf9
commit 036e2e3d6c
2 changed files with 512 additions and 470 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
pandora_console/godmode/users/configure_user.php
View File

@ -324,6 +324,16 @@ if ($create_user) {
$user_is_admin = (int) get_parameter('is_admin', 0); $user_is_admin = (int) get_parameter('is_admin', 0);
if (users_is_admin() === false && $user_is_admin !== 0) {
db_pandora_audit(
AUDIT_LOG_ACL_VIOLATION,
'Trying to create with administrator privileges to user by non administrator user '.$config['id_user'],
);
include 'general/noaccess.php';
exit;
}
$values = []; $values = [];
$values['id_user'] = (string) get_parameter('id_user'); $values['id_user'] = (string) get_parameter('id_user');
$values['fullname'] = (string) get_parameter('fullname'); $values['fullname'] = (string) get_parameter('fullname');
@ -538,6 +548,16 @@ if ($update_user) {
$values['default_event_filter'] = (int) get_parameter('default_event_filter'); $values['default_event_filter'] = (int) get_parameter('default_event_filter');
$values['default_custom_view'] = (int) get_parameter('default_custom_view'); $values['default_custom_view'] = (int) get_parameter('default_custom_view');
if (users_is_admin() === false && (bool) $values['is_admin'] !== false) {
db_pandora_audit(
AUDIT_LOG_ACL_VIOLATION,
'Trying to add administrator privileges to user by non administrator user '.$config['id_user'],
);
include 'general/noaccess.php';
exit;
}
// eHorus user level conf. // eHorus user level conf.
$values['ehorus_user_level_enabled'] = (bool) get_parameter('ehorus_user_level_enabled', false); $values['ehorus_user_level_enabled'] = (bool) get_parameter('ehorus_user_level_enabled', false);
$values['ehorus_user_level_user'] = (string) get_parameter('ehorus_user_level_user'); $values['ehorus_user_level_user'] = (string) get_parameter('ehorus_user_level_user');

962
pandora_console/godmode/users/user_list.php
View File

File diff suppressed because it is too large Load Diff