Restricting arbitrary users from creating servers/groups

At the moment, arbitrary users are able to create servers/groups by forging their own POST call. This Patch limits both calls to administrators.
operasoftware · Apr 4, 2019 · fe2eeab · fe2eeab
1 parent 3920033
commit fe2eeab
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/views/groups.php b/views/groups.php
@@ -15,7 +15,7 @@
 ## limitations under the License.
 ##
 
-if(isset($_POST['add_group'])) {
+if(isset($_POST['add_group']) && ($active_user->admin)) {
 	$name = trim($_POST['name']);
 	if(preg_match('|/|', $name)) {
 		$content = new PageSection('invalid_group_name');

diff --git a/views/servers.php b/views/servers.php
@@ -15,7 +15,7 @@
 ## limitations under the License.
 ##
 
-if(isset($_POST['add_server'])) {
+if(isset($_POST['add_server']) && ($active_user->admin)) {
 	$hostname = trim($_POST['hostname']);
 	if(!preg_match('|.*\..*\..*|', $hostname)) {
 		$content = new PageSection('invalid_hostname');