maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

avoid accessing api_keys page if not allowed for loggedin user

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2022-06-30 14:53:58 +02:00
parent d4e94c0390
commit c8183fbbbf
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
api_keys.php
View File

@@ -34,6 +34,16 @@ use Froxlor\UI\HTML;
use Froxlor\UI\Listing;
use Froxlor\UI\Panel\UI;
use Froxlor\UI\Request;
use Froxlor\UI\Response;
// redirect if this customer has no permission for API usage
if ($userinfo['adminsession'] == 0 && $userinfo['api_allowed'] == 0) {
Response::redirectTo('customer_index.php');
}
// redirect if this admin has no permission for API usage
if ($userinfo['adminsession'] == 1 && $userinfo['api_allowed'] == 0) {
Response::redirectTo('admin_index.php');
}
// This file is being included in admin_index and customer_index
// and therefore does not need to require lib/init.php

2
templates/Froxlor/userarea.html.twig
View File

@@ -79,7 +79,7 @@
<a class="dropdown-item" href="{{ linker({'section': 'index', 'page': 'change_theme'}) }}"><i class="fa-solid fa-image"></i> {{ lng('panel.theme') }}</a>
</li>
{% endif %}
{% if get_setting('api.enabled') == 1 %}
{% if get_setting('api.enabled') == 1 and userinfo.api_allowed == 1 %}
<li><hr class="dropdown-divider"></li>
<li>
<a class="dropdown-item" href="{{ linker({'section': 'index', 'page': 'apikeys'}) }}"><i class="fa-solid fa-key"></i> {{ lng('menue.main.apikeys') }}</a>