dbxe/fusionpbx
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Harden the security with specific permissions for domains, domain settings and default settings. Everyone using multi-tenant are encouraged to update. Run Upgrade Schema on wiki.fusionpbx.com. After updating go to advanced -> group manager click on the superadmin group and then select the permissions for domains, domains settings, and default settings. Logout and back in.

Browse Source
This commit is contained in:
Mark Crane
2012-09-27 00:34:10 +00:00
parent 6e662615d4
commit 23a2f84577
16 changed files with 161 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/domains/domain_settings_edit.php
+5 -5
View File
@@ -26,7 +26,7 @@
require_once "root.php";
require_once "includes/require.php";
require_once "includes/checkauth.php";
if (if_group("admin") || if_group("superadmin")) {
if (permission_exists('domain_setting_add') || permission_exists('domain_setting_edit')) {
//access granted
}
else {
@@ -87,7 +87,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//add or update the database
if ($_POST["persistformvar"] != "true") {
if ($action == "add") {
if ($action == "add" && permission_exists('domain_setting_add')) {
$sql = "insert into v_domain_settings ";
$sql .= "(";
$sql .= "domain_uuid, ";
@@ -122,7 +122,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
return;
} //if ($action == "add")
if ($action == "update") {
if ($action == "update" && permission_exists('domain_setting_edit')) {
$sql = "update v_domain_settings set ";
$sql .= "domain_setting_category = '$domain_setting_category', ";
$sql .= "domain_setting_subcategory = '$domain_setting_subcategory', ";
@@ -148,7 +148,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
//pre-populate the form
if (count($_GET)>0 && $_POST["persistformvar"] != "true") {
$domain_setting_uuid = $_GET["id"];
$domain_setting_uuid = check_str($_GET["id"]);
$sql = "select * from v_domain_settings ";
$sql .= "where domain_uuid = '$domain_uuid' ";
$sql .= "and domain_setting_uuid = '$domain_setting_uuid' ";
@@ -175,7 +175,7 @@ if (count($_POST)>0 && strlen($_POST["persistformvar"]) == 0) {
echo "<table width='100%' border='0' cellpadding='0' cellspacing=''>\n";
echo "<tr class='border'>\n";
echo " <td align=\"left\">\n";
echo " <br>";
echo " <br>";
echo "<form method='post' name='frm' action=''>\n";
echo "<div align='center'>\n";