(xmlrpc) proper acl handling

(cherry picked from commit 803fd5f5)

(xmlrpc) proper acl handling
(cherry picked from commit 803fd5f5)
4dc44200 · Ad Schellevis · Franco Fichtner · 4ec842fa · 4dc44200
Commit 4dc44200 authored May 18, 2016 by Ad Schellevis Committed by Franco Fichtner May 24, 2016
Show whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletion

xmlrpc.php src/www/xmlrpc.php +4 -1

No files found.
--- a/src/www/xmlrpc.php
+++ b/src/www/xmlrpc.php
@@ -41,7 +41,10 @@ function http_basic_auth($http_auth_header)
    if (count($tags) >= 2) {
        $userinfo= explode(":", base64_decode($tags[1])) ;
        if (count($userinfo)>=2) {
-            return authenticate_user($userinfo[0], $userinfo[1]);
+            if (authenticate_user($userinfo[0], $userinfo[1])) {
+                $aclObj = new \OPNsense\Core\ACL();
+                return $aclObj->isPageAccessible($userinfo[0], "/xmlrpc.php");
+            }
        }
    }