Fix security vulnerability in admin modules

- The Module\BaseAdmin::post method checked credentials but didn't abort the process when it failed
- Created Module\BaseAdmin::checkAdminAccess method

src/Module/Admin/Addons/Details.php

@@ -32,7 +32,7 @@ class Details extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		$addon = Strings::sanitizeFilePathItem($parameters['addon']);
 

src/Module/Admin/Blocklist/Contact.php

@@ -32,7 +32,7 @@ class Contact extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		self::checkFormSecurityTokenRedirectOnError('/admin/blocklist/contact', 'admin_contactblock');
 

src/Module/Admin/Blocklist/Server.php

@@ -30,7 +30,7 @@ class Server extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		if (empty($_POST['page_blocklist_save']) && empty($_POST['page_blocklist_edit'])) {
 			return;

src/Module/Admin/Features.php

@@ -30,7 +30,7 @@ class Features extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		self::checkFormSecurityTokenRedirectOnError('/admin/features', 'admin_manage_features');
 

src/Module/Admin/Item/Delete.php

@@ -31,7 +31,7 @@ class Delete extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		if (empty($_POST['page_deleteitem_submit'])) {
 			return;

src/Module/Admin/Logs/Settings.php

@@ -31,7 +31,7 @@ class Settings extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		if (empty($_POST['page_logs'])) {
 			return;

src/Module/Admin/PhpInfo.php

@@ -27,7 +27,7 @@ class PhpInfo extends BaseAdmin
 {
 	public static function rawContent(array $parameters = [])
 	{
-		parent::rawContent($parameters);
+		self::checkAdminAccess();
 
 		phpinfo();
 		exit();

src/Module/Admin/Site.php

@@ -43,7 +43,7 @@ class Site extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		self::checkFormSecurityTokenRedirectOnError('/admin/site', 'admin_site');
 

src/Module/Admin/Themes/Embed.php

@@ -38,7 +38,7 @@ class Embed extends BaseAdmin
 
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		$theme = Strings::sanitizeFilePathItem($parameters['theme']);
 		if (is_file("view/theme/$theme/config.php")) {

src/Module/Admin/Tos.php

@@ -29,7 +29,7 @@ class Tos extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		if (empty($_POST['page_tos'])) {
 			return;

src/Module/Admin/Users.php

@@ -34,7 +34,7 @@ class Users extends BaseAdmin
 {
 	public static function post(array $parameters = [])
 	{
-		parent::post($parameters);
+		self::checkAdminAccess();
 
 		self::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users');