Fix security vulnerability in admin modules
- The Module\BaseAdmin::post method checked credentials but didn't abort the process when it failed - Created Module\BaseAdmin::checkAdminAccess method
This commit is contained in:
@@ -38,7 +38,7 @@ class Embed extends BaseAdmin
|
||||
|
||||
public static function post(array $parameters = [])
|
||||
{
|
||||
parent::post($parameters);
|
||||
self::checkAdminAccess();
|
||||
|
||||
$theme = Strings::sanitizeFilePathItem($parameters['theme']);
|
||||
if (is_file("view/theme/$theme/config.php")) {
|
||||
|
||||
Reference in New Issue
Block a user