psychon 7965a12bd0 Fix a privilege escalation bug in webadmin if auth modules are used ...

auth modules = imapauth and saslauth

Some code in CWebAdminSock::OnLogin() is skipped if a module handles auth
and thus m_pUser stays NULL. Most checks for admin rights only check for
m_pUser being NULL and thus any user WHO ALREADY HAS A VALID LOGIN can edit
other users if they know their user name.
(=Change the password of an admin and log in using this info)

One of the major excpeptions are the templates which use m_bAdmin instead of
m_pUser for checking the privieleges, thus users still see the normal pages
and this bug stayed unnoticed for a while.

This patch now moves the code that sets m_pUser to some code which is executed
in both cases, when an auth module is in effect and when one isn't.
(Well, technically this isn't a move, but code duplication, but executing this
 twice won't hurt and one of the follow-up patches cleans this up.)


git-svn-id: https://znc.svn.sourceforge.net/svnroot/znc/trunk@1113 726aef4b-f618-498e-8847-2d620e286838

2008-07-07 18:30:35 +00:00

..

webadmin/skins

Webadmin: Add support for timezone offset

2008-05-30 14:09:41 +00:00

autoattach.cpp

autoattach: Don't allow adding the same entry twice

2008-06-22 14:06:01 +00:00

autoop.cpp

Cleanup autoop a little

2008-05-24 17:02:14 +00:00

away.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

awaynick.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

chansaver.cpp

chansaver: Add all channels to the config when this module is loaded

2008-04-07 20:19:17 +00:00

crypt.cpp

crypt: Fix bug where a usermsg was not forwarded to other clients

2008-06-08 09:34:21 +00:00

email.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

imapauth.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

kickrejoin.cpp

Don't use <> but "" for the includes in kickrejoin

2008-01-18 23:06:54 +00:00

Makefile.in

modules/Makefile.in: $LIBS is unused and should not be used

2008-06-16 19:17:05 +00:00

modperl.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

modperl.pm

throw an warning if package definition is not found

2008-03-17 02:40:38 +00:00

nickserv.cpp

Nickserv: Work on freenode (which uses lower case 'identify' notice)

2008-05-30 10:54:44 +00:00

partyline.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

perform.cpp

Perform: Require an argument for the 'add' command

2008-05-30 13:59:01 +00:00

raw.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

sample.cpp

Add OnUserTopic module call

2008-06-06 14:27:57 +00:00

saslauth.cpp

Clean up includes

2008-01-07 21:31:16 +00:00

savebuff.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

schat.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

shell.cpp

Move ChangeDir() and MakeDir() from CUtils to CDir

2008-05-08 16:58:32 +00:00

simple_away.cpp

Remove useless spaces inside of braces "( stuff )"

2008-04-20 13:00:19 +00:00

stickychan.cpp

Force a space between if, for, while and (

2008-04-20 13:08:44 +00:00

watch.cpp

watch: Remove the raw /watch command

2008-04-30 14:09:15 +00:00

webadmin.cpp

Fix a privilege escalation bug in webadmin if auth modules are used

2008-07-07 18:30:35 +00:00