Fix security vulnerability in admin modules

- The Module\BaseAdmin::post method checked credentials but didn't abort the process when it failed
- Created Module\BaseAdmin::checkAdminAccess method
This commit is contained in:
Hypolite Petovan 2020-09-08 10:44:27 -04:00
parent 9bc2c5a52e
commit 3efa8648c5
12 changed files with 29 additions and 36 deletions

View file

@ -32,7 +32,7 @@ class Details extends BaseAdmin
{
public static function post(array $parameters = [])
{
parent::post($parameters);
self::checkAdminAccess();
$addon = Strings::sanitizeFilePathItem($parameters['addon']);