CVE-2022-4868: Improper Authorization (CWE-285)
value: Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
CWE description: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2022-12-31T10:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: admin_cronjobs.php, admin_ipsandports.php, admin_mysqlserver.php, lib/Froxlor/Api/Commands/IpsAndPorts.php
Commit date: 2022-12-31 00:42:58 +0100
Commit message: dont show page content for resellers withouth required permissions to actually do something

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/admin_cronjobs.php b/admin_cronjobs.php
index e23ce0c05..3a77e6943 100644
--- a/admin_cronjobs.php
+++ b/admin_cronjobs.php
@@ -34,11 +34,11 @@ use Froxlor\UI\Panel\UI;
 use Froxlor\UI\Request;
 use Froxlor\UI\Response;
 
 $id = (int)Request::any('id');
 
-if ($page == 'cronjobs' || $page == 'overview') {
+if (($page == 'cronjobs' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
 	if ($action == '') {
 		$log->logAction(FroxlorLogger::ADM_ACTION, LOG_NOTICE, 'viewed admin_cronjobs');
 
 		try {
 			$cron_list_data = include_once dirname(__FILE__) . '/lib/tablelisting/admin/tablelisting.cronjobs.php';
diff --git a/admin_ipsandports.php b/admin_ipsandports.php
index 6a60288bf..e8f796b3c 100644
--- a/admin_ipsandports.php
+++ b/admin_ipsandports.php
@@ -36,11 +36,11 @@ use Froxlor\UI\Panel\UI;
 use Froxlor\UI\Request;
 use Froxlor\UI\Response;
 
 $id = (int)Request::any('id');
 
-if ($page == 'ipsandports' || $page == 'overview') {
+if (($page == 'ipsandports' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
 	if ($action == '') {
 		$log->logAction(FroxlorLogger::ADM_ACTION, LOG_NOTICE, "viewed admin_ipsandports");
 
 		try {
 			$ipsandports_list_data = include_once dirname(__FILE__) . '/lib/tablelisting/admin/tablelisting.ipsandports.php';
diff --git a/admin_mysqlserver.php b/admin_mysqlserver.php
index c2332d0bb..699a24414 100644
--- a/admin_mysqlserver.php
+++ b/admin_mysqlserver.php
@@ -36,11 +36,11 @@ use Froxlor\UI\Panel\UI;
 use Froxlor\UI\Request;
 use Froxlor\UI\Response;
 
 $id = (int)Request::any('id');
 
-if ($page == 'mysqlserver' || $page == 'overview') {
+if (($page == 'mysqlserver' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
 	if ($action == '') {
 		$log->logAction(FroxlorLogger::ADM_ACTION, LOG_NOTICE, "viewed admin_mysqlserver");
 
 		try {
 			$mysqlserver_list_data = include_once dirname(__FILE__) . '/lib/tablelisting/admin/tablelisting.mysqlserver.php';
diff --git a/lib/Froxlor/Api/Commands/IpsAndPorts.php b/lib/Froxlor/Api/Commands/IpsAndPorts.php
index 579614cb8..d3dfe6bec 100644
--- a/lib/Froxlor/Api/Commands/IpsAndPorts.php
+++ b/lib/Froxlor/Api/Commands/IpsAndPorts.php
@@ -389,11 +389,11 @@ class IpsAndPorts extends ApiCommand implements ResourceEntity
 	 * @return string json-encoded array
 	 * @throws Exception
 	 */
 	public function update()
 	{
-		if ($this->isAdmin() && ($this->getUserDetail('change_serversettings') || !empty($this->getUserDetail('ip')))) {
+		if ($this->isAdmin() && $this->getUserDetail('change_serversettings')) {
 			$id = $this->getParam('id');
 
 			$result = $this->apiCall('IpsAndPorts.get', [
 				'id' => $id
 			]);

Vulnerable code: if ($page == 'cronjobs' || $page == 'overview') {
if ($page == 'ipsandports' || $page == 'overview') {
if ($page == 'mysqlserver' || $page == 'overview') {
		if ($this->isAdmin() && ($this->getUserDetail('change_serversettings') || !empty($this->getUserDetail('ip')))) {
Fixed code: if (($page == 'cronjobs' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
if (($page == 'ipsandports' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
if (($page == 'mysqlserver' || $page == 'overview') && $userinfo['change_serversettings'] == '1') {
		if ($this->isAdmin() && $this->getUserDetail('change_serversettings')) {