CVE-2020-9381: Incorrect Authorization (CWE-863)
value: controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.5
Published: 2020-02-24T22:15Z
Repository: https://github.com/totaljs/cms
Language: Other
Files changed: cms.bundle, controllers/admin.js
Commit date: 2020-02-19 12:51:13 +0100
Commit message: Fixed permissions.

Diff: diff --git a/cms.bundle b/cms.bundle
index 07cae7d..edd9a7c 100755
--- a/cms.bundle
+++ b/cms.bundle
@@ -1,6 +1,6 @@
-/controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOooytJALH9lgykGH579cvsuOEhJ1vRxUVWd1q9eujlsI00Uac9L/cnPYGR4dfRUc8i8HXs+6ucJLUqOHUES/ttbBi2zvung/qXEEsc1Nj2u/1/jrq3vTOBke90z5xahkWuTJT4NYmV6FxPDE2JkuTGOZMXsjZ8r3j494lrLpyWkGmWpHMZBLJJFRSt2AZz2bBCD6zXD4o+TibLrI4DaLZdxI8zD6GKi5FaBMYO4zVg5zxPKpoJCtSOkoL03KuK9UOTo5OL86PQTtgjyYqaTnttbWHIBcHBz0yFczAz0v8SIo4BvLhxem+z66EyWGRhEalifsQxIVsiue1hhoK97JPw8YsEL6ZZhIWEJ9QsH+QhDIdit7tnQyN+MQUZtvlj/a8hInUGhz1A0JKTgiQg0Iu+74Gt7szYU2Yfll7Ke1B6nJrwPTffhOlAJ5vzxZSttRXFlrmnkArPDHvE6SwrJlvKPtK1+BPe46wYPE8keR1BP74STCRi4YS18zO3qnrPCitTJpDOlT6prd3PxC1auXKkICcNz0NP2vyKUtzo30KXBzX3YYbrzVaLXGUGJknQbzWOO9dDLqu86U7EPjHGYqZzAOUu5SlSnRPrP5jnpqMs15/wDKgboAKcmxJrBRDXEtF0ML5Cl7+x3QP0IFHwLi1CX/XntjZ2t5stgW4ZEecfP6BTW4DLX9/v2Qvpt8wHfYqd9jefP+Bd9iu77DgzVeotcSM9b40RiUjLTY2Poo/6uwYJwrsSe+ge7wrWjocy0nQCtPJJE38O/3WvrdBeF9kuhXGMsiXbLy+T1J4V2a+Id43sqMu9xnT+6X1rKKX1j/JzSWEpzTmUt7qNLyXBgCi+7nf2/+rO3BLEC0xmDkwuHc6TZxrWnx4dNx1s7iA1CEER0VpzmlF6WNSpgvSaEsLNli9gNomT2NAnHoBz2a5hrCQZ3N+kce+Lm7xnEpG7qZXob4fy2Rkxk3xU6dTTTahhHNpijxBXRH6oyjVUKh4IFzVxKrs2rpiRwwDUDYSgTFykhnNKtC6j2KHEaW2MkTIjl20uz5txnn6+H5ziwmlDoAcsMk6i9zvnR765OIbk97LBMG0JiGX3/wxeEzm+sp52iAW51p0wLzFla+Uslja/9q/6HfP5zVYb1lXhGl6rxDr6tbQXF01nkErUOef7KK//xZ2WPkdVVjiVpBPvvvEP+/EFhxjW+0fciK2Dy7j4wahk/Pam2iJNfdk7+iUTNdXrNt1u3ZUdfjI/78pCrl1nkKFWEfSOacDDDoNc6RZZy5kAuT8fFZTYXAMSR88bHM8T2F2mObCRZKCWagPK7Hzepc2sPxbVON379g1JBf55tZcKSqQxrJ6VACOT72hi4y+SY/TR5nvAzq7Ta7GjS0ruVGpOwxiTSd8o3ELsHBPw5e1BnkKXbUXxyAmEmDumt2U1lrbV5tJDeo/WPiWEbQerF1UfanuNeVJe1Z/QV1avDyF3oCMWvaUniHpr6scf9rckZQoKmqI7AKQeCKX2hNKzzAVxlWGCsQacMLVFuOLc+OUeJkF5FVmUD5+2uaMnI9OAzJOVx50EPC3m5YFuUuOGXBve7yWzpD5WHLQqJbZilq+lhEkzYhYlr1lpTTlAPCMryIyCdWo5Td65rVWbA5UPkegZLQmnO0N/oRiSA1YaLdrOcBN5Hdw58iK21iFNIfLWAg43scvt5RUTpfBtXFFPpsB7zEDYA4RAw4ALQKhMxmqoQpZ8WGeTkQUmAB7IGQ7BA+qCd66hHuXjTwxUkNPZMmoKXSRUZcqMpmHMjFFEGMyqO9gsAjCMM0jHP38SXdOL04+d89/FkE+KibACiES3wqZTwX7R0h/5O8KH3YA7h2oOjv8sCncYamCGAWYndArNVE1KGDokqpeYN1fn2Vp1RVUOcr5SbkQ2bTTWawMZCYciFkchNJ1fPQwkuSTkYkGSdBFcy9D0Iok0tvXeFC5c6xU1g7o7SDKLiGB61aRwKFOk7OoDOtQuw6VGeS8ipai/n6hDcSLnVO6no2EsbR9R3+CV4gxNGcCXWnGkmMdBtBg+sRyCPoobTTcLqDm9auipIUh+BN7V4HdC6gEccTECeC2IwK4Fep7lUFGwV710GpxO50tdW9lGMAWoIXSpFPTZ9/WXMt+QAtsoOw8qJNrCfeesvVZUPI1mNQj65FPsJx8p9melQZ5b97ZtaaRqKwQDX24DGWFmY98pc4sqp16LvDKb1AgykzdDzvET9pURIqedEsVf+Vjnmlw9qvhlIx+4frFJhew+UGFcr7DLfBSWF1T7bf4VWztkEabTduh2CeLeWjnNpxumJxDMh5iAwChatP9vkNTMMYfPyhMGkmIcjp1YVHn4+z1g7WsBPMdcpVgEraqPcT6g/+NLUClKTmF2HMZqVyGprpKOK+3VMmqHQnkHyNrj3+bRlNIGa0fAbJ8PQ62d36va6Il5K8pj517ic857mxlidK7CB4othyTCF4MX2+saPrjQI+hqXlzc4xorREFPa5tz0LYdHbePWQSpItRkGvfZYTxbhBFQ2SdRTK4Fts7ArjGL/29/8DtqvsAhQ2EZ3pmwZe7qYaK56s+zKOMXTFvjCdI2fJJzxOnvd6ZR0yc62+HGEyBGG8JuEmaMWwx/5I4k6CLMJRacyUICc1SSVHJA1gUuY7M8zTfIDs3wHEEUtBVOdW5d0F3fOFOitioDM5SkakQYBXa5yp5+B3AXTgyrq7bS5LJJiSBh/8YKONW5YhznkgAFBhA8NunQ6liAXU9Om9tB4FwDXgK4FzkOR6UhNQqMSnh9p8HB8iF1+D+oHe+96VbwlYT34pkbmhTv+wIWHYNIWi/XA6rdjXyswJS7xlM3EWCR03HrlgQg7hkJ7ll8sSjiszYztHYE2OpRmNj5/jDs1lEU/zYB5rgDqe9S09MauMKPC137QwuD3nIxtrln87qISO67YxqCPxim11I/KPJBPAiMNKlYHDjy0nPP5CxjGAUS3yEcOHIXcwZfhdaTBP7XLQCa2zjMCsX6t/4gKv2spC55P5pXxXnl/u84z5UC6TIAFjcEpzAPErJR2XCsXBxub3CwxLh0HnSwmZjF30A3Phk6eMEOaW6dNTZ7zK5wI/n2mp+bHPm2HFinj2SwwDqj7iWuOG1HzCNV/lhkH4uhkOZu+UL0arSWERg6OAcFgE8ZafQ+q9/tbnxr2Dj+/W7X1qK+j9/Ejy57zebkGRgU1lUXEyQJ/OJs5ChKuJVlE3/Awg7gJ51GQAA
+/controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOohxbTgSO7bFkIMPy36+7Jb/lhZ1vRxUVWd1q9eujlvwkloqdDb/cnQ9GJ8dfWY+9sNHXi/4+s+JEiXBusdfuhl+yHZz2L0d1Li/imaoxHQ4Gf5307wYXo5PB+ZA4JffzTKg5cEuVCV9ZDpsqlSZxBHMqy3m1/OD0dHBNq770R/vsxup4qegEPOVxwGNfcNmB1Xo29SbwmWb8UfCnajr2HquPUETFEqk8ZYaReOQVz5MIJrwkJZMkV/VNMiTdOuxiMKw0ytMo8YJltpolR2cn51eXp2AMsAQzEXes7sbGo5exo6MBeQZ48fMaP+I8ioB8fHV+6GrPw2SYx74SSWw/elHO2+xloyVCZl8Padiq4uaqecphAfExAft7sc+TkA3G99xX7JOmaLZ9/dFtSphxKcGhPyCk4IR4WijkeuhKCI9dCWvD9OvGa2EPUldbA6b/9hsrBOj5brWQkqu+Mpc8cxha4bCmT5CiZVW+oWQtXIM/3QZhweImkeT1GP64sTfji4YSV2Xn4Ny2HoUUKskgJ0p9k/H9D0StXLk2JCDnTU/DzwZ/ThNIQpcCF0V1t+HGG61Oh53EimexF220LgdXo75tQZUx/NMZiumsByh3JUutQNb/aZ6aDKwdLQNqBaggx5TEWjHEtVIELWwW4eo/TXegZvUIGHe24Q+KeW9nd7vdZeCSPXb2+Qc2GXuS//5+xV6afqfpsFexw+72+w96h936DgveXEK3FWZsDrlSIp5ItrX1kf1RZ8c4UWDPBkf9033Wkf6Uz7yOn8xmSezey7f2HXv+Q57Kjh9xL1ux8eYhSdG7auY74n0jO+pyXzC9XzsvInjt/JPcjEN4CmOu+Vgm/gNXABD9z8PB4V/9kV2AaIHdmgODey+T2Lqlxccnp307jXJIHUJ+VJTmrE6QPMVFuiCNtjRgg9ULqK2yJALEqRdwNatrCAu5mnPzLHJlPsZjLZ7Y206J+m7E44mattlPvV452YYSzrjKsxh1RegPgkRCoeKBcFMTK9Jb44o9FnqgbMA8pfgsVVKrQOs+sj2NKLWVPkJ2ZKPd9Wk1zZKn99s7mlDoAMgBm2xqkYeD82OXXHynkgceI5jWJGT8mzsFj/FM3ljPW8QCx10PzFtcuaSUwdLh1+HVsH/Z1GCzY1zhJ8mDQKyrW0NzddX0DFqBOv9kFv39NzPD0u+owgq3gnzy3Sf9847twDG20/0hJ2KbYWt83CJ0spa9iZYYc88OTs7JdHmjdbvt1o6qnj7y/2+KQm5dJlAhxpF0zkkPg07DDGnGmQuZADnfzGoqDB1D0gcP2wzPU5gNk4zZSBIwC/VhJPaWd+kCy79ZOX73TruG5CJfY82NoAJprapHAeD4PAhtZHRVcpo88ewQ0Nlu62rc2jGSW6W6oRdJOuFbrTHAwgMNXzda5Cl01UEUgZiAgbkbZlNaa2wnJT3kAWHUwt4slM6Mq2kSGKXXOoVE/IM/3jKZ1oNvFg1daWnNVLJVG7tgHC1enXBvAEwt1wo/kvRlTMCfru5fCsxlNfy2wXcOy7h0mJAVAsO4zGeG7gUn3OxoNLLurAJdU4+8qhmEi5+mlSPno9OAjNOlBy08HnbbhgW5C44K5ncdvZZOnGYsddCo8rUVtewuIkiaEbEACcNKSa0DoGdcEZBJqEatGtAzy1ppcwAndAQKRmPCxcHoTyidRIGFZruOBdxEfgc3lDQfR8KnOVymhYDjXfyyC0nFdBFcE1fkMxnwHjMA5hBf4LiQzGMy5b4Iha8VD7NkxgJPedgxIdsxeFDM8C7H7Pt04rCJCB2WxpM2k3lKPS1LeebzWOVehMkgvoPBzPP9JAtw9PMn2Tu/Ovvcv/yZedkknwErhIh9y3k2Z9o/jLsTd5+5sANw70HVmeGHbWaHhQps4mF2QmfVRtWg3KGnKjuHTXezytKyhyhzVOcn5UJg0k6mkVCQmYABaeT53LZc9DCS+LPisQRJ0HPrzoeAGEmktyvxWLMbrFTWFuhtISavIIHr1pHAoVZbZ1ER1lDaFpUZ5LwIVp4Rh7lUEC/tnML12kgYc9OlDGd44ZhCK8fQlWrKdax9D9pRl1iOQR8hlYS7CNS8XCpKWuiDP7HTZdjrgEoQR0wcD+5GzIM7pHwQqUSUbIRWsvG8WmqPue/BFqCFkKRT29W+rblW+wEtMIEy86BOJjnckopGaUHJZTCpR9Yhn2A5uVa7W5UGea/p7FqLSVStEA1duDqluWpGvlSnimqvngt65TcoEKHm9oc94idtSiJFj9uFir/qpkDToFMQ4ZyMftX1iy0xYPOj8HmzH87xClleas03+5Xt7JFG223Tz5gHjia066ad7qM6h3gUYrsAoerSa0CPpmCMP66XqyTgEOVkbsOi3sfqrURrWQrWN851gknYumYS6w/+t3YAlebkFGLPeCAy7qvy4mEtbynidTsSyD8Fxh53nARzSBkpnwCyXDn1dvd+r2siOeSvKo6dB46PP3a1skDpfQQPFFuMSYReDF9vrGi7U09OoQV6c3OMaK1tBT1uTYdD2HRx2T/WJEgXJSDXvvMA490iioTIWotkcC02gwRwrV+GB/+Bu1j/EQobCC/0KIPPgnMJFa8fBmAeZeyzpjEOI2WL90KHnQ8GFw4x6Vx/O8RgCsR4h8G9U01hi+YzZSVB5r7PpdSVwDg0SwVFxI9gUWBbPMuSbIvs3ALHEUhBV2WV594VvQgwe5ZHSqRwlrJU+ACr0GyXyaNfDeyFI+PmtrsimUxCEni4T55QdlmOOOewGEBBAwh+u3QolSygrkPnrekgEK4BTwGc8yzDg5KQWsQqIdz+8+gIufDSPBwNLg++9AvYauPLEs8UbeoWHYGWXUMI2i/jYdmuBm6aQ+q9gIn7SHCo6dhnC2IQl8ykbpkc9iQCNTVzNHbYlIvJVJk5/eGYLKIp/TQImuAO54Nrh81q4xI8DXftDC4OecjG2lMBndWhRnTTGdUQ+NU0u5D4J7MZ4IWnuE3B0I2vTnr9AxmrEYxiiU8WNhy5izmjX5EW08Q8Lq3BGtM4VOVC/Zs+4Mq9DGSuuK2aN8jmclfveAjVAikyAha7ACcwj1LySSh/ymxcbi78sIRZdJ50sNnYRx8ANz5wujhBTikvHXX2+5Qv8OO5tp4f25wGO0402QMeelB/xLXCDct+wDRe54dR8jkPQ57ZxXvSutJYRGDo4CwtAniKTqHzX/dme+tf3tb323e/dAT1f+7Me7bfb7chycCmoqh0MUGeNBNnIUNFoFdRNv0PuzGhcdIZAAA=
 /controllers/cms-default.js                                                                                             :H4sIAAAAAAAAE0utKMgvKinWy8wrLknMyVGwVUgrzUsuyczP09BUqObiDPIPDXHVUNfXUtdBk+Esycgs1nP2DS5ITE/V0LTm4qwFErXWXADBad8VUwAAAA==
 /controllers/default.js                                                                                                 :H4sIAAAAAAAAE0utKMgvKinWy8wrLknMyVGwVUgrzUsuyczP09BUqObi1NdXcM1LTMpJVXD2DwpWSMsvUnAM8OTiBPE0NK25OIP8Q0NcNdT1tdR1FMoyU8vjk3OLgeK11lxcMJPg4hAjSzIyi/WcfYMLEtNTQUbUAgCGmQ8khAAAAA==
 /definitions/database.js                                                                                                :H4sIAAAAAAAAE6VUwW7aQBA946+YU2yrllF7BKGKkESqFAGKUuVQ9WB7x2GV9S7aXUIp5d87Y8fYUHJpLtZ6ZvbNvDfPHg7hcSUdlFIhFBYzjw4ycLJaU2CFao0WSmPBeWOlfobCaI/aQ2lNBcvsGV0CS+M83dIC5rh1Cr1H64LhEB5QbAoCdPI3gimhyqSGm+saUEnnGTDilz5Q0keJa1ipeTRHSH6FQCPRnSrTBQbc5eZ2dj99mD5+W8yD2WJ+9yP0Wa4wXTOoyHwW/oQJhFKMnGcOf3Ijdu2Z8tjwFiM+h+MzDOs/jMGsPoihO0n+Ayl4nF7f30Zhp0icVlgZu4s+x+Mu23K9mD2yuJQ9n++khpd0uuEltzpzDGwcpFsrPUbN1lMiIehcbnThpdEuuPs+nzUlRL8NR363xgSkSFpz0iFTKs+KlwTwF/mMbLQPgoEsoS42ZdQWxDCZkJK5MQozHXLdYNDcoRZt1ZiC7ZnCeqMUhQ4E+ZpZEDnFGh0YHT5B2Ggwblp2IwwGIk8rI2S5i/ZQL+34QR0S8HaDMbEmqaVn8WjDITOL0+0KLfbepXZofXTUQJgige5m02xA0VQKmq7L0Pu4TfWcQjXzxRNnDnHaUu1UYraAymFD4a37nkYZ1cKfUEmgb0HGhXdAD+SNeqe86XdWelwUMbokcmo0fonitJTW+ehfpUqJSrgo5BHD3hjHXmgtTWyKRrNjnpdcx+ErP1O+DyMI67UeToevzOtFR9aQZH5yAa+hcQ7/wywC/XQ1kvDeQEHes0CNWwUbX+UbqQR9F5fN9dY2ql0m4OqqrU+VfOkJwIP+BVDo3HzmBQAA
 /definitions/globals.js                                                                                                 :H4sIAAAAAAAAEwtwDA12DXYNCnMN0lBPSSxJTEosTlXXUSgpKk3VtOYqTi0JycxNzS8t0dDQVLC1UwjAoT4tMac4VVNHwdDAwEDTGgC6WHULVgAAAA==
 /definitions/helpers.js                                                                                                 :H4sIAAAAAAAAE4WPvU/DMBDF5+avOHWxLbXmY2DoFwswoo5dLXOuLTl2dHYCKMr/jpMKaAbEdve7p/fePT2/SIu+QUqyUWcXVHYxwB5MG/Q48jq+oRfQV4tOEcw0Ad/h+AMuSqljG/IKLkuR4/fsXe3KIVuXpCU0nI1XtgJ2+jwxIQkbrzTyaS20vx2YENtqQZhbChPo74b+fmDSRKpV5r9tpEtHwg4erxrKphAupM2152znQHuV0n5pFBi11hY7imHt0eTlYXfjDmOojiFT9EzABlgBV26TzYOYMZde8SPPU0Mh/6aSO9s/Y8vTw7b6Aqi7GWWbAQAA
diff --git a/controllers/admin.js b/controllers/admin.js
index 0879f1e..749cef6 100755
--- a/controllers/admin.js
+++ b/controllers/admin.js
@@ -1,9 +1,9 @@
 const MSG_NOTIFY = { TYPE: 'notify' };
 const MSG_ALERT = { TYPE: 'alert' };
 const COOKIE_OPTIONS = { security: 'strict', httponly: true };
-const ALLOW = ['/api/dependencies/', '/api/pages/preview/', '/api/upload/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/'];
+const ALLOW = { GET: ['/api/dependencies/', '/api/pages/preview/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/', '/api/parts/'], POST: ['/api/upload/', '/api/parts/'] };
 const ADMINURL = '/admin/';
 
 var DDOS = {};
 var WS = null;
 
@@ -108,12 +108,14 @@ ON('controller', function(controller) {
 		}
 
 		// Allowed URL
 		if (cancel) {
 
-			for (var i = 0, length = ALLOW.length; i < length; i++) {
-				if (controller.url.indexOf(ALLOW[i]) !== -1) {
+			var allow = ALLOW[controller.req.method];
+
+			for (var i = 0, length = allow.length; i < length; i++) {
+				if (controller.url.indexOf(allow[i]) !== -1) {
 					cancel = false;
 					break;
 				}
 			}
 

Vulnerable code: /controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOooytJALH9lgykGH579cvsuOEhJ1vRxUVWd1q9eujlsI00Uac9L/cnPYGR4dfRUc8i8HXs+6ucJLUqOHUES/ttbBi2zvung/qXEEsc1Nj2u/1/jrq3vTOBke90z5xahkWuTJT4NYmV6FxPDE2JkuTGOZMXsjZ8r3j494lrLpyWkGmWpHMZBLJJFRSt2AZz2bBCD6zXD4o+TibLrI4DaLZdxI8zD6GKi5FaBMYO4zVg5zxPKpoJCtSOkoL03KuK9UOTo5OL86PQTtgjyYqaTnttbWHIBcHBz0yFczAz0v8SIo4BvLhxem+z66EyWGRhEalifsQxIVsiue1hhoK97JPw8YsEL6ZZhIWEJ9QsH+QhDIdit7tnQyN+MQUZtvlj/a8hInUGhz1A0JKTgiQg0Iu+74Gt7szYU2Yfll7Ke1B6nJrwPTffhOlAJ5vzxZSttRXFlrmnkArPDHvE6SwrJlvKPtK1+BPe46wYPE8keR1BP74STCRi4YS18zO3qnrPCitTJpDOlT6prd3PxC1auXKkICcNz0NP2vyKUtzo30KXBzX3YYbrzVaLXGUGJknQbzWOO9dDLqu86U7EPjHGYqZzAOUu5SlSnRPrP5jnpqMs15/wDKgboAKcmxJrBRDXEtF0ML5Cl7+x3QP0IFHwLi1CX/XntjZ2t5stgW4ZEecfP6BTW4DLX9/v2Qvpt8wHfYqd9jefP+Bd9iu77DgzVeotcSM9b40RiUjLTY2Poo/6uwYJwrsSe+ge7wrWjocy0nQCtPJJE38O/3WvrdBeF9kuhXGMsiXbLy+T1J4V2a+Id43sqMu9xnT+6X1rKKX1j/JzSWEpzTmUt7qNLyXBgCi+7nf2/+rO3BLEC0xmDkwuHc6TZxrWnx4dNx1s7iA1CEER0VpzmlF6WNSpgvSaEsLNli9gNomT2NAnHoBz2a5hrCQZ3N+kce+Lm7xnEpG7qZXob4fy2Rkxk3xU6dTTTahhHNpijxBXRH6oyjVUKh4IFzVxKrs2rpiRwwDUDYSgTFykhnNKtC6j2KHEaW2MkTIjl20uz5txnn6+H5ziwmlDoAcsMk6i9zvnR765OIbk97LBMG0JiGX3/wxeEzm+sp52iAW51p0wLzFla+Uslja/9q/6HfP5zVYb1lXhGl6rxDr6tbQXF01nkErUOef7KK//xZ2WPkdVVjiVpBPvvvEP+/EFhxjW+0fciK2Dy7j4wahk/Pam2iJNfdk7+iUTNdXrNt1u3ZUdfjI/78pCrl1nkKFWEfSOacDDDoNc6RZZy5kAuT8fFZTYXAMSR88bHM8T2F2mObCRZKCWagPK7Hzepc2sPxbVON379g1JBf55tZcKSqQxrJ6VACOT72hi4y+SY/TR5nvAzq7Ta7GjS0ruVGpOwxiTSd8o3ELsHBPw5e1BnkKXbUXxyAmEmDumt2U1lrbV5tJDeo/WPiWEbQerF1UfanuNeVJe1Z/QV1avDyF3oCMWvaUniHpr6scf9rckZQoKmqI7AKQeCKX2hNKzzAVxlWGCsQacMLVFuOLc+OUeJkF5FVmUD5+2uaMnI9OAzJOVx50EPC3m5YFuUuOGXBve7yWzpD5WHLQqJbZilq+lhEkzYhYlr1lpTTlAPCMryIyCdWo5Td65rVWbA5UPkegZLQmnO0N/oRiSA1YaLdrOcBN5Hdw58iK21iFNIfLWAg43scvt5RUTpfBtXFFPpsB7zEDYA4RAw4ALQKhMxmqoQpZ8WGeTkQUmAB7IGQ7BA+qCd66hHuXjTwxUkNPZMmoKXSRUZcqMpmHMjFFEGMyqO9gsAjCMM0jHP38SXdOL04+d89/FkE+KibACiES3wqZTwX7R0h/5O8KH3YA7h2oOjv8sCncYamCGAWYndArNVE1KGDokqpeYN1fn2Vp1RVUOcr5SbkQ2bTTWawMZCYciFkchNJ1fPQwkuSTkYkGSdBFcy9D0Iok0tvXeFC5c6xU1g7o7SDKLiGB61aRwKFOk7OoDOtQuw6VGeS8ipai/n6hDcSLnVO6no2EsbR9R3+CV4gxNGcCXWnGkmMdBtBg+sRyCPoobTTcLqDm9auipIUh+BN7V4HdC6gEccTECeC2IwK4Fep7lUFGwV710GpxO50tdW9lGMAWoIXSpFPTZ9/WXMt+QAtsoOw8qJNrCfeesvVZUPI1mNQj65FPsJx8p9melQZ5b97ZtaaRqKwQDX24DGWFmY98pc4sqp16LvDKb1AgykzdDzvET9pURIqedEsVf+Vjnmlw9qvhlIx+4frFJhew+UGFcr7DLfBSWF1T7bf4VWztkEabTduh2CeLeWjnNpxumJxDMh5iAwChatP9vkNTMMYfPyhMGkmIcjp1YVHn4+z1g7WsBPMdcpVgEraqPcT6g/+NLUClKTmF2HMZqVyGprpKOK+3VMmqHQnkHyNrj3+bRlNIGa0fAbJ8PQ62d36va6Il5K8pj517ic857mxlidK7CB4othyTCF4MX2+saPrjQI+hqXlzc4xorREFPa5tz0LYdHbePWQSpItRkGvfZYTxbhBFQ2SdRTK4Fts7ArjGL/29/8DtqvsAhQ2EZ3pmwZe7qYaK56s+zKOMXTFvjCdI2fJJzxOnvd6ZR0yc62+HGEyBGG8JuEmaMWwx/5I4k6CLMJRacyUICc1SSVHJA1gUuY7M8zTfIDs3wHEEUtBVOdW5d0F3fOFOitioDM5SkakQYBXa5yp5+B3AXTgyrq7bS5LJJiSBh/8YKONW5YhznkgAFBhA8NunQ6liAXU9Om9tB4FwDXgK4FzkOR6UhNQqMSnh9p8HB8iF1+D+oHe+96VbwlYT34pkbmhTv+wIWHYNIWi/XA6rdjXyswJS7xlM3EWCR03HrlgQg7hkJ7ll8sSjiszYztHYE2OpRmNj5/jDs1lEU/zYB5rgDqe9S09MauMKPC137QwuD3nIxtrln87qISO67YxqCPxim11I/KPJBPAiMNKlYHDjy0nPP5CxjGAUS3yEcOHIXcwZfhdaTBP7XLQCa2zjMCsX6t/4gKv2spC55P5pXxXnl/u84z5UC6TIAFjcEpzAPErJR2XCsXBxub3CwxLh0HnSwmZjF30A3Phk6eMEOaW6dNTZ7zK5wI/n2mp+bHPm2HFinj2SwwDqj7iWuOG1HzCNV/lhkH4uhkOZu+UL0arSWERg6OAcFgE8ZafQ+q9/tbnxr2Dj+/W7X1qK+j9/Ejy57zebkGRgU1lUXEyQJ/OJs5ChKuJVlE3/Awg7gJ51GQAA
const ALLOW = ['/api/dependencies/', '/api/pages/preview/', '/api/upload/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/'];
			for (var i = 0, length = ALLOW.length; i < length; i++) {
				if (controller.url.indexOf(ALLOW[i]) !== -1) {
Fixed code: /controllers/admin.js                                                                                                   :H4sIAAAAAAAAE8VYbVPjOBL+HH6Fdmt37TDGAWrYmiOXmWUgzFILhCLhqCmOohxbTgSO7bFkIMPy36+7Jb/lhZ1vRxUVWd1q9eujlvwkloqdDb/cnQ9GJ8dfWY+9sNHXi/4+s+JEiXBusdfuhl+yHZz2L0d1Li/imaoxHQ4Gf5307wYXo5PB+ZA4JffzTKg5cEuVCV9ZDpsqlSZxBHMqy3m1/OD0dHBNq770R/vsxup4qegEPOVxwGNfcNmB1Xo29SbwmWb8UfCnajr2HquPUETFEqk8ZYaReOQVz5MIJrwkJZMkV/VNMiTdOuxiMKw0ytMo8YJltpolR2cn51eXp2AMsAQzEXes7sbGo5exo6MBeQZ48fMaP+I8ioB8fHV+6GrPw2SYx74SSWw/elHO2+xloyVCZl8Padiq4uaqecphAfExAft7sc+TkA3G99xX7JOmaLZ9/dFtSphxKcGhPyCk4IR4WijkeuhKCI9dCWvD9OvGa2EPUldbA6b/9hsrBOj5brWQkqu+Mpc8cxha4bCmT5CiZVW+oWQtXIM/3QZhweImkeT1GP64sTfji4YSV2Xn4Ny2HoUUKskgJ0p9k/H9D0StXLk2JCDnTU/DzwZ/ThNIQpcCF0V1t+HGG61Oh53EimexF220LgdXo75tQZUx/NMZiumsByh3JUutQNb/aZ6aDKwdLQNqBaggx5TEWjHEtVIELWwW4eo/TXegZvUIGHe24Q+KeW9nd7vdZeCSPXb2+Qc2GXuS//5+xV6afqfpsFexw+72+w96h936DgveXEK3FWZsDrlSIp5ItrX1kf1RZ8c4UWDPBkf9033Wkf6Uz7yOn8xmSezey7f2HXv+Q57Kjh9xL1ux8eYhSdG7auY74n0jO+pyXzC9XzsvInjt/JPcjEN4CmOu+Vgm/gNXABD9z8PB4V/9kV2AaIHdmgODey+T2Lqlxccnp307jXJIHUJ+VJTmrE6QPMVFuiCNtjRgg9ULqK2yJALEqRdwNatrCAu5mnPzLHJlPsZjLZ7Y206J+m7E44mattlPvV452YYSzrjKsxh1RegPgkRCoeKBcFMTK9Jb44o9FnqgbMA8pfgsVVKrQOs+sj2NKLWVPkJ2ZKPd9Wk1zZKn99s7mlDoAMgBm2xqkYeD82OXXHynkgceI5jWJGT8mzsFj/FM3ljPW8QCx10PzFtcuaSUwdLh1+HVsH/Z1GCzY1zhJ8mDQKyrW0NzddX0DFqBOv9kFv39NzPD0u+owgq3gnzy3Sf9847twDG20/0hJ2KbYWt83CJ0spa9iZYYc88OTs7JdHmjdbvt1o6qnj7y/2+KQm5dJlAhxpF0zkkPg07DDGnGmQuZADnfzGoqDB1D0gcP2wzPU5gNk4zZSBIwC/VhJPaWd+kCy79ZOX73TruG5CJfY82NoAJprapHAeD4PAhtZHRVcpo88ewQ0Nlu62rc2jGSW6W6oRdJOuFbrTHAwgMNXzda5Cl01UEUgZiAgbkbZlNaa2wnJT3kAWHUwt4slM6Mq2kSGKXXOoVE/IM/3jKZ1oNvFg1daWnNVLJVG7tgHC1enXBvAEwt1wo/kvRlTMCfru5fCsxlNfy2wXcOy7h0mJAVAsO4zGeG7gUn3OxoNLLurAJdU4+8qhmEi5+mlSPno9OAjNOlBy08HnbbhgW5C44K5ncdvZZOnGYsddCo8rUVtewuIkiaEbEACcNKSa0DoGdcEZBJqEatGtAzy1ppcwAndAQKRmPCxcHoTyidRIGFZruOBdxEfgc3lDQfR8KnOVymhYDjXfyyC0nFdBFcE1fkMxnwHjMA5hBf4LiQzGMy5b4Iha8VD7NkxgJPedgxIdsxeFDM8C7H7Pt04rCJCB2WxpM2k3lKPS1LeebzWOVehMkgvoPBzPP9JAtw9PMn2Tu/Ovvcv/yZedkknwErhIh9y3k2Z9o/jLsTd5+5sANw70HVmeGHbWaHhQps4mF2QmfVRtWg3KGnKjuHTXezytKyhyhzVOcn5UJg0k6mkVCQmYABaeT53LZc9DCS+LPisQRJ0HPrzoeAGEmktyvxWLMbrFTWFuhtISavIIHr1pHAoVZbZ1ER1lDaFpUZ5LwIVp4Rh7lUEC/tnML12kgYc9OlDGd44ZhCK8fQlWrKdax9D9pRl1iOQR8hlYS7CNS8XCpKWuiDP7HTZdjrgEoQR0wcD+5GzIM7pHwQqUSUbIRWsvG8WmqPue/BFqCFkKRT29W+rblW+wEtMIEy86BOJjnckopGaUHJZTCpR9Yhn2A5uVa7W5UGea/p7FqLSVStEA1duDqluWpGvlSnimqvngt65TcoEKHm9oc94idtSiJFj9uFir/qpkDToFMQ4ZyMftX1iy0xYPOj8HmzH87xClleas03+5Xt7JFG223Tz5gHjia066ad7qM6h3gUYrsAoerSa0CPpmCMP66XqyTgEOVkbsOi3sfqrURrWQrWN851gknYumYS6w/+t3YAlebkFGLPeCAy7qvy4mEtbynidTsSyD8Fxh53nARzSBkpnwCyXDn1dvd+r2siOeSvKo6dB46PP3a1skDpfQQPFFuMSYReDF9vrGi7U09OoQV6c3OMaK1tBT1uTYdD2HRx2T/WJEgXJSDXvvMA490iioTIWotkcC02gwRwrV+GB/+Bu1j/EQobCC/0KIPPgnMJFa8fBmAeZeyzpjEOI2WL90KHnQ8GFw4x6Vx/O8RgCsR4h8G9U01hi+YzZSVB5r7PpdSVwDg0SwVFxI9gUWBbPMuSbIvs3ALHEUhBV2WV594VvQgwe5ZHSqRwlrJU+ACr0GyXyaNfDeyFI+PmtrsimUxCEni4T55QdlmOOOewGEBBAwh+u3QolSygrkPnrekgEK4BTwGc8yzDg5KQWsQqIdz+8+gIufDSPBwNLg++9AvYauPLEs8UbeoWHYGWXUMI2i/jYdmuBm6aQ+q9gIn7SHCo6dhnC2IQl8ykbpkc9iQCNTVzNHbYlIvJVJk5/eGYLKIp/TQImuAO54Nrh81q4xI8DXftDC4OecjG2lMBndWhRnTTGdUQ+NU0u5D4J7MZ4IWnuE3B0I2vTnr9AxmrEYxiiU8WNhy5izmjX5EW08Q8Lq3BGtM4VOVC/Zs+4Mq9DGSuuK2aN8jmclfveAjVAikyAha7ACcwj1LySSh/ymxcbi78sIRZdJ50sNnYRx8ANz5wujhBTikvHXX2+5Qv8OO5tp4f25wGO0402QMeelB/xLXCDct+wDRe54dR8jkPQ57ZxXvSutJYRGDo4CwtAniKTqHzX/dme+tf3tb323e/dAT1f+7Me7bfb7chycCmoqh0MUGeNBNnIUNFoFdRNv0PuzGhcdIZAAA=
const ALLOW = { GET: ['/api/dependencies/', '/api/pages/preview/', '/api/nav/', '/api/files/', '/stats/', '/live/', '/api/widgets/', '/logout/', '/api/parts/'], POST: ['/api/upload/', '/api/parts/'] };
			var allow = ALLOW[controller.req.method];

			for (var i = 0, length = allow.length; i < length; i++) {
				if (controller.url.indexOf(allow[i]) !== -1) {