[webui] make sure to check if source access is allowed in #show