michield/phplist — pull request #15 by FireFoxIXI (2013-11-21 14:46:20+00:00)
Title: Proposed fix for plugin rights management

Added 2 new public variables for plugins:
* rightsRequired
* dontRequireSuperuser

This should fix a security-bypass. This security-bypass allows an authenticated admin to access
a plugin via the direct url, example:

http://www.example.com/lists/admin/?page=main&pi=MessageStatisticsPlugin

Further, this should allow updated plugins to be served to non superusers and
grant access to updated plugins with the rights as defined under "Manage administrators".

Example :

class MessageStatisticsPlugin extends phplistPlugin
{
public $rightsRequired = 'statistics';
...
}