amorfo77/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-10-24 03:28:54 +00:00
Code Issues Projects Releases Wiki Activity

[Web] Restrict read-only API sessions

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-10-23 11:21:45 +02:00
1 parent 40488b2120
commit 4828f0cf64
2 files changed
+8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/inc/ajax/container_ctrl.php
+4
View File
@@ -10,6 +10,10 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
exit();
}
// Read-only API keys must not control containers
if (!empty($_SESSION['mailcow_cc_api']) && ($_SESSION['mailcow_cc_api_access'] ?? '') != 'rw') {
exit();
}
if (preg_match('/^[a-z\-]{0,}-mailcow/', $_GET['service'])) {
if ($_GET['action'] == "start") {