From c8757aa682bc2462feb45e556180c87a11c5e5d5 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Mon, 21 Oct 2019 10:52:59 +0200
Subject: [minilinux] Add missing permissions checks

---
 modules-available/minilinux/page.inc.php | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'modules-available/minilinux/page.inc.php')

diff --git a/modules-available/minilinux/page.inc.php b/modules-available/minilinux/page.inc.php
index 7c7e3d36..11998aad 100644
--- a/modules-available/minilinux/page.inc.php
+++ b/modules-available/minilinux/page.inc.php
@@ -252,6 +252,7 @@ class Page_MiniLinux extends Page
 
 	private function updateSources()
 	{
+		User::assertPermission('view'); // As it doesn't really change anything, accept view permission
 		$ret = MiniLinux::updateList();
 		if ($ret > 0) {
 			sleep(2);
@@ -261,6 +262,7 @@ class Page_MiniLinux extends Page
 
 	private function setDefault()
 	{
+		User::assertPermission('update');
 		$versionid = Request::post('version', false, 'string');
 		if ($versionid === false) {
 			Message::addError('main.parameter-missing', 'versionid');
-- 
cgit v1.2.3-55-g7522