Fixed isssue #19500: [security] As a non super admin, I can still acc…

…ess phpinfo page (#3801) Co-authored-by: lapiudevgit <devgit@lapiu.biz>
LimeSurvey · Apr 12, 2024 · 4cc6e2c · 4cc6e2c
1 parent a1c67f9
commit 4cc6e2c
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/application/controllers/admin/globalsettings.php b/application/controllers/admin/globalsettings.php
@@ -58,9 +58,10 @@ public function index()
      */
     public function showphpinfo()
     {
-        if (!Yii::app()->getConfig('demoMode')) {
-            phpinfo();
+        if (Yii::app()->getConfig('demoMode') || !Permission::model()->hasGlobalPermission('superadmin', 'read')) {
+            throw new CHttpException(403, gT("You do not have permission to access this page."));
         }
+        phpinfo();
     }
 
     /**