Fixed issue: [security]Admin user without permissions can still see p…

…lugins page - kindly reported by Pavol Michalec & Frederik Koľbík
LimeSurvey · Aug 27, 2019 · c3f0156 · c3f0156
1 parent 287e52e
commit c3f0156
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/application/controllers/admin/PluginManagerController.php b/application/controllers/admin/PluginManagerController.php
@@ -14,6 +14,10 @@ public function init()
      */
     public function index()
     {
+        if (!Permission::model()->hasGlobalPermission('settings', 'read')) {
+            Yii::app()->setFlashMessage(gT("No permission"), 'error');
+            $this->getController()->redirect(array('/admin'));
+        }        
         $oPluginManager = App()->getPluginManager();
 
         // Scan the plugins folder.
@@ -73,10 +77,6 @@ function ($installedPlugin) {
         $aData['fullpagebar']['returnbutton']['text'] = gT('Return to admin home');
         $aData['data'] = $data;
         $this->_renderWrappedTemplate('pluginmanager', 'index', $aData);
-        if (!Permission::model()->hasGlobalPermission('settings', 'read')) {
-            Yii::app()->setFlashMessage(gT("No permission"), 'error');
-            $this->getController()->redirect(array('/admin'));
-        }
     }
 
     /**