[ss-2015-028] Block unauthenticated access to dev/build/defaults

silverstripe · Feb 23, 2016 · 5d2fc0d · 5d2fc0d
1 parent f323025
commit 5d2fc0d
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/dev/DevelopmentAdmin.php b/dev/DevelopmentAdmin.php
@@ -34,8 +34,9 @@ public function init() {
 		parent::init();
 
 		// Special case for dev/build: Defer permission checks to DatabaseAdmin->init() (see #4957)
-		$requestedDevBuild = (stripos($this->request->getURL(), 'dev/build') === 0);
-
+		$requestedDevBuild = (stripos($this->getRequest()->getURL(), 'dev/build') === 0)
+			&& (stripos($this->getRequest()->getURL(), 'dev/build/defaults') === false);
+
 		// We allow access to this controller regardless of live-status or ADMIN permission only
 		// if on CLI.  Access to this controller is always allowed in "dev-mode", or of the user is ADMIN.
 		$canAccess = (