Skip to content

Require admin user role for all admin module functions

Make all files to edit or delete configurations in the admin module accessible to the admin user only. This change is in response to:

https://ssd-disclosure.com/ssd-advisory-ispconfig-authenticated-remote-code-execution/

While assigning the admin module to a user is a security setting on its own, we will change the default now to require admin module permission and be an admin user to edit settings. There is no good reason to assign the admin module to non-admin users. In the above case, a superadmin user created another superadmin user (a remote user is a user with superadmin privileges) to create another admin user. So there was no security breach here, as properly authenticated users with administrative privileges were used to create other users with administrative privileges.