From: Jaroslav Kysela <perex@perex.cz>
Date: Fri, 9 Oct 2015 06:17:17 +0000 (+0200)
Subject: DVR: fix the access/entry/userlist for non-admin users, fixes #3100
X-Git-Tag: v4.2.1~1960
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ba732b47275fa5cc11e0314ae57212bbef24303a;p=thirdparty%2Ftvheadend.git

DVR: fix the access/entry/userlist for non-admin users, fixes #3100
---

diff --git a/src/api/api_access.c b/src/api/api_access.c
index 6de6a1a33..f31ef6413 100644
--- a/src/api/api_access.c
+++ b/src/api/api_access.c
@@ -100,6 +100,10 @@ api_access_entry_userlist
   htsmsg_t        *l, *e;
 
   l = htsmsg_create_list();
+
+  if (!access_verify2(perm, ACCESS_ADMIN))
+    goto empty;
+
   if ((is = idnode_find_all(&access_entry_class, NULL))) {
     for (i = 0; i < is->is_count; i++) {
       in = is->is_array[i];
@@ -122,6 +126,7 @@ api_access_entry_userlist
     free(is);
   }
 
+empty:
   *resp = htsmsg_create_map();
   htsmsg_add_msg(*resp, "entries", l);
 
@@ -168,7 +173,7 @@ void api_access_init ( void )
     { "ipblock/entry/create", ACCESS_ADMIN, api_ipblock_entry_create, NULL },
 
     { "access/entry/class",  ACCESS_ADMIN, api_idnode_class, (void*)&access_entry_class },
-    { "access/entry/userlist", ACCESS_ADMIN, api_access_entry_userlist, NULL },
+    { "access/entry/userlist", ACCESS_ANONYMOUS, api_access_entry_userlist, NULL },
     { "access/entry/grid",   ACCESS_ADMIN, api_idnode_grid,  api_access_entry_grid },
     { "access/entry/create", ACCESS_ADMIN, api_access_entry_create, NULL },