json call for list addresses now need the password as GET/POST parameter

HaschekSolutions · Dec 2, 2023 · f8578d6 · f8578d6
1 parent 0858fcb
commit f8578d6
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/web/inc/OpenTrashmailBackend.class.php b/web/inc/OpenTrashmailBackend.class.php
@@ -78,7 +78,7 @@ public function run(){
             header("Content-Type: application/json; charset=UTF8");
             if($this->url[1]=='listaccounts')
             {
-                if($this->settings['SHOW_ACCOUNT_LIST'])
+                if($this->settings['SHOW_ACCOUNT_LIST'] && (($this->settings['ADMIN_PASSWORD'] != "" && $_REQUEST['password']==$this->settings['ADMIN_PASSWORD'])|| !$this->settings['ADMIN_PASSWORD']))
                     return json_encode(listEmailAdresses());
                 else exit(json_encode(['error'=>'403 Forbidden']));
             }