diff --git a/application/libraries/Api.php b/application/libraries/Api.php index bc60d542e7..863e881d92 100644 --- a/application/libraries/Api.php +++ b/application/libraries/Api.php @@ -77,7 +77,9 @@ public function auth() $password = $_SERVER['PHP_AUTH_PW']; - if ( ! $this->CI->accounts->check_login($username, $password)) + $userdata = $this->CI->accounts->check_login($username, $password); + + if (empty($userdata['role_slug']) || $userdata['role_slug'] !== DB_SLUG_ADMIN) { throw new RuntimeException('The provided credentials do not match any admin user!', 401, 'Unauthorized'); }