bug fix (#5062)

openemr · Mar 30, 2022 · 3af1f4a · 3af1f4a
1 parent 5e30306
commit 3af1f4a
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/...ce/modules/zend_modules/module/Installer/src/Installer/Controller/InstallerController.php b/...ce/modules/zend_modules/module/Installer/src/Installer/Controller/InstallerController.php
@@ -24,6 +24,7 @@
 use Application\Listener\Listener;
 use Installer\Model\InstModuleTable;
 use Laminas\Db\Adapter\Adapter;
+use OpenEMR\Common\Acl\AclMain;
 use OpenEMR\Common\Utils\RandomGenUtils;
 use Laminas\Console\Request as ConsoleRequest;
 use OpenEMR\Services\Utils\SQLUpgradeService;
@@ -90,6 +91,11 @@ public function getInstallerTable(): InstModuleTable
 
     public function registerAction()
     {
+        if (!AclMain::aclCheckCore('admin', 'manage_modules')) {
+            echo xlt('Not Authorized');
+            exit;
+        }
+
         $status = false;
         $request = $this->getRequest();
         if (method_exists($request, 'isPost')) {
@@ -133,6 +139,11 @@ public function registerAction()
 
     public function manageAction()
     {
+        if (!AclMain::aclCheckCore('admin', 'manage_modules')) {
+            echo json_encode(["status" => xlt('Not Authorized')]);
+            exit;
+        }
+
         $outputToBrowser = '';
         $request = $this->getRequest();
         $status = $this->listenerObject->z_xlt("Failure");