From f0495cdedc8f0c1f57651d0f878d1387919f1adb Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Sat, 11 May 2019 10:40:23 +0200
Subject: [PATCH] system: only show crash reports to admins

We could check admin or page access rights, but in the end we just
want to avoid showing a banner that links to a page that is not
accessible in 99% of the cases if specific dashboard access was
granted.
---
 src/www/guiconfig.inc | 4 ++++
 src/www/index.php     | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/www/guiconfig.inc b/src/www/guiconfig.inc
index 1882b71aa..38ac08ed4 100644
--- a/src/www/guiconfig.inc
+++ b/src/www/guiconfig.inc
@@ -473,6 +473,10 @@ date_default_timezone_set($timezone);
 
 function get_crash_report($pedantic = false)
 {
+    if (!userIsAdmin($_SESSION['Username'])) {
+        return;
+    }
+
     $savemsg = sprintf(
         gettext('A problem was detected. Click %shere%s for more information.'),
         '<a href="/crash_reporter.php">',
diff --git a/src/www/index.php b/src/www/index.php
index cbd09b352..a89d81fef 100644
--- a/src/www/index.php
+++ b/src/www/index.php
@@ -332,7 +332,7 @@ include("fbegin.inc");?>
 <?php
           print_service_banner('livecd');
           $crash_report = get_crash_report();
-          if ($crash_report != '') {
+          if (!empty($crash_report)) {
               print_info_box($crash_report);
           }?>
         </div>