BUG-14986 Authorization Bypass via Forceful Browsing IMPROVEMENT

workflow/engine/methods/setup/pluginsMain.php

@@ -21,6 +21,8 @@
  * For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
  * Coral Gables, FL, 33134, USA, or email info@colosa.com.
  */
+global $RBAC;
+$RBAC->requirePermissions( 'PM_SETUP' );
 
 $headPublisher = & headPublisher::getSingleton();
 $headPublisher->addExtJsScript( 'setup/pluginsMain', false );