[security issue] unauthorized users accessing the server dashboard.

[Karl Blixt 8]

Hi, so I was setting up some users and I found that by simply manually typing in the url emby.mydomain.com/web/index.html#!/dashboard.html I was able to get to the server's dashboard as a user without admin privileges. I was unable to actually save any changes and actually make some changes. But there are some things that are stored in plain text that is potentially sensitive. the emby premium key for example. 

 

now, I don't have any users sophisticated enough to abuse this and I certainly don't have any hostile users which I doubt anyone have. but I really think that this should be addressed.

[Luke 42077]

Thanks, we'll take a look.