Add new option for RPC-only mode, and a help page

acl/edit_user.cgi

@@ -370,10 +370,11 @@ elsif ($miniserv{'twofactor_provider'}) {
 
 # Can accept RPC calls?
 if ($access{'acl'} && !$safe) {
-	print &ui_table_row($text{'acl_rpc'},
+	print &ui_table_row(&hlink($text{'acl_rpc'}, 'rpc'),
 		&ui_radio("rpc", int($uaccess{'rpc'}),
 			  [ [ 1, $text{'acl_rpc1'} ],
 			    $uaccess{'rpc'} == 2 ? ( [ 2, $text{'acl_rpc2'} ] ) : ( ),
+			    [ 3, $text{'acl_rpc3'} ],
 			    [ 0, $text{'acl_rpc0'} ] ]));
 	}
 

acl/help/rpc.html

@@ -0,0 +1,14 @@
+<header>Can accept RPC calls?</header>
+
+This option determines if the user can make use of Webmin's poweful RPC calls
+feature, which is designed to allow this system to be controlled by a script
+or other Webmin server via HTTP. Because the RPC feature does <b>not</b>
+respect any module grants or fine-grained access controls, this option should
+only be enabled for fully trusted <tt>root</tt>-equivalent users. <p>
+
+In addition, if the <b>RPC calls only</b> option is selected, the user will not
+be able to use the Webmin UI. This is useful for creating a separate login with
+a longer password for RPC purposes only, as two-factor authentication cannot be
+used when making RPC calls. <p>
+
+<footer>

lang/en

@@ -216,6 +216,7 @@ acl_gedit_gid=Groups with GIDs in range
 acl_rpc=Can accept RPC calls?
 acl_rpc2=Only for <tt>root</tt> or <tt>admin</tt>
 acl_rpc1=Yes
+acl_rpc3=RPC calls only
 acl_rpc0=No
 acl_readonly2=User is in demo mode?
 acl_readonlyyes=Yes (Some modules may not be available)