Respect the RPC-only setting for users

fastrpc.cgi

@@ -4,6 +4,7 @@
 # client. From then on, direct TCP connections can be made to this port
 # to send requests and get replies.
 
+$main::allow_rpc_only = 1;
 BEGIN { push(@INC, "."); };
 use WebminCore;
 use POSIX;

lang/en

@@ -270,6 +270,7 @@ sday_6=Sa
 emodule=Access denied : User $1 is not allowed to use the $2 module
 emodulecheck=The $1 module is not available on your system
 elock_tries2=Failed to lock file $1 after $2 minutes. Last error was : $3
+erpconly=Webmin user is for RPC calls only
 
 skill_high=Expert
 skill_medium=Intermediate

rpc.cgi

@@ -4,8 +4,9 @@
 # other webmin servers. State is preserved by starting a process for each
 # session that listens for requests on a named pipe (and dies after a few
 # seconds of inactivity)
-# access{'rpc'}  0=not allowed 1=allowed 2=allowed if root or admin
+# access{'rpc'}  0=not allowed 1=allowed 2=allowed if root or admin, 3=allowed
 
+$main::allow_rpc_only = 1;
 BEGIN { push(@INC, "."); };
 use WebminCore;
 use POSIX;

web-lib-funcs.pl

@@ -5759,6 +5759,16 @@ if ($module_name && !$main::no_acl_check &&
 	$main::no_acl_check++;
 	}
 
+if (!$main::allow_rpc_only &&
+    $main::webmin_script_type eq 'web' &&
+    !$main::no_acl_check &&
+    !defined($ENV{'FOREIGN_MODULE_NAME'})) {
+	# Check if this user is RPC-only
+	if (&webmin_user_can_rpc() == 2) {
+		&error($text{'erpconly'});
+		}
+	}
+
 # Check the Referer: header for nasty redirects
 my @referers = split(/\s+/, $gconfig{'referers'});
 my $referer_site;
@@ -13752,12 +13762,14 @@ return &globals('delete', $variable, $scope);
 }
 
 # webmin_user_can_rpc()
-# Returns 1 if the given user can make remote calls
+# Returns 1 if the given user can receive remote calls, 0 if not, or 2 if the
+# user can receive remote calls but not use the UI
 sub webmin_user_can_rpc
 {
 my $u = $base_remote_user;
 my %access = &get_module_acl($u, "");
 return 1 if ($access{'rpc'} == 1);	# Can make arbitrary RPC calls
+return 2 if ($access{'rpc'} == 3);	# Can only make RPC calls
 return 0 if ($access{'rpc'} == 0);	# Cannot make RPCs
 
 # Assume that standard admin usernames