[Security] Any user can edit RemoteApps

[sashaqwert]

I have several accounts without administrator rights. Some of these accounts do not have RDP access and have a very simple password.

I decided to try to log into the Web interface under such an account and was able to edit the RemoteApp list (as if I were an administrator).

---

Please add a check for user rights so that users without administrator rights can only download RDP files and use the WEB channel.

[kimmknight]

Correct. The authentication does not check the user's group membership.

This most certainly needs to go on the todo list!

Ideally, I'd like it to check whether the user is a member of either:

Administrators
Remote Desktop Users

[boyfromgermany]

Correct. The authentication does not check the user's group membership.

This most certainly needs to go on the todo list!

Ideally, I'd like it to check whether the user is a member of either:

Administrators Remote Desktop Users

please allow to specify a seperate group