I have setup the access section with this:
<access>
<policy>deny</policy>
<allow>
<enabled>true</enabled>
<comment>localhost</comment>
<profiles></profiles>
<ip>127.0.0.1</ip>
<pamauth>false</pamauth>
<username>yop</username>
<password>yop</password>
<access>config</access>
<bypass></bypass>
</allow>
</access>
I was thinking that with this setup, I can only access
the web interface, and nothing else. But I can browse
the web too. It shouldn't work, because I didn't
checked the "Proxy requests" and "HTTP requests" options.
Logged In: YES
user_id=432781
Yikes... that's a nasty bug :)
Ok, fixed in CVS... I forgot to reset the bitmask to 0, causing unset
values to never lose their bits.