pfSense: pfSense-SA-19_08.webgui: Privilege Escalation in the WebGUI

When testing if a privilege matches a requested page, the path to the filename
was not fully resolved before the check was performed. This allowed a directory
traversal style attack to bypass privilege checks and gain elevated privileges.

An authenticated user with access to a page in the WebGUI could have used a
directory traversal style attack to access other pages for which they did not
have access, gaining elevated privileges.

For example, a user granted access to "a.php" could have gained access to
"b.php" by submitting a request for "a.php/../b.php". The privilege system
matched "a.php" but the WebGUI served "b.php" to the client.

Note that most browsers and HTTP clients will not allow this type of URL, so
attacks are limited to clients such as cURL (using --path-as-is) or special
purpose proxies which allow these requests.