pfSense: pfSense-SA-19_07.webgui: Privilege Escalation in the WebGUI

The privileges for access to the dashboard (page-dashboard-all) and for direct
access to dashboard widgets (page-dashboard-widgets) contained a match clause
for widget files with a leading wildcard. This allowed the URL to be manipulated
in a way which could have been used to gain elevated privileges.

Authenticated users with these privileges could access pages for which they had
not been granted access by appending a string to the URL ending in
".widget.php", for example: https://x.x.x.x/diag_backup.php?a.widget.php

Authenticated users could have used this behavior to gain elevated privileges
and perform actions allowed by any page in the WebGUI.