--- auth.inc.php        2016-12-30 08:02:19.382921109 +0100
+++ new 2016-12-30 08:05:34.326913374 +0100
@@ -13,14 +13,27 @@

 if (!is_array($vars['id'])) { $vars['id'] = array($vars['id']); }

-$auth = TRUE;
+$is_permitted = FALSE;

 foreach ($vars['id'] as $port_id)
 {
-  if (!$auth && !port_permitted($port_id))
-  $auth = FALSE;
+  if (is_numeric($port_id) && port_permitted($port_id))
+  {
+    $is_permitted = TRUE;
+  } else {
+    $is_permitted = FALSE;
+    // Bail on first reject.
+    break;
+  }
 }

-$title = "Multi Port :: ".count($vars['id'])." ports :: ";
+if ($auth || $is_permitted)
+{
+  $title = "Multi Port :: ".count($vars['id'])." ports :: ";
+  // Update $auth with permission check.
+  $auth = TRUE;
+}
+
+unset($is_permitted);

 // EOF