Skip to content

Commit 0d61417

Browse files
committed
Addresses security flaw allowing unauthenticated access to server overview.
1 parent 02458c9 commit 0d61417

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

app/Models/Server.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,9 @@ public function __construct()
113113
*/
114114
public static function byUuid($uuid)
115115
{
116-
$query = self::with('service', 'node')->where('uuidShort', $uuid)->orWhere('uuid', $uuid);
116+
$query = self::with('service', 'node')->where(function ($q) use ($uuid) {
117+
$q->where('uuidShort', $uuid)->orWhere('uuid', $uuid);
118+
});
117119

118120
if (! Auth::user()->isRootAdmin()) {
119121
$query->whereIn('id', Auth::user()->serverAccessArray());

0 commit comments

Comments
 (0)