Skip to content

Commit 207e013

Browse files
schrejschrej
committed
Merge branch 'develop' of github.com:Pterodactyl/Panel into improve-password-reset
2 parents 142cbb0 + 1f0e957 commit 207e013

File tree

18 files changed

+414
-828
lines changed

18 files changed

+414
-828
lines changed

‎CHANGELOG.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,17 @@ This file is a running track of new features and fixes to each version of the pa
33

44
This project follows [Semantic Versioning](http://semver.org) guidelines.
55

6+
## v0.6.0-pre.8 (Courageous Carniadactylus)
7+
### Fixed
8+
* `[pre.7]` — Fixes bug with subuser checkbox display.
9+
* `[pre.7]` — Fixes bug with injected JS that was causing `<!DOCTYPE html>` to be ignored in templates.
10+
* `[pre.7]` — Fixes exception thrown when trying to delete a node due to a misnamed model.
11+
12+
### Changed
13+
* Subuser permissions are now stored in `Permission::list()` to make views way cleaner and make adding to views significantly cleaner.
14+
* `[pre.7]` — Sidebar for file manager now is a single link rather than a dropdown.
15+
* Attempting to reset a password for an account that does not exist no longer returns an error, rather it displays a success message. Failed resets trigger a `Pterodactyl\Events\Auth\FailedPasswordReset` event that can be caught if needed to perform other actions.
16+
617
## v0.6.0-pre.7 (Courageous Carniadactylus)
718
### Fixed
819
* `[pre.6]` — Addresses misconfigured console queue that was still sending data way to quickly thus causing the console to explode on some devices when large amounts of data were sent.

‎app/Events/Auth/FailedPasswordReset.php‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?php
2+
/**
3+
* Pterodactyl - Panel
4+
* Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in all
14+
* copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
24+
25+
namespace Pterodactyl\Events\Auth;
26+
27+
use Illuminate\Queue\SerializesModels;
28+
29+
class FailedPasswordReset
30+
{
31+
use SerializesModels;
32+
33+
/**
34+
* The IP that the request originated from.
35+
*
36+
* @var string
37+
*/
38+
public $ip;
39+
40+
/**
41+
* The email address that was used when the reset request failed.
42+
*
43+
* @var string
44+
*/
45+
public $email;
46+
47+
/**
48+
* Create a new event instance.
49+
*
50+
* @param string $ip
51+
* @param string $email
52+
* @return void
53+
*/
54+
public function __construct($ip, $email)
55+
{
56+
$this->ip = $ip;
57+
$this->email = $email;
58+
}
59+
}

‎app/Http/Controllers/Auth/ForgotPasswordController.php‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,33 @@
11
<?php
2+
/**
3+
* Pterodactyl - Panel
4+
* Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in all
14+
* copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
224

325
namespace Pterodactyl\Http\Controllers\Auth;
426

27+
use Illuminate\Http\Request;
28+
use Illuminate\Support\Facades\Password;
529
use Pterodactyl\Http\Controllers\Controller;
30+
use Pterodactyl\Events\Auth\FailedPasswordReset;
631
use Illuminate\Foundation\Auth\SendsPasswordResetEmails;
732

833
class ForgotPasswordController extends Controller
@@ -29,4 +54,21 @@ public function __construct()
2954
{
3055
$this->middleware('guest');
3156
}
57+
58+
/**
59+
* Get the response for a failed password reset link.
60+
*
61+
* @param \Illuminate\Http\Request
62+
* @param string $response
63+
* @return \Illuminate\Http\RedirectResponse
64+
*/
65+
protected function sendResetLinkFailedResponse(Request $request, $response)
66+
{
67+
// As noted in #358 we will return success even if it failed
68+
// to avoid pointing out that an account does or does not
69+
// exist on the system.
70+
event(new FailedPasswordReset($request->ip(), $request->only('email')));
71+
72+
return $this->sendResetLinkResponse(Password::RESET_LINK_SENT);
73+
}
3274
}

‎app/Http/Controllers/Server/SubuserController.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ public function getView(Request $request, $uuid, $id)
7979
'server' => $server,
8080
'node' => $server->node,
8181
'subuser' => $subuser,
82+
'permlist' => Models\Permission::list(),
8283
'permissions' => $subuser->permissions->mapWithKeys(function ($item, $key) {
8384
return [$item->permission => true];
8485
}),
@@ -146,6 +147,7 @@ public function getNew(Request $request, $uuid)
146147

147148
return view('server.users.new', [
148149
'server' => $server,
150+
'permissions' => Models\Permission::list(),
149151
'node' => $server->node,
150152
]);
151153
}

‎app/Models/Permission.php‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,80 @@ class Permission extends Model
5858
'subuser_id' => 'integer',
5959
];
6060

61+
/**
62+
* A list of all permissions available for a user.
63+
*
64+
* @var array
65+
*/
66+
protected static $permissions = [
67+
'power' => [
68+
'power-start' => 's:power:start',
69+
'power-stop' => 's:power:stop',
70+
'power-restart' => 's:power:restart',
71+
'power-kill' => 's:power:kill',
72+
'send-command' => 's:command',
73+
],
74+
'subuser' => [
75+
'list-subusers' => null,
76+
'view-subuser' => null,
77+
'edit-subuser' => null,
78+
'create-subuser' => null,
79+
'delete-subuser' => null,
80+
],
81+
'server' => [
82+
'set-connection' => null,
83+
'view-startup' => null,
84+
'edit-startup' => null,
85+
],
86+
'sftp' => [
87+
'view-sftp' => null,
88+
'view-sftp-password' => null,
89+
'reset-sftp' => 's:set-password',
90+
],
91+
'file' => [
92+
'list-files' => 's:files:get',
93+
'edit-files' => 's:files:read',
94+
'save-files' => 's:files:post',
95+
'move-files' => 's:files:move',
96+
'copy-files' => 's:files:copy',
97+
'compress-files' => 's:files:compress',
98+
'decompress-files' => 's:files:decompress',
99+
'create-files' => 's:files:create',
100+
'upload-files' => 's:files:upload',
101+
'delete-files' => 's:files:delete',
102+
'download-files' => null,
103+
],
104+
'task' => [
105+
'list-tasks' => null,
106+
'view-task' => null,
107+
'toggle-task' => null,
108+
'queue-task' => null,
109+
'create-task' => null,
110+
'delete-task' => null,
111+
],
112+
'database' => [
113+
'view-databases' => null,
114+
'reset-db-password' => null,
115+
],
116+
];
117+
118+
/**
119+
* Return a collection of permissions available.
120+
*
121+
* @param array $single
122+
* @return \Illuminate\Support\Collection|array
123+
*/
124+
public static function list($single = false)
125+
{
126+
if ($single) {
127+
return collect(self::$permissions)->mapWithKeys(function ($item) {
128+
return $item;
129+
})->all();
130+
}
131+
132+
return collect(self::$permissions);
133+
}
134+
61135
/**
62136
* Find permission by permission node.
63137
*

‎app/Repositories/NodeRepository.php‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -277,13 +277,9 @@ public function delete($id)
277277
throw new DisplayException('You cannot delete a node with servers currently attached to it.');
278278
}
279279

280-
DB::beginTransaction();
281-
282-
try {
280+
DB::transaction(function () use ($node) {
283281
// Unlink Database Servers
284-
Models\DatabaseServer::where('linked_node', $node->id)->update([
285-
'linked_node' => null,
286-
]);
282+
Models\DatabaseHost::where('node_id', $node->id)->update(['node_id' => null]);
287283

288284
// Delete Allocations
289285
Models\Allocation::where('node_id', $node->id)->delete();
@@ -293,11 +289,6 @@ public function delete($id)
293289

294290
// Delete Node
295291
$node->delete();
296-
297-
DB::commit();
298-
} catch (\Exception $ex) {
299-
DB::rollback();
300-
throw $ex;
301-
}
292+
});
302293
}
303294
}

‎app/Repositories/SubuserRepository.php‎

Lines changed: 10 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -45,62 +45,6 @@ class SubuserRepository
4545
's:console',
4646
];
4747

48-
/**
49-
* Allowed permissions and their related daemon permission.
50-
*
51-
* @var array
52-
*/
53-
protected $permissions = [
54-
// Power Permissions
55-
'power-start' => 's:power:start',
56-
'power-stop' => 's:power:stop',
57-
'power-restart' => 's:power:restart',
58-
'power-kill' => 's:power:kill',
59-
60-
// Commands
61-
'send-command' => 's:command',
62-
63-
// File Manager
64-
'list-files' => 's:files:get',
65-
'edit-files' => 's:files:read',
66-
'save-files' => 's:files:post',
67-
'create-files' => 's:files:create',
68-
'download-files' => null,
69-
'upload-files' => 's:files:upload',
70-
'delete-files' => 's:files:delete',
71-
'move-files' => 's:files:move',
72-
'copy-files' => 's:files:copy',
73-
'compress-files' => 's:files:compress',
74-
'decompress-files' => 's:files:decompress',
75-
76-
// Subusers
77-
'list-subusers' => null,
78-
'view-subuser' => null,
79-
'edit-subuser' => null,
80-
'create-subuser' => null,
81-
'delete-subuser' => null,
82-
83-
// Tasks
84-
'list-tasks' => null,
85-
'view-task' => null,
86-
'toggle-task' => null,
87-
'delete-task' => null,
88-
'create-task' => null,
89-
'queue-task' => null,
90-
91-
// Management
92-
'set-connection' => null,
93-
'view-startup' => null,
94-
'edit-startup' => null,
95-
'view-sftp' => null,
96-
'reset-sftp' => 's:set-password',
97-
'view-sftp-password' => null,
98-
99-
// Databases
100-
'view-databases' => null,
101-
'reset-db-password' => null,
102-
];
103-
10448
/**
10549
* Creates a new subuser on the server.
10650
*
@@ -155,12 +99,14 @@ public function create($sid, array $data)
15599
'daemonSecret' => (string) $uuid->generate('servers', 'uuid'),
156100
]);
157101

102+
$perms = Permission::list(true);
158103
$daemonPermissions = $this->coreDaemonPermissions;
104+
159105
foreach ($data['permissions'] as $permission) {
160-
if (array_key_exists($permission, $this->permissions)) {
106+
if (array_key_exists($permission, $perms)) {
161107
// Build the daemon permissions array for sending.
162-
if (! is_null($this->permissions[$permission])) {
163-
array_push($daemonPermissions, $this->permissions[$permission]);
108+
if (! is_null($perms[$permission])) {
109+
array_push($daemonPermissions, $perms[$permission]);
164110
}
165111

166112
Models\Permission::create([
@@ -272,12 +218,14 @@ public function update($id, array $data)
272218
$permission->delete();
273219
}
274220

221+
$perms = Permission::list(true);
275222
$daemonPermissions = $this->coreDaemonPermissions;
223+
276224
foreach ($data['permissions'] as $permission) {
277-
if (array_key_exists($permission, $this->permissions)) {
225+
if (array_key_exists($permission, $perms)) {
278226
// Build the daemon permissions array for sending.
279-
if (! is_null($this->permissions[$permission])) {
280-
array_push($daemonPermissions, $this->permissions[$permission]);
227+
if (! is_null($perms[$permission])) {
228+
array_push($daemonPermissions, $perms[$permission]);
281229
}
282230
Models\Permission::create([
283231
'subuser_id' => $subuser->id,

‎composer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
],
1313
"require": {
1414
"php": ">=5.6.4",
15-
"laravel/framework": "5.3.21",
15+
"laravel/framework": "5.3.31",
1616
"barryvdh/laravel-debugbar": "2.2.3",
1717
"doctrine/dbal": "2.5.5",
1818
"guzzlehttp/guzzle": "6.2.2",

0 commit comments

Comments
 (0)