Skip to content

Commit 6409fff

Browse files
committed
Implement fix to allow root admins to view all servers.
closes pterodactyl#722
1 parent fb2909a commit 6409fff

22 files changed

+142
-165
lines changed

app/Contracts/Repository/ServerRepositoryInterface.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ public function filterUserAccessServers($user, $admin = false, $level = 'all', a
118118
* Return a server by UUID.
119119
*
120120
* @param string $uuid
121-
* @return \Illuminate\Database\Eloquent\Collection
121+
* @return \Pterodactyl\Models\Server
122122
*
123123
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
124124
*/

app/Contracts/Repository/SubuserRepositoryInterface.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ interface SubuserRepositoryInterface extends RepositoryInterface
1313
* @param bool $refresh
1414
* @return \Pterodactyl\Models\Subuser
1515
*/
16-
public function getWithServer(Subuser $subuser, bool $refresh = false): Subuser;
16+
public function loadServerAndUserRelations(Subuser $subuser, bool $refresh = false): Subuser;
1717

1818
/**
1919
* Return a subuser with the associated permissions relationship.

app/Http/Controllers/Base/IndexController.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ public function getIndex(Request $request)
9393
public function status(Request $request, $uuid)
9494
{
9595
$server = $this->repository->findFirstWhere([['uuidShort', '=', $uuid]]);
96-
$token = $this->keyProviderService->handle($server->id, $request->user()->id);
96+
$token = $this->keyProviderService->handle($server, $request->user());
9797

9898
if (! $server->installed) {
9999
return response()->json(['status' => 20]);

app/Http/Middleware/AdminAuthenticate.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111

1212
use Closure;
1313
use Illuminate\Http\Request;
14-
use Symfony\Component\HttpKernel\Exception\HttpException;
14+
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
1515

1616
class AdminAuthenticate
1717
{
@@ -25,7 +25,7 @@ class AdminAuthenticate
2525
public function handle(Request $request, Closure $next)
2626
{
2727
if (! $request->user() || ! $request->user()->root_admin) {
28-
throw new HttpException(403, 'Access Denied');
28+
throw new AccessDeniedHttpException;
2929
}
3030

3131
return $next($request);

app/Http/Middleware/Authenticate.php

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,7 @@ class Authenticate
2020
public function handle(Request $request, Closure $next)
2121
{
2222
if (! $request->user()) {
23-
if ($request->ajax() || $request->expectsJson()) {
24-
throw new AuthenticationException();
25-
} else {
26-
return redirect()->route('auth.login');
27-
}
23+
throw new AuthenticationException;
2824
}
2925

3026
return $next($request);

app/Http/Middleware/Daemon/DaemonAuthenticate.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
use Symfony\Component\HttpKernel\Exception\HttpException;
3030
use Pterodactyl\Contracts\Repository\NodeRepositoryInterface;
3131
use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
32+
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
3233

3334
class DaemonAuthenticate
3435
{
@@ -80,7 +81,7 @@ public function handle(Request $request, Closure $next)
8081
try {
8182
$node = $this->repository->findFirstWhere([['daemonSecret', '=', $token]]);
8283
} catch (RecordNotFoundException $exception) {
83-
throw new HttpException(403);
84+
throw new AccessDeniedHttpException;
8485
}
8586

8687
$request->attributes->set('node', $node);

app/Http/Middleware/Server/AuthenticateAsSubuser.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@
1212
use Closure;
1313
use Illuminate\Http\Request;
1414
use Illuminate\Contracts\Session\Session;
15-
use Illuminate\Auth\AuthenticationException;
1615
use Pterodactyl\Services\DaemonKeys\DaemonKeyProviderService;
1716
use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
17+
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
1818

1919
class AuthenticateAsSubuser
2020
{
@@ -56,9 +56,9 @@ public function handle(Request $request, Closure $next)
5656
$server = $request->attributes->get('server');
5757

5858
try {
59-
$token = $this->keyProviderService->handle($server->id, $request->user()->id);
59+
$token = $this->keyProviderService->handle($server, $request->user());
6060
} catch (RecordNotFoundException $exception) {
61-
throw new AuthenticationException('This account does not have permission to access this server.');
61+
throw new AccessDeniedHttpException('This account does not have permission to access this server.');
6262
}
6363

6464
$this->session->now('server_data.token', $token);

app/Jobs/Schedule/RunTaskJob.php

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -92,20 +92,21 @@ public function handle(
9292
$this->taskRepository = $taskRepository;
9393

9494
$task = $this->taskRepository->getTaskWithServer($this->task);
95-
$server = $task->server;
95+
$server = $task->getRelation('server');
96+
$user = $server->getRelation('user');
9697

9798
// Perform the provided task aganist the daemon.
9899
switch ($task->action) {
99100
case 'power':
100101
$this->powerRepository->setNode($server->node_id)
101102
->setAccessServer($server->uuid)
102-
->setAccessToken($keyProviderService->handle($server->id, $server->owner_id))
103+
->setAccessToken($keyProviderService->handle($server, $user))
103104
->sendSignal($task->payload);
104105
break;
105106
case 'command':
106107
$this->commandRepository->setNode($server->node_id)
107108
->setAccessServer($server->uuid)
108-
->setAccessToken($keyProviderService->handle($server->id, $server->owner_id))
109+
->setAccessToken($keyProviderService->handle($server, $user))
109110
->send($task->payload);
110111
break;
111112
default:

app/Repositories/Eloquent/SubuserRepository.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,16 @@ public function model()
3131
* @param bool $refresh
3232
* @return \Pterodactyl\Models\Subuser
3333
*/
34-
public function getWithServer(Subuser $subuser, bool $refresh = false): Subuser
34+
public function loadServerAndUserRelations(Subuser $subuser, bool $refresh = false): Subuser
3535
{
3636
if (! $subuser->relationLoaded('server') || $refresh) {
3737
$subuser->load('server');
3838
}
3939

40+
if (! $subuser->relationLoaded('user') || $refresh) {
41+
$subuser->load('user');
42+
}
43+
4044
return $subuser;
4145
}
4246

app/Repositories/Eloquent/TaskRepository.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public function getTaskWithServer($id)
3131
{
3232
Assert::integerish($id, 'First argument passed to getTaskWithServer must be numeric, received %s.');
3333

34-
$instance = $this->getBuilder()->with('server')->find($id, $this->getColumns());
34+
$instance = $this->getBuilder()->with('server.user')->find($id, $this->getColumns());
3535
if (! $instance) {
3636
throw new RecordNotFoundException;
3737
}

0 commit comments

Comments
 (0)