Merge branch 'develop' into feature/admin-retheme

Author: DaneEveritt

CHANGELOG.md

@@ -3,6 +3,15 @@ This file is a running track of new features and fixes to each version of the pa
 
 This project follows [Semantic Versioning](http://semver.org) guidelines.
 
+## v0.6.0-pre.4 (Courageous Carniadactylus)
+### Fixed
+* `[pre.3]` — Fixes bug in cache handler that doesn't cache against the user making the request. Would have allowed for users to access servers not belonging to themselves in production.
+* `[pre.3]` — Fixes misnamed MySQL column that was causing the inability to delete certain port ranges from the database.
+* `[pre.3]` — Fixes bug preventing rebuilding server containers through the Admin CP.
+
+### Added
+* New cache policy for ServerPolicy to avoid making 15+ queries per page load when confirming if a user has permission to perform an action.
+
 ## v0.6.0-pre.3 (Courageous Carniadactylus)
 ### Fixed
 * `[pre.2]` — Fixes bug where servers could not be manually deployed to nodes due to a broken SQL call.

app/Http/Controllers/Admin/NodesController.php

@@ -163,7 +163,7 @@ public function deallocateSingle(Request $request, $node, $allocation)
 
     public function deallocateBlock(Request $request, $node)
     {
-        $query = Models\Allocation::where('node', $node)->whereNull('server_id')->where('ip', $request->input('ip'))->delete();
+        $query = Models\Allocation::where('node_id', $node)->whereNull('server_id')->where('ip', $request->input('ip'))->delete();
         if ((int) $query === 0) {
             Alert::danger('There was an error while attempting to delete allocations on that IP.')->flash();
 
@@ -199,7 +199,7 @@ public function setAlias(Request $request, $node)
 
     public function getAllocationsJson(Request $request, $id)
     {
-        $allocations = Models\Allocation::select('ip')->where('node', $id)->groupBy('ip')->get();
+        $allocations = Models\Allocation::select('ip')->where('node_id', $id)->groupBy('ip')->get();
 
         return response()->json($allocations);
     }

app/Http/Controllers/Admin/ServersController.php

@@ -254,7 +254,7 @@ public function postUpdateServerToggleBuild(Request $request, $id)
         try {
             $res = $server->node->guzzleClient([
                 'X-Access-Server' => $server->uuid,
-                'X-Access-Token' => $node->daemonSecret,
+                'X-Access-Token' => $server->node->daemonSecret,
             ])->request('POST', '/server/rebuild');
             Alert::success('A rebuild has been queued successfully. It will run the next time this server is booted.')->flash();
         } catch (\GuzzleHttp\Exception\TransferException $ex) {

app/Http/Controllers/Base/APIController.php

@@ -80,6 +80,7 @@ public function revoke(Request $request, $key)
             return response('', 204);
         } catch (\Exception $ex) {
             Log::error($ex);
+
             return response()->json([
                 'error' => 'An error occured while attempting to remove this key.',
             ], 503);

app/Models/Server.php

@@ -113,7 +113,7 @@ class Server extends Model
     public static function byUuid($uuid)
     {
         // Results are cached because we call this functions a few times on page load.
-        $result = Cache::remember('Server.byUuid.' . $uuid, 60, function () use ($uuid) {
+        $result = Cache::remember('Server.byUuid.' . $uuid . Auth::user()->uuid, 60, function () use ($uuid) {
             $query = self::with('service', 'node')->where(function ($q) use ($uuid) {
                 $q->where('uuidShort', $uuid)->orWhere('uuid', $uuid);
             });

app/Observers/ServerObserver.php

@@ -24,6 +24,7 @@
 
 namespace Pterodactyl\Observers;
 
+use Auth;
 use Cache;
 use Carbon;
 use Pterodactyl\Events;
@@ -141,8 +142,8 @@ public function updating(Server $server)
     public function updated(Server $server)
     {
         // Clear Caches
-        Cache::forget('Server.byUuid.' . $server->uuid);
-        Cache::forget('Server.byUuid.' . $server->uuidShort);
+        Cache::forget('Server.byUuid.' . $server->uuid . Auth::user()->uuid);
+        Cache::forget('Server.byUuid.' . $server->uuidShort . Auth::user()->uuid);
 
         event(new Events\Server\Updated($server));
     }

app/Policies/ServerPolicy.php

@@ -24,6 +24,8 @@
 
 namespace Pterodactyl\Policies;
 
+use Cache;
+use Carbon;
 use Pterodactyl\Models\User;
 use Pterodactyl\Models\Server;
 
@@ -53,7 +55,13 @@ private function checkPermission(User $user, Server $server, $permission)
             return true;
         }
 
-        return $user->permissions()->server($server)->permission($permission)->exists();
+        $permissions = Cache::remember('ServerPolicy.' . $user->uuid . $server->uuid, Carbon::now()->addSeconds(10), function () use ($user, $server) {
+            return $user->permissions()->server($server)->get()->transform(function ($item) {
+                return $item->permission;
+            })->values();
+        });
+
+        return $permissions->search($permission, true) !== false;
     }
 
     /**

app/Repositories/APIRepository.php

@@ -225,7 +225,7 @@ public function revoke($key)
 
         try {
             $model = Models\APIKey::with('permissions')->where('public', $key)->where('user_id', $this->user->id)->firstOrFail();
-            foreach($model->permissions as &$permission) {
+            foreach ($model->permissions as &$permission) {
                 $permission->delete();
             }
 

app/Repositories/Daemon/CommandRepository.php

@@ -24,7 +24,6 @@
 
 namespace Pterodactyl\Repositories\Daemon;
 
-use GuzzleHttp\Client;
 use Pterodactyl\Models;
 use GuzzleHttp\Exception\RequestException;
 use Pterodactyl\Exceptions\DisplayException;

app/Repositories/Daemon/PowerRepository.php

@@ -24,7 +24,6 @@
 
 namespace Pterodactyl\Repositories\Daemon;
 
-use GuzzleHttp\Client;
 use Pterodactyl\Models;
 use Pterodactyl\Exceptions\DisplayException;