Merge branch 'develop' into matthewpi/server-details-patch-1

Author: matthewpi

CHANGELOG.md

@@ -3,6 +3,10 @@ This file is a running track of new features and fixes to each version of the pa
 
 This project follows [Semantic Versioning](http://semver.org) guidelines.
 
+## Unreleased
+### Fixed
+* Fixes the application API unable to return server's variables.
+
 ## v1.1.3
 ### Fixed
 * Server bulk power actions command will no longer attempt to run commands against installing or suspended servers.

app/Http/Controllers/Api/Client/Servers/BackupController.php

@@ -60,7 +60,8 @@ public function __construct(
      */
     public function index(GetBackupsRequest $request, Server $server)
     {
-        return $this->fractal->collection($server->backups()->paginate(20))
+        $limit = min($request->query('per_page') ?? 20, 50);
+        return $this->fractal->collection($server->backups()->paginate($limit))
             ->transformWith($this->getTransformer(BackupTransformer::class))
             ->toArray();
     }

app/Http/Controllers/Api/Client/Servers/FileController.php

@@ -16,6 +16,7 @@
 use Pterodactyl\Http\Requests\Api\Client\Servers\Files\ListFilesRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Files\DeleteFileRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Files\RenameFileRequest;
+use Pterodactyl\Http\Requests\Api\Client\Servers\Files\ChmodFilesRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Files\CreateFolderRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Files\CompressFilesRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Files\DecompressFilesRequest;
@@ -263,6 +264,25 @@ public function delete(DeleteFileRequest $request, Server $server): JsonResponse
         return new JsonResponse([], Response::HTTP_NO_CONTENT);
     }
 
+    /**
+     * Updates file permissions for file(s) in the given root directory.
+     *
+     * @param \Pterodactyl\Http\Requests\Api\Client\Servers\Files\ChmodFilesRequest $request
+     * @param \Pterodactyl\Models\Server $server
+     * @return \Illuminate\Http\JsonResponse
+     *
+     * @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
+     */
+    public function chmod(ChmodFilesRequest $request, Server $server): JsonResponse
+    {
+        $this->fileRepository->setServer($server)
+            ->chmodFiles(
+                $request->input('root'), $request->input('files')
+            );
+
+        return new JsonResponse([], Response::HTTP_NO_CONTENT);
+    }
+
     /**
      * Encodes a given file name & path in a format that should work for a good majority
      * of file names without too much confusing logic.

app/Http/Controllers/Api/Client/Servers/SubuserController.php

@@ -135,7 +135,7 @@ public function update(UpdateSubuserRequest $request, Server $server): array
             ]);
 
             try {
-                $this->serverRepository->setServer($server)->revokeJTIs([md5($subuser->user_id . $server->uuid)]);
+                $this->serverRepository->setServer($server)->revokeUserJTI($subuser->user_id);
             } catch (DaemonConnectionException $exception) {
                 // Don't block this request if we can't connect to the Wings instance. Chances are it is
                 // offline in this event and the token will be invalid anyways once Wings boots back.
@@ -163,7 +163,7 @@ public function delete(DeleteSubuserRequest $request, Server $server)
         $this->repository->delete($subuser->id);
 
         try {
-            $this->serverRepository->setServer($server)->revokeJTIs([md5($subuser->user_id . $server->uuid)]);
+            $this->serverRepository->setServer($server)->revokeUserJTI($subuser->user_id);
         } catch (DaemonConnectionException $exception) {
             // Don't block this request if we can't connect to the Wings instance.
             Log::warning($exception, ['user_id' => $subuser->user_id, 'server_id' => $server->id]);

app/Http/Requests/Api/Client/Servers/Files/ChmodFilesRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace Pterodactyl\Http\Requests\Api\Client\Servers\Files;
+
+use Pterodactyl\Models\Permission;
+use Pterodactyl\Contracts\Http\ClientPermissionsRequest;
+use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
+
+class ChmodFilesRequest extends ClientApiRequest implements ClientPermissionsRequest
+{
+    /**
+     * @return string
+     */
+    public function permission(): string
+    {
+        return Permission::ACTION_FILE_UPDATE;
+    }
+
+    /**
+     * @return array
+     */
+    public function rules(): array
+    {
+        return [
+            'root' => 'required|nullable|string',
+            'files' => 'required|array',
+            'files.*.file' => 'required|string',
+            'files.*.mode' => 'required|numeric',
+        ];
+    }
+}

app/Repositories/Wings/DaemonFileRepository.php

@@ -269,4 +269,32 @@ public function decompressFile(?string $root, string $file): ResponseInterface
             throw new DaemonConnectionException($exception);
         }
     }
+
+    /**
+     * Chmods the given files.
+     *
+     * @param string|null $root
+     * @param array $files
+     * @return \Psr\Http\Message\ResponseInterface
+     *
+     * @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
+     */
+    public function chmodFiles(?string $root, array $files): ResponseInterface
+    {
+        Assert::isInstanceOf($this->server, Server::class);
+
+        try {
+            return $this->getHttpClient()->post(
+                sprintf('/api/servers/%s/files/chmod', $this->server->uuid),
+                [
+                    'json' => [
+                        'root' => $root ?? '/',
+                        'files' => $files,
+                    ],
+                ]
+            );
+        } catch (TransferException $exception) {
+            throw new DaemonConnectionException($exception);
+        }
+    }
 }

app/Repositories/Wings/DaemonServerRepository.php

@@ -3,6 +3,7 @@
 namespace Pterodactyl\Repositories\Wings;
 
 use Webmozart\Assert\Assert;
+use Pterodactyl\Models\User;
 use Pterodactyl\Models\Server;
 use GuzzleHttp\Exception\TransferException;
 use Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException;
@@ -144,14 +145,29 @@ public function requestArchive(): void
         }
     }
 
+    /**
+     * Revokes a single user's JTI by using their ID. This is simply a helper function to
+     * make it easier to revoke tokens on the fly. This ensures that the JTI key is formatted
+     * correctly and avoids any costly mistakes in the codebase.
+     *
+     * @param int $id
+     * @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
+     */
+    public function revokeUserJTI(int $id): void
+    {
+        Assert::isInstanceOf($this->server, Server::class);
+
+        $this->revokeJTIs([ md5($id . $this->server->uuid) ]);
+    }
+
     /**
      * Revokes an array of JWT JTI's by marking any token generated before the current time on
      * the Wings instance as being invalid.
      *
      * @param array $jtis
      * @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
      */
-    public function revokeJTIs(array $jtis): void
+    protected function revokeJTIs(array $jtis): void
     {
         Assert::isInstanceOf($this->server, Server::class);
 

app/Services/Nodes/NodeUpdateService.php

@@ -4,6 +4,7 @@
 
 use Illuminate\Support\Str;
 use Pterodactyl\Models\Node;
+use Illuminate\Support\Facades\Log;
 use GuzzleHttp\Exception\ConnectException;
 use Illuminate\Database\ConnectionInterface;
 use Illuminate\Contracts\Encryption\Encrypter;
@@ -90,11 +91,17 @@ public function handle(Node $node, array $data, bool $resetToken = false)
 
                 $this->configurationRepository->setNode($node)->update($updated);
             } catch (DaemonConnectionException $exception) {
-                if (! is_null($exception->getPrevious()) && $exception->getPrevious() instanceof ConnectException) {
-                    return [$updated, true];
-                }
+                Log::warning($exception, ['node_id' => $node->id]);
 
-                throw $exception;
+                // Never actually throw these exceptions up the stack. If we were able to change the settings
+                // but something went wrong with Wings we just want to store the update and let the user manually
+                // make changes as needed.
+                //
+                // This avoids issues with proxies such as CloudFlare which will see Wings as offline and then
+                // inject their own response pages, causing this logic to get fucked up.
+                //
+                // @see https://github.com/pterodactyl/panel/issues/2712
+                return [ $updated, true ];
             }
 
             return [$updated, false];

app/Services/Servers/DetailsModificationService.php

@@ -2,10 +2,12 @@
 
 namespace Pterodactyl\Services\Servers;
 
+use Illuminate\Support\Arr;
 use Pterodactyl\Models\Server;
 use Illuminate\Database\ConnectionInterface;
 use Pterodactyl\Traits\Services\ReturnsUpdatedModels;
-use Pterodactyl\Repositories\Eloquent\ServerRepository;
+use Pterodactyl\Repositories\Wings\DaemonServerRepository;
+use Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException;
 
 class DetailsModificationService
 {
@@ -17,47 +19,57 @@ class DetailsModificationService
     private $connection;
 
     /**
-     * @var \Pterodactyl\Repositories\Eloquent\ServerRepository
+     * @var \Pterodactyl\Repositories\Wings\DaemonServerRepository
      */
-    private $repository;
+    private $serverRepository;
 
     /**
      * DetailsModificationService constructor.
      *
      * @param \Illuminate\Database\ConnectionInterface $connection
-     * @param \Pterodactyl\Repositories\Eloquent\ServerRepository $repository
+     * @param \Pterodactyl\Repositories\Wings\DaemonServerRepository $serverRepository
      */
-    public function __construct(
-        ConnectionInterface $connection,
-        ServerRepository $repository
-    ) {
+    public function __construct(ConnectionInterface $connection, DaemonServerRepository $serverRepository)
+    {
         $this->connection = $connection;
-        $this->repository = $repository;
+        $this->serverRepository = $serverRepository;
     }
 
     /**
      * Update the details for a single server instance.
      *
      * @param \Pterodactyl\Models\Server $server
      * @param array $data
-     * @return bool|\Pterodactyl\Models\Server
+     * @return \Pterodactyl\Models\Server
      *
-     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
-     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     * @throws \Throwable
      */
-    public function handle(Server $server, array $data)
+    public function handle(Server $server, array $data): Server
     {
-        $this->connection->beginTransaction();
+        return $this->connection->transaction(function () use ($data, $server) {
+            $owner = $server->owner_id;
 
-        $response = $this->repository->setFreshModel($this->getUpdatedModel())->update($server->id, [
-            'external_id' => array_get($data, 'external_id'),
-            'owner_id' => array_get($data, 'owner_id'),
-            'name' => array_get($data, 'name'),
-            'description' => array_get($data, 'description') ?? '',
-        ], true, true);
+            $server->forceFill([
+                'external_id' => Arr::get($data, 'external_id'),
+                'owner_id' => Arr::get($data, 'owner_id'),
+                'name' => Arr::get($data, 'name'),
+                'description' => Arr::get($data, 'description') ?? '',
+            ])->saveOrFail();
 
-        $this->connection->commit();
+            // If the owner_id value is changed we need to revoke any tokens that exist for the server
+            // on the Wings instance so that the old owner no longer has any permission to access the
+            // websockets.
+            if ($server->owner_id !== $owner) {
+                try {
+                    $this->serverRepository->setServer($server)->revokeUserJTI($owner);
+                } catch (DaemonConnectionException $exception) {
+                    // Do nothing. A failure here is not ideal, but it is likely to be caused by Wings
+                    // being offline, or in an entirely broken state. Remeber, these tokens reset every
+                    // few minutes by default, we're just trying to help it along a little quicker.
+                }
+            }
 
-        return $response;
+            return $server;
+        });
     }
 }

app/Transformers/Api/Application/ServerVariableTransformer.php

@@ -2,7 +2,7 @@
 
 namespace Pterodactyl\Transformers\Api\Application;
 
-use Pterodactyl\Models\ServerVariable;
+use Pterodactyl\Models\EggVariable;
 use Pterodactyl\Services\Acl\Api\AdminAcl;
 
 class ServerVariableTransformer extends BaseTransformer
@@ -27,22 +27,22 @@ public function getResourceName(): string
     /**
      * Return a generic transformed server variable array.
      *
-     * @param \Pterodactyl\Models\ServerVariable $variable
+     * @param \Pterodactyl\Models\EggVariable $variable
      * @return array
      */
-    public function transform(ServerVariable $variable)
+    public function transform(EggVariable $variable)
     {
         return $variable->toArray();
     }
 
     /**
      * Return the parent service variable data.
      *
-     * @param \Pterodactyl\Models\ServerVariable $variable
+     * @param \Pterodactyl\Models\EggVariable $variable
      * @return \League\Fractal\Resource\Item|\League\Fractal\Resource\NullResource
      * @throws \Pterodactyl\Exceptions\Transformer\InvalidTransformerLevelException
      */
-    public function includeParent(ServerVariable $variable)
+    public function includeParent(EggVariable $variable)
     {
         if (! $this->authorize(AdminAcl::RESOURCE_EGGS)) {
             return $this->null();