Server API obey's the subuser permissions as well

Author: DaneEveritt

app/Http/Controllers/API/User/ServerController.php

@@ -23,6 +23,7 @@
  */
 namespace Pterodactyl\Http\Controllers\API\User;
 
+use Auth;
 use Log;
 use Pterodactyl\Models;
 use Illuminate\Http\Request;
@@ -79,7 +80,7 @@ public function info(Request $request, $uuid)
             ],
             'allocations' => $allocations,
             'sftp' => [
-                'username' => $server->username
+                'username' => (Auth::user()->can('view-sftp', $server)) ? $server->username : null
             ],
             'daemon' => [
                 'token' => ($request->secure()) ? $server->daemonSecret : false,
@@ -94,6 +95,8 @@ public function power(Request $request, $uuid)
         $node = Models\Node::getByID($server->node);
         $client = Models\Node::guzzleRequest($server->node);
 
+        Auth::user()->can('power-' . $request->input('action'), $server);
+
         $res = $client->request('PUT', '/server/power', [
             'headers' => [
                 'X-Access-Server' => $server->uuid,

app/Models/Server.php

@@ -27,7 +27,7 @@
 use Pterodactyl\Models\Subuser;
 use Illuminate\Database\Eloquent\Model;
 
-use Pterodactyl\Exception\DisplayException;
+use Pterodactyl\Exceptions\DisplayException;
 
 class Server extends Model
 {