1212use Pterodactyl \Repositories \Eloquent \ServerRepository ;
1313use Pterodactyl \Services \Servers \GetUserPermissionsService ;
1414use Symfony \Component \HttpKernel \Exception \NotFoundHttpException ;
15+ use Pterodactyl \Exceptions \Http \Server \ServerTransferringException ;
1516use Symfony \Component \HttpKernel \Exception \BadRequestHttpException ;
1617use Pterodactyl \Http \Requests \Api \Remote \SftpAuthenticationFormRequest ;
1718use Symfony \Component \HttpKernel \Exception \TooManyRequestsHttpException ;
@@ -110,9 +111,14 @@ public function __invoke(SftpAuthenticationFormRequest $request): JsonResponse
110111 }
111112 }
112113
113- // Remeber, for security purposes, only reveal the existence of the server to people that
114+ // Prevent SFTP access to servers that are being transferred.
115+ if (! is_null ($ server ->transfer )) {
116+ throw new ServerTransferringException ();
117+ }
118+
119+ // Remember, for security purposes, only reveal the existence of the server to people that
114120 // have provided valid credentials, and have permissions to know about it.
115- if ($ server ->installed !== 1 || $ server ->suspended || $ server -> transfer !== null ) {
121+ if ($ server ->installed !== 1 || $ server ->suspended ) {
116122 throw new BadRequestHttpException (
117123 'Server is not installed or is currently suspended. '
118124 );
@@ -132,7 +138,7 @@ public function __invoke(SftpAuthenticationFormRequest $request): JsonResponse
132138 * @param \Illuminate\Http\Request $request
133139 * @return string
134140 */
135- protected function throttleKey (Request $ request )
141+ protected function throttleKey (Request $ request ): string
136142 {
137143 $ username = explode ('. ' , strrev ($ request ->input ('username ' , '' )));
138144
0 commit comments