StarMC/Astral-nook
StarMC/Astral-nook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Attempt revocation of JWT access when changing a server's owner

Browse source 
closes #2771
This commit is contained in:
Dane Everitt 2020-12-06 12:16:12 -08:00
parent af360d49dd
commit 11054de5b3
No known key found for this signature in database
GPG key ID: EEA66103B3D71F53
3 changed files with 53 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

18
app/Repositories/Wings/DaemonServerRepository.php
View file

@ -3,6 +3,7 @@
namespace Pterodactyl\Repositories\Wings;
use Webmozart\Assert\Assert;
use Pterodactyl\Models\User;
use Pterodactyl\Models\Server;
use GuzzleHttp\Exception\TransferException;
use Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException;
@ -144,6 +145,21 @@ class DaemonServerRepository extends DaemonRepository
}
}
/**
* Revokes a single user's JTI by using their ID. This is simply a helper function to
* make it easier to revoke tokens on the fly. This ensures that the JTI key is formatted
* correctly and avoids any costly mistakes in the codebase.
*
* @param int $id
* @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
*/
public function revokeUserJTI(int $id): void
{
Assert::isInstanceOf($this->server, Server::class);
$this->revokeJTIs([ md5($id . $this->server->uuid) ]);
}
/**
* Revokes an array of JWT JTI's by marking any token generated before the current time on
* the Wings instance as being invalid.
@ -151,7 +167,7 @@ class DaemonServerRepository extends DaemonRepository
* @param array $jtis
* @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
*/
public function revokeJTIs(array $jtis): void
protected function revokeJTIs(array $jtis): void
{
Assert::isInstanceOf($this->server, Server::class);