StarMC/Astral-nook
StarMC/Astral-nook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Don't return variables to users that they should not be able to see; closes #2388

Browse source
This commit is contained in:
Dane Everitt 2020-09-22 21:12:00 -07:00
parent 7968258004
commit 2182a15494
No known key found for this signature in database
GPG key ID: EEA66103B3D71F53
2 changed files with 15 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
app/Transformers/Api/Client/EggVariableTransformer.php
View file

@ -2,6 +2,8 @@
namespace Pterodactyl\Transformers\Api\Client;
use BadMethodCallException;
use InvalidArgumentException;
use Pterodactyl\Models\EggVariable;
class EggVariableTransformer extends BaseClientTransformer
@ -20,6 +22,15 @@ class EggVariableTransformer extends BaseClientTransformer
*/
public function transform(EggVariable $variable)
{
// This guards against someone incorrectly retrieving variables (haha, me) and then passing
// them into the transformer and along to the user. Just throw an exception and break the entire
// pathway since you should never be exposing these types of variables to a client.
if (!$variable->user_viewable) {
throw new BadMethodCallException(
'Cannot transform a hidden egg variable in a client transformer.'
);
}
return [
'name' => $variable->name,
'description' => $variable->description,