StarMC/Astral-nook
StarMC/Astral-nook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix authorization checking for subusers

Browse source
This commit is contained in:
Dane Everitt 2020-03-28 16:18:56 -07:00
parent e4e5dea6b8
commit 5717a705a8
No known key found for this signature in database
GPG key ID: EEA66103B3D71F53
2 changed files with 25 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

39
app/Policies/ServerPolicy.php
View file

@ -1,21 +1,29 @@
<?php
/**
* Pterodactyl - Panel
* Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
*
* This software is licensed under the terms of the MIT license.
* https://opensource.org/licenses/MIT
*/
namespace Pterodactyl\Policies;
use Cache;
use Carbon;
use Carbon\Carbon;
use Pterodactyl\Models\User;
use Pterodactyl\Models\Server;
use Illuminate\Contracts\Cache\Repository as CacheRepository;
class ServerPolicy
{
/**
* @var \Illuminate\Contracts\Cache\Repository
*/
private $cache;
/**
* ServerPolicy constructor.
*
* @param \Illuminate\Contracts\Cache\Repository $cache
*/
public function __construct(CacheRepository $cache)
{
$this->cache = $cache;
}
/**
* Checks if the user has the given permission on/for the server.
*
@ -26,13 +34,16 @@ class ServerPolicy
*/
protected function checkPermission(User $user, Server $server, $permission)
{
$permissions = Cache::remember('ServerPolicy.' . $user->uuid . $server->uuid, Carbon::now()->addSeconds(5), function () use ($user, $server) {
return $user->permissions()->server($server)->get()->transform(function ($item) {
return $item->permission;
})->values();
$key = sprintf('ServerPolicy.%s.%s', $user->uuid, $server->uuid);
$permissions = $this->cache->remember($key, Carbon::now()->addSeconds(5), function () use ($user, $server) {
/** @var \Pterodactyl\Models\Subuser|null $subuser */
$subuser = $server->subusers()->where('user_id', $user->id)->first();
return $subuser ? $subuser->permissions : [];
});
return $permissions->search($permission, true) !== false;
return in_array($permission, $permissions);
}
/**