Merge branch 'release/v1.11.7' of https://github.com/pterodactyl/panel into release/v1.11.5
This commit is contained in:
Angelillo15
commit
c332151c9a
29 changed files with 203 additions and 242 deletions
|
|
@ -69,7 +69,7 @@ class EggVariableController extends Controller
|
|||
{
|
||||
$this->updateService->handle($variable, $request->normalize());
|
||||
$this->alert->success(trans('admin/nests.variables.notices.variable_updated', [
|
||||
'variable' => $variable->name,
|
||||
'variable' => htmlspecialchars($variable->name),
|
||||
]))->flash();
|
||||
|
||||
return redirect()->route('admin.nests.egg.variables', $egg->id);
|
||||
|
|
@ -82,7 +82,7 @@ class EggVariableController extends Controller
|
|||
{
|
||||
$this->variableRepository->delete($variable->id);
|
||||
$this->alert->success(trans('admin/nests.variables.notices.variable_deleted', [
|
||||
'variable' => $variable->name,
|
||||
'variable' => htmlspecialchars($variable->name),
|
||||
]))->flash();
|
||||
|
||||
return redirect()->route('admin.nests.egg.variables', $egg);
|
||||
|
|
|
|||
|
|
@ -56,7 +56,7 @@ class NestController extends Controller
|
|||
public function store(StoreNestFormRequest $request): RedirectResponse
|
||||
{
|
||||
$nest = $this->nestCreationService->handle($request->normalize());
|
||||
$this->alert->success(trans('admin/nests.notices.created', ['name' => $nest->name]))->flash();
|
||||
$this->alert->success(trans('admin/nests.notices.created', ['name' => htmlspecialchars($nest->name)]))->flash();
|
||||
|
||||
return redirect()->route('admin.nests.view', $nest->id);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -131,7 +131,7 @@ class NodesController extends Controller
|
|||
['ip', '=', $request->input('ip')],
|
||||
]);
|
||||
|
||||
$this->alert->success(trans('admin/node.notices.unallocated_deleted', ['ip' => $request->input('ip')]))
|
||||
$this->alert->success(trans('admin/node.notices.unallocated_deleted', ['ip' => htmlspecialchars($request->input('ip'))]))
|
||||
->flash();
|
||||
|
||||
return redirect()->route('admin.nodes.view.allocation', $node);
|
||||
|
|
|
|||
|
|
@ -32,18 +32,32 @@ class BackupRemoteUploadController extends Controller
|
|||
*/
|
||||
public function __invoke(Request $request, string $backup): JsonResponse
|
||||
{
|
||||
// Get the node associated with the request.
|
||||
/** @var \Pterodactyl\Models\Node $node */
|
||||
$node = $request->attributes->get('node');
|
||||
|
||||
// Get the size query parameter.
|
||||
$size = (int) $request->query('size');
|
||||
if (empty($size)) {
|
||||
throw new BadRequestHttpException('A non-empty "size" query parameter must be provided.');
|
||||
}
|
||||
|
||||
/** @var \Pterodactyl\Models\Backup $backup */
|
||||
$backup = Backup::query()->where('uuid', $backup)->firstOrFail();
|
||||
/** @var \Pterodactyl\Models\Backup $model */
|
||||
$model = Backup::query()
|
||||
->where('uuid', $backup)
|
||||
->firstOrFail();
|
||||
|
||||
// Check that the backup is "owned" by the node making the request. This avoids other nodes
|
||||
// from messing with backups that they don't own.
|
||||
/** @var \Pterodactyl\Models\Server $server */
|
||||
$server = $model->server;
|
||||
if ($server->node_id !== $node->id) {
|
||||
throw new HttpForbiddenException('You do not have permission to access that backup.');
|
||||
}
|
||||
|
||||
// Prevent backups that have already been completed from trying to
|
||||
// be uploaded again.
|
||||
if (!is_null($backup->completed_at)) {
|
||||
if (!is_null($model->completed_at)) {
|
||||
throw new ConflictHttpException('This backup is already in a completed state.');
|
||||
}
|
||||
|
||||
|
|
@ -54,7 +68,7 @@ class BackupRemoteUploadController extends Controller
|
|||
}
|
||||
|
||||
// The path where backup will be uploaded to
|
||||
$path = sprintf('%s/%s.tar.gz', $backup->server->uuid, $backup->uuid);
|
||||
$path = sprintf('%s/%s.tar.gz', $model->server->uuid, $model->uuid);
|
||||
|
||||
// Get the S3 client
|
||||
$client = $adapter->getClient();
|
||||
|
|
@ -92,7 +106,7 @@ class BackupRemoteUploadController extends Controller
|
|||
}
|
||||
|
||||
// Set the upload_id on the backup in the database.
|
||||
$backup->update(['upload_id' => $params['UploadId']]);
|
||||
$model->update(['upload_id' => $params['UploadId']]);
|
||||
|
||||
return new JsonResponse([
|
||||
'parts' => $parts,
|
||||
|
|
|
|||
|
|
@ -30,8 +30,22 @@ class BackupStatusController extends Controller
|
|||
*/
|
||||
public function index(ReportBackupCompleteRequest $request, string $backup): JsonResponse
|
||||
{
|
||||
// Get the node associated with the request.
|
||||
/** @var \Pterodactyl\Models\Node $node */
|
||||
$node = $request->attributes->get('node');
|
||||
|
||||
/** @var \Pterodactyl\Models\Backup $model */
|
||||
$model = Backup::query()->where('uuid', $backup)->firstOrFail();
|
||||
$model = Backup::query()
|
||||
->where('uuid', $backup)
|
||||
->firstOrFail();
|
||||
|
||||
// Check that the backup is "owned" by the node making the request. This avoids other nodes
|
||||
// from messing with backups that they don't own.
|
||||
/** @var \Pterodactyl\Models\Server $server */
|
||||
$server = $model->server;
|
||||
if ($server->node_id !== $node->id) {
|
||||
throw new HttpForbiddenException('You do not have permission to access that backup.');
|
||||
}
|
||||
|
||||
if ($model->is_successful) {
|
||||
throw new BadRequestHttpException('Cannot update the status of a backup that is already marked as completed.');
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ class EggFormRequest extends AdminFormRequest
|
|||
$rules = [
|
||||
'name' => 'required|string|max:191',
|
||||
'description' => 'nullable|string',
|
||||
'docker_images' => 'required|string',
|
||||
'docker_images' => ['required', 'string', 'regex:/^[\w#\.\/\- ]*\|*[\w\.\/\-:@ ]*$/im'],
|
||||
'force_outgoing_ip' => 'sometimes|boolean',
|
||||
'file_denylist' => 'array',
|
||||
'startup' => 'required|string',
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ class StoreNestFormRequest extends AdminFormRequest
|
|||
public function rules(): array
|
||||
{
|
||||
return [
|
||||
'name' => 'required|string|min:1|max:191',
|
||||
'name' => 'required|string|min:1|max:191|regex:/^[\w\- ]+$/',
|
||||
'description' => 'string|nullable',
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ class SetDockerImageRequest extends ClientApiRequest implements ClientPermission
|
|||
Assert::isInstanceOf($server, Server::class);
|
||||
|
||||
return [
|
||||
'docker_image' => ['required', 'string', Rule::in(array_values($server->egg->docker_images))],
|
||||
'docker_image' => ['required', 'string', 'max:191', 'regex:/^[\w#\.\/\- ]*\|*[\w\.\/\-:@ ]*$/', Rule::in(array_values($server->egg->docker_images))],
|
||||
];
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -123,7 +123,7 @@ class Egg extends Model
|
|||
'file_denylist' => 'array|nullable',
|
||||
'file_denylist.*' => 'string',
|
||||
'docker_images' => 'required|array|min:1',
|
||||
'docker_images.*' => 'required|string',
|
||||
'docker_images.*' => ['required', 'string', 'max:191', 'regex:/^[\w#\.\/\- ]*\|*[\w\.\/\-:@ ]*$/'],
|
||||
'startup' => 'required|nullable|string',
|
||||
'config_from' => 'sometimes|bail|nullable|numeric|exists:eggs,id',
|
||||
'config_stop' => 'required_without:config_from|nullable|string|max:191',
|
||||
|
|
|
|||
|
|
@ -163,7 +163,7 @@ class Server extends Model
|
|||
'egg_id' => 'required|exists:eggs,id',
|
||||
'startup' => 'required|string',
|
||||
'skip_scripts' => 'sometimes|boolean',
|
||||
'image' => 'required|string|max:191',
|
||||
'image' => ['required', 'string', 'max:191', 'regex:/^[\w\.\/\-:@ ]*$/'],
|
||||
'database_limit' => 'present|nullable|integer|min:0',
|
||||
'allocation_limit' => 'sometimes|nullable|integer|min:0',
|
||||
'backup_limit' => 'present|nullable|integer|min:0',
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue