StarMC/Astral-nook
StarMC/Astral-nook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[Security] Don't return all servers on the system when not a root admin and admin level servers are requested

Browse source 
Cleaned up the API endpoint by simplifying the logic and adds test case to cover this bug.

If you ever need to list _all_ of the servers on the system you should be using the application API endpoint for the servers most likely.
This commit is contained in:
Dane Everitt 2020-07-26 10:43:46 -07:00
parent 24db6d9128
commit f0ac0725b6
No known key found for this signature in database
GPG key ID: EEA66103B3D71F53
6 changed files with 84 additions and 88 deletions
Download patch file Download diff file Expand all files Collapse all files

18
resources/scripts/components/dashboard/DashboardContainer.tsx
View file

@ -17,11 +17,11 @@ export default () => {
const { clearFlashes, clearAndAddHttpError } = useFlash();
const [ page, setPage ] = useState(1);
const { rootAdmin } = useStoreState(state => state.user.data!);
const [ includeAdmin, setIncludeAdmin ] = usePersistedState('show_all_servers', false);
const [ showOnlyAdmin, setShowOnlyAdmin ] = usePersistedState('show_all_servers', false);
const { data: servers, error } = useSWR<PaginatedResult<Server>>(
[ '/api/client/servers', includeAdmin, page ],
() => getServers({ includeAdmin, page }),
[ '/api/client/servers', showOnlyAdmin, page ],
() => getServers({ onlyAdmin: showOnlyAdmin, page }),
);
useEffect(() => {
@ -34,12 +34,12 @@ export default () => {
{rootAdmin &&
<div css={tw`mb-2 flex justify-end items-center`}>
<p css={tw`uppercase text-xs text-neutral-400 mr-2`}>
{includeAdmin ? 'Showing all servers' : 'Showing your servers'}
{showOnlyAdmin ? 'Showing other\'s servers' : 'Showing your servers'}
</p>
<Switch
name={'show_all_servers'}
defaultChecked={includeAdmin}
onChange={() => setIncludeAdmin(s => !s)}
defaultChecked={showOnlyAdmin}
onChange={() => setShowOnlyAdmin(s => !s)}
/>
</div>
}
@ -58,7 +58,11 @@ export default () => {
))
:
<p css={tw`text-center text-sm text-neutral-400`}>
There are no servers associated with your account.
{showOnlyAdmin ?
'There are no other servers to display.'
:
'There are no servers associated with your account.'
}
</p>
)}
</Pagination>