Merge branch 'feature/vuejs' into feature/vue-serverview

app/Http/Controllers/Admin/StatisticsController.php

@@ -2,16 +2,14 @@
 
 namespace Pterodactyl\Http\Controllers\Admin;
 
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\DB;
-use Pterodactyl\Contracts\Repository\AllocationRepositoryInterface;
-use Pterodactyl\Contracts\Repository\DatabaseRepositoryInterface;
-use Pterodactyl\Contracts\Repository\EggRepositoryInterface;
-use Pterodactyl\Contracts\Repository\NodeRepositoryInterface;
-use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
-use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
 use Pterodactyl\Http\Controllers\Controller;
+use Pterodactyl\Contracts\Repository\EggRepositoryInterface;
 use Pterodactyl\Traits\Controllers\PlainJavascriptInjection;
+use Pterodactyl\Contracts\Repository\NodeRepositoryInterface;
+use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
+use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
+use Pterodactyl\Contracts\Repository\DatabaseRepositoryInterface;
+use Pterodactyl\Contracts\Repository\AllocationRepositoryInterface;
 
 class StatisticsController extends Controller
 {
@@ -29,15 +27,14 @@ class StatisticsController extends Controller
 
     private $userRepository;
 
-    function __construct(
+    public function __construct(
         AllocationRepositoryInterface $allocationRepository,
         DatabaseRepositoryInterface $databaseRepository,
         EggRepositoryInterface $eggRepository,
         NodeRepositoryInterface $nodeRepository,
         ServerRepositoryInterface $serverRepository,
         UserRepositoryInterface $userRepository
-    )
-    {
+    ) {
         $this->allocationRepository = $allocationRepository;
         $this->databaseRepository = $databaseRepository;
         $this->eggRepository = $eggRepository;
@@ -83,7 +80,7 @@ class StatisticsController extends Controller
             'nodes' => $nodes,
             'tokens' => $tokens,
         ]);
-        
+
         return view('admin.statistics', [
             'servers' => $servers,
             'nodes' => $nodes,
@@ -97,5 +94,4 @@ class StatisticsController extends Controller
             'totalAllocations' => $totalAllocations,
         ]);
     }
-
 }

app/Http/Controllers/Api/Client/AccountController.php

@@ -3,14 +3,71 @@
 namespace Pterodactyl\Http\Controllers\Api\Client;
 
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Pterodactyl\Services\Users\UserUpdateService;
 use Pterodactyl\Transformers\Api\Client\AccountTransformer;
+use Pterodactyl\Http\Requests\Api\Client\Account\UpdateEmailRequest;
+use Pterodactyl\Http\Requests\Api\Client\Account\UpdatePasswordRequest;
 
 class AccountController extends ClientApiController
 {
+    /**
+     * @var \Pterodactyl\Services\Users\UserUpdateService
+     */
+    private $updateService;
+
+    /**
+     * AccountController constructor.
+     *
+     * @param \Pterodactyl\Services\Users\UserUpdateService $updateService
+     */
+    public function __construct(UserUpdateService $updateService)
+    {
+        parent::__construct();
+
+        $this->updateService = $updateService;
+    }
+
+    /**
+     * @param Request $request
+     * @return array
+     */
     public function index(Request $request): array
     {
         return $this->fractal->item($request->user())
             ->transformWith($this->getTransformer(AccountTransformer::class))
             ->toArray();
     }
+
+    /**
+     * Update the authenticated user's email address.
+     *
+     * @param \Pterodactyl\Http\Requests\Api\Client\Account\UpdateEmailRequest $request
+     * @return \Illuminate\Http\Response
+     *
+     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
+     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     */
+    public function updateEmail(UpdateEmailRequest $request): Response
+    {
+        $this->updateService->handle($request->user(), $request->validated());
+
+        return response('', Response::HTTP_CREATED);
+    }
+
+    /**
+     * Update the authenticated user's password.
+     *
+     * @param \Pterodactyl\Http\Requests\Api\Client\Account\UpdatePasswordRequest $request
+     * @return \Illuminate\Http\Response
+     *
+     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
+     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     */
+    public function updatePassword(UpdatePasswordRequest $request): Response
+    {
+        $this->updateService->handle($request->user(), $request->validated());
+
+        return response('', Response::HTTP_CREATED);
+    }
 }

app/Http/Controllers/Auth/AbstractLoginController.php

@@ -2,8 +2,6 @@
 
 namespace Pterodactyl\Http\Controllers\Auth;
 
-use Cake\Chronos\Chronos;
-use Lcobucci\JWT\Builder;
 use Illuminate\Http\Request;
 use Pterodactyl\Models\User;
 use Illuminate\Auth\AuthManager;
@@ -15,25 +13,18 @@ use Pterodactyl\Http\Controllers\Controller;
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Contracts\Encryption\Encrypter;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
-use Pterodactyl\Traits\Helpers\ProvidesJWTServices;
-use Pterodactyl\Transformers\Api\Client\AccountTransformer;
 use Illuminate\Contracts\Cache\Repository as CacheRepository;
 use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
 
 abstract class AbstractLoginController extends Controller
 {
-    use AuthenticatesUsers, ProvidesJWTServices;
+    use AuthenticatesUsers;
 
     /**
      * @var \Illuminate\Auth\AuthManager
      */
     protected $auth;
 
-    /**
-     * @var \Lcobucci\JWT\Builder
-     */
-    protected $builder;
-
     /**
      * @var \Illuminate\Contracts\Cache\Repository
      */
@@ -79,7 +70,6 @@ abstract class AbstractLoginController extends Controller
      * LoginController constructor.
      *
      * @param \Illuminate\Auth\AuthManager                              $auth
-     * @param \Lcobucci\JWT\Builder                                     $builder
      * @param \Illuminate\Contracts\Cache\Repository                    $cache
      * @param \Illuminate\Contracts\Encryption\Encrypter                $encrypter
      * @param \PragmaRX\Google2FA\Google2FA                             $google2FA
@@ -87,14 +77,12 @@ abstract class AbstractLoginController extends Controller
      */
     public function __construct(
         AuthManager $auth,
-        Builder $builder,
         CacheRepository $cache,
         Encrypter $encrypter,
         Google2FA $google2FA,
         UserRepositoryInterface $repository
     ) {
         $this->auth = $auth;
-        $this->builder = $builder;
         $this->cache = $cache;
         $this->encrypter = $encrypter;
         $this->google2FA = $google2FA;
@@ -143,32 +131,10 @@ abstract class AbstractLoginController extends Controller
         return response()->json([
             'complete' => true,
             'intended' => $this->redirectPath(),
-            'jwt' => $this->createJsonWebToken($user),
+            'user' => $user->toVueObject(),
         ]);
     }
 
-    /**
-     * Create a new JWT for the request and sign it using the signing key.
-     *
-     * @param User $user
-     * @return string
-     */
-    protected function createJsonWebToken(User $user): string
-    {
-        $token = $this->builder
-            ->setIssuer('Pterodactyl Panel')
-            ->setAudience(config('app.url'))
-            ->setId(str_random(16), true)
-            ->setIssuedAt(Chronos::now()->getTimestamp())
-            ->setNotBefore(Chronos::now()->getTimestamp())
-            ->setExpiration(Chronos::now()->addSeconds(config('session.lifetime'))->getTimestamp())
-            ->set('user', (new AccountTransformer())->transform($user))
-            ->sign($this->getJWTSigner(), $this->getJWTSigningKey())
-            ->getToken();
-
-        return $token->__toString();
-    }
-
     /**
      * Determine if the user is logging in using an email or username,.
      *

app/Http/Controllers/Auth/ResetPasswordController.php

@@ -2,12 +2,17 @@
 
 namespace Pterodactyl\Http\Controllers\Auth;
 
+use Illuminate\Support\Str;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Contracts\Hashing\Hasher;
 use Illuminate\Support\Facades\Password;
+use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Contracts\Events\Dispatcher;
 use Pterodactyl\Exceptions\DisplayException;
 use Pterodactyl\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\ResetsPasswords;
 use Pterodactyl\Http\Requests\Auth\ResetPasswordRequest;
+use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
 
 class ResetPasswordController extends Controller
 {
@@ -20,6 +25,40 @@ class ResetPasswordController extends Controller
      */
     public $redirectTo = '/';
 
+    /**
+     * @var bool
+     */
+    protected $hasTwoFactor = false;
+
+    /**
+     * @var \Illuminate\Contracts\Events\Dispatcher
+     */
+    private $dispatcher;
+
+    /**
+     * @var \Illuminate\Contracts\Hashing\Hasher
+     */
+    private $hasher;
+
+    /**
+     * @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
+     */
+    private $userRepository;
+
+    /**
+     * ResetPasswordController constructor.
+     *
+     * @param \Illuminate\Contracts\Events\Dispatcher                   $dispatcher
+     * @param \Illuminate\Contracts\Hashing\Hasher                      $hasher
+     * @param \Pterodactyl\Contracts\Repository\UserRepositoryInterface $userRepository
+     */
+    public function __construct(Dispatcher $dispatcher, Hasher $hasher, UserRepositoryInterface $userRepository)
+    {
+        $this->dispatcher = $dispatcher;
+        $this->hasher = $hasher;
+        $this->userRepository = $userRepository;
+    }
+
     /**
      * Reset the given user's password.
      *
@@ -49,6 +88,35 @@ class ResetPasswordController extends Controller
         throw new DisplayException(trans($response));
     }
 
+    /**
+     * Reset the given user's password. If the user has two-factor authentication enabled on their
+     * account do not automatically log them in. In those cases, send the user back to the login
+     * form with a note telling them their password was changed and to log back in.
+     *
+     * @param \Illuminate\Contracts\Auth\CanResetPassword|\Pterodactyl\Models\User $user
+     * @param string                                                               $password
+     *
+     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
+     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     */
+    protected function resetPassword($user, $password)
+    {
+        $user = $this->userRepository->update($user->id, [
+            'password' => $this->hasher->make($password),
+            $user->getRememberTokenName() => Str::random(60),
+        ]);
+
+        $this->dispatcher->dispatch(new PasswordReset($user));
+
+        // If the user is not using 2FA log them in, otherwise skip this step and force a
+        // fresh login where they'll be prompted to enter a token.
+        if (! $user->use_totp) {
+            $this->guard()->login($user);
+        }
+
+        $this->hasTwoFactor = $user->use_totp;
+    }
+
     /**
      * Send a successful password reset response back to the callee.
      *
@@ -59,6 +127,7 @@ class ResetPasswordController extends Controller
         return response()->json([
             'success' => true,
             'redirect_to' => $this->redirectTo,
+            'send_to_login' => $this->hasTwoFactor,
         ]);
     }
 }

app/Http/Controllers/Base/AccountController.php

@@ -1,72 +0,0 @@
-<?php
-
-namespace Pterodactyl\Http\Controllers\Base;
-
-use Pterodactyl\Models\User;
-use Prologue\Alerts\AlertsMessageBag;
-use Pterodactyl\Http\Controllers\Controller;
-use Pterodactyl\Services\Users\UserUpdateService;
-use Pterodactyl\Http\Requests\Base\AccountDataFormRequest;
-
-class AccountController extends Controller
-{
-    /**
-     * @var \Prologue\Alerts\AlertsMessageBag
-     */
-    protected $alert;
-
-    /**
-     * @var \Pterodactyl\Services\Users\UserUpdateService
-     */
-    protected $updateService;
-
-    /**
-     * AccountController constructor.
-     *
-     * @param \Prologue\Alerts\AlertsMessageBag             $alert
-     * @param \Pterodactyl\Services\Users\UserUpdateService $updateService
-     */
-    public function __construct(AlertsMessageBag $alert, UserUpdateService $updateService)
-    {
-        $this->alert = $alert;
-        $this->updateService = $updateService;
-    }
-
-    /**
-     * Display base account information page.
-     *
-     * @return \Illuminate\View\View
-     */
-    public function index()
-    {
-        return view('base.account');
-    }
-
-    /**
-     * Update details for a user's account.
-     *
-     * @param \Pterodactyl\Http\Requests\Base\AccountDataFormRequest $request
-     * @return \Illuminate\Http\RedirectResponse
-     *
-     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
-     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
-     * @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
-     */
-    public function update(AccountDataFormRequest $request)
-    {
-        $data = [];
-        if ($request->input('do_action') === 'password') {
-            $data['password'] = $request->input('new_password');
-        } elseif ($request->input('do_action') === 'email') {
-            $data['email'] = $request->input('new_email');
-        } elseif ($request->input('do_action') === 'identity') {
-            $data = $request->only(['name_first', 'name_last', 'username']);
-        }
-
-        $this->updateService->setUserLevel(User::USER_LEVEL_USER);
-        $this->updateService->handle($request->user(), $data);
-        $this->alert->success(trans('base.account.details_updated'))->flash();
-
-        return redirect()->route('account');
-    }
-}

app/Http/Controllers/Base/SecurityController.php

@@ -3,6 +3,7 @@
 namespace Pterodactyl\Http\Controllers\Base;
 
 use Illuminate\Http\Request;
+use Illuminate\Http\JsonResponse;
 use Prologue\Alerts\AlertsMessageBag;
 use Pterodactyl\Http\Controllers\Controller;
 use Pterodactyl\Services\Users\TwoFactorSetupService;
@@ -62,36 +63,28 @@ class SecurityController extends Controller
     }
 
     /**
-     * Returns Security Management Page.
-     *
-     * @param \Illuminate\Http\Request $request
-     * @return \Illuminate\View\View
-     */
-    public function index(Request $request)
-    {
-        if ($this->config->get('session.driver') === 'database') {
-            $activeSessions = $this->repository->getUserSessions($request->user()->id);
-        }
-
-        return view('base.security', [
-            'sessions' => $activeSessions ?? null,
-        ]);
-    }
-
-    /**
-     * Generates TOTP Secret and returns popup data for user to verify
-     * that they can generate a valid response.
+     * Return information about the user's two-factor authentication status. If not enabled setup their
+     * secret and return information to allow the user to proceede with setup.
      *
      * @param \Illuminate\Http\Request $request
      * @return \Illuminate\Http\JsonResponse
-     *
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      */
-    public function generateTotp(Request $request)
+    public function index(Request $request): JsonResponse
     {
-        return response()->json([
-            'qrImage' => $this->twoFactorSetupService->handle($request->user()),
+        if ($request->user()->use_totp) {
+            return JsonResponse::create([
+                'enabled' => true,
+            ]);
+        }
+
+        $response = $this->twoFactorSetupService->handle($request->user());
+
+        return JsonResponse::create([
+            'enabled' => false,
+            'qr_image' => $response->get('image'),
+            'secret' => $response->get('secret'),
         ]);
     }
 
@@ -99,53 +92,43 @@ class SecurityController extends Controller
      * Verifies that 2FA token received is valid and will work on the account.
      *
      * @param \Illuminate\Http\Request $request
-     * @return \Illuminate\Http\Response
+     * @return \Illuminate\Http\JsonResponse
      *
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      */
-    public function setTotp(Request $request)
+    public function store(Request $request): JsonResponse
     {
         try {
             $this->toggleTwoFactorService->handle($request->user(), $request->input('token') ?? '');
-
-            return response('true');
         } catch (TwoFactorAuthenticationTokenInvalid $exception) {
-            return response('false');
+            $error = true;
         }
+
+        return JsonResponse::create([
+            'success' => ! isset($error),
+        ]);
     }
 
     /**
      * Disables TOTP on an account.
      *
      * @param \Illuminate\Http\Request $request
-     * @return \Illuminate\Http\RedirectResponse
+     * @return \Illuminate\Http\JsonResponse
      *
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      */
-    public function disableTotp(Request $request)
+    public function delete(Request $request): JsonResponse
     {
         try {
             $this->toggleTwoFactorService->handle($request->user(), $request->input('token') ?? '', false);
         } catch (TwoFactorAuthenticationTokenInvalid $exception) {
-            $this->alert->danger(trans('base.security.2fa_disable_error'))->flash();
+            $error = true;
         }
 
-        return redirect()->route('account.security');
-    }
-
-    /**
-     * Revokes a user session.
-     *
-     * @param \Illuminate\Http\Request $request
-     * @param string                   $id
-     * @return \Illuminate\Http\RedirectResponse
-     */
-    public function revoke(Request $request, string $id)
-    {
-        $this->repository->deleteUserSession($request->user()->id, $id);
-
-        return redirect()->route('account.security');
+        return JsonResponse::create([
+            'success' => ! isset($error),
+        ]);
     }
 }

app/Http/Controllers/Daemon/ActionController.php

@@ -7,9 +7,26 @@ use Illuminate\Http\Request;
 use Pterodactyl\Models\Node;
 use Pterodactyl\Models\Server;
 use Pterodactyl\Http\Controllers\Controller;
+use Pterodactyl\Events\Server\Installed as ServerInstalled;
+use Illuminate\Contracts\Events\Dispatcher as EventDispatcher;
 
 class ActionController extends Controller
 {
+    /**
+     * @var \Illuminate\Contracts\Events\Dispatcher
+     */
+    private $eventDispatcher;
+
+    /**
+     * ActionController constructor.
+     *
+     * @param \Illuminate\Contracts\Events\Dispatcher $eventDispatcher
+     */
+    public function __construct(EventDispatcher $eventDispatcher)
+    {
+        $this->eventDispatcher = $eventDispatcher;
+    }
+
     /**
      * Handles install toggle request from daemon.
      *
@@ -37,6 +54,11 @@ class ActionController extends Controller
         $server->installed = ($status === 'installed') ? 1 : 2;
         $server->save();
 
+        // Only fire event if server installed successfully.
+        if ($server->installed === 1) {
+            $this->eventDispatcher->dispatch(new ServerInstalled($server));
+        }
+
         return response()->json([]);
     }
 

app/Http/Controllers/Server/SubuserController.php

@@ -157,7 +157,6 @@ class SubuserController extends Controller
      * @return \Illuminate\Http\RedirectResponse
      *
      * @throws \Exception
-     * @throws \Illuminate\Auth\Access\AuthorizationException
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      * @throws \Pterodactyl\Exceptions\Service\Subuser\ServerSubuserExistsException
@@ -171,7 +170,7 @@ class SubuserController extends Controller
         $this->alert->success(trans('server.users.user_assigned'))->flash();
 
         return redirect()->route('server.subusers.view', [
-            'uuid' => $server->uuid,
+            'uuid' => $server->uuidShort,
             'id' => $subuser->hashid,
         ]);
     }

app/Http/Kernel.php

@@ -17,8 +17,8 @@ use Pterodactyl\Http\Middleware\LanguageMiddleware;
 use Illuminate\Foundation\Http\Kernel as HttpKernel;
 use Pterodactyl\Http\Middleware\Api\AuthenticateKey;
 use Illuminate\Routing\Middleware\SubstituteBindings;
-use Pterodactyl\Http\Middleware\AccessingValidServer;
 use Pterodactyl\Http\Middleware\Api\SetSessionDriver;
+use Illuminate\Session\Middleware\AuthenticateSession;
 use Illuminate\View\Middleware\ShareErrorsFromSession;
 use Pterodactyl\Http\Middleware\MaintenanceMiddleware;
 use Pterodactyl\Http\Middleware\RedirectIfAuthenticated;
@@ -27,6 +27,7 @@ use Pterodactyl\Http\Middleware\Api\AuthenticateIPAccess;
 use Pterodactyl\Http\Middleware\Api\ApiSubstituteBindings;
 use Illuminate\Foundation\Http\Middleware\ValidatePostSize;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
+use Pterodactyl\Http\Middleware\Server\AccessingValidServer;
 use Pterodactyl\Http\Middleware\Server\AuthenticateAsSubuser;
 use Pterodactyl\Http\Middleware\Api\Daemon\DaemonAuthenticate;
 use Pterodactyl\Http\Middleware\Server\SubuserBelongsToServer;
@@ -48,6 +49,7 @@ class Kernel extends HttpKernel
      */
     protected $middleware = [
         CheckForMaintenanceMode::class,
+        EncryptCookies::class,
         ValidatePostSize::class,
         TrimStrings::class,
         ConvertEmptyStringsToNull::class,
@@ -61,9 +63,9 @@ class Kernel extends HttpKernel
      */
     protected $middlewareGroups = [
         'web' => [
-            EncryptCookies::class,
             AddQueuedCookiesToResponse::class,
             StartSession::class,
+            AuthenticateSession::class,
             ShareErrorsFromSession::class,
             VerifyCsrfToken::class,
             SubstituteBindings::class,
@@ -80,8 +82,10 @@ class Kernel extends HttpKernel
         ],
         'client-api' => [
             'throttle:240,1',
-            SubstituteClientApiBindings::class,
+            StartSession::class,
             SetSessionDriver::class,
+            AuthenticateSession::class,
+            SubstituteClientApiBindings::class,
             'api..key:' . ApiKey::TYPE_ACCOUNT,
             AuthenticateIPAccess::class,
         ],

app/Http/Middleware/Api/AuthenticateKey.php

@@ -3,13 +3,12 @@
 namespace Pterodactyl\Http\Middleware\Api;
 
 use Closure;
-use Lcobucci\JWT\Parser;
 use Cake\Chronos\Chronos;
 use Illuminate\Http\Request;
+use Pterodactyl\Models\User;
 use Pterodactyl\Models\ApiKey;
 use Illuminate\Auth\AuthManager;
 use Illuminate\Contracts\Encryption\Encrypter;
-use Pterodactyl\Traits\Helpers\ProvidesJWTServices;
 use Symfony\Component\HttpKernel\Exception\HttpException;
 use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
 use Pterodactyl\Contracts\Repository\ApiKeyRepositoryInterface;
@@ -17,8 +16,6 @@ use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 class AuthenticateKey
 {
-    use ProvidesJWTServices;
-
     /**
      * @var \Illuminate\Auth\AuthManager
      */
@@ -62,57 +59,29 @@ class AuthenticateKey
      */
     public function handle(Request $request, Closure $next, int $keyType)
     {
-        if (is_null($request->bearerToken())) {
+        if (is_null($request->bearerToken()) && is_null($request->user())) {
             throw new HttpException(401, null, null, ['WWW-Authenticate' => 'Bearer']);
         }
 
         $raw = $request->bearerToken();
 
-        // This is an internal JWT, treat it differently to get the correct user before passing it along.
-        if (strlen($raw) > ApiKey::IDENTIFIER_LENGTH + ApiKey::KEY_LENGTH) {
-            $model = $this->authenticateJWT($raw);
+        // This is a request coming through using cookies, we have an authenticated user not using
+        // an API key. Make some fake API key models and continue on through the process.
+        if (empty($raw) && $request->user() instanceof User) {
+            $model = (new ApiKey())->forceFill([
+                'user_id' => $request->user()->id,
+                'key_type' => ApiKey::TYPE_ACCOUNT,
+            ]);
         } else {
             $model = $this->authenticateApiKey($raw, $keyType);
+            $this->auth->guard()->loginUsingId($model->user_id);
         }
 
-        $this->auth->guard()->loginUsingId($model->user_id);
         $request->attributes->set('api_key', $model);
 
         return $next($request);
     }
 
-    /**
-     * Authenticate an API request using a JWT rather than an API key.
-     *
-     * @param string $token
-     * @return \Pterodactyl\Models\ApiKey
-     */
-    protected function authenticateJWT(string $token): ApiKey
-    {
-        $token = (new Parser)->parse($token);
-
-        // If the key cannot be verified throw an exception to indicate that a bad
-        // authorization header was provided.
-        if (! $token->verify($this->getJWTSigner(), $this->getJWTSigningKey())) {
-            throw new HttpException(401, null, null, ['WWW-Authenticate' => 'Bearer']);
-        }
-
-        // Run through the token validation and throw an exception if the token is not valid.
-        if (
-            $token->getClaim('nbf') > Chronos::now()->getTimestamp()
-            || $token->getClaim('iss') !== 'Pterodactyl Panel'
-            || $token->getClaim('aud') !== config('app.url')
-            || $token->getClaim('exp') <= Chronos::now()->getTimestamp()
-        ) {
-            throw new AccessDeniedHttpException;
-        }
-
-        return (new ApiKey)->forceFill([
-            'user_id' => object_get($token->getClaim('user'), 'id', 0),
-            'key_type' => ApiKey::TYPE_ACCOUNT,
-        ]);
-    }
-
     /**
      * Authenticate an API key.
      *

app/Http/Middleware/Api/SetSessionDriver.php

@@ -4,16 +4,10 @@ namespace Pterodactyl\Http\Middleware\Api;
 
 use Closure;
 use Illuminate\Http\Request;
-use Illuminate\Contracts\Foundation\Application;
 use Illuminate\Contracts\Config\Repository as ConfigRepository;
 
 class SetSessionDriver
 {
-    /**
-     * @var \Illuminate\Contracts\Foundation\Application
-     */
-    private $app;
-
     /**
      * @var \Illuminate\Contracts\Config\Repository
      */
@@ -22,12 +16,10 @@ class SetSessionDriver
     /**
      * SetSessionDriver constructor.
      *
-     * @param \Illuminate\Contracts\Foundation\Application $app
-     * @param \Illuminate\Contracts\Config\Repository      $config
+     * @param \Illuminate\Contracts\Config\Repository $config
      */
-    public function __construct(Application $app, ConfigRepository $config)
+    public function __construct(ConfigRepository $config)
     {
-        $this->app = $app;
         $this->config = $config;
     }
 

app/Http/Middleware/RequireTwoFactorAuthentication.php

@@ -10,6 +10,7 @@
 namespace Pterodactyl\Http\Middleware;
 
 use Closure;
+use Illuminate\Support\Str;
 use Illuminate\Http\Request;
 use Prologue\Alerts\AlertsMessageBag;
 
@@ -24,27 +25,12 @@ class RequireTwoFactorAuthentication
      */
     private $alert;
 
-    /**
-     * The names of routes that should be accessible without 2FA enabled.
-     *
-     * @var array
-     */
-    protected $except = [
-        'account.security',
-        'account.security.revoke',
-        'account.security.totp',
-        'account.security.totp.set',
-        'account.security.totp.disable',
-        'auth.totp',
-        'auth.logout',
-    ];
-
     /**
      * The route to redirect a user to to enable 2FA.
      *
      * @var string
      */
-    protected $redirectRoute = 'account.security';
+    protected $redirectRoute = 'account';
 
     /**
      * RequireTwoFactorAuthentication constructor.
@@ -69,7 +55,8 @@ class RequireTwoFactorAuthentication
             return $next($request);
         }
 
-        if (in_array($request->route()->getName(), $this->except)) {
+        $current = $request->route()->getName();
+        if (in_array($current, ['auth', 'account']) || Str::startsWith($current, ['auth.', 'account.'])) {
             return $next($request);
         }
 

app/Http/Middleware/Server/AccessingValidServer.php

@@ -1,11 +1,10 @@
 <?php
 
-namespace Pterodactyl\Http\Middleware;
+namespace Pterodactyl\Http\Middleware\Server;
 
 use Closure;
 use Illuminate\Http\Request;
 use Pterodactyl\Models\Server;
-use Illuminate\Contracts\Session\Session;
 use Illuminate\Contracts\Routing\ResponseFactory;
 use Illuminate\Contracts\Config\Repository as ConfigRepository;
 use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
@@ -29,29 +28,21 @@ class AccessingValidServer
      */
     private $response;
 
-    /**
-     * @var \Illuminate\Contracts\Session\Session
-     */
-    private $session;
-
     /**
      * AccessingValidServer constructor.
      *
      * @param \Illuminate\Contracts\Config\Repository                     $config
      * @param \Illuminate\Contracts\Routing\ResponseFactory               $response
      * @param \Pterodactyl\Contracts\Repository\ServerRepositoryInterface $repository
-     * @param \Illuminate\Contracts\Session\Session                       $session
      */
     public function __construct(
         ConfigRepository $config,
         ResponseFactory $response,
-        ServerRepositoryInterface $repository,
-        Session $session
+        ServerRepositoryInterface $repository
     ) {
         $this->config = $config;
         $this->repository = $repository;
         $this->response = $response;
-        $this->session = $session;
     }
 
     /**
@@ -61,7 +52,6 @@ class AccessingValidServer
      * @param \Closure                 $next
      * @return \Illuminate\Http\Response|mixed
      *
-     * @throws \Illuminate\Auth\AuthenticationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      * @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException
      * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
@@ -90,10 +80,6 @@ class AccessingValidServer
             return $this->response->view('errors.installing', [], 409);
         }
 
-        // Store the server in the session.
-        // @todo remove from session. use request attributes.
-        $this->session->now('server_data.model', $server);
-
         // Add server to the request attributes. This will replace sessions
         // as files are updated.
         $request->attributes->set('server', $server);

app/Http/Requests/Api/Application/Nodes/StoreNodeRequest.php

@@ -74,7 +74,7 @@ class StoreNodeRequest extends ApplicationApiRequest
         $response = parent::validated();
         $response['daemonListen'] = $response['daemon_listen'];
         $response['daemonSFTP'] = $response['daemon_sftp'];
-        $response['daemonBase'] = $response['daemon_base'];
+        $response['daemonBase'] = $response['daemon_base'] ?? (new Node)->getAttribute('daemonBase');
 
         unset($response['daemon_base'], $response['daemon_listen'], $response['daemon_sftp']);
 

app/Http/Requests/Api/Client/Account/UpdateEmailRequest.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Pterodactyl\Http\Requests\Api\Client\Account;
+
+use Pterodactyl\Models\User;
+use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
+use Pterodactyl\Exceptions\Http\Base\InvalidPasswordProvidedException;
+
+class UpdateEmailRequest extends ClientApiRequest
+{
+    /**
+     * @return bool
+     *
+     * @throws \Pterodactyl\Exceptions\Http\Base\InvalidPasswordProvidedException
+     */
+    public function authorize(): bool
+    {
+        if (! parent::authorize()) {
+            return false;
+        }
+
+        // Verify password matches when changing password or email.
+        if (! password_verify($this->input('password'), $this->user()->password)) {
+            throw new InvalidPasswordProvidedException(trans('validation.internal.invalid_password'));
+        }
+
+        return true;
+    }
+
+    /**
+     * @return array
+     */
+    public function rules(): array
+    {
+        $rules = User::getUpdateRulesForId($this->user()->id);
+
+        return ['email' => $rules['email']];
+    }
+}

app/Http/Requests/Api/Client/Account/UpdatePasswordRequest.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Pterodactyl\Http\Requests\Api\Client\Account;
+
+use Pterodactyl\Models\User;
+use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
+use Pterodactyl\Exceptions\Http\Base\InvalidPasswordProvidedException;
+
+class UpdatePasswordRequest extends ClientApiRequest
+{
+    /**
+     * @return bool
+     *
+     * @throws \Pterodactyl\Exceptions\Http\Base\InvalidPasswordProvidedException
+     */
+    public function authorize(): bool
+    {
+        if (! parent::authorize()) {
+            return false;
+        }
+
+        // Verify password matches when changing password or email.
+        if (! password_verify($this->input('current_password'), $this->user()->password)) {
+            throw new InvalidPasswordProvidedException(trans('validation.internal.invalid_password'));
+        }
+
+        return true;
+    }
+
+    /**
+     * @return array
+     */
+    public function rules(): array
+    {
+        $rules = User::getUpdateRulesForId($this->user()->id);
+
+        return ['password' => array_merge($rules['password'], ['confirmed'])];
+    }
+}

app/Http/Requests/Base/AccountDataFormRequest.php

@@ -28,7 +28,7 @@ class AccountDataFormRequest extends FrontendUserFormRequest
         // Verify password matches when changing password or email.
         if (in_array($this->input('do_action'), ['password', 'email'])) {
             if (! password_verify($this->input('current_password'), $this->user()->password)) {
-                throw new InvalidPasswordProvidedException(trans('base.account.invalid_password'));
+                throw new InvalidPasswordProvidedException(trans('validation.internal.invalid_password'));
             }
         }
 

app/Http/Requests/Server/Subuser/SubuserStoreFormRequest.php

@@ -25,7 +25,7 @@ class SubuserStoreFormRequest extends ServerFormRequest
     {
         return [
             'email' => 'required|email',
-            'permissions' => 'present|array',
+            'permissions' => 'sometimes|array',
         ];
     }
 }