Merge branch 'feature/vuejs' into feature/vue-serverview

app/Http/Controllers/Admin/StatisticsController.php

@@ -2,16 +2,14 @@
 
 namespace Pterodactyl\Http\Controllers\Admin;
 
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\DB;
-use Pterodactyl\Contracts\Repository\AllocationRepositoryInterface;
-use Pterodactyl\Contracts\Repository\DatabaseRepositoryInterface;
-use Pterodactyl\Contracts\Repository\EggRepositoryInterface;
-use Pterodactyl\Contracts\Repository\NodeRepositoryInterface;
-use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
-use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
 use Pterodactyl\Http\Controllers\Controller;
+use Pterodactyl\Contracts\Repository\EggRepositoryInterface;
 use Pterodactyl\Traits\Controllers\PlainJavascriptInjection;
+use Pterodactyl\Contracts\Repository\NodeRepositoryInterface;
+use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
+use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
+use Pterodactyl\Contracts\Repository\DatabaseRepositoryInterface;
+use Pterodactyl\Contracts\Repository\AllocationRepositoryInterface;
 
 class StatisticsController extends Controller
 {
@@ -29,15 +27,14 @@ class StatisticsController extends Controller
 
     private $userRepository;
 
-    function __construct(
+    public function __construct(
         AllocationRepositoryInterface $allocationRepository,
         DatabaseRepositoryInterface $databaseRepository,
         EggRepositoryInterface $eggRepository,
         NodeRepositoryInterface $nodeRepository,
         ServerRepositoryInterface $serverRepository,
         UserRepositoryInterface $userRepository
-    )
-    {
+    ) {
         $this->allocationRepository = $allocationRepository;
         $this->databaseRepository = $databaseRepository;
         $this->eggRepository = $eggRepository;
@@ -83,7 +80,7 @@ class StatisticsController extends Controller
             'nodes' => $nodes,
             'tokens' => $tokens,
         ]);
-        
+
         return view('admin.statistics', [
             'servers' => $servers,
             'nodes' => $nodes,
@@ -97,5 +94,4 @@ class StatisticsController extends Controller
             'totalAllocations' => $totalAllocations,
         ]);
     }
-
 }

app/Http/Controllers/Api/Client/AccountController.php

@@ -3,14 +3,71 @@
 namespace Pterodactyl\Http\Controllers\Api\Client;
 
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Pterodactyl\Services\Users\UserUpdateService;
 use Pterodactyl\Transformers\Api\Client\AccountTransformer;
+use Pterodactyl\Http\Requests\Api\Client\Account\UpdateEmailRequest;
+use Pterodactyl\Http\Requests\Api\Client\Account\UpdatePasswordRequest;
 
 class AccountController extends ClientApiController
 {
+    /**
+     * @var \Pterodactyl\Services\Users\UserUpdateService
+     */
+    private $updateService;
+
+    /**
+     * AccountController constructor.
+     *
+     * @param \Pterodactyl\Services\Users\UserUpdateService $updateService
+     */
+    public function __construct(UserUpdateService $updateService)
+    {
+        parent::__construct();
+
+        $this->updateService = $updateService;
+    }
+
+    /**
+     * @param Request $request
+     * @return array
+     */
     public function index(Request $request): array
     {
         return $this->fractal->item($request->user())
             ->transformWith($this->getTransformer(AccountTransformer::class))
             ->toArray();
     }
+
+    /**
+     * Update the authenticated user's email address.
+     *
+     * @param \Pterodactyl\Http\Requests\Api\Client\Account\UpdateEmailRequest $request
+     * @return \Illuminate\Http\Response
+     *
+     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
+     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     */
+    public function updateEmail(UpdateEmailRequest $request): Response
+    {
+        $this->updateService->handle($request->user(), $request->validated());
+
+        return response('', Response::HTTP_CREATED);
+    }
+
+    /**
+     * Update the authenticated user's password.
+     *
+     * @param \Pterodactyl\Http\Requests\Api\Client\Account\UpdatePasswordRequest $request
+     * @return \Illuminate\Http\Response
+     *
+     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
+     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     */
+    public function updatePassword(UpdatePasswordRequest $request): Response
+    {
+        $this->updateService->handle($request->user(), $request->validated());
+
+        return response('', Response::HTTP_CREATED);
+    }
 }

app/Http/Controllers/Auth/AbstractLoginController.php

@@ -2,8 +2,6 @@
 
 namespace Pterodactyl\Http\Controllers\Auth;
 
-use Cake\Chronos\Chronos;
-use Lcobucci\JWT\Builder;
 use Illuminate\Http\Request;
 use Pterodactyl\Models\User;
 use Illuminate\Auth\AuthManager;
@@ -15,25 +13,18 @@ use Pterodactyl\Http\Controllers\Controller;
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Contracts\Encryption\Encrypter;
 use Illuminate\Foundation\Auth\AuthenticatesUsers;
-use Pterodactyl\Traits\Helpers\ProvidesJWTServices;
-use Pterodactyl\Transformers\Api\Client\AccountTransformer;
 use Illuminate\Contracts\Cache\Repository as CacheRepository;
 use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
 
 abstract class AbstractLoginController extends Controller
 {
-    use AuthenticatesUsers, ProvidesJWTServices;
+    use AuthenticatesUsers;
 
     /**
      * @var \Illuminate\Auth\AuthManager
      */
     protected $auth;
 
-    /**
-     * @var \Lcobucci\JWT\Builder
-     */
-    protected $builder;
-
     /**
      * @var \Illuminate\Contracts\Cache\Repository
      */
@@ -79,7 +70,6 @@ abstract class AbstractLoginController extends Controller
      * LoginController constructor.
      *
      * @param \Illuminate\Auth\AuthManager                              $auth
-     * @param \Lcobucci\JWT\Builder                                     $builder
      * @param \Illuminate\Contracts\Cache\Repository                    $cache
      * @param \Illuminate\Contracts\Encryption\Encrypter                $encrypter
      * @param \PragmaRX\Google2FA\Google2FA                             $google2FA
@@ -87,14 +77,12 @@ abstract class AbstractLoginController extends Controller
      */
     public function __construct(
         AuthManager $auth,
-        Builder $builder,
         CacheRepository $cache,
         Encrypter $encrypter,
         Google2FA $google2FA,
         UserRepositoryInterface $repository
     ) {
         $this->auth = $auth;
-        $this->builder = $builder;
         $this->cache = $cache;
         $this->encrypter = $encrypter;
         $this->google2FA = $google2FA;
@@ -143,32 +131,10 @@ abstract class AbstractLoginController extends Controller
         return response()->json([
             'complete' => true,
             'intended' => $this->redirectPath(),
-            'jwt' => $this->createJsonWebToken($user),
+            'user' => $user->toVueObject(),
         ]);
     }
 
-    /**
-     * Create a new JWT for the request and sign it using the signing key.
-     *
-     * @param User $user
-     * @return string
-     */
-    protected function createJsonWebToken(User $user): string
-    {
-        $token = $this->builder
-            ->setIssuer('Pterodactyl Panel')
-            ->setAudience(config('app.url'))
-            ->setId(str_random(16), true)
-            ->setIssuedAt(Chronos::now()->getTimestamp())
-            ->setNotBefore(Chronos::now()->getTimestamp())
-            ->setExpiration(Chronos::now()->addSeconds(config('session.lifetime'))->getTimestamp())
-            ->set('user', (new AccountTransformer())->transform($user))
-            ->sign($this->getJWTSigner(), $this->getJWTSigningKey())
-            ->getToken();
-
-        return $token->__toString();
-    }
-
     /**
      * Determine if the user is logging in using an email or username,.
      *

app/Http/Controllers/Auth/ResetPasswordController.php

@@ -2,12 +2,17 @@
 
 namespace Pterodactyl\Http\Controllers\Auth;
 
+use Illuminate\Support\Str;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Contracts\Hashing\Hasher;
 use Illuminate\Support\Facades\Password;
+use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Contracts\Events\Dispatcher;
 use Pterodactyl\Exceptions\DisplayException;
 use Pterodactyl\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\ResetsPasswords;
 use Pterodactyl\Http\Requests\Auth\ResetPasswordRequest;
+use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
 
 class ResetPasswordController extends Controller
 {
@@ -20,6 +25,40 @@ class ResetPasswordController extends Controller
      */
     public $redirectTo = '/';
 
+    /**
+     * @var bool
+     */
+    protected $hasTwoFactor = false;
+
+    /**
+     * @var \Illuminate\Contracts\Events\Dispatcher
+     */
+    private $dispatcher;
+
+    /**
+     * @var \Illuminate\Contracts\Hashing\Hasher
+     */
+    private $hasher;
+
+    /**
+     * @var \Pterodactyl\Contracts\Repository\UserRepositoryInterface
+     */
+    private $userRepository;
+
+    /**
+     * ResetPasswordController constructor.
+     *
+     * @param \Illuminate\Contracts\Events\Dispatcher                   $dispatcher
+     * @param \Illuminate\Contracts\Hashing\Hasher                      $hasher
+     * @param \Pterodactyl\Contracts\Repository\UserRepositoryInterface $userRepository
+     */
+    public function __construct(Dispatcher $dispatcher, Hasher $hasher, UserRepositoryInterface $userRepository)
+    {
+        $this->dispatcher = $dispatcher;
+        $this->hasher = $hasher;
+        $this->userRepository = $userRepository;
+    }
+
     /**
      * Reset the given user's password.
      *
@@ -49,6 +88,35 @@ class ResetPasswordController extends Controller
         throw new DisplayException(trans($response));
     }
 
+    /**
+     * Reset the given user's password. If the user has two-factor authentication enabled on their
+     * account do not automatically log them in. In those cases, send the user back to the login
+     * form with a note telling them their password was changed and to log back in.
+     *
+     * @param \Illuminate\Contracts\Auth\CanResetPassword|\Pterodactyl\Models\User $user
+     * @param string                                                               $password
+     *
+     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
+     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     */
+    protected function resetPassword($user, $password)
+    {
+        $user = $this->userRepository->update($user->id, [
+            'password' => $this->hasher->make($password),
+            $user->getRememberTokenName() => Str::random(60),
+        ]);
+
+        $this->dispatcher->dispatch(new PasswordReset($user));
+
+        // If the user is not using 2FA log them in, otherwise skip this step and force a
+        // fresh login where they'll be prompted to enter a token.
+        if (! $user->use_totp) {
+            $this->guard()->login($user);
+        }
+
+        $this->hasTwoFactor = $user->use_totp;
+    }
+
     /**
      * Send a successful password reset response back to the callee.
      *
@@ -59,6 +127,7 @@ class ResetPasswordController extends Controller
         return response()->json([
             'success' => true,
             'redirect_to' => $this->redirectTo,
+            'send_to_login' => $this->hasTwoFactor,
         ]);
     }
 }

app/Http/Controllers/Base/AccountController.php

@@ -1,72 +0,0 @@
-<?php
-
-namespace Pterodactyl\Http\Controllers\Base;
-
-use Pterodactyl\Models\User;
-use Prologue\Alerts\AlertsMessageBag;
-use Pterodactyl\Http\Controllers\Controller;
-use Pterodactyl\Services\Users\UserUpdateService;
-use Pterodactyl\Http\Requests\Base\AccountDataFormRequest;
-
-class AccountController extends Controller
-{
-    /**
-     * @var \Prologue\Alerts\AlertsMessageBag
-     */
-    protected $alert;
-
-    /**
-     * @var \Pterodactyl\Services\Users\UserUpdateService
-     */
-    protected $updateService;
-
-    /**
-     * AccountController constructor.
-     *
-     * @param \Prologue\Alerts\AlertsMessageBag             $alert
-     * @param \Pterodactyl\Services\Users\UserUpdateService $updateService
-     */
-    public function __construct(AlertsMessageBag $alert, UserUpdateService $updateService)
-    {
-        $this->alert = $alert;
-        $this->updateService = $updateService;
-    }
-
-    /**
-     * Display base account information page.
-     *
-     * @return \Illuminate\View\View
-     */
-    public function index()
-    {
-        return view('base.account');
-    }
-
-    /**
-     * Update details for a user's account.
-     *
-     * @param \Pterodactyl\Http\Requests\Base\AccountDataFormRequest $request
-     * @return \Illuminate\Http\RedirectResponse
-     *
-     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
-     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
-     * @throws \Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException
-     */
-    public function update(AccountDataFormRequest $request)
-    {
-        $data = [];
-        if ($request->input('do_action') === 'password') {
-            $data['password'] = $request->input('new_password');
-        } elseif ($request->input('do_action') === 'email') {
-            $data['email'] = $request->input('new_email');
-        } elseif ($request->input('do_action') === 'identity') {
-            $data = $request->only(['name_first', 'name_last', 'username']);
-        }
-
-        $this->updateService->setUserLevel(User::USER_LEVEL_USER);
-        $this->updateService->handle($request->user(), $data);
-        $this->alert->success(trans('base.account.details_updated'))->flash();
-
-        return redirect()->route('account');
-    }
-}

app/Http/Controllers/Base/SecurityController.php

@@ -3,6 +3,7 @@
 namespace Pterodactyl\Http\Controllers\Base;
 
 use Illuminate\Http\Request;
+use Illuminate\Http\JsonResponse;
 use Prologue\Alerts\AlertsMessageBag;
 use Pterodactyl\Http\Controllers\Controller;
 use Pterodactyl\Services\Users\TwoFactorSetupService;
@@ -62,36 +63,28 @@ class SecurityController extends Controller
     }
 
     /**
-     * Returns Security Management Page.
-     *
-     * @param \Illuminate\Http\Request $request
-     * @return \Illuminate\View\View
-     */
-    public function index(Request $request)
-    {
-        if ($this->config->get('session.driver') === 'database') {
-            $activeSessions = $this->repository->getUserSessions($request->user()->id);
-        }
-
-        return view('base.security', [
-            'sessions' => $activeSessions ?? null,
-        ]);
-    }
-
-    /**
-     * Generates TOTP Secret and returns popup data for user to verify
-     * that they can generate a valid response.
+     * Return information about the user's two-factor authentication status. If not enabled setup their
+     * secret and return information to allow the user to proceede with setup.
      *
      * @param \Illuminate\Http\Request $request
      * @return \Illuminate\Http\JsonResponse
-     *
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      */
-    public function generateTotp(Request $request)
+    public function index(Request $request): JsonResponse
     {
-        return response()->json([
-            'qrImage' => $this->twoFactorSetupService->handle($request->user()),
+        if ($request->user()->use_totp) {
+            return JsonResponse::create([
+                'enabled' => true,
+            ]);
+        }
+
+        $response = $this->twoFactorSetupService->handle($request->user());
+
+        return JsonResponse::create([
+            'enabled' => false,
+            'qr_image' => $response->get('image'),
+            'secret' => $response->get('secret'),
         ]);
     }
 
@@ -99,53 +92,43 @@ class SecurityController extends Controller
      * Verifies that 2FA token received is valid and will work on the account.
      *
      * @param \Illuminate\Http\Request $request
-     * @return \Illuminate\Http\Response
+     * @return \Illuminate\Http\JsonResponse
      *
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      */
-    public function setTotp(Request $request)
+    public function store(Request $request): JsonResponse
     {
         try {
             $this->toggleTwoFactorService->handle($request->user(), $request->input('token') ?? '');
-
-            return response('true');
         } catch (TwoFactorAuthenticationTokenInvalid $exception) {
-            return response('false');
+            $error = true;
         }
+
+        return JsonResponse::create([
+            'success' => ! isset($error),
+        ]);
     }
 
     /**
      * Disables TOTP on an account.
      *
      * @param \Illuminate\Http\Request $request
-     * @return \Illuminate\Http\RedirectResponse
+     * @return \Illuminate\Http\JsonResponse
      *
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      */
-    public function disableTotp(Request $request)
+    public function delete(Request $request): JsonResponse
     {
         try {
             $this->toggleTwoFactorService->handle($request->user(), $request->input('token') ?? '', false);
         } catch (TwoFactorAuthenticationTokenInvalid $exception) {
-            $this->alert->danger(trans('base.security.2fa_disable_error'))->flash();
+            $error = true;
         }
 
-        return redirect()->route('account.security');
-    }
-
-    /**
-     * Revokes a user session.
-     *
-     * @param \Illuminate\Http\Request $request
-     * @param string                   $id
-     * @return \Illuminate\Http\RedirectResponse
-     */
-    public function revoke(Request $request, string $id)
-    {
-        $this->repository->deleteUserSession($request->user()->id, $id);
-
-        return redirect()->route('account.security');
+        return JsonResponse::create([
+            'success' => ! isset($error),
+        ]);
     }
 }

app/Http/Controllers/Daemon/ActionController.php

@@ -7,9 +7,26 @@ use Illuminate\Http\Request;
 use Pterodactyl\Models\Node;
 use Pterodactyl\Models\Server;
 use Pterodactyl\Http\Controllers\Controller;
+use Pterodactyl\Events\Server\Installed as ServerInstalled;
+use Illuminate\Contracts\Events\Dispatcher as EventDispatcher;
 
 class ActionController extends Controller
 {
+    /**
+     * @var \Illuminate\Contracts\Events\Dispatcher
+     */
+    private $eventDispatcher;
+
+    /**
+     * ActionController constructor.
+     *
+     * @param \Illuminate\Contracts\Events\Dispatcher $eventDispatcher
+     */
+    public function __construct(EventDispatcher $eventDispatcher)
+    {
+        $this->eventDispatcher = $eventDispatcher;
+    }
+
     /**
      * Handles install toggle request from daemon.
      *
@@ -37,6 +54,11 @@ class ActionController extends Controller
         $server->installed = ($status === 'installed') ? 1 : 2;
         $server->save();
 
+        // Only fire event if server installed successfully.
+        if ($server->installed === 1) {
+            $this->eventDispatcher->dispatch(new ServerInstalled($server));
+        }
+
         return response()->json([]);
     }
 

app/Http/Controllers/Server/SubuserController.php

@@ -157,7 +157,6 @@ class SubuserController extends Controller
      * @return \Illuminate\Http\RedirectResponse
      *
      * @throws \Exception
-     * @throws \Illuminate\Auth\Access\AuthorizationException
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      * @throws \Pterodactyl\Exceptions\Service\Subuser\ServerSubuserExistsException
@@ -171,7 +170,7 @@ class SubuserController extends Controller
         $this->alert->success(trans('server.users.user_assigned'))->flash();
 
         return redirect()->route('server.subusers.view', [
-            'uuid' => $server->uuid,
+            'uuid' => $server->uuidShort,
             'id' => $subuser->hashid,
         ]);
     }