misc_pterodactyl-panel/app/Http/Middleware/Server/SubuserBelongsToServer.php

68 lines
2.1 KiB
PHP
Raw Normal View History

2017-09-04 23:12:13 +00:00
<?php
namespace Pterodactyl\Http\Middleware\Server;
use Closure;
2017-10-29 17:37:25 +00:00
use Illuminate\Http\Request;
2017-09-04 23:12:13 +00:00
use Pterodactyl\Exceptions\DisplayException;
use Pterodactyl\Contracts\Extensions\HashidsInterface;
use Pterodactyl\Contracts\Repository\SubuserRepositoryInterface;
2017-09-04 23:12:13 +00:00
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
class SubuserBelongsToServer
2017-09-04 23:12:13 +00:00
{
/**
* @var \Pterodactyl\Contracts\Extensions\HashidsInterface
2017-09-04 23:12:13 +00:00
*/
private $hashids;
2017-09-04 23:12:13 +00:00
/**
* @var \Pterodactyl\Contracts\Repository\SubuserRepositoryInterface
2017-09-04 23:12:13 +00:00
*/
private $repository;
2017-09-04 23:12:13 +00:00
/**
* SubuserAccess constructor.
*
* @param \Pterodactyl\Contracts\Extensions\HashidsInterface $hashids
2017-09-04 23:12:13 +00:00
* @param \Pterodactyl\Contracts\Repository\SubuserRepositoryInterface $repository
*/
public function __construct(HashidsInterface $hashids, SubuserRepositoryInterface $repository)
2017-09-04 23:12:13 +00:00
{
$this->hashids = $hashids;
2017-09-04 23:12:13 +00:00
$this->repository = $repository;
}
/**
2017-09-30 16:45:24 +00:00
* Determine if a user has permission to access and modify subuser.
2017-09-04 23:12:13 +00:00
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*
* @throws \Pterodactyl\Exceptions\DisplayException
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
* @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
2017-09-04 23:12:13 +00:00
*/
2017-10-29 17:37:25 +00:00
public function handle(Request $request, Closure $next)
2017-09-04 23:12:13 +00:00
{
$server = $request->attributes->get('server');
2017-09-04 23:12:13 +00:00
$hash = $request->route()->parameter('subuser', 0);
$subuser = $this->repository->find($this->hashids->decodeFirst($hash, 0));
if (! $subuser || $subuser->server_id !== $server->id) {
2017-09-04 23:12:13 +00:00
throw new NotFoundHttpException;
}
if ($request->method() === 'PATCH') {
if ($subuser->user_id === $request->user()->id) {
throw new DisplayException(trans('exceptions.subusers.editing_self'));
}
}
$request->attributes->set('subuser', $subuser);
2017-09-04 23:12:13 +00:00
return $next($request);
}
}