misc_pterodactyl-panel/tests/Integration/Api/Client/Server/Subuser/DeleteSubuserTest.php

68 lines
2.9 KiB
PHP
Raw Normal View History

<?php
namespace Pterodactyl\Tests\Integration\Api\Client\Server\Subuser;
2020-11-07 06:33:39 +00:00
use Mockery;
use Ramsey\Uuid\Uuid;
use Pterodactyl\Models\User;
use Pterodactyl\Models\Subuser;
use Pterodactyl\Models\Permission;
2020-11-07 06:33:39 +00:00
use Pterodactyl\Repositories\Wings\DaemonServerRepository;
use Pterodactyl\Tests\Integration\Api\Client\ClientApiIntegrationTestCase;
class DeleteSubuserTest extends ClientApiIntegrationTestCase
{
/**
* Guards against PHP's exciting behavior where a string can be cast to an int and only
* the first numeric digits are returned. This causes UUIDs to be returned as an int when
* looking up users, thus returning the wrong subusers (or no subuser at all).
*
* For example, 12aaaaaa-bbbb-cccc-ddddeeeeffff would be cast to "12" if you tried to cast
* it to an integer. Then, in the deep API middlewares you would end up trying to load a user
* with an ID of 12, which may or may not exist and be wrongly assigned to the model object.
*
* @see https://github.com/pterodactyl/panel/issues/2359
*/
public function testCorrectSubuserIsDeletedFromServer()
{
2020-11-07 06:33:39 +00:00
$this->swap(DaemonServerRepository::class, $mock = Mockery::mock(DaemonServerRepository::class));
[$user, $server] = $this->generateTestAccount();
/** @var \Pterodactyl\Models\User $differentUser */
$differentUser = factory(User::class)->create();
// Generate a UUID that lines up with a user in the database if it were to be cast to an int.
$uuid = $differentUser->id . str_repeat('a', strlen((string)$differentUser->id)) . substr(Uuid::uuid4()->toString(), 8);
/** @var \Pterodactyl\Models\User $subuser */
$subuser = factory(User::class)->create(['uuid' => $uuid]);
Subuser::query()->forceCreate([
'user_id' => $subuser->id,
'server_id' => $server->id,
2020-11-07 06:33:39 +00:00
'permissions' => [Permission::ACTION_WEBSOCKET_CONNECT],
]);
2020-11-07 06:33:39 +00:00
$mock->expects('setServer->revokeJTIs')->with([md5($subuser->id . $server->uuid)])->andReturnUndefined();
$this->actingAs($user)->deleteJson($this->link($server) . "/users/{$subuser->uuid}")->assertNoContent();
// Try the same test, but this time with a UUID that if cast to an int (shouldn't) line up with
// anything in the database.
$uuid = '18180000' . substr(Uuid::uuid4()->toString(), 8);
/** @var \Pterodactyl\Models\User $subuser */
$subuser = factory(User::class)->create(['uuid' => $uuid]);
Subuser::query()->forceCreate([
'user_id' => $subuser->id,
'server_id' => $server->id,
2020-11-07 06:33:39 +00:00
'permissions' => [Permission::ACTION_WEBSOCKET_CONNECT],
]);
2020-11-07 06:33:39 +00:00
$mock->expects('setServer->revokeJTIs')->with([md5($subuser->id . $server->uuid)])->andReturnUndefined();
$this->actingAs($user)->deleteJson($this->link($server) . "/users/{$subuser->uuid}")->assertNoContent();
}
}