Skynet/misc_pterodactyl-panel
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Have the panel handle all of the authorization for both public key and password based attempts

Browse source
This commit is contained in:
DaneEveritt 2022-05-15 16:00:08 -04:00
parent e856daee19
commit 412ac5ef39
No known key found for this signature in database
GPG key ID: EEA66103B3D71F53
2 changed files with 4 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/Http/Controllers/Api/Remote/SftpAuthenticationController.php
View file

@ -28,7 +28,8 @@ abstract class SftpAuthenticationController extends Controller
/** /**
* Authenticate a set of credentials and return the associated server details * Authenticate a set of credentials and return the associated server details
* for a SFTP connection on the daemon. * for a SFTP connection on the daemon. This supports both public key and password
* based credentials.
*/ */
public function __invoke(SftpAuthenticationFormRequest $request): JsonResponse public function __invoke(SftpAuthenticationFormRequest $request): JsonResponse
{ {
@ -44,9 +45,7 @@ abstract class SftpAuthenticationController extends Controller
$this->reject($request); $this->reject($request);
} }
} else { } else {
// Start blocking requests when the user has no public keys in the first place — if (!$user->sshKeys()->where('public_key', $request->input('password'))->exists()) {
// don't let the user spam this endpoint.
if ($user->sshKeys->isEmpty()) {
$this->reject($request); $this->reject($request);
} }
} }

5
app/Http/Requests/Api/Remote/SftpAuthenticationFormRequest.php
View file

@ -2,7 +2,6 @@
namespace Pterodactyl\Http\Requests\Api\Remote; namespace Pterodactyl\Http\Requests\Api\Remote;
use Illuminate\Validation\Rule;
use Illuminate\Foundation\Http\FormRequest; use Illuminate\Foundation\Http\FormRequest;
class SftpAuthenticationFormRequest extends FormRequest class SftpAuthenticationFormRequest extends FormRequest
@ -27,9 +26,7 @@ class SftpAuthenticationFormRequest extends FormRequest
return [ return [
'type' => ['nullable', 'in:password,public_key'], 'type' => ['nullable', 'in:password,public_key'],
'username' => ['required', 'string'], 'username' => ['required', 'string'],
'password' => [ 'password' => ['required', 'string'],
Rule::when(fn () => $this->input('type') !== 'public_key', ['required', 'string'], ['nullable']),
],
]; ];
} }