fix: exclude any permissions not defined internally when updating or creating subusers (#4416)
This commit is contained in:
Dane Everitt
GitHub
parent
597821b3bb
commit
c748fa9842
3 changed files with 154 additions and 31 deletions
|
|
@ -190,10 +190,23 @@ class SubuserController extends ClientApiController
|
|||
}
|
||||
|
||||
/**
|
||||
* Returns the default permissions for all subusers to ensure none are ever removed wrongly.
|
||||
* Returns the default permissions for subusers and parses out any permissions
|
||||
* that were passed that do not also exist in the internally tracked list of
|
||||
* permissions.
|
||||
*/
|
||||
protected function getDefaultPermissions(Request $request): array
|
||||
{
|
||||
return array_unique(array_merge($request->input('permissions') ?? [], [Permission::ACTION_WEBSOCKET_CONNECT]));
|
||||
$allowed = Permission::permissions()
|
||||
->map(function ($value, $prefix) {
|
||||
return array_map(function ($value) use ($prefix) {
|
||||
return "$prefix.$value";
|
||||
}, array_keys($value['keys']));
|
||||
})
|
||||
->flatten()
|
||||
->all();
|
||||
|
||||
$cleaned = array_intersect($request->input('permissions') ?? [], $allowed);
|
||||
|
||||
return array_unique(array_merge($cleaned, [Permission::ACTION_WEBSOCKET_CONNECT]));
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,45 +2,22 @@
|
|||
|
||||
namespace Pterodactyl\Policies;
|
||||
|
||||
use Carbon\Carbon;
|
||||
use Pterodactyl\Models\User;
|
||||
use Pterodactyl\Models\Server;
|
||||
use Illuminate\Contracts\Cache\Repository as CacheRepository;
|
||||
|
||||
class ServerPolicy
|
||||
{
|
||||
/**
|
||||
* @var \Illuminate\Contracts\Cache\Repository
|
||||
* Checks if the user has the given permission on/for the server.
|
||||
*/
|
||||
private $cache;
|
||||
|
||||
/**
|
||||
* ServerPolicy constructor.
|
||||
*/
|
||||
public function __construct(CacheRepository $cache)
|
||||
protected function checkPermission(User $user, Server $server, string $permission): bool
|
||||
{
|
||||
$this->cache = $cache;
|
||||
$subuser = $server->subusers->where('user_id', $user->id)->first();
|
||||
if (!$subuser || empty($permission)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if the user has the given permission on/for the server.
|
||||
*
|
||||
* @param string $permission
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
protected function checkPermission(User $user, Server $server, $permission)
|
||||
{
|
||||
$key = sprintf('ServerPolicy.%s.%s', $user->uuid, $server->uuid);
|
||||
|
||||
$permissions = $this->cache->remember($key, Carbon::now()->addSeconds(5), function () use ($user, $server) {
|
||||
/** @var \Pterodactyl\Models\Subuser|null $subuser */
|
||||
$subuser = $server->subusers()->where('user_id', $user->id)->first();
|
||||
|
||||
return $subuser ? $subuser->permissions : [];
|
||||
});
|
||||
|
||||
return in_array($permission, $permissions);
|
||||
return in_array($permission, $subuser->permissions);
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -0,0 +1,133 @@
|
|||
<?php
|
||||
|
||||
namespace Pterodactyl\Tests\Integration\Api\Client\Server\Subuser;
|
||||
|
||||
use Pterodactyl\Models\User;
|
||||
use Pterodactyl\Models\Subuser;
|
||||
use Pterodactyl\Models\Permission;
|
||||
use Pterodactyl\Tests\Integration\Api\Client\ClientApiIntegrationTestCase;
|
||||
|
||||
class UpdateSubuserTest extends ClientApiIntegrationTestCase
|
||||
{
|
||||
/**
|
||||
* Test that the correct permissions are applied to the account when making updates
|
||||
* to a subusers permissions.
|
||||
*/
|
||||
public function testCorrectPermissionsAreRequiredForUpdating()
|
||||
{
|
||||
[$user, $server] = $this->generateTestAccount(['user.read']);
|
||||
|
||||
$subuser = Subuser::factory()
|
||||
->for(User::factory()->create())
|
||||
->for($server)
|
||||
->create([
|
||||
'permissions' => ['control.start'],
|
||||
]);
|
||||
|
||||
$this->postJson(
|
||||
$endpoint = "/api/client/servers/$server->uuid/users/{$subuser->user->uuid}",
|
||||
$data = [
|
||||
'permissions' => [
|
||||
'control.start',
|
||||
'control.stop',
|
||||
],
|
||||
]
|
||||
)
|
||||
->assertUnauthorized();
|
||||
|
||||
$this->actingAs($subuser->user)->postJson($endpoint, $data)->assertForbidden();
|
||||
$this->actingAs($user)->postJson($endpoint, $data)->assertForbidden();
|
||||
|
||||
$server->subusers()->where('user_id', $user->id)->update([
|
||||
'permissions' => [
|
||||
Permission::ACTION_USER_UPDATE,
|
||||
Permission::ACTION_CONTROL_START,
|
||||
Permission::ACTION_CONTROL_STOP,
|
||||
],
|
||||
]);
|
||||
|
||||
$this->postJson($endpoint, $data)->assertOk();
|
||||
}
|
||||
|
||||
/**
|
||||
* Tests that permissions for the account are updated and any extraneous values
|
||||
* we don't know about are removed.
|
||||
*/
|
||||
public function testPermissionsAreSavedToAccount()
|
||||
{
|
||||
[$user, $server] = $this->generateTestAccount();
|
||||
|
||||
/** @var \Pterodactyl\Models\Subuser $subuser */
|
||||
$subuser = Subuser::factory()
|
||||
->for(User::factory()->create())
|
||||
->for($server)
|
||||
->create([
|
||||
'permissions' => ['control.restart', 'websocket.connect', 'foo.bar'],
|
||||
]);
|
||||
|
||||
$this->actingAs($user)
|
||||
->postJson("/api/client/servers/$server->uuid/users/{$subuser->user->uuid}", [
|
||||
'permissions' => [
|
||||
'control.start',
|
||||
'control.stop',
|
||||
'control.stop',
|
||||
'foo.bar',
|
||||
'power.fake',
|
||||
],
|
||||
])
|
||||
->assertOk();
|
||||
|
||||
$subuser->refresh();
|
||||
$this->assertEqualsCanonicalizing(
|
||||
['control.start', 'control.stop', 'websocket.connect'],
|
||||
$subuser->permissions
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure a subuser cannot assign permissions to an account that they do not have
|
||||
* themselves.
|
||||
*/
|
||||
public function testUserCannotAssignPermissionsTheyDoNotHave()
|
||||
{
|
||||
[$user, $server] = $this->generateTestAccount([Permission::ACTION_USER_READ, Permission::ACTION_USER_UPDATE]);
|
||||
|
||||
$subuser = Subuser::factory()
|
||||
->for(User::factory()->create())
|
||||
->for($server)
|
||||
->create(['permissions' => ['foo.bar']]);
|
||||
|
||||
$this->actingAs($user)
|
||||
->postJson("/api/client/servers/$server->uuid/users/{$subuser->user->uuid}", [
|
||||
'permissions' => [Permission::ACTION_USER_READ, Permission::ACTION_CONTROL_CONSOLE],
|
||||
])
|
||||
->assertForbidden();
|
||||
|
||||
$this->assertEqualsCanonicalizing(['foo.bar'], $subuser->refresh()->permissions);
|
||||
}
|
||||
|
||||
/**
|
||||
* Test that a user cannot update thyself.
|
||||
*/
|
||||
public function testUserCannotUpdateSelf()
|
||||
{
|
||||
[$user, $server] = $this->generateTestAccount([Permission::ACTION_USER_READ, Permission::ACTION_USER_UPDATE]);
|
||||
|
||||
$this->actingAs($user)
|
||||
->postJson("/api/client/servers/$server->uuid/users/$user->uuid", [])
|
||||
->assertForbidden();
|
||||
}
|
||||
|
||||
/**
|
||||
* Test that an error is returned if you attempt to update a subuser on a different account.
|
||||
*/
|
||||
public function testCannotUpdateSubuserForDifferentServer()
|
||||
{
|
||||
[$user, $server] = $this->generateTestAccount();
|
||||
[$user2] = $this->generateTestAccount(['foo.bar']);
|
||||
|
||||
$this->actingAs($user)
|
||||
->postJson("/api/client/servers/$server->uuid/users/$user2->uuid", [])
|
||||
->assertNotFound();
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue