Skynet/misc_pterodactyl-panel
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Attach user to cache to prevent showing servers they can't access.

Browse source
This commit is contained in:
Dane Everitt 2017-02-18 21:45:11 -05:00
parent 911434d033
commit f91e4c511e
No known key found for this signature in database
GPG key ID: EEA66103B3D71F53
3 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
CHANGELOG.md
View file

@ -3,6 +3,10 @@ This file is a running track of new features and fixes to each version of the pa
This project follows [Semantic Versioning](http://semver.org) guidelines.
## v0.6.0-pre.4 (Courageous Carniadactylus)
### Fixed
* `[pre.3]` — Fixes bug in cache handler that doesn't cache against the user making the request. Would have allowed for users to access servers not belonging to themselves in production.
## v0.6.0-pre.3 (Courageous Carniadactylus)
### Fixed
* `[pre.2]` — Fixes bug where servers could not be manually deployed to nodes due to a broken SQL call.

2
app/Models/Server.php
View file

@ -96,7 +96,7 @@ class Server extends Model
public static function byUuid($uuid)
{
// Results are cached because we call this functions a few times on page load.
$result = Cache::remember('Server.byUuid.' . $uuid, 60, function () use ($uuid) {
$result = Cache::remember('Server.byUuid.' . $uuid . Auth::user()->uuid, 60, function () use ($uuid) {
$query = self::with('service', 'node')->where(function ($q) use ($uuid) {
$q->where('uuidShort', $uuid)->orWhere('uuid', $uuid);
});

5
app/Observers/ServerObserver.php
View file

@ -24,6 +24,7 @@
namespace Pterodactyl\Observers;
use Auth;
use Cache;
use Carbon;
use Pterodactyl\Events;
@ -141,8 +142,8 @@ class ServerObserver
public function updated(Server $server)
{
// Clear Caches
Cache::forget('Server.byUuid.' . $server->uuid);
Cache::forget('Server.byUuid.' . $server->uuidShort);
Cache::forget('Server.byUuid.' . $server->uuid . Auth::user()->uuid);
Cache::forget('Server.byUuid.' . $server->uuidShort . Auth::user()->uuid);
event(new Events\Server\Updated($server));
}