60eff40a0c
Versions of Pterodactyl prior to 1.6.3 used a different throttle pathway for requests. That pathway found the current request user before continuing on to other in-app middleware, thus the user was available downstream. Changes introduced in 1.6.3 changed the throttler logic, therefore removing this step. As a result, the client API could not always get the currently authenticated user when cookies were used (aka, requests from the Panel UI, and not API directly). This change corrects the logic to get the session setup correctly before falling through to authenticating as a user using the API key. If a cookie is present and a user is found as a result that session will be used. If an API key is provided it is ignored when a cookie is also present. In order to keep the API stateless any session created for an API request stemming from an API key will have the associated session deleted at the end of the request, and the 'Set-Cookies' header will be stripped from the response.
118 lines
4.4 KiB
PHP
118 lines
4.4 KiB
PHP
<?php
|
|
|
|
namespace Pterodactyl\Http;
|
|
|
|
use Pterodactyl\Models\ApiKey;
|
|
use Illuminate\Auth\Middleware\Authorize;
|
|
use Illuminate\Auth\Middleware\Authenticate;
|
|
use Pterodactyl\Http\Middleware\TrimStrings;
|
|
use Pterodactyl\Http\Middleware\TrustProxies;
|
|
use Illuminate\Session\Middleware\StartSession;
|
|
use Pterodactyl\Http\Middleware\EncryptCookies;
|
|
use Pterodactyl\Http\Middleware\Api\IsValidJson;
|
|
use Pterodactyl\Http\Middleware\VerifyCsrfToken;
|
|
use Pterodactyl\Http\Middleware\VerifyReCaptcha;
|
|
use Pterodactyl\Http\Middleware\AdminAuthenticate;
|
|
use Illuminate\Routing\Middleware\ThrottleRequests;
|
|
use Pterodactyl\Http\Middleware\LanguageMiddleware;
|
|
use Illuminate\Foundation\Http\Kernel as HttpKernel;
|
|
use Pterodactyl\Http\Middleware\Api\AuthenticateKey;
|
|
use Illuminate\Routing\Middleware\SubstituteBindings;
|
|
use Illuminate\Session\Middleware\AuthenticateSession;
|
|
use Illuminate\View\Middleware\ShareErrorsFromSession;
|
|
use Pterodactyl\Http\Middleware\MaintenanceMiddleware;
|
|
use Pterodactyl\Http\Middleware\RedirectIfAuthenticated;
|
|
use Illuminate\Auth\Middleware\AuthenticateWithBasicAuth;
|
|
use Pterodactyl\Http\Middleware\Api\AuthenticateIPAccess;
|
|
use Pterodactyl\Http\Middleware\Api\ApiSubstituteBindings;
|
|
use Illuminate\Foundation\Http\Middleware\ValidatePostSize;
|
|
use Pterodactyl\Http\Middleware\Api\HandleStatelessRequest;
|
|
use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
|
|
use Pterodactyl\Http\Middleware\Api\Daemon\DaemonAuthenticate;
|
|
use Pterodactyl\Http\Middleware\RequireTwoFactorAuthentication;
|
|
use Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode;
|
|
use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
|
|
use Pterodactyl\Http\Middleware\Api\Client\SubstituteClientApiBindings;
|
|
use Pterodactyl\Http\Middleware\Api\Application\AuthenticateApplicationUser;
|
|
|
|
class Kernel extends HttpKernel
|
|
{
|
|
/**
|
|
* The application's global HTTP middleware stack.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $middleware = [
|
|
CheckForMaintenanceMode::class,
|
|
EncryptCookies::class,
|
|
ValidatePostSize::class,
|
|
TrimStrings::class,
|
|
ConvertEmptyStringsToNull::class,
|
|
TrustProxies::class,
|
|
];
|
|
|
|
/**
|
|
* The application's route middleware groups.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $middlewareGroups = [
|
|
'web' => [
|
|
AddQueuedCookiesToResponse::class,
|
|
StartSession::class,
|
|
AuthenticateSession::class,
|
|
ShareErrorsFromSession::class,
|
|
VerifyCsrfToken::class,
|
|
SubstituteBindings::class,
|
|
LanguageMiddleware::class,
|
|
RequireTwoFactorAuthentication::class,
|
|
],
|
|
'api' => [
|
|
HandleStatelessRequest::class,
|
|
IsValidJson::class,
|
|
ApiSubstituteBindings::class,
|
|
'api..key:' . ApiKey::TYPE_APPLICATION,
|
|
AuthenticateApplicationUser::class,
|
|
AuthenticateIPAccess::class,
|
|
],
|
|
'client-api' => [
|
|
HandleStatelessRequest::class,
|
|
IsValidJson::class,
|
|
StartSession::class,
|
|
AuthenticateSession::class,
|
|
SubstituteClientApiBindings::class,
|
|
'api..key:' . ApiKey::TYPE_ACCOUNT,
|
|
AuthenticateIPAccess::class,
|
|
// This is perhaps a little backwards with the Client API, but logically you'd be unable
|
|
// to create/get an API key without first enabling 2FA on the account, so I suppose in the
|
|
// end it makes sense.
|
|
//
|
|
// You just wouldn't be authenticating with the API by providing a 2FA token.
|
|
RequireTwoFactorAuthentication::class,
|
|
],
|
|
'daemon' => [
|
|
SubstituteBindings::class,
|
|
DaemonAuthenticate::class,
|
|
],
|
|
];
|
|
|
|
/**
|
|
* The application's route middleware.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $routeMiddleware = [
|
|
'auth' => Authenticate::class,
|
|
'auth.basic' => AuthenticateWithBasicAuth::class,
|
|
'guest' => RedirectIfAuthenticated::class,
|
|
'admin' => AdminAuthenticate::class,
|
|
'csrf' => VerifyCsrfToken::class,
|
|
'throttle' => ThrottleRequests::class,
|
|
'can' => Authorize::class,
|
|
'bindings' => SubstituteBindings::class,
|
|
'recaptcha' => VerifyReCaptcha::class,
|
|
'node.maintenance' => MaintenanceMiddleware::class,
|
|
// API Specific Middleware
|
|
'api..key' => AuthenticateKey::class,
|
|
];
|
|
}
|