Alex/Pterodactyl-Panel
1
1
Fork 1
mirror of https://github.com/pterodactyl/panel.git synced 2024-10-27 20:32:28 +01:00
Code Issues Releases Wiki Activity

Update middleware to handle wildcards correctly.

Browse Source
This commit is contained in:
Dane Everitt 2016-10-20 18:35:55 -04:00
parent 0f4648b13a
commit b1a9a59707
No known key found for this signature in database
GPG Key ID: EEA66103B3D71F53
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
app/Http/Middleware/APISecretToken.php
View File

@ -93,13 +93,18 @@ class APISecretToken extends Authorization
}
}
$permission = APIPermission::where('key_id', $key->id)
->where('permission', $request->route()->getName())
->orWhere('permission', '*')
->first();
if (!$permission) {
APILogService::log($request, 'You do not have permission to access this resource.');
throw new AccessDeniedHttpException('You do not have permission to access this resource.');
$permission = APIPermission::where('key_id', $key->id)->where('permission', $request->route()->getName());
// Suport Wildcards
if (starts_with($request->route()->getName(), 'api.user')) {
$permission->orWhere('permission', 'api.user.*');
} else if(starts_with($request->route()->getName(), 'api.admin')) {
$permission->orWhere('permission', 'api.admin.*');
}
if (!$permission->first()) {
APILogService::log($request, 'You do not have permission to access this resource. This API Key requires the ' . $request->route()->getName() . ' permission node.');
throw new AccessDeniedHttpException('You do not have permission to access this resource. This API Key requires the ' . $request->route()->getName() . ' permission node.');
}
}