From 5a1cceb9d2fb99e46fc63a07b8cb2f3e8a9e4b0c Mon Sep 17 00:00:00 2001
From: Dane Everitt <dane@daneeveritt.com>
Date: Sat, 7 Aug 2021 15:45:36 -0700
Subject: [PATCH] Fix bindings for schedule tasks

---
 .../Api/Client/Servers/ScheduleTaskController.php  |  9 ++-------
 .../Api/Client/SubstituteClientApiBindings.php     | 14 ++++++++++++++
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/app/Http/Controllers/Api/Client/Servers/ScheduleTaskController.php b/app/Http/Controllers/Api/Client/Servers/ScheduleTaskController.php
index d025f271..14437afa 100644
--- a/app/Http/Controllers/Api/Client/Servers/ScheduleTaskController.php
+++ b/app/Http/Controllers/Api/Client/Servers/ScheduleTaskController.php
@@ -6,16 +6,15 @@ use Pterodactyl\Models\Task;
 use Illuminate\Http\Response;
 use Pterodactyl\Models\Server;
 use Pterodactyl\Models\Schedule;
-use Pterodactyl\Models\Permission;
 use Pterodactyl\Repositories\Eloquent\TaskRepository;
 use Pterodactyl\Exceptions\Http\HttpForbiddenException;
 use Pterodactyl\Transformers\Api\Client\TaskTransformer;
-use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
 use Pterodactyl\Http\Controllers\Api\Client\ClientApiController;
 use Pterodactyl\Exceptions\Service\ServiceLimitExceededException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Schedules\StoreTaskRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Schedules\UpdateScheduleRequest;
+use Pterodactyl\Http\Requests\Api\Client\Servers\Schedules\DeleteScheduleRequest;
 
 class ScheduleTaskController extends ClientApiController
 {
@@ -108,12 +107,8 @@ class ScheduleTaskController extends ClientApiController
      *
      * @throws \Exception
      */
-    public function delete(UpdateScheduleRequest $request, Server $server, Schedule $schedule, Task $task): Response
+    public function delete(DeleteScheduleRequest $request, Server $server, Schedule $schedule, Task $task): Response
     {
-        if ($task->schedule_id !== $schedule->id || $schedule->server_id !== $server->id) {
-            throw new NotFoundHttpException();
-        }
-
         $schedule->tasks()->where('sequence_id', '>', $task->sequence_id)->update([
             'sequence_id' => $schedule->tasks()->getConnection()->raw('(sequence_id - 1)'),
         ]);
diff --git a/app/Http/Middleware/Api/Client/SubstituteClientApiBindings.php b/app/Http/Middleware/Api/Client/SubstituteClientApiBindings.php
index 9988e367..244654cd 100644
--- a/app/Http/Middleware/Api/Client/SubstituteClientApiBindings.php
+++ b/app/Http/Middleware/Api/Client/SubstituteClientApiBindings.php
@@ -4,9 +4,11 @@ namespace Pterodactyl\Http\Middleware\Api\Client;
 
 use Closure;
 use Illuminate\Support\Str;
+use Pterodactyl\Models\Task;
 use Illuminate\Routing\Route;
 use Pterodactyl\Models\Server;
 use Illuminate\Container\Container;
+use Illuminate\Database\Query\JoinClause;
 use Illuminate\Contracts\Routing\Registrar;
 use Pterodactyl\Contracts\Extensions\HashidsInterface;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
@@ -41,6 +43,18 @@ class SubstituteClientApiBindings
             return $this->server($route)->schedule()->where('id', $value)->firstOrFail();
         });
 
+        $this->router->bind('task', function ($value, $route) {
+            return Task::query()
+                ->select('tasks.*')
+                ->join('schedules', function (JoinClause $join) use ($route) {
+                    $join->on('schedules.id', 'tasks.schedule_id')
+                        ->where('schedules.server_id', $route->parameter('server')->id);
+                })
+                ->where('schedules.id', $route->parameter('schedule')->id)
+                ->where('tasks.id', $value)
+                ->firstOrFail();
+        });
+
         $this->router->bind('database', function ($value, $route) {
             $id = Container::getInstance()->make(HashidsInterface::class)->decodeFirst($value);