fix(security): implement authorization checks for terminal access management

This commit is contained in:
Andras Bacsai
2025-09-25 11:44:58 +02:00
parent 12c7e28a48
commit 6cd3bc0461

View File

@@ -4,6 +4,7 @@ namespace App\Livewire\Server\Security;
use App\Models\InstanceSettings;
use App\Models\Server;
use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Livewire\Attributes\Validate;
@@ -11,6 +12,8 @@ use Livewire\Component;
class TerminalAccess extends Component
{
use AuthorizesRequests;
public Server $server;
public array $parameters = [];
@@ -22,6 +25,7 @@ class TerminalAccess extends Component
{
try {
$this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
$this->authorize('update', $this->server);
$this->parameters = get_route_parameters();
$this->syncData();
@@ -33,6 +37,8 @@ class TerminalAccess extends Component
public function toggleTerminal($password)
{
try {
$this->authorize('update', $this->server);
// Check if user is admin or owner
if (! auth()->user()->isAdmin()) {
throw new \Exception('Only team administrators and owners can modify terminal access.');
@@ -76,4 +82,4 @@ class TerminalAccess extends Component
{
return view('livewire.server.security.terminal-access');
}
}
}