banquise/pelican-panel-mirror
14
0
Fork 1
mirror of https://github.com/pelican-dev/panel.git synced 2025-12-08 18:30:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix permission checks on Client side (#1913)

Browse Source
This commit is contained in:
MartinOscar 2025-11-19 21:28:13 +00:00 committed by GitHub
parent d78c977d75
commit a195b56f93
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Filament/Server/Pages/Settings.php
View File

@ -64,7 +64,7 @@ class Settings extends ServerFormPage
Textarea::make('description') Textarea::make('description')
->label(trans('server/setting.server_info.description')) ->label(trans('server/setting.server_info.description'))
->hidden(!config('panel.editable_server_descriptions')) ->hidden(!config('panel.editable_server_descriptions'))
->disabled(fn (Server $server) => !user()?->can(Permission::ACTION_SETTINGS_RENAME, $server)) ->disabled(fn (Server $server) => !user()?->can(Permission::ACTION_SETTINGS_DESCRIPTION, $server))
->columnSpan([ ->columnSpan([
'default' => 1, 'default' => 1,
'sm' => 2, 'sm' => 2,
@ -277,7 +277,7 @@ class Settings extends ServerFormPage
public function updateDescription(string $description, Server $server): void public function updateDescription(string $description, Server $server): void
{ {
abort_unless(user()?->can(Permission::ACTION_SETTINGS_RENAME, $server) && config('panel.editable_server_descriptions'), 403); abort_unless(user()?->can(Permission::ACTION_SETTINGS_DESCRIPTION, $server) && config('panel.editable_server_descriptions'), 403);
$original = $server->description; $original = $server->description;

2
app/Http/Controllers/Api/Client/Servers/ScheduleTaskController.php
View File

@ -170,7 +170,7 @@ class ScheduleTaskController extends ClientApiController
throw new NotFoundHttpException(); throw new NotFoundHttpException();
} }
if (!$request->user()->can(Permission::ACTION_SCHEDULE_UPDATE, $server)) { if (!$request->user()->can(Permission::ACTION_SCHEDULE_DELETE, $server)) {
throw new HttpForbiddenException('You do not have permission to perform this action.'); throw new HttpForbiddenException('You do not have permission to perform this action.');
} }