banquise/pelican-panel-mirror
14
0
Fork 1
mirror of https://github.com/pelican-dev/panel.git synced 2025-12-08 16:30:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix permission checks on Client side (#1913)

Browse Source
This commit is contained in:
MartinOscar 2025-11-19 21:28:13 +00:00 committed by GitHub
parent d78c977d75
commit a195b56f93
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Filament/Server/Pages/Settings.php
View File

@ -64,7 +64,7 @@ class Settings extends ServerFormPage
Textarea::make('description')
->label(trans('server/setting.server_info.description'))
->hidden(!config('panel.editable_server_descriptions'))
->disabled(fn (Server $server) => !user()?->can(Permission::ACTION_SETTINGS_RENAME, $server))
->disabled(fn (Server $server) => !user()?->can(Permission::ACTION_SETTINGS_DESCRIPTION, $server))
->columnSpan([
'default' => 1,
'sm' => 2,
@ -277,7 +277,7 @@ class Settings extends ServerFormPage
public function updateDescription(string $description, Server $server): void
{
abort_unless(user()?->can(Permission::ACTION_SETTINGS_RENAME, $server) && config('panel.editable_server_descriptions'), 403);
abort_unless(user()?->can(Permission::ACTION_SETTINGS_DESCRIPTION, $server) && config('panel.editable_server_descriptions'), 403);
$original = $server->description;

2
app/Http/Controllers/Api/Client/Servers/ScheduleTaskController.php
View File

@ -170,7 +170,7 @@ class ScheduleTaskController extends ClientApiController
throw new NotFoundHttpException();
}
if (!$request->user()->can(Permission::ACTION_SCHEDULE_UPDATE, $server)) {
if (!$request->user()->can(Permission::ACTION_SCHEDULE_DELETE, $server)) {
throw new HttpForbiddenException('You do not have permission to perform this action.');
}