From 503cb20c83f7c1551e939db47e36ad971e028630 Mon Sep 17 00:00:00 2001 From: printempw Date: Wed, 15 Aug 2018 17:07:21 +0800 Subject: [PATCH] Restrict PluginController access to super admin only --- app/Http/Kernel.php | 13 +++++++------ app/Http/Middleware/CheckSuperAdmin.php | 23 +++++++++++++++++++++++ app/Models/User.php | 10 ++++++++++ resources/lang/en/auth.yml | 1 + resources/lang/zh_CN/auth.yml | 1 + routes/web.php | 4 ++-- tests/MarketControllerTest.php | 2 +- tests/MiddlewareTest.php | 13 +++++++++++++ tests/PluginControllerTest.php | 2 +- tests/UpdateControllerTest.php | 8 +++----- 10 files changed, 62 insertions(+), 15 deletions(-) create mode 100644 app/Http/Middleware/CheckSuperAdmin.php diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 9b7f383f..56e92283 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -45,11 +45,12 @@ class Kernel extends HttpKernel * @var array */ protected $routeMiddleware = [ - 'auth' => \App\Http\Middleware\CheckAuthenticated::class, - 'verified' => \App\Http\Middleware\CheckUserVerified::class, - 'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class, - 'admin' => \App\Http\Middleware\CheckAdministrator::class, - 'player' => \App\Http\Middleware\CheckPlayerExist::class, - 'setup' => \App\Http\Middleware\CheckInstallation::class, + 'auth' => \App\Http\Middleware\CheckAuthenticated::class, + 'verified' => \App\Http\Middleware\CheckUserVerified::class, + 'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class, + 'admin' => \App\Http\Middleware\CheckAdministrator::class, + 'super-admin' => \App\Http\Middleware\CheckSuperAdmin::class, + 'player' => \App\Http\Middleware\CheckPlayerExist::class, + 'setup' => \App\Http\Middleware\CheckInstallation::class, ]; } diff --git a/app/Http/Middleware/CheckSuperAdmin.php b/app/Http/Middleware/CheckSuperAdmin.php new file mode 100644 index 00000000..333668c2 --- /dev/null +++ b/app/Http/Middleware/CheckSuperAdmin.php @@ -0,0 +1,23 @@ +handle($request, $next, true); + + if ($result instanceof Response) { + return $result; + } + + if (! $result->isSuperAdmin()) { + abort(403, trans('auth.check.super-admin')); + } + + return $next($request); + } +} diff --git a/app/Models/User.php b/app/Models/User.php index 7170a452..380d2c2c 100644 --- a/app/Models/User.php +++ b/app/Models/User.php @@ -66,6 +66,16 @@ class User extends Model return ($this->permission >= static::ADMIN); } + /** + * Check if user is super admin. + * + * @return bool + */ + public function isSuperAdmin() + { + return ($this->permission == static::SUPER_ADMIN); + } + /** * Get closet instance. * diff --git a/resources/lang/en/auth.yml b/resources/lang/en/auth.yml index 967aafc0..421a38bf 100644 --- a/resources/lang/en/auth.yml +++ b/resources/lang/en/auth.yml @@ -9,6 +9,7 @@ check: anonymous: Illegal access. Please log in first. verified: To access this page, you should verify your email address first. admin: Only admins are permitted to access this page. + super-admin: Only super admin is permitted to access this page. banned: You are banned on this site. Please contact the admin. token: Token expired. Please log in. diff --git a/resources/lang/zh_CN/auth.yml b/resources/lang/zh_CN/auth.yml index 57fae119..42a7bac3 100644 --- a/resources/lang/zh_CN/auth.yml +++ b/resources/lang/zh_CN/auth.yml @@ -9,6 +9,7 @@ check: anonymous: 未授权的访问，请先登录 verified: 你必须验证邮箱后才能访问此页面 admin: 只有管理员才能访问此页面 + super-admin: 只有超级管理员才能访问此页面 banned: 你已被本站封禁，详情请联系站点管理员 token: 登录状态已过期，请重新登录 diff --git a/routes/web.php b/routes/web.php index 633a30ff..9fb58743 100644 --- a/routes/web.php +++ b/routes/web.php @@ -121,7 +121,7 @@ Route::group(['middleware' => 'admin', 'prefix' => 'admin'], function () Route::post('/users', 'AdminController@userAjaxHandler'); Route::post('/players', 'AdminController@playerAjaxHandler'); - Route::group(['prefix' => 'plugins'], function () { + Route::group(['prefix' => 'plugins', 'middleware' => 'super-admin'], function () { // Allow using POST method to get data for DataTables, // otherwise it may cause a "414 Request-URI Too Large" error. Route::get ('/manage', 'PluginController@showManage'); @@ -135,7 +135,7 @@ Route::group(['middleware' => 'admin', 'prefix' => 'admin'], function () Route::post('/market/download', 'MarketController@download'); }); - Route::group(['prefix' => 'update'], function () { + Route::group(['prefix' => 'update', 'middleware' => 'super-admin'], function () { Route::any('', 'UpdateController@showUpdatePage'); Route::get('/check', 'UpdateController@checkUpdates'); Route::any('/download', 'UpdateController@download'); diff --git a/tests/MarketControllerTest.php b/tests/MarketControllerTest.php index bfc10018..5e72e0f3 100644 --- a/tests/MarketControllerTest.php +++ b/tests/MarketControllerTest.php @@ -5,7 +5,7 @@ class MarketControllerTest extends TestCase protected function setUp() { parent::setUp(); - return $this->actAs('admin'); + return $this->actAs('superAdmin'); } public function testShowMarket() diff --git a/tests/MiddlewareTest.php b/tests/MiddlewareTest.php index 17011329..fe27a6d0 100644 --- a/tests/MiddlewareTest.php +++ b/tests/MiddlewareTest.php @@ -105,6 +105,19 @@ class MiddlewareTest extends TestCase ->assertResponseStatus(200); } + public function testCheckSuperAdmin() + { + // Admin + $this->actAs('admin') + ->get('/admin/plugins/manage') + ->assertResponseStatus(403); + + // Super admin + $this->actAs('superAdmin') + ->visit('/admin/plugins/manage') + ->assertResponseStatus(200); + } + public function testCheckInstallation() { $this->visit('/setup')->see('Already installed'); diff --git a/tests/PluginControllerTest.php b/tests/PluginControllerTest.php index 6ca36c38..c3f41eb8 100644 --- a/tests/PluginControllerTest.php +++ b/tests/PluginControllerTest.php @@ -37,7 +37,7 @@ class PluginControllerTest extends TestCase } } - return $this->actAs('admin'); + return $this->actAs('superAdmin'); } public function testShowManage() diff --git a/tests/UpdateControllerTest.php b/tests/UpdateControllerTest.php index ce182c26..f45c9d3d 100644 --- a/tests/UpdateControllerTest.php +++ b/tests/UpdateControllerTest.php @@ -16,7 +16,7 @@ class UpdateControllerTest extends TestCase vfs\vfsStream::setup(); - return $this->actAs('admin'); + return $this->actAs('superAdmin'); } /** @@ -136,8 +136,7 @@ class UpdateControllerTest extends TestCase // Start downloading $this->flushCache(); - $this->actAs('admin') - ->get('/admin/update/download?action=start-download') + $this->get('/admin/update/download?action=start-download') ->see('No temp path available, please try again.'); unlink(storage_path('testing/update.zip')); @@ -159,8 +158,7 @@ class UpdateControllerTest extends TestCase // Get file size $this->flushCache(); - $this->actAs('admin') - ->get('/admin/update/download?action=get-progress') + $this->get('/admin/update/download?action=get-progress') ->see('[]'); $this->withCache(['download-progress' => ['total' => 514, 'downloaded' => 114]])