Leisuretimedock/blessing-skin-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Return 403 instead when accessing private textures, close #111

Browse Source
This commit is contained in:
printempw 2018-02-10 12:55:10 +08:00
parent dcc132700c
commit 7e6cc96e5e
3 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/Http/Controllers/SkinlibController.php
View File

@ -121,9 +121,10 @@ class SkinlibController extends Controller
$texture = Texture::find($tid); $texture = Texture::find($tid);
if (!$texture || $texture && !Storage::disk('textures')->has($texture->hash)) { if (!$texture || $texture && !Storage::disk('textures')->has($texture->hash)) {
if (Option::get('auto_del_invalid_texture') == "1") { if (option('auto_del_invalid_texture')) {
if ($texture) if ($texture) {
$texture->delete(); $texture->delete();
}
abort(404, trans('skinlib.show.deleted')); abort(404, trans('skinlib.show.deleted'));
} }
@ -132,7 +133,7 @@ class SkinlibController extends Controller
if ($texture->public == "0") { if ($texture->public == "0") {
if (is_null($this->user) || ($this->user->uid != $texture->uploader && !$this->user->isAdmin())) if (is_null($this->user) || ($this->user->uid != $texture->uploader && !$this->user->isAdmin()))
abort(404, trans('skinlib.show.private')); abort(403, trans('skinlib.show.private'));
} }
return view('skinlib.show')->with('texture', $texture)->with('with_out_filter', true)->with('user', $this->user); return view('skinlib.show')->with('texture', $texture)->with('with_out_filter', true)->with('user', $this->user);

5
app/Http/Controllers/TextureController.php
View File

@ -198,8 +198,9 @@ class TextureController extends Controller
{ {
$player = Player::where('player_name', $player_name)->first(); $player = Player::where('player_name', $player_name)->first();
if ($player->isBanned()) if ($player->isBanned()) {
abort(404, trans('general.player-banned')); abort(403, trans('general.player-banned'));
}
return $player; return $player;
} }

2
tests/TextureControllerTest.php
View File

@ -25,7 +25,7 @@ class TextureControllerTest extends TestCase
User::find($player->uid)->setPermission(User::BANNED); User::find($player->uid)->setPermission(User::BANNED);
$this->get("/{$player->player_name}.json") $this->get("/{$player->player_name}.json")
->see(trans('general.player-banned')) ->see(trans('general.player-banned'))
->assertResponseStatus(404); ->assertResponseStatus(403);
User::find($player->uid)->setPermission(User::NORMAL); User::find($player->uid)->setPermission(User::NORMAL);