From 2573ba7522d25dff37c90315fb25eee2293d26b9 Mon Sep 17 00:00:00 2001 From: naiba Date: Fri, 15 May 2026 02:46:16 +0000 Subject: [PATCH] fix(controller): restrict waf and online-user listings to admins Co-authored-by: naiba/CloudCode --- cmd/dashboard/controller/controller.go | 27 ++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/cmd/dashboard/controller/controller.go b/cmd/dashboard/controller/controller.go index 4e089889..13518b8c 100644 --- a/cmd/dashboard/controller/controller.go +++ b/cmd/dashboard/controller/controller.go @@ -145,10 +145,10 @@ func routers(r *gin.Engine, frontendDist fs.FS) { auth.PATCH("/nat/:id", commonHandler(updateNAT)) auth.POST("/batch-delete/nat", commonHandler(batchDeleteNAT)) - auth.GET("/waf", pCommonHandler(listBlockedAddress)) + auth.GET("/waf", pAdminHandler(listBlockedAddress)) auth.POST("/batch-delete/waf", adminHandler(batchDeleteBlockedAddress)) - auth.GET("/online-user", pCommonHandler(listOnlineUser)) + auth.GET("/online-user", pAdminHandler(listOnlineUser)) auth.POST("/online-user/batch-block", adminHandler(batchBlockOnlineUser)) auth.PATCH("/setting", adminHandler(updateConfig)) @@ -285,6 +285,29 @@ func pCommonHandler[S ~[]E, E any](handler pHandlerFunc[S, E]) func(*gin.Context } } +func pAdminHandler[S ~[]E, E any](handler pHandlerFunc[S, E]) func(*gin.Context) { + return func(c *gin.Context) { + auth, ok := c.Get(model.CtxKeyAuthorizedUser) + if !ok { + c.JSON(http.StatusOK, newErrorResponse(singleton.Localizer.ErrorT("unauthorized"))) + return + } + user := *auth.(*model.User) + if !user.Role.IsAdmin() { + c.JSON(http.StatusOK, newErrorResponse(singleton.Localizer.ErrorT("permission denied"))) + return + } + + data, err := handler(c) + if err != nil { + c.JSON(http.StatusOK, newErrorResponse(err)) + return + } + + c.JSON(http.StatusOK, model.PaginatedResponse[S, E]{Success: true, Data: data}) + } +} + func filter[S ~[]E, E model.CommonInterface](ctx *gin.Context, s S) S { return slices.DeleteFunc(s, func(e E) bool { return !e.HasPermission(ctx)