Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(controller): enforce ownership on notification group, NAT server, and batch move

Browse Source 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
This commit is contained in:
naiba
2026-05-17 10:24:19 +08:00
co-authored by naiba/CloudCode
parent 58f98db1a0
commit 2a65a7db80
6 changed files with 109 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/server.go
+6 -2
View File
@@ -336,6 +336,10 @@ func batchMoveServer(c *gin.Context) (any, error) {
return nil, singleton.Localizer.ErrorT("user id is required")
}
if !callerIsAdmin(c) && moveForm.ToUser != getUid(c) {
return nil, singleton.Localizer.ErrorT("permission denied")
}
singleton.UserLock.RLock()
defer singleton.UserLock.RUnlock()
if _, ok := singleton.UserInfoMap[moveForm.ToUser]; !ok {
@@ -412,10 +416,10 @@ func getServerMetrics(c *gin.Context) (*model.ServerMetricsResponse, error) {
return nil, singleton.Localizer.ErrorT("server not found")
}
_, isMember := c.Get(model.CtxKeyAuthorizedUser)
if server.HideForGuest && !isMember {
if !userCanViewServer(c, server) {
return nil, singleton.Localizer.ErrorT("unauthorized")
}
_, isMember := c.Get(model.CtxKeyAuthorizedUser)
metricName := c.Query("metric")
metricType, ok := serverMetricMap[metricName]