Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(controller): validate trigger task ownership

Browse Source 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
This commit is contained in:
naiba
2026-05-17 10:24:19 +08:00
co-authored by naiba/CloudCode
parent e38a0ef469
commit 58f98db1a0
3 changed files with 97 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/service.go
+9
View File
@@ -545,5 +545,14 @@ func validateServers(c *gin.Context, ss *model.Service) error {
return singleton.Localizer.ErrorT("permission denied")
}
// Trigger task IDs are user-controlled; validate them here so services cannot
// reference another user's cron and later execute it from the sentinel path.
if !singleton.CronShared.CheckPermission(c, slices.Values(ss.FailTriggerTasks)) {
return singleton.Localizer.ErrorT("permission denied")
}
if !singleton.CronShared.CheckPermission(c, slices.Values(ss.RecoverTriggerTasks)) {
return singleton.Localizer.ErrorT("permission denied")
}
return nil
}