mirror of
https://github.com/pterodactyl/panel.git
synced 2026-04-13 02:25:38 -05:00
7576d0d08e
This PR closes Issue #5175. For context, I am aware that Application API Keys are deprecated in favour of Client API Keys however they are still operational within Pterodactyl and thus, not fully removed. Currently in Pterodactyl, as an Admin, you can only view your Application API Keys on the Admin Panel. In this PR, I made it so all Application Keys are visible and deletable. The key strings are obfuscated if the key does not belong to the user viewing.  The reason for adding this is primarily so other admin users can be aware of and delete another admin user's Application API keys from the UI. This functionality is useful in the event of a malicious user compromising an admin account, creating some API Keys to continue their attacks and the owner of the compromised admin account being unaware of Application API Keys. In this instance, even after a password reset, the attack could continue via the Application API without the admin realising it. I've tested the creation and deleting of keys along with using keys via the Application API to ensure no breakages have occurred. --------- Co-authored-by: DaneEveritt <dane@daneeveritt.com>
87 lines
2.5 KiB
PHP
87 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace Pterodactyl\Http\Controllers\Admin;
|
|
|
|
use Illuminate\View\View;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Http\Response;
|
|
use Pterodactyl\Models\ApiKey;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Prologue\Alerts\AlertsMessageBag;
|
|
use Pterodactyl\Services\Acl\Api\AdminAcl;
|
|
use Pterodactyl\Http\Controllers\Controller;
|
|
use Pterodactyl\Services\Api\KeyCreationService;
|
|
use Pterodactyl\Http\Requests\Admin\Api\StoreApplicationApiKeyRequest;
|
|
|
|
class ApiController extends Controller
|
|
{
|
|
/**
|
|
* ApiController constructor.
|
|
*/
|
|
public function __construct(
|
|
private AlertsMessageBag $alert,
|
|
private KeyCreationService $keyCreationService,
|
|
) {
|
|
}
|
|
|
|
/**
|
|
* Render view showing all of a user's application API keys.
|
|
*/
|
|
public function index(Request $request): View
|
|
{
|
|
return view('admin.api.index', [
|
|
'keys' => ApiKey::query()->where('key_type', ApiKey::TYPE_APPLICATION)->get(),
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Render view allowing an admin to create a new application API key.
|
|
*
|
|
* @throws \ReflectionException
|
|
*/
|
|
public function create(): View
|
|
{
|
|
$resources = AdminAcl::getResourceList();
|
|
sort($resources);
|
|
|
|
return view('admin.api.new', [
|
|
'resources' => $resources,
|
|
'permissions' => [
|
|
'r' => AdminAcl::READ,
|
|
'rw' => AdminAcl::READ | AdminAcl::WRITE,
|
|
'n' => AdminAcl::NONE,
|
|
],
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Store the new key and redirect the user back to the application key listing.
|
|
*
|
|
* @throws \Pterodactyl\Exceptions\Model\DataValidationException
|
|
*/
|
|
public function store(StoreApplicationApiKeyRequest $request): RedirectResponse
|
|
{
|
|
$this->keyCreationService->setKeyType(ApiKey::TYPE_APPLICATION)->handle([
|
|
'memo' => $request->input('memo'),
|
|
'user_id' => $request->user()->id,
|
|
], $request->getKeyPermissions());
|
|
|
|
$this->alert->success('A new application API key has been generated for your account.')->flash();
|
|
|
|
return redirect()->route('admin.api.index');
|
|
}
|
|
|
|
/**
|
|
* Delete an application API key from the database.
|
|
*/
|
|
public function delete(Request $request, string $identifier): Response
|
|
{
|
|
ApiKey::query()
|
|
->where('key_type', ApiKey::TYPE_APPLICATION)
|
|
->where('identifier', $identifier)
|
|
->delete();
|
|
|
|
return response('', 204);
|
|
}
|
|
}
|