Panel 1.12.1 (#8)

* [🫸] Sync gh with prod

New version branch: panel-1.12.0
created after panel update

* Sync gh with prod

* Sync gh with prod

Updated panel to 1.12.1

Author: 2000Arion

CHANGELOG.md

@@ -3,6 +3,25 @@ This file is a running track of new features and fixes to each version of the pa
 
 This project follows [Semantic Versioning](http://semver.org) guidelines.
 
+## v1.12.1
+### Fixed
+* [CVE-2026-26016](https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728)
+* [GHSA-hr7j-63v7-vj7g](https://github.com/pterodactyl/panel/security/advisories/GHSA-hr7j-63v7-vj7g)
+* Fixes bug where presigned URLs would 
+* Fixes issue where certain input values would cause the activity log screen to stop rendering properly due to improper element encoding.
+* Fixes improper display of unicode characters in console output.
+* Fixes page number not resetting when toggling between "Show My Servers" and "Show All Servers" on the dashboard.
+
+### Changed
+* SFTP sessions are now revoked on nodes when a user changes their password or their account is deleted.
+* Remote node access tokens are now scoped to only allow access to servers that belong to the same node. Previously a node could access information and control the installation status for any server in the system.
+* The default rate limit for the client API was bumped from `128` to `256` requests per minute.
+
+### Added
+* HTTP responses now include default security headers if not otherwise set.
+* Adds modal popup when running a Hytale server that requires additional auth.
+* Adds support for administrators to view any application API key that has been created, regardless of the owning account.
+
 ## v1.12.0
 ### Fixed
 

app/Contracts/Models/Identifiable.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace Pterodactyl\Contracts\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+
+interface Identifiable
+{
+    public function scopeWhereIdentifier(Builder $builder, string $identifier): void;
+}

app/Contracts/Repository/ApiKeyRepositoryInterface.php

@@ -12,18 +12,8 @@ interface ApiKeyRepositoryInterface extends RepositoryInterface
      */
     public function getAccountKeys(User $user): Collection;
 
-    /**
-     * Get all the application API keys that exist for a specific user.
-     */
-    public function getApplicationKeys(User $user): Collection;
-
     /**
      * Delete an account API key from the panel for a specific user.
      */
     public function deleteAccountKey(User $user, string $identifier): int;
-
-    /**
-     * Delete an application API key from the panel for a specific user.
-     */
-    public function deleteApplicationKey(User $user, string $identifier): int;
 }

app/Events/User/PasswordChanged.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace Pterodactyl\Events\User;
+
+use Pterodactyl\Models\User;
+use Illuminate\Foundation\Events\Dispatchable;
+
+final class PasswordChanged
+{
+    use Dispatchable;
+
+    public function __construct(public readonly User $user)
+    {
+    }
+}

app/Http/Controllers/Admin/ApiController.php

@@ -11,7 +11,6 @@
 use Pterodactyl\Services\Acl\Api\AdminAcl;
 use Pterodactyl\Http\Controllers\Controller;
 use Pterodactyl\Services\Api\KeyCreationService;
-use Pterodactyl\Contracts\Repository\ApiKeyRepositoryInterface;
 use Pterodactyl\Http\Requests\Admin\Api\StoreApplicationApiKeyRequest;
 
 class ApiController extends Controller
@@ -21,7 +20,6 @@ class ApiController extends Controller
      */
     public function __construct(
         private AlertsMessageBag $alert,
-        private ApiKeyRepositoryInterface $repository,
         private KeyCreationService $keyCreationService,
     ) {
     }
@@ -32,7 +30,7 @@ public function __construct(
     public function index(Request $request): View
     {
         return view('admin.api.index', [
-            'keys' => $this->repository->getApplicationKeys($request->user()),
+            'keys' => ApiKey::query()->where('key_type', ApiKey::TYPE_APPLICATION)->get(),
         ]);
     }
 
@@ -78,7 +76,10 @@ public function store(StoreApplicationApiKeyRequest $request): RedirectResponse
      */
     public function delete(Request $request, string $identifier): Response
     {
-        $this->repository->deleteApplicationKey($request->user(), $identifier);
+        ApiKey::query()
+            ->where('key_type', ApiKey::TYPE_APPLICATION)
+            ->where('identifier', $identifier)
+            ->delete();
 
         return response('', 204);
     }

app/Http/Controllers/Admin/NodeAutoDeployController.php

@@ -9,15 +9,13 @@
 use Pterodactyl\Http\Controllers\Controller;
 use Illuminate\Contracts\Encryption\Encrypter;
 use Pterodactyl\Services\Api\KeyCreationService;
-use Pterodactyl\Repositories\Eloquent\ApiKeyRepository;
 
 class NodeAutoDeployController extends Controller
 {
     /**
      * NodeAutoDeployController constructor.
      */
     public function __construct(
-        private ApiKeyRepository $repository,
         private Encrypter $encrypter,
         private KeyCreationService $keyCreationService,
     ) {
@@ -31,17 +29,10 @@ public function __construct(
      */
     public function __invoke(Request $request, Node $node): JsonResponse
     {
-        /** @var ApiKey|null $key */
-        $key = $this->repository->getApplicationKeys($request->user())
-            ->filter(function (ApiKey $key) {
-                foreach ($key->getAttributes() as $permission => $value) {
-                    if ($permission === 'r_nodes' && $value === 1) {
-                        return true;
-                    }
-                }
-
-                return false;
-            })
+        $key = ApiKey::query()
+            ->where('user_id', $request->user()->id)
+            ->where('key_type', ApiKey::TYPE_APPLICATION)
+            ->where('r_nodes', 1)
             ->first();
 
         // We couldn't find a key that exists for this user with only permission for

app/Http/Controllers/Api/Client/AccountController.php

@@ -54,7 +54,9 @@ public function updateEmail(UpdateEmailRequest $request): JsonResponse
      */
     public function updatePassword(UpdatePasswordRequest $request): JsonResponse
     {
-        $user = $this->updateService->handle($request->user(), $request->validated());
+        $user = Activity::event('user:account.password-changed')->transaction(function () use ($request) {
+            return $this->updateService->handle($request->user(), $request->validated());
+        });
 
         $guard = $this->manager->guard();
         // If you do not update the user in the session you'll end up working with a
@@ -68,8 +70,6 @@ public function updatePassword(UpdatePasswordRequest $request): JsonResponse
             $guard->logoutOtherDevices($request->input('password'));
         }
 
-        Activity::event('user:account.password-changed')->log();
-
         return new JsonResponse([], Response::HTTP_NO_CONTENT);
     }
 }

app/Http/Controllers/Api/Client/Servers/SubuserController.php

@@ -7,13 +7,12 @@
 use Illuminate\Http\JsonResponse;
 use Pterodactyl\Facades\Activity;
 use Pterodactyl\Models\Permission;
-use Illuminate\Support\Facades\Log;
+use Pterodactyl\Jobs\RevokeSftpAccessJob;
 use Pterodactyl\Repositories\Eloquent\SubuserRepository;
 use Pterodactyl\Services\Subusers\SubuserCreationService;
 use Pterodactyl\Transformers\Api\Client\SubuserTransformer;
 use Pterodactyl\Repositories\Wings\DaemonRevocationRepository;
 use Pterodactyl\Http\Controllers\Api\Client\ClientApiController;
-use Pterodactyl\Exceptions\Http\Connection\DaemonConnectionException;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Subusers\GetSubuserRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Subusers\StoreSubuserRequest;
 use Pterodactyl\Http\Requests\Api\Client\Servers\Subusers\DeleteSubuserRequest;
@@ -109,23 +108,12 @@ public function update(UpdateSubuserRequest $request, Server $server): array
         // Only update the database and hit up the Wings instance to invalidate JTI's if the permissions
         // have actually changed for the user.
         if ($permissions !== $current) {
-            $log->transaction(function ($instance) use ($request, $subuser, $server) {
+            $log->transaction(function () use ($request, $subuser, $server) {
                 $this->repository->update($subuser->id, [
                     'permissions' => $this->getDefaultPermissions($request),
                 ]);
 
-                try {
-                    $this->revocationRepository->setNode($server->node)->deauthorize(
-                        $subuser->user->uuid,
-                        [$server->uuid],
-                    );
-                } catch (DaemonConnectionException $exception) {
-                    // Don't block this request if we can't connect to the Wings instance. Chances are it is
-                    // offline and the token will be invalid once Wings boots back.
-                    Log::warning($exception, ['user_id' => $subuser->user_id, 'server_id' => $server->id]);
-
-                    $instance->property('revoked', false);
-                }
+                RevokeSftpAccessJob::dispatch($subuser->user->uuid, $server);
             });
         }
 
@@ -149,20 +137,10 @@ public function delete(DeleteSubuserRequest $request, Server $server): JsonRespo
             ->property('email', $subuser->user->email)
             ->property('revoked', true);
 
-        $log->transaction(function ($instance) use ($server, $subuser) {
+        $log->transaction(function () use ($server, $subuser) {
             $subuser->delete();
 
-            try {
-                $this->revocationRepository->setNode($server->node)->deauthorize(
-                    $subuser->user->uuid,
-                    [$server->uuid],
-                );
-            } catch (DaemonConnectionException $exception) {
-                // Don't block this request if we can't connect to the Wings instance.
-                Log::warning($exception, ['user_id' => $subuser->user_id, 'server_id' => $server->id]);
-
-                $instance->property('revoked', false);
-            }
+            RevokeSftpAccessJob::dispatch($subuser->user->uuid, $server);
         });
 
         return new JsonResponse([], JsonResponse::HTTP_NO_CONTENT);

app/Http/Controllers/Api/Remote/Backups/BackupRemoteUploadController.php

@@ -49,7 +49,7 @@ public function __invoke(Request $request, string $backup): JsonResponse
         // from messing with backups that they don't own.
         $server = $model->server;
         if ($server->node_id !== $node->id) {
-            throw new HttpForbiddenException('You do not have permission to access that backup.');
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
         }
 
         // Prevent backups that have already been completed from trying to

app/Http/Controllers/Api/Remote/Backups/BackupStatusController.php

@@ -45,7 +45,7 @@ public function index(ReportBackupCompleteRequest $request, string $backup): Jso
         /** @var \Pterodactyl\Models\Server $server */
         $server = $model->server;
         if ($server->node_id !== $node->id) {
-            throw new HttpForbiddenException('You do not have permission to access that backup.');
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
         }
 
         if ($model->is_successful) {
@@ -95,6 +95,11 @@ public function restore(Request $request, string $backup): JsonResponse
         /** @var Backup $model */
         $model = Backup::query()->where('uuid', $backup)->firstOrFail();
 
+        $node = $request->attributes->get('node');
+        if (! $model->server->node->is($node)) {
+            throw new HttpForbiddenException('Requesting node does not have permission to access this server.');
+        }
+
         $model->server->update(['status' => null]);
 
         Activity::event($request->boolean('successful') ? 'server:backup.restore-complete' : 'server.backup.restore-failed')