2000Arion
diff --git a/‎CHANGELOG.md‎
Lines changed: 10 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎app/Console/Commands/Environment/Addons/RunHooksCommand.php‎
Lines changed: 68 additions & 0 deletions b/‎app/Console/Commands/Environment/Addons/RunHooksCommand.php‎
Lines changed: 68 additions & 0 deletions
diff --git a/‎app/Enum/JwtScope.php‎
Lines changed: 12 additions & 0 deletions b/‎app/Enum/JwtScope.php‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎app/Extensions/Laravel/Sanctum/NewAccessToken.php‎
Lines changed: 26 additions & 9 deletions b/‎app/Extensions/Laravel/Sanctum/NewAccessToken.php‎
Lines changed: 26 additions & 9 deletions
diff --git a/‎app/Http/Controllers/Admin/NodeAutoDeployController.php‎
Lines changed: 6 additions & 6 deletions b/‎app/Http/Controllers/Admin/NodeAutoDeployController.php‎
Lines changed: 6 additions & 6 deletions
diff --git a/‎app/Http/Controllers/Admin/Nodes/SystemInformationController.php‎
Lines changed: 1 addition & 1 deletion b/‎app/Http/Controllers/Admin/Nodes/SystemInformationController.php‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎app/Http/Controllers/Admin/Servers/ServerTransferController.php‎
Lines changed: 3 additions & 1 deletion b/‎app/Http/Controllers/Admin/Servers/ServerTransferController.php‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎app/Http/Controllers/Admin/ServersController.php‎
Lines changed: 3 additions & 2 deletions b/‎app/Http/Controllers/Admin/ServersController.php‎
Lines changed: 3 additions & 2 deletions
diff --git a/‎app/Http/Controllers/Api/Application/Nodes/NodeConfigurationController.php‎
Lines changed: 2 additions & 2 deletions b/‎app/Http/Controllers/Api/Application/Nodes/NodeConfigurationController.php‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎app/Http/Controllers/Api/Client/AccountController.php‎
Lines changed: 21 additions & 4 deletions b/‎app/Http/Controllers/Api/Client/AccountController.php‎
Lines changed: 21 additions & 4 deletions
@@ -3,6 +3,16 @@ This file is a running track of new features and fixes to each version of the pa
 
 This project follows [Semantic Versioning](http://semver.org) guidelines.
 
+## v1.12.3
+### Fixed
+* Adds a rate limit when changing email addresses on an account to prevent account enumeration.
+* Fixes backups, databases, and allocation creation to properly acquire a lock before checking if users can create more resources on a server.
+
+### Changed
+* Added Java 25 as an option to the default Minecraft eggs.
+* Updates Paper install script and adds support for Java 25 to default egg.
+* JWTs now require at least one `JwtScope` enum value to be set when generating. Failure to provide a scope will result in an exception being raised.
+
 ## v1.12.2
 ### Fixed
 * Fixes task execution jobs to correctly dispatch the next job in the chain.
 
@@ -0,0 +1,68 @@
+<?php
+
+namespace Pterodactyl\Console\Commands\Environment\Addons;
+
+use Illuminate\Support\Str;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Process;
+
+class RunHooksCommand extends Command
+{
+    protected $signature = 'p:environment:addons:run-hooks
+                            {event : The lifecycle event to run hooks for (e.g. post-install).}';
+
+    protected $description = 'Execute addon lifecycle hook scripts for the given event.';
+
+    /**
+     * Runs every executable "addons/<name>/hooks/<event>" script for the given lifecycle event when addon hooks are enabled.
+     */
+    public function handle(): int
+    {
+        if (!config('addons.hooks_enabled')) {
+            return self::SUCCESS;
+        }
+
+        $event = $this->argument('event');
+        if (!Str::isMatch('/^[a-z0-9-]+$/', $event)) {
+            $this->components->error("Invalid hook event name: {$event}");
+
+            return self::INVALID;
+        }
+
+        $hooks = Collection::make(File::glob(base_path("addons/*/hooks/{$event}")) ?: [])
+            ->filter(fn (string $hook) => is_executable($hook))
+            ->values();
+
+        if ($hooks->isEmpty()) {
+            return self::SUCCESS;
+        }
+
+        if ($this->input->isInteractive() && !$this->confirm(
+            sprintf('Execute %d addon hook script(s) for the "%s" event? They run with the privileges of this process.', $hooks->count(), $event)
+        )) {
+            return self::SUCCESS;
+        }
+
+        $hooks->each($this->runHook(...));
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * Streams a single hook's output, reporting a non-zero exit without aborting the remaining hooks.
+     */
+    private function runHook(string $hook): void
+    {
+        $this->components->info("Running addon hook: {$hook}");
+
+        $result = Process::path(base_path())
+            ->forever()
+            ->run([$hook], fn (string $type, string $output) => $this->output->write($output));
+
+        if ($result->failed()) {
+            $this->components->warn("Addon hook exited with an error: {$hook}");
+        }
+    }
+}
@@ -0,0 +1,12 @@
+<?php
+
+namespace Pterodactyl\Enum;
+
+enum JwtScope: string
+{
+    case Websocket = 'websocket';
+    case FileUpload = 'file-upload';
+    case FileDownload = 'file-download';
+    case BackupDownload = 'backup-download';
+    case ServerTransfer = 'transfer';
+}
@@ -3,21 +3,38 @@
 namespace Pterodactyl\Extensions\Laravel\Sanctum;
 
 use Pterodactyl\Models\ApiKey;
-use Laravel\Sanctum\NewAccessToken as SanctumAccessToken;
+use Illuminate\Contracts\Support\Jsonable;
+use Illuminate\Contracts\Support\Arrayable;
 
-/**
- * @property ApiKey $accessToken
- */
-class NewAccessToken extends SanctumAccessToken
+class NewAccessToken implements Arrayable, Jsonable
 {
     /**
      * NewAccessToken constructor.
+     */
+    public function __construct(public ApiKey $accessToken, public string $plainTextToken)
+    {
+    }
+
+    /**
+     * Get the instance as an array.
+     *
+     * @return array<string, ApiKey|string>
+     */
+    public function toArray()
+    {
+        return [
+            'accessToken' => $this->accessToken,
+            'plainTextToken' => $this->plainTextToken,
+        ];
+    }
+
+    /**
+     * Convert the object to its JSON representation.
      *
-     * @noinspection PhpMissingParentConstructorInspection
+     * @param int $options
      */
-    public function __construct(ApiKey $accessToken, string $plainTextToken)
+    public function toJson($options = 0)
     {
-        $this->accessToken = $accessToken;
-        $this->plainTextToken = $plainTextToken;
+        return json_encode($this->toArray(), $options);
     }
 }
@@ -22,8 +22,8 @@ public function __construct(
     }
 
     /**
-     * Generates a new API key for the logged-in user with only permission to read
-     * nodes, and returns that as the deployment key for a node.
+     * Generates a new API key for the logged-in user with read and write permission
+     * to nodes, and returns that as the deployment key for a node.
      *
      * @throws \Pterodactyl\Exceptions\Model\DataValidationException
      */
@@ -32,17 +32,17 @@ public function __invoke(Request $request, Node $node): JsonResponse
         $key = ApiKey::query()
             ->where('user_id', $request->user()->id)
             ->where('key_type', ApiKey::TYPE_APPLICATION)
-            ->where('r_nodes', 1)
+            ->where('r_nodes', 3)
             ->first();
 
-        // We couldn't find a key that exists for this user with only permission for
-        // reading nodes. Go ahead and create it now.
+        // We couldn't find a key that exists for this user with read and write
+        // permission for nodes. Go ahead and create it now.
         if (!$key) {
             $key = $this->keyCreationService->setKeyType(ApiKey::TYPE_APPLICATION)->handle([
                 'user_id' => $request->user()->id,
                 'memo' => 'Automatically generated node deployment key.',
                 'allowed_ips' => [],
-            ], ['r_nodes' => 1]);
+            ], ['r_nodes' => 3]);
         }
 
         return new JsonResponse([
 
@@ -33,7 +33,7 @@ public function __invoke(Request $request, Node $node): JsonResponse
                 'type' => Str::title($data['os'] ?? 'Unknown'),
                 'arch' => $data['architecture'] ?? '--',
                 'release' => $data['kernel_version'] ?? '--',
-                'cpus' => $data['cpu_count'] ?? 0,
+                'cpus' => (int) ($data['cpu_count'] ?? 0),
             ],
         ]);
     }
 
@@ -4,6 +4,7 @@
 
 use Carbon\CarbonImmutable;
 use Illuminate\Http\Request;
+use Pterodactyl\Enum\JwtScope;
 use Pterodactyl\Models\Server;
 use Illuminate\Http\RedirectResponse;
 use Prologue\Alerts\AlertsMessageBag;
@@ -78,7 +79,8 @@ public function transfer(Request $request, Server $server): RedirectResponse
             $token = $this->nodeJWTService
                 ->setExpiresAt(CarbonImmutable::now()->addMinutes(15))
                 ->setSubject($server->uuid)
-                ->handle($transfer->newNode, $server->uuid, 'sha256');
+                ->setScopes(JwtScope::ServerTransfer)
+                ->handle($transfer->newNode, $server->uuid);
 
             // Notify the source node of the pending outgoing transfer.
             $this->daemonTransferRepository->setServer($server)->notify($transfer->newNode, $token);
 
@@ -25,6 +25,7 @@
 use Pterodactyl\Services\Servers\DetailsModificationService;
 use Pterodactyl\Services\Servers\StartupModificationService;
 use Pterodactyl\Contracts\Repository\NestRepositoryInterface;
+use Pterodactyl\Http\Requests\Admin\ServerDetailsFormRequest;
 use Pterodactyl\Repositories\Eloquent\DatabaseHostRepository;
 use Pterodactyl\Services\Databases\DatabaseManagementService;
 use Illuminate\Contracts\Config\Repository as ConfigRepository;
@@ -67,9 +68,9 @@ public function __construct(
      * @throws DataValidationException
      * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
      */
-    public function setDetails(Request $request, Server $server): RedirectResponse
+    public function setDetails(ServerDetailsFormRequest $request, Server $server): RedirectResponse
     {
-        $this->detailsModificationService->handle($server, $request->only([
+        $this->detailsModificationService->handle($server, $request->normalize([
             'owner_id', 'external_id', 'name', 'description',
         ]));
 
 
@@ -4,8 +4,8 @@
 
 use Pterodactyl\Models\Node;
 use Illuminate\Http\JsonResponse;
-use Pterodactyl\Http\Requests\Api\Application\Nodes\GetNodeRequest;
 use Pterodactyl\Http\Controllers\Api\Application\ApplicationApiController;
+use Pterodactyl\Http\Requests\Api\Application\Nodes\GetNodeConfigurationRequest;
 
 class NodeConfigurationController extends ApplicationApiController
 {
@@ -14,7 +14,7 @@ class NodeConfigurationController extends ApplicationApiController
      * to remote machines so long as an API key is provided to the machine to make the request
      * with, and the node is known.
      */
-    public function __invoke(GetNodeRequest $request, Node $node): JsonResponse
+    public function __invoke(GetNodeConfigurationRequest $request, Node $node): JsonResponse
     {
         return new JsonResponse($node->getConfiguration());
     }
 
@@ -7,13 +7,20 @@
 use Illuminate\Auth\AuthManager;
 use Illuminate\Http\JsonResponse;
 use Pterodactyl\Facades\Activity;
+use Illuminate\Support\Facades\RateLimiter;
 use Pterodactyl\Services\Users\UserUpdateService;
 use Pterodactyl\Transformers\Api\Client\AccountTransformer;
 use Pterodactyl\Http\Requests\Api\Client\Account\UpdateEmailRequest;
 use Pterodactyl\Http\Requests\Api\Client\Account\UpdatePasswordRequest;
+use Symfony\Component\HttpKernel\Exception\TooManyRequestsHttpException;
 
 class AccountController extends ClientApiController
 {
+    /**
+     * The number of seconds that must elapse before the email change throttle resets.
+     */
+    private const EMAIL_UPDATE_THROTTLE = 60 * 60 * 24;
+
     /**
      * AccountController constructor.
      */
@@ -34,12 +41,22 @@ public function index(Request $request): array
      */
     public function updateEmail(UpdateEmailRequest $request): JsonResponse
     {
-        $original = $request->user()->email;
-        $this->updateService->handle($request->user(), $request->validated());
+        $user = $request->user();
+        // Only allow a user to change their email three times in the span
+        // of 24 hours. This prevents malicious users from trying to find
+        // existing accounts in the system by constantly changing their email.
+        if (RateLimiter::tooManyAttempts($key = "user:update-email:{$user->uuid}", 3)) {
+            throw new TooManyRequestsHttpException(message: 'Your email address has been changed too many times today. Please try again later.');
+        }
+
+        $original = $user->email;
+        if (mb_strtolower($original) !== mb_strtolower($request->validated('email'))) {
+            RateLimiter::hit($key, self::EMAIL_UPDATE_THROTTLE);
+
+            $this->updateService->handle($user, $request->validated());
 
-        if ($original !== $request->input('email')) {
             Activity::event('user:account.email-changed')
-                ->property(['old' => $original, 'new' => $request->input('email')])
+                ->property(['old' => $original, 'new' => $request->validated('email')])
                 ->log();
         }
Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ public function __invoke(Request $request, Node $node): JsonResponse`
`33`	`33`	`'type' => Str::title($data['os'] ?? 'Unknown'),`
`34`	`34`	`'arch' => $data['architecture'] ?? '--',`
`35`	`35`	`'release' => $data['kernel_version'] ?? '--',`
`36`		`- 'cpus' => $data['cpu_count'] ?? 0,`
	`36`	`+ 'cpus' => (int) ($data['cpu_count'] ?? 0),`
`37`	`37`	`],`
`38`	`38`	`]);`
`39`	`39`	`}`
Original file line number	Diff line number	Diff line change
`@@ -4,8 +4,8 @@`
`4`	`4`
`5`	`5`	`use Pterodactyl\Models\Node;`
`6`	`6`	`use Illuminate\Http\JsonResponse;`
`7`		`-use Pterodactyl\Http\Requests\Api\Application\Nodes\GetNodeRequest;`
`8`	`7`	`use Pterodactyl\Http\Controllers\Api\Application\ApplicationApiController;`
	`8`	`+use Pterodactyl\Http\Requests\Api\Application\Nodes\GetNodeConfigurationRequest;`
`9`	`9`
`10`	`10`	`class NodeConfigurationController extends ApplicationApiController`
`11`	`11`	`{`
`@@ -14,7 +14,7 @@ class NodeConfigurationController extends ApplicationApiController`
`14`	`14`	`* to remote machines so long as an API key is provided to the machine to make the request`
`15`	`15`	`* with, and the node is known.`
`16`	`16`	`*/`
`17`		`- public function __invoke(GetNodeRequest $request, Node $node): JsonResponse`
	`17`	`+ public function __invoke(GetNodeConfigurationRequest $request, Node $node): JsonResponse`
`18`	`18`	`{`
`19`	`19`	`return new JsonResponse($node->getConfiguration());`
`20`	`20`	`}`