starred/panel
1
0
Fork 0
mirror of https://github.com/pelican-dev/panel.git synced 2026-03-01 11:21:31 +03:00
Code Issues 42 Packages Projects Releases 12 Wiki Activity

[PR #919] [MERGED] Fix server access for admins without subuser #1056

New Issue
Closed
opened 2026-02-04 19:13:55 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-04 19:13:55 +03:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/pelican-dev/panel/pull/919
Author: @Boy132
Created: 1/16/2025
Status: ✅ Merged
Merged: 1/18/2025
Merged by: @Boy132

Base: main ← Head: boy132/fix-admin-server-access

📝 Commits (10+)

  • 57c87ba fix server access for admins without subuser
  • 291e6f2 add permission checks to power buttons
  • 5022118 add permission check for console command sending
  • 03c2f03 fix tests
  • d83b049 fix websocket token permissions
  • 9517533 fix sftp access
  • f3a2afc fix server api + small cleanup
  • d0fb6fb it's "update", not "edit"...
  • 44ba4fb fix tests
  • 63dd0bb Merge remote-tracking branch 'upstream/main' into boy132/fix-admin-server-access

📊 Changes

13 files changed (+103 additions, -45 deletions)

View changed files

📝 app/Filament/App/Resources/ServerResource/Pages/ListServers.php (+1 -1)
📝 app/Filament/Server/Pages/Console.php (+5 -0)
📝 app/Filament/Server/Resources/UserResource/Pages/ListUsers.php (+21 -1)
📝 app/Filament/Server/Widgets/ServerConsole.php (+6 -1)
📝 app/Http/Controllers/Api/Client/ClientController.php (+2 -2)
📝 app/Http/Controllers/Api/Remote/SftpAuthenticationController.php (+1 -1)
📝 app/Http/Middleware/Api/Client/Server/AuthenticateServerAccess.php (+3 -3)
📝 app/Http/Requests/Api/Client/Servers/Subusers/SubuserRequest.php (+2 -2)
📝 app/Models/Permission.php (+1 -1)
📝 app/Models/User.php (+28 -5)
📝 app/Services/Servers/GetUserPermissionsService.php (+11 -9)
📝 lang/en/server/users.php (+3 -2)
📝 resources/views/filament/components/server-console.blade.php (+19 -17)

📄 Description

  • If an admin has view permissions they can only view the console & settings page. (read only)
  • If an admin has update permissions they have full control over a server (like root admins or the server owner)
  • Added permissions checks for the power buttons and the console command input
  • Also fixes the "read activity" subuser permission

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/pelican-dev/panel/pull/919 **Author:** [@Boy132](https://github.com/Boy132) **Created:** 1/16/2025 **Status:** ✅ Merged **Merged:** 1/18/2025 **Merged by:** [@Boy132](https://github.com/Boy132) **Base:** `main` ← **Head:** `boy132/fix-admin-server-access` --- ### 📝 Commits (10+) - [`57c87ba`](https://github.com/pelican-dev/panel/commit/57c87ba1ac567b448c63d4e0c381cd7d26944fb1) fix server access for admins without subuser - [`291e6f2`](https://github.com/pelican-dev/panel/commit/291e6f2e9c8ad90c9f5ce7c9abdcd20303299f66) add permission checks to power buttons - [`5022118`](https://github.com/pelican-dev/panel/commit/5022118e13c5334d195ad95e3fa6cdadf64df6f7) add permission check for console command sending - [`03c2f03`](https://github.com/pelican-dev/panel/commit/03c2f03fd52b1bc94753765e4f882d1ea9f4d829) fix tests - [`d83b049`](https://github.com/pelican-dev/panel/commit/d83b049e758d256de93c2b9d8f8249fad0b3d3c8) fix websocket token permissions - [`9517533`](https://github.com/pelican-dev/panel/commit/9517533d9dc29b8a2d93058b431e62370d9405d7) fix sftp access - [`f3a2afc`](https://github.com/pelican-dev/panel/commit/f3a2afc34835dbb1f99b7c6559c959927ab5a4eb) fix server api + small cleanup - [`d0fb6fb`](https://github.com/pelican-dev/panel/commit/d0fb6fb7c819647cc0153ac6af62c22e525f18ab) it's "update", not "edit"... - [`44ba4fb`](https://github.com/pelican-dev/panel/commit/44ba4fbb8489028529c3acd7dbb683e7f9d1f011) fix tests - [`63dd0bb`](https://github.com/pelican-dev/panel/commit/63dd0bb7625d4fba77e2f11a36fd523db393b2e5) Merge remote-tracking branch 'upstream/main' into boy132/fix-admin-server-access ### 📊 Changes **13 files changed** (+103 additions, -45 deletions) <details> <summary>View changed files</summary> 📝 `app/Filament/App/Resources/ServerResource/Pages/ListServers.php` (+1 -1) 📝 `app/Filament/Server/Pages/Console.php` (+5 -0) 📝 `app/Filament/Server/Resources/UserResource/Pages/ListUsers.php` (+21 -1) 📝 `app/Filament/Server/Widgets/ServerConsole.php` (+6 -1) 📝 `app/Http/Controllers/Api/Client/ClientController.php` (+2 -2) 📝 `app/Http/Controllers/Api/Remote/SftpAuthenticationController.php` (+1 -1) 📝 `app/Http/Middleware/Api/Client/Server/AuthenticateServerAccess.php` (+3 -3) 📝 `app/Http/Requests/Api/Client/Servers/Subusers/SubuserRequest.php` (+2 -2) 📝 `app/Models/Permission.php` (+1 -1) 📝 `app/Models/User.php` (+28 -5) 📝 `app/Services/Servers/GetUserPermissionsService.php` (+11 -9) 📝 `lang/en/server/users.php` (+3 -2) 📝 `resources/views/filament/components/server-console.blade.php` (+19 -17) </details> ### 📄 Description - If an admin has `view` permissions they can only view the console & settings page. (read only) - If an admin has `update` permissions they have full control over a server (like root admins or the server owner) - Added permissions checks for the power buttons and the console command input - Also fixes the "read activity" subuser permission --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
OVERLORD added the pull-request label 2026-02-04 19:13:55 +03:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
not confirmed
pull-request
Mirrored from GitHub Pull Request
 👑 sponsor
💰 fund
🔴 hard
🟡 medium
🟡 medium
🟡 medium
🟢 easy
🟢 easy
🟢 easy
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/panel#1056
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?