Remco/Epicnabbo-Catalogus-Updated-Daily
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden admin ACL on critical write paths.

Browse Source 
Gate translations, RCON, and user mutations on SETTINGS_EDIT, RCON_EXECUTE, and USERS_EDIT instead of dashboard/rank checks; redirect the legacy user-edit URL to the guarded canonical page.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
simoleo
2026-07-15 20:07:15 +02:00
co-authored by Cursor
parent bae543baf6
commit f2427b3483
8 changed files with 127 additions and 284 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/actions/admin-user-edit.ts
+6 -5
View File
@@ -2,7 +2,8 @@
import { revalidatePath } from "next/cache";
import { redirect } from "next/navigation";
import { requireStaff } from "@/lib/admin/guard";
import { requirePermission } from "@/lib/admin/guard";
import { PERMS } from "@/lib/permissions";
import { prisma } from "@/lib/prisma";
import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -28,8 +29,8 @@ function toInt(value: FormDataEntryValue | null, min = 0): number | null {
* user from the session and logs the action. emulator-owned users.id is Int.
*/
export async function updateUser(formData: FormData): Promise<void> {
// Never trust the client: re-check staff inside the action.
const staff = await requireStaff();
// Never trust the client: re-check USERS_EDIT inside the action.
const staff = await requirePermission(PERMS.USERS_EDIT);
const userId = Number(formData.get("id"));
if (!Number.isInteger(userId) || userId <= 0) return;
@@ -95,6 +96,6 @@ export async function updateUser(formData: FormData): Promise<void> {
});
revalidatePath(`/admin/users/${userId}`);
revalidatePath(`/admin/users/${userId}/edit`);
redirect(`/admin/users/${userId}`);
revalidatePath(`/admin/users/edit/${userId}`);
redirect(`/admin/users/show/${userId}`);
}