Merge pull request #22 from ZeroHost-Code/beta

v1.0.5

Author: ddrayko

.github/workflows/deploy-beta.yml

@@ -13,8 +13,9 @@ jobs:
         with:
           host: ${{ secrets.SSH_HOST }}
           username: ${{ secrets.SSH_USER }}
-          password: ${{ secrets.SSH_PASSWORD }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
           port: ${{ secrets.SSH_PORT || 22 }}
+          host_key_checking: false
           script: |
             cd ${{ secrets.BETA_PATH }}
             cp .env /tmp/beta.env 2>/dev/null; cp port.txt /tmp/beta.port.txt 2>/dev/null

.github/workflows/deploy-main.yml

@@ -13,8 +13,9 @@ jobs:
         with:
           host: ${{ secrets.SSH_HOST }}
           username: ${{ secrets.SSH_USER }}
-          password: ${{ secrets.SSH_PASSWORD }}
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
           port: ${{ secrets.SSH_PORT || 22 }}
+          host_key_checking: false
           script: |
             cd ${{ secrets.MAIN_PATH }}
             cp .env /tmp/main.env 2>/dev/null; cp port.txt /tmp/main.port.txt 2>/dev/null

config/pyrodactyl.js

@@ -1,6 +1,7 @@
 export const PTERO_URL = process.env.PTERO_URL || 'https://panel.zero-host.org';
 export const PTERO_API_KEY = process.env.PTERO_API_KEY || '';
-export const PANEL_DB_NAME = (process.env.PANEL_DB_NAME || 'panel').replace(/[^a-zA-Z0-9_]/g, '');
+const _rawPanelDb = (process.env.PANEL_DB_NAME || 'panel').replace(/[^a-zA-Z0-9_]/g, '');
+export const PANEL_DB_NAME = '`' + _rawPanelDb + '`';
 
 export const SERVER_LIMITS = {
   memory: 512,

middleware/auth.js

@@ -75,9 +75,17 @@ export function requireNotRestricted(req, res, next) {
   next();
 }
 
+const ALLOWED_TABLES = new Set(['server_meta']);
+const ALLOWED_COLUMNS = new Set(['ptero_server_id', 'user_id', 'id']);
+
 export function requireOwnership(table, column, paramName, idSource = 'params') {
   return async (req, res, next) => {
     try {
+      if (!ALLOWED_TABLES.has(table) || !ALLOWED_COLUMNS.has(column)) {
+        console.error(`Blocked ownership check on unauthorized table/column: ${table}.${column}`);
+        return res.status(500).json({ error: 'Ownership verification failed' });
+      }
+
       const id = parseInt(idSource === 'params' ? req.params[paramName] : req.body[paramName], 10);
       if (isNaN(id)) {
         return res.status(400).json({ error: 'Invalid ID' });