fix(guest-panel): fail closed when getCurrentPlaylistAuth() resolves to null - #1405
Closed
Grimothy wants to merge 1 commit into
Closed
fix(guest-panel): fail closed when getCurrentPlaylistAuth() resolves to null#1405Grimothy wants to merge 1 commit into
Grimothy wants to merge 1 commit into
Conversation
…to null The merged m3ue#1398 fix scoped the three guest-panel DVR queries to playlist_auth_id, but used $currentAuth?->id which silently becomes WHERE playlist_auth_id IS NULL when the credentials no longer resolve to a live PlaylistAuth row (e.g. revoked/disabled mid-session while stale session credentials still exist). That matches the playlist owner's recordings — the exact privacy leak m3ue#1398 exists to close — now reachable through a different path. Add an early-return guard immediately after $currentAuth is computed in all three sites. The guard fails closed unless isOwnerAuth() returns true: the playlist owner has no PlaylistAuth row by design (they log in via the owner_auth fallback in PlaylistService::authenticate), so getCurrentPlaylistAuth() legitimately returns null for them, and the existing whereNull coercion is how their own playlist_auth_id = null records surface. Both code paths now have a regression test. Followup to m3ue#1398.
Member
Contributor
Author
|
thanks boss man |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1398
Bug
The three guest-panel DVR query entry points all share the same pattern: they filter on
$currentAuth?->id, where$currentAuthcomes fromgetCurrentPlaylistAuth(). When that helper returnsnull, Laravel's query builder translates thenullright-hand side intoWHERE playlist_auth_id IS NULL— which doesn't fail closed, it returns the playlist owner's records to the guest.Affected entry points:
app/Filament/GuestPanel/Resources/DvrRecordings/GuestDvrRecordingResource::getEloquentQuery()app/Filament/GuestPanel/Resources/DvrRules/GuestDvrRuleResource::getEloquentQuery()app/Filament/GuestPanel/Widgets/GuestScheduledSeriesWidget::getSeriesRules()Fix
Added
&& ! static::isOwnerAuth()to the null-auth guard in each entry point. WhengetCurrentPlaylistAuth()returnsnullAND the request is NOT in the owner-auth path (noPlaylistAuthrow), return an empty result set instead of leaking the owner's records.isOwnerAuth()is already defined inapp/Filament/GuestPanel/Pages/Concerns/HasGuestDvr.phpand is the canonical predicate for the owner-auth path; reusing it preserves the existing two owner-auth tests that legitimately rely ongetCurrentPlaylistAuth()returningnullfor the playlist owner.Tests
Added 7 regression tests across the three affected files. All assert that when
getCurrentPlaylistAuth()resolves tonull(stale / mismatched state), the entry point returns an empty collection rather than the playlist owner's records.tests/Feature/GuestDvrRecordingResourceTest.php— table query, header stat, nav badge (3 tests)tests/Feature/GuestDvrRuleResourceTest.php— table query, header stat (2 tests)tests/Feature/GuestScheduledSeriesWidgetTest.php—getSeriesRules(), nav badge (2 tests)Verification
vendor/bin/peston the three target files: 72 tests pass (86 assertions), up from 65 pre-fixvendor/bin/pint --dirty --test: clean