Nosial/FederationServer
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add authorization check for audit logs in handleRequest method

Browse source
This commit is contained in:
netkas 2025-06-06 13:05:20 -04:00
parent 4817c15338
commit cb5862fe94
Signed by: netkas
GPG key ID: 4D8629441B76E4CC
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/FederationServer/Methods/Audit/ViewAuditEntry.php
View file

@ -2,6 +2,7 @@
namespace FederationServer\Methods\Audit;
use FederationServer\Classes\Configuration;
use FederationServer\Classes\Managers\AuditLogManager;
use FederationServer\Classes\RequestHandler;
use FederationServer\Classes\Validate;
@ -16,6 +17,12 @@
*/
public static function handleRequest(): void
{
$authenticatedOperator = FederationServer::getAuthenticatedOperator();
if(!Configuration::getServerConfiguration()->isAuditLogsPublic() && $authenticatedOperator === null)
{
throw new RequestException('Unauthorized: Public audit logs are disabled and no operator is authenticated', 403);
}
if(!preg_match('#^/audit/([a-fA-F0-9\-]{36,})$#', FederationServer::getPath(), $matches))
{
throw new RequestException('Bad Request: Audit UUID is required', 400);