From c69006e1852befa93f94a7c45651025214941a4e Mon Sep 17 00:00:00 2001 From: KernelDeimos Date: Wed, 18 Dec 2024 14:51:30 -0500 Subject: [PATCH] fix: acl check for subdomain on access --- src/backend/src/routers/hosting/puter-site.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/backend/src/routers/hosting/puter-site.js b/src/backend/src/routers/hosting/puter-site.js index d9d81bf48..29c7255d0 100644 --- a/src/backend/src/routers/hosting/puter-site.js +++ b/src/backend/src/routers/hosting/puter-site.js @@ -147,6 +147,14 @@ class PuterSiteMiddleware extends AdvancedBase { res.status(502).send('subdomain is pointing to non-directory'); } + // Verify subdomain owner permission + const subdomain_actor = Actor.adapt(subdomain_owner); + const svc_acl = services.get('acl'); + if ( ! await svc_acl.check(subdomain_actor, node, 'read') ) { + res.status(502).send('subdomain owner does not have access to directory'); + return; + } + subdomain_root_path = await node.get('path'); }