boban
/
CluPilotCloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(admin): derive legacy datacenter location allowlist from DB, not client property 

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat/portal-design
nexxo 2026-07-25 18:27:41 +02:00
parent 3a794b05dd
commit 507ab485a0
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
app/Livewire/Admin/EditDatacenter.php
View File

@ -39,12 +39,15 @@ class EditDatacenter extends ModalComponent
public function save() public function save()
{ {
$this->authorize('datacenters.manage'); $this->authorize('datacenters.manage');
// Accept the configured countries plus the record's own legacy value, so a // Accept the configured countries plus the record's own legacy value, so a
// datacenter created before the curated list can still be edited (e.g. a // datacenter created before the curated list can still be edited. The
// name-only change) without being forced to replace a free-form location. // legacy value is read from the DB — never from the client-hydrated
// property, which could be forged to whitelist an arbitrary location.
$dc = Datacenter::query()->where('uuid', $this->uuid)->firstOrFail();
$allowed = array_keys((array) config('countries')); $allowed = array_keys((array) config('countries'));
if ($this->originalLocation !== '') { if ($dc->location) {
$allowed[] = $this->originalLocation; $allowed[] = $dc->location;
} }
$data = $this->validate([ $data = $this->validate([
'name' => 'required|string|max:255', 'name' => 'required|string|max:255',