Files
ProxyPanel/routes/channels.php
BrettonYe bd5bbbd832 Fixed Payment Status & Node IDOR
Solved #292 4th & 5th problem;
2026-03-15 23:57:03 +08:00

38 lines
1.1 KiB
PHP

<?php
use App\Models\Node;
use App\Models\Payment;
use Illuminate\Support\Facades\Broadcast;
/*
|--------------------------------------------------------------------------
| Broadcast Channels
|--------------------------------------------------------------------------
|
| Here you may register all of the event broadcasting channels that your
| application supports. The given channel authorization callbacks are
| used to check if an authenticated user can listen to the channel.
|
*/
// 支付状态更新频道
Broadcast::channel('payment-status.{tradeNo}', static function ($user, $tradeNo) {
// 检查订单是否属于该用户
return Payment::uid()->whereTradeNo($tradeNo)->exists();
});
// 节点相关操作频道
Broadcast::channel('node.{type}.{nodeId}', static function ($user, $type, $nodeId) {
// 验证用户权限和节点访问权限
if (! $user->can("admin.node.$type")) {
return false;
}
// 如果是特定节点操作,验证节点存在性和访问权限
if ($nodeId !== 'all') {
return Node::where('id', $nodeId)->exists();
}
return true;
});