copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #263 from copenhagentruckwash/fix-machine-relay-set-endpoint-vulnerability

Browse Source 
Guard machine relay set status
This commit is contained in:
Jeppe B
2026-06-02 00:21:49 +02:00
committed by GitHub
parent d6190626ce a96f40cf13
commit 267ec1bed1
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/modules/selfserve/traits/selfserve_lane_relay_controller_t.php
+4 -2
View File
@@ -107,14 +107,16 @@ trait selfserve_lane_relay_controller_t
}
/**
* Set MACHINE relay status directly.
* Set MACHINE relay status using the same guards as manual relay controls.
* @param bool $on true to turn on, false to turn off
* @return bool
* @throws \Exception
*/
public function setMachineRelayStatus(bool $on): bool
{
return $this->setRelayStatus(selfserve_lane_relay::MACHINE, $on);
return $on
? $this->turnOnRelay(selfserve_lane_relay::MACHINE)
: $this->turnOffRelay(selfserve_lane_relay::MACHINE);
}
/**
services/nginx/app/tests/Unit/Selfserve/SelfserveLaneRelayShellyBatchingTest.php
+9
View File
@@ -621,6 +621,14 @@ it('is a safe no-op when MACHINE relay is not configured', function (): void {
expect($harness->getShellyCallCount('/v2/devices/api/set/switch'))->toBe(0);
});
it('blocks setMachineRelayStatus from enabling MACHINE when MACHINE is not allowed', function (): void {
$harness = selfserve_lane_shelly_test_harness();
expect(fn() => $harness->setMachineRelayStatus(true))
->toThrow(\Exception::class, 'MACHINE relay is not allowed to be enabled at this time');
expect($harness->getShellyCallCount('/v2/devices/api/set/switch'))->toBe(0);
});
it('uses local demo responses and skips Shelly cloud calls for demo relay ids', function (): void {
$harness = selfserve_lane_shelly_test_harness();
$harness->department_lane = new SelfserveDepartmentLaneRelayFake(
@@ -628,6 +636,7 @@ it('uses local demo responses and skips Shelly cloud calls for demo relay ids',
programPickerRelayId: 'demo-program',
cleanerRelayId: 'demo-cleaner'
);
$harness->setLaneCache($harness->id, $harness::CACHE_SELFSERVE_LANE_KEY_ALLOWED_SERVICES, ['MACHINE']);
$result = $harness->setMachineRelayStatus(true);
$status = $harness->getMachineRelayStatus();