Security update enabling update_nn to edit system details

app/Http/Controllers/SystemController.php

@@ -16,7 +16,7 @@ use Illuminate\Support\Facades\Notification;
 use Illuminate\Support\ViewErrorBag;
 
 use App\Classes\FTN\Message;
-use App\Http\Requests\{AddressMerge,AreafixRequest,SystemEchoareaRequest,SystemRegister,SystemSessionRequest};
+use App\Http\Requests\{AddressMerge,AreafixRequest,SystemEchoareaRequest,SystemRegisterRequest,SystemSessionRequest};
 use App\Jobs\AddressPoll;
 use App\Models\{Address,Echoarea,Echomail,Filearea,Netmail,Setup,System,Zone};
 use App\Notifications\Netmails\AddressLink;
@@ -29,13 +29,18 @@ class SystemController extends Controller
 	/**
 	 * Add or edit a node
 	 */
-	public function add_edit(SystemRegister $request,System $o)
+	public function add_edit(SystemRegisterRequest $request, System $o)
 	{
-		if ($request->post()) {
+		if ($request->validated()) {
-			foreach (['name','location','sysop','hold','phone','address','port','active','method','notes','zt_id','pkt_type','heartbeat'] as $key)
+			foreach (['name','location','phone','address','port','active','method','pkt_type'] as $key)
-				$o->{$key} = $request->post($key);
+				$o->{$key} = $request->validated($key);
 
-			switch ($request->post('pollmode')) {
+			// Sometimes items
+			foreach (['sysop','hold','notes','zt_id','heartbeat'] as $key)
+				if ($request->validated($key))
+					$o->{$key} = $request->validated($key);
+
+			switch ($request->validated('pollmode')) {
 				case 1: $o->pollmode = FALSE; break;
 				case 2: $o->pollmode = TRUE; break;
 				default: $o->pollmode = NULL;
@@ -49,9 +54,9 @@ class SystemController extends Controller
 				->transform(function($item) { $item['active'] = Arr::get($item,'active',FALSE); return $item; });
 
 			$o->mailers()->sync($mailers);
-			if ($request->post('users')) {
+			if ($request->validated('users')) {
-				if (array_filter($request->post('users'),function($item) { return $item; }))
+				if (array_filter($request->validated('users'),function($item) { return $item; }))
-					$o->users()->sync($request->post('users'));
+					$o->users()->sync($request->validated('users'));
 				else
 					$o->users()->detach();
 			}
@@ -62,7 +67,7 @@ class SystemController extends Controller
 		$o->load(['addresses.zone.domain','addresses.nodes_hub','addresses.system','sessions.domain','sessions.systems']);
 
 		return view('system.addedit')
-				->with('action',$o->exists ? 'update' : 'create')
+				->with('action',$o->exists ? 'update_nn' : 'create')
 				->with('o',$o);
 	}
 
@@ -767,7 +772,7 @@ class SystemController extends Controller
 	/**
 	 * Register a system, or link to an existing system
 	 */
-	public function register(SystemRegister $request)
+	public function register(SystemRegisterRequest $request)
 	{
 		// Step 1, show the user a form to select an existing defined system
 		if ($request->isMethod('GET'))

app/Http/Requests/SystemRegisterRequest.php

@@ -10,8 +10,7 @@ use Illuminate\Validation\Rule;
 use App\Classes\FTN\Packet;
 use App\Models\{Setup,System};
 
-// @todo rename to SystemRegisterRequest
+class SystemRegisterRequest extends FormRequest
-class SystemRegister extends FormRequest
 {
 	private System $so;
 
@@ -73,7 +72,7 @@ class SystemRegister extends FormRequest
 		],($so && $so->exists) ? [
 			'users' => 'nullable|array|min:1|max:2',
 			'active' => 'required|boolean',
-			'hold' => 'required|boolean',
+			'hold' => 'sometimes|boolean',
 			'pollmode' => 'required|integer|min:0|max:2',
 			'heartbeat' => 'nullable|integer|min:0|max:48',
 		] : []));

resources/views/system/addedit.blade.php

@@ -1,12 +1,12 @@
 @php
-	use App\Models\Address;
+use App\Models\Address;
 @endphp
 
 <!-- $o=System::class -->
 @extends('layouts.app')
 
 @section('htmlheader_title')
-	@can('admin',$o) @if($o->exists) Update @else Add @endif @endcan System
+	@can('update_nn',$o) @if($o->exists) Update @else Add @endif @endcan System
 @endsection
 
 @section('content')
@@ -21,6 +21,7 @@
 		<p>This system is the ZC for the following zones: <strong class="highlight">{!! $o->zcs->sortBy('zone_id')->map(function($item) { return sprintf('%d@%s',$item->zone_id,$item->domain->name); })->join('</strong>, <strong class="highlight">') !!} </strong></p>
 	@endif
 
+	@include('widgets.error')
 	<div class="accordion" id="accordion_homepage">
 		@if ($o->exists)
 			<!-- System -->
@@ -163,8 +164,8 @@
 									<span class="btn btn-sm btn-danger" role="alert" style="text-align: left;">
 										{!! $message !!}
 									</span>
+								</div>
 							</div>
-						</div>
 						@enderror
 
 						@can('admin',$o)

resources/views/system/widget/form-system.blade.php

@@ -1,3 +1,4 @@
+<!-- $o=System::class -->
 <form class="needs-validation" method="post" novalidate>
 	@csrf
 	<input type="hidden" name="system_id" value="{{ $o->id }}">
@@ -5,7 +6,7 @@
 	<div class="row pt-0">
 		<div class="col-12">
 			<div class="greyframe titledbox shadow0xb0">
-				<h2 class="cap">@can('update',$o) @if($o->exists) Update @else Add @endif @endif System</h2>
+				<h2 class="cap">@can($action,$o) @if($o->exists) Update @else Add @endif @endif System</h2>
 
 				@include('system.widget.system')
 			</div>

resources/views/system/widget/system.blade.php

@@ -1,9 +1,9 @@
 @php
-	use App\Classes\FTN\Packet;
+use App\Classes\FTN\Packet;
-	use App\Models\{Mailer,User};
+use App\Models\{Mailer,User};
 @endphp
 
-<!-- $o = System::class -->
+<!-- $o=System::class -->
 <div class="row">
 	<div class="col-xl-9 col-12">
 		@can('admin',$o)
@@ -46,7 +46,7 @@
 						<label for="name" class="form-label">BBS Name</label>
 						<div class="input-group has-validation">
 							<span class="input-group-text"><i class="bi bi-pc"></i></span>
-							<input type="text" class="form-control @error('name') is-invalid @enderror" id="name" placeholder="Name" name="name" value="{{ old('name',$o->name) }}" required @cannot('update',$o)readonly @endcannot autofocus>
+							<input type="text" class="form-control @error('name') is-invalid @enderror" id="name" placeholder="Name" name="name" value="{{ old('name',$o->name) }}" required @cannot($action,$o)readonly @endcannot autofocus>
 							<span id="search-icon" style="width: 0;"><i style="border-radius: 50%;" class="spinner-border spinner-border-sm text-dark d-none"></i></span>
 							<div id="system_search_results"></div>
 							<span class="invalid-feedback" role="alert">
@@ -227,7 +227,7 @@
 		<div class="row">
 			<!-- Active -->
 			<div class="col-6">
-				@can('update',$o)
+				@can($action,$o)
 					<label for="active" class="form-label">Active</label>
 					<div class="input-group">
 						<div class="btn-group" role="group">
@@ -245,7 +245,7 @@
 		<div class="row">
 			<!-- Hold -->
 			<div class="col-6">
-				@can('update',$o)
+				@can('admin',$o)
 					<label for="hold" class="form-label">Hold Mail <i class="bi bi-info-circle" title="Dont give the node any mail regardless of poll mode"></i></label>
 					<div class="input-group">
 						<div class="btn-group" role="group">
@@ -263,7 +263,7 @@
 		<div class="row">
 			<!-- Poll Mode -->
 			<div class="col-12">
-				@can('update',$o)
+				@can($action,$o)
 					<label for="pollmode" class="form-label">Poll Mode <i class="bi bi-info-circle" title="Poll node when mail available, poll on a schedule or hold mail for collection"></i></label>
 					<div class="input-group has-validation">
 						<div class="btn-group @error('pollmode') is-invalid @enderror" role="group">
@@ -287,11 +287,18 @@
 		</div>
 
 		<div class="row">
-			<!-- @todo This is only relevant for uplinks, so hide it if this system isnt an uplink -->
+			<div class="col-12">
-			<div class="col-12 @if((old('pollmode') === "0") || is_null($o->pollmode))d-none @endif" id="heartbeat_option">
+				<div class="row p-0">
-				@can('admin',$o)
+					<div class="col-6">
-					<div class="row p-0">
+						<label for="autohold" class="form-label">Auto Hold</label>
-						<div class="col-6">
+						<div class="input-group">
+							<button id="autohold" @class(['btn','btn-danger'=>$o->autohold,'btn-success'=>(! $o->autohold)])><i @class(['bi-toggle-on'=>$o->autohold,'bi-toggle-off'=>(! $o->autohold)])></i></button>
+						</div>
+					</div>
+
+					<!-- @todo This is only relevant for uplinks, so hide it if this system isnt an uplink -->
+					@can('admin',$o)
+						<div class="col-6 @if((old('pollmode') === "0") || is_null($o->pollmode))d-none @endif" id="heartbeat_option">
 							<label for="heartbeat" class="form-label">Heartbeat <i class="bi bi-info-circle" title="Attempt contact after last seen"></i></label>
 							<div class="input-group has-validation">
 								<span class="input-group-text"><i class="bi bi-hourglass-bottom"></i></span>
@@ -303,18 +310,15 @@
 								</span>
 							</div>
 						</div>
+					@endcan
 
-						<div class="col-6">
-							<label for="passkey" class="form-label">Auto Hold</label>
-							<button id="autohold" @class(['btn','btn-danger'=>$o->autohold,'btn-success'=>(! $o->autohold)])><i @class(['bi-toggle-on'=>$o->autohold,'bi-toggle-off'=>(! $o->autohold)])></i></button>
-						</div>
-					</div>
-				@endcan
 
-				@if (! is_null($o->pollmode))
+				</div>
+
+				@if(! is_null($o->pollmode))
 					<div class="row">
 						<div class="col-12 bg-secondary rounded p-2 small">
-							@if($job = $o->poll())
+							@if($job=$o->poll())
 								<div class="row p-0">
 									<div class="col-4 text-dark">
 										@if($job->attempts)Last: @else Scheduled: @endif
@@ -333,7 +337,7 @@
 									</div>
 								</div>
 
-								@if ($job->attempts)
+								@if($job->attempts)
 									<div class="row">
 										<div class="col-4 text-dark">
 											Next:
@@ -363,7 +367,7 @@
 									</div>
 								</div>
 
-								@if ($o->heartbeat)
+								@if($o->heartbeat)
 									<div class="row">
 										<div class="col-4 text-dark">
 											Next Heartbeat:
@@ -381,7 +385,7 @@
 								</div>
 								<div class="col-8">
 									<strong class="highlight">
-										@if ($job) Queued
+										@if($job) Queued
 										@elseif ($o->autohold)Auto Hold
 										@else
 											@switch($o->pollmode)
@@ -416,7 +420,7 @@
 		@if($o->exists)
 			@can($action,$o)
 				<a href="{{ url('system') }}" class="btn btn-danger">Cancel</a>
-				<button type="submit" name="submit" class="btn btn-success float-end">@if ($o->exists)Save @else Add @endif</button>
+				<button type="submit" name="submit" class="btn btn-success float-end">@if($o->exists)Save @else Add @endif</button>
 			@else
 				<input type="hidden" name="system_id" value="{{ $o->id }}">
 				<span><small><strong>NOTE:</strong> You'll be able to update these details after registration is completed.</small></span>
@@ -449,7 +453,6 @@
 			})
 			$('#poll_hold').on('click',function() {
 				$('#heartbeat_option').addClass('d-none');
-				console.log('hold');
 			})
 			$("#autohold").on('click',function(item) {
 				var that = $(this)