@akemona-org/strapi-admin 3.14.2 → 3.15.1

package/controllers/authentication.js

@@ -20,6 +20,11 @@ module.exports = {
           return ctx.badImplementation();
         }
 
+        const accessAllowed = strapi.admin.services.auth.checkNetworkAccess(ctx.request.ip);
+        if (!accessAllowed) {
+          return ctx.badRequest('Access is not allowed from this network.');
+        }
+
         if (!user) {
           strapi.eventHub.emit('admin.auth.error', {
             error: new Error(info.message),

package/middlewares/auth/index.js

@@ -23,6 +23,11 @@ module.exports = (strapi) => ({
             return ctx.forbidden('Invalid credentials');
           }
 
+          const accessAllowed = strapi.admin.services.auth.checkNetworkAccess(ctx.request.ip);
+          if (!accessAllowed) {
+            return ctx.forbidden('Invalid network');
+          }
+
           ctx.state.admin = admin;
           ctx.state.user = admin;
           ctx.state.userAbility =

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.14.2",
+  "version": "3.15.1",
   "description": "Strapi Admin",
   "repository": {
     "type": "git",
@@ -17,8 +17,8 @@
   },
   "main": "index.js",
   "dependencies": {
-    "@akemona-org/strapi-helper-plugin": "3.14.2",
-    "@akemona-org/strapi-utils": "3.14.2",
+    "@akemona-org/strapi-helper-plugin": "3.15.1",
+    "@akemona-org/strapi-utils": "3.15.1",
     "@babel/core": "^7.14.0",
     "@babel/plugin-proposal-async-generator-functions": "^7.13.15",
     "@babel/plugin-proposal-class-properties": "^7.12.1",
@@ -125,5 +125,5 @@
   "devDependencies": {
     "webpack-bundle-analyzer": "4.4.0"
   },
-  "gitHead": "a1766a21d909726ba2f64588830ac4b3467683a7"
+  "gitHead": "f4c98c57d5309f2d463e432a98274bc631ff3193"
 }

package/services/auth.js

@@ -19,6 +19,22 @@ const hashPassword = (password) => bcrypt.hash(password, 10);
  */
 const validatePassword = (password, hash) => bcrypt.compare(password, hash);
 
+/**
+ *
+ * @param {string} ip
+ * @returns {boolean} is allowed
+ */
+const checkNetworkAccess = (ip) => {
+  if (process.env.STRAPI_ADMIN_ENABLE_NETWORK_CHECK === 'true') {
+    const ipListStr = process.env.STRAPI_ADMIN_ALLOWED_IP_LIST ?? '';
+    const allowedList = ipListStr.split(',').map((item) => item.trim());
+    if (!allowedList.includes(ip)) {
+      return false;
+    }
+  }
+  return true;
+};
+
 /**
  * Check login credentials
  * @param {Object} options
@@ -105,6 +121,7 @@ const resetPassword = async ({ resetPasswordToken, password } = {}) => {
 };
 
 module.exports = {
+  checkNetworkAccess,
   checkCredentials,
   validatePassword,
   hashPassword,