@akemona-org/strapi-admin 3.15.0 → 3.15.2

package/controllers/authentication.js

@@ -20,6 +20,11 @@ module.exports = {
           return ctx.badImplementation();
         }
 
+        const accessAllowed = strapi.admin.services.auth.checkNetworkAccess(ctx.request.ip);
+        if (!accessAllowed) {
+          return ctx.badRequest('Access is not allowed from this network.');
+        }
+
         if (!user) {
           strapi.eventHub.emit('admin.auth.error', {
             error: new Error(info.message),

package/middlewares/auth/index.js

@@ -7,18 +7,6 @@ module.exports = (strapi) => ({
     strapi.app.use(passportMiddleware);
 
     strapi.app.use(async (ctx, next) => {
-      if (
-        process.env.STRAPI_ADMIN_ENABLE_NETWORK_CHECK === 'true' &&
-        process.env.STRAPI_ADMIN_ALLOWED_IP_LIST
-      ) {
-        const allowedList = process.env.STRAPI_ADMIN_ALLOWED_IP_LIST.split(',').map((item) =>
-          item.trim()
-        );
-        if (!allowedList.includes(ctx.request.ip)) {
-          return ctx.forbidden('Invalid network');
-        }
-      }
-
       if (
         ctx.request.header.authorization &&
         ctx.request.header.authorization.split(' ')[0] === 'Bearer'
@@ -35,6 +23,11 @@ module.exports = (strapi) => ({
             return ctx.forbidden('Invalid credentials');
           }
 
+          const accessAllowed = strapi.admin.services.auth.checkNetworkAccess(ctx.request.ip);
+          if (!accessAllowed) {
+            return ctx.forbidden('Invalid network');
+          }
+
           ctx.state.admin = admin;
           ctx.state.user = admin;
           ctx.state.userAbility =

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "3.15.0",
+  "version": "3.15.2",
   "description": "Strapi Admin",
   "repository": {
     "type": "git",
@@ -17,8 +17,8 @@
   },
   "main": "index.js",
   "dependencies": {
-    "@akemona-org/strapi-helper-plugin": "3.15.0",
-    "@akemona-org/strapi-utils": "3.15.0",
+    "@akemona-org/strapi-helper-plugin": "3.15.2",
+    "@akemona-org/strapi-utils": "3.15.2",
     "@babel/core": "^7.14.0",
     "@babel/plugin-proposal-async-generator-functions": "^7.13.15",
     "@babel/plugin-proposal-class-properties": "^7.12.1",
@@ -125,5 +125,5 @@
   "devDependencies": {
     "webpack-bundle-analyzer": "4.4.0"
   },
-  "gitHead": "885f45a8bf903e9a82babad9343befe5dff54796"
+  "gitHead": "0c7c8e5f9e88e61ddc086537cb425a7014b83539"
 }

package/services/auth.js

@@ -19,6 +19,22 @@ const hashPassword = (password) => bcrypt.hash(password, 10);
  */
 const validatePassword = (password, hash) => bcrypt.compare(password, hash);
 
+/**
+ *
+ * @param {string} ip
+ * @returns {boolean} is allowed
+ */
+const checkNetworkAccess = (ip) => {
+  if (process.env.STRAPI_ADMIN_ENABLE_NETWORK_CHECK === 'true') {
+    const ipListStr = process.env.STRAPI_ADMIN_ALLOWED_IP_LIST ?? '';
+    const allowedList = ipListStr.split(',').map((item) => item.trim());
+    if (!allowedList.includes(ip)) {
+      return false;
+    }
+  }
+  return true;
+};
+
 /**
  * Check login credentials
  * @param {Object} options
@@ -105,6 +121,7 @@ const resetPassword = async ({ resetPasswordToken, password } = {}) => {
 };
 
 module.exports = {
+  checkNetworkAccess,
   checkCredentials,
   validatePassword,
   hashPassword,