Skip to content

Users can bypass "Fixed Mode" limits and increase RAM with an empty resource pool via BillingResources #185

@zarti0

Description

@zarti0

Current Behavior

When a user purchases a server via a Billing Plan with Fixed Mode enabled, they are still able to access the /server/{id}/billingresources page. Even though their "Available Resources" pool shows 0, they can successfully use the "Edit Resources" button to slightly increase their allocated RAM (for example, bypassing a 128MB limit to reach 133MB). The backend is not properly validating the empty resource pool when updating the server.

Expected Behavior

The backend should reject the resource update request because the user's available memory pool is 0 MB. Alternatively, the "Edit Resources" feature should be entirely disabled or hidden for servers deployed via Fixed Mode plans.

Steps to Reproduce

  1. Log in as an Admin and create a Billing Plan.
  2. Enable Fixed Mode and set a strict limit (e.g., 128MB Memory).
  3. Log in as a normal User and purchase/deploy a server using this plan.
  4. Verify that the user's global "Available Resources" pool is completely empty (0 MB Memory, 0% CPU, etc.).
  5. Navigate to the server's sidebar -> Settings -> Resources (which loads /server/{id}/billingresources).
  6. Click Edit Resources and attempt to increase the memory slightly (e.g., to 133MB).
  7. Save the changes. The server successfully upgrades to 133MB despite the user not having the required resources in their pool.

Framework Version

1.3.7.4

Error Logs

No application crash log produced. The panel processes the invalid resource modification request successfully instead of validating the pool and throwing an error.

Is there an existing issue for this?

  • I have searched the existing issues before opening this issue.
  • I have provided all relevant details.
  • I have checked in the Discord server and believe this is a bug with the FeatherPanel, and not a configuration issue with my specific system.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions