Pterodactyl has a database resource limit bypass via race condition in Client API

@@ -5,6 +5,7 @@
 use Pterodactyl\Models\ApiKey;
 use Illuminate\Http\JsonResponse;
 use Pterodactyl\Facades\Activity;
+use Illuminate\Support\Facades\DB;
 use Pterodactyl\Exceptions\DisplayException;
 use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
 use Pterodactyl\Transformers\Api\Client\ApiKeyTransformer;
@@ -29,14 +30,16 @@ public function index(ClientApiRequest $request): array
      */
     public function store(StoreApiKeyRequest $request): array
     {
-        if ($request->user()->apiKeys->count() >= 25) {
-            throw new DisplayException('You have reached the account limit for number of API keys.');
-        }
+        $token = DB::transaction(function () use ($request) {
+            if ($request->user()->apiKeys()->lockForUpdate()->count() >= 25) {
+                throw new DisplayException('You have reached the account limit for number of API keys.');
+            }
 
-        $token = $request->user()->createToken(
-            $request->input('description'),
-            $request->input('allowed_ips')
-        );
+            return $request->user()->createToken(
+                $request->input('description'),
+                $request->input('allowed_ips')
+            );
+        });
 
         Activity::event('user:api-key.create')
             ->subject($token->accessToken)

@@ -78,7 +78,7 @@ public function store(StoreBackupRequest $request, Server $server): array
         }
 
         $backup = Activity::event('server:backup.start')->transaction(function ($log) use ($action, $server, $request) {
-            $server->backups()->lockForUpdate();
+            $server->backups()->lockForUpdate()->count();
 
             $backup = $action->handle($server, $request->input('name'));
 

@@ -6,6 +6,7 @@
 use Pterodactyl\Models\Server;
 use Pterodactyl\Models\Database;
 use Pterodactyl\Facades\Activity;
+use Pterodactyl\Exceptions\DisplayException;
 use Pterodactyl\Services\Databases\DatabasePasswordService;
 use Pterodactyl\Transformers\Api\Client\DatabaseTransformer;
 use Pterodactyl\Services\Databases\DatabaseManagementService;
@@ -49,7 +50,9 @@ public function index(GetDatabasesRequest $request, Server $server): array
     public function store(StoreDatabaseRequest $request, Server $server): array
     {
         $database = Activity::event('server:database.create')->transaction(function ($log) use ($request, $server) {
-            $server->databases()->lockForUpdate();
+            if ($server->databases()->lockForUpdate()->count() >= $server->database_limit) {
+                throw new DisplayException('Cannot create additional databases on this server: limit has been reached.');
+            }
 
             $database = $this->deployDatabaseService->handle($server, $request->validated());
 
@@ -75,11 +78,7 @@ public function rotatePassword(RotatePasswordRequest $request, Server $server, D
         Activity::event('server:database.rotate-password')
             ->subject($database)
             ->property('name', $database->database)
-            ->transaction(function () use ($database) {
-                $database->lockForUpdate();
-
-                $this->passwordService->handle($database);
-            });
+            ->transaction(fn () => $this->passwordService->handle($database));
 
         return $this->fractal->item($database->refresh())
             ->parseIncludes(['password'])

@@ -39,6 +39,7 @@ public function handle(Server $server): Allocation
         // server.
         /** @var Allocation|null $allocation */
         $allocation = $server->node->allocations()
+            ->lockForUpdate()
             ->where('ip', $server->allocation->ip)
             ->whereNull('server_id')
             ->inRandomOrder()
@@ -102,6 +103,7 @@ protected function createNewAllocation(Server $server): Allocation
 
         /** @var Allocation $allocation */
         $allocation = $server->node->allocations()
+            ->lockForUpdate()
             ->where('ip', $server->allocation->ip)
             ->where('port', $port)
             ->firstOrFail();

@@ -32,12 +32,11 @@ public function handle(Database|int $database): string
         $password = Utilities::randomStringWithSpecialCharacters(24);
 
         $this->connection->transaction(function () use ($database, $password) {
-            $this->dynamic->set('dynamic', $database->database_host_id);
-
-            $this->repository->withoutFreshModel()->update($database->id, [
+            $database->sharedLock()->update([
                 'password' => $this->encrypter->encrypt($password),
             ]);
 
+            $this->dynamic->set('dynamic', $database->database_host_id);
             $this->repository->dropUser($database->username, $database->remote);
             $this->repository->createUser($database->username, $database->remote, $password, $database->max_connections);
             $this->repository->assignUserToDatabase($database->database, $database->username, $database->remote);