Fix #1434

src/endpoints/ProjectsDelete.php

@@ -11,6 +11,20 @@ class ProjectsDelete extends Route
 {
     public function __invoke(Request $request, Response $response)
     {
+
+        $data = $request->getParsedBody();
+        $this->validate($data,[
+            'super_admin_token' => 'required',
+        ]);
+
+        $superadminFilePath = \Directus\get_app_base_path().'/config/__api.json';
+
+            $superadminFileData = json_decode(file_get_contents($superadminFilePath), true);
+            if ($data['super_admin_token'] !== $superadminFileData['super_admin_token']) {
+                throw new UnauthorizedException('Permission denied: Superadmin Only');
+            }
+
+
         $installService = new ProjectService($this->container);
         $installService->delete($request->getAttribute('name'));
 

src/endpoints/Server.php

@@ -9,6 +9,7 @@
 use Directus\Exception\NotInstalledException;
 use Directus\Util\StringUtils;
 use Directus\Services\ServerService;
+use Directus\Application\Http\Middleware\TableGatewayMiddleware;
 
 class Server extends Route
 {
@@ -17,9 +18,17 @@ class Server extends Route
      */
     public function __invoke(Application $app)
     {
+        $container = $this->container;
         \Directus\create_ping_route($app);
         $app->get('/projects', [$this, 'projects']);
         $app->get('/info', [$this, 'getInfo']);
+        $app->group('/projects', function () use ($container){
+            $this->post('/', \Directus\Api\Routes\ProjectsCreate::class);
+            $this->delete('/{name}', \Directus\Api\Routes\ProjectsDelete::class)
+                ->add(new \Directus\Application\Http\Middleware\AuthenticationMiddleware($container))
+                ->add(new \Directus\Application\Http\Middleware\AdminOnlyMiddleware($container))
+                ->add(new \Directus\Application\Http\Middleware\AuthenticationIgnoreOriginMiddleware($container));
+        })->add(new TableGatewayMiddleware($container));
     }
 
     /**

src/web.php

@@ -134,14 +134,6 @@
     ->add($middleware['rate_limit_user'])
     ->add($middleware['table_gateway']);
 
-$app->group('/projects', function () use ($middleware) {
-    $this->post('', \Directus\Api\Routes\ProjectsCreate::class);
-
-    $this->delete('/{name}', \Directus\Api\Routes\ProjectsDelete::class)
-        ->add($middleware['auth_admin'])
-        ->add($middleware['auth'])
-        ->add($middleware['auth_ignore_origin']);
-})->add($middleware['table_gateway']);
 
 $app->group('/{project}', function () use ($middleware) {
     $this->get('/', \Directus\Api\Routes\ProjectHome::class)