FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Dry Run button; fix CSRF token on all POST API calls

Browse Source 
All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.

Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.
This commit is contained in:
Gmer4Lfe
2026-05-23 17:50:47 -04:00
parent 131d9093b0
commit d0b842a489
9 changed files with 98 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/usr/local/emhttp/plugins/varaverk/api/config.php
+2 -3
View File
@@ -2,9 +2,8 @@
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/config.php';
$body = json_decode(file_get_contents('php://input'), true);
$file = trim($body['file'] ?? '');
$content = $body['content'] ?? '';
$file = trim($_POST['file'] ?? '');
$content = $_POST['content'] ?? '';
// Must be an allowed file for this host
$allowed = vv_get_conf_files();
Plugin/usr/local/emhttp/plugins/varaverk/api/dryrun.php
+26
View File
@@ -0,0 +1,26 @@
<?php
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/scheduler.php';
$id = trim($_POST['id'] ?? '');
if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
echo json_encode(['ok' => false, 'error' => 'Invalid id']);
exit;
}
$script = SCRIPTS_DIR . '/' . $id;
if (!file_exists($script)) {
echo json_encode(['ok' => false, 'error' => 'Script not found: ' . $id]);
exit;
}
$logFile = vv_job_log_path($id);
$logDir = dirname($logFile);
if (!is_dir($logDir)) mkdir($logDir, 0755, true);
file_put_contents($logFile, date('[Y-m-d H:i:s]') . " [DRY RUN] started\n", FILE_APPEND);
exec('nohup env DRY_RUN=1 bash ' . escapeshellarg($script) . ' >> ' . escapeshellarg($logFile) . ' 2>&1 </dev/null &');
echo json_encode(['ok' => true]);
Plugin/usr/local/emhttp/plugins/varaverk/api/log.php
+2 -2
View File
@@ -2,7 +2,7 @@
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/scheduler.php';
$id = trim($_GET['id'] ?? '');
$id = trim($_SERVER['REQUEST_METHOD'] === 'POST' ? ($_POST['id'] ?? '') : ($_GET['id'] ?? ''));
if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
echo json_encode(['ok' => false, 'error' => 'Invalid job id']);
@@ -11,7 +11,7 @@ if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id,
$logFile = vv_job_log_path($id);
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_GET['clear'])) {
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['clear'])) {
if (file_exists($logFile)) file_put_contents($logFile, '');
echo json_encode(['ok' => true]);
exit;
Plugin/usr/local/emhttp/plugins/varaverk/api/run.php
+2 -3
View File
@@ -2,8 +2,7 @@
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/scheduler.php';
$body = json_decode(file_get_contents('php://input'), true);
$id = trim($body['id'] ?? '');
$id = trim($_POST['id'] ?? '');
if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
echo json_encode(['ok' => false, 'error' => 'Invalid id']);
@@ -23,6 +22,6 @@ if (!is_dir($logDir)) mkdir($logDir, 0755, true);
// Stamp the log so the panel shows when the run started
file_put_contents($logFile, date('[Y-m-d H:i:s]') . " Manual run started\n", FILE_APPEND);
exec('bash ' . escapeshellarg($script) . ' >> ' . escapeshellarg($logFile) . ' 2>&1 &');
exec('nohup bash ' . escapeshellarg($script) . ' >> ' . escapeshellarg($logFile) . ' 2>&1 </dev/null &');
echo json_encode(['ok' => true]);
Plugin/usr/local/emhttp/plugins/varaverk/api/scheduler.php
+3 -4
View File
@@ -2,10 +2,9 @@
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/scheduler.php';
$body = json_decode(file_get_contents('php://input'), true);
$id = trim($body['id'] ?? '');
$enabled = (bool)($body['enabled'] ?? false);
$cron = trim($body['cron'] ?? '');
$id = trim($_POST['id'] ?? '');
$enabled = (bool)($_POST['enabled'] ?? false);
$cron = trim($_POST['cron'] ?? '');
if (!$id) {
echo json_encode(['ok' => false, 'error' => 'Missing id']);
Plugin/usr/local/emhttp/plugins/varaverk/api/settings.php
+1 -2
View File
@@ -1,8 +1,7 @@
<?php
header('Content-Type: application/json');
$body = json_decode(file_get_contents('php://input'), true);
$scriptsDir = trim($body['scripts_dir'] ?? '');
$scriptsDir = trim($_POST['scripts_dir'] ?? '');
if (!$scriptsDir) {
echo json_encode(['ok' => false, 'error' => 'scripts_dir is required']);
Plugin/usr/local/emhttp/plugins/varaverk/css/varaverk.css
+3
View File
@@ -61,6 +61,9 @@
.vv-run-btn { border-color: #2196f3 !important; color: #2196f3 !important; }
.vv-run-btn:hover { background: #0d47a1 !important; color: #fff !important;
border-color: #2196f3 !important; }
.vv-dry-btn { border-color: #ff9800 !important; color: #ff9800 !important; }
.vv-dry-btn:hover { background: #e65100 !important; color: #fff !important;
border-color: #ff9800 !important; }
/* Log panel */
.vv-log-panel { margin-top: 10px; border-top: 1px solid #333; padding-top: 8px; }
Plugin/usr/local/emhttp/plugins/varaverk/pages/config.php
+15 -16
View File
@@ -50,19 +50,23 @@ $currentScriptsDir = SCRIPTS_DIR;
</div>
<script>
function vvPost(url, data) {
const params = new URLSearchParams({csrf_token, ...data});
return fetch(url, {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: params
}).then(r => r.json());
}
function vvSaveSettings() {
const dir = document.getElementById('vv-scripts-dir').value.trim();
const status = document.getElementById('vv-settings-status');
if (!dir) { status.textContent = '✗ Path required'; return; }
status.textContent = 'Saving...';
fetch('/plugins/varaverk/api/settings.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({scripts_dir: dir})
})
.then(r => r.json())
.then(d => { status.textContent = d.ok ? '✓ Saved — reload to apply' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
vvPost('/plugins/varaverk/api/settings.php', {scripts_dir: dir})
.then(d => { status.textContent = d.ok ? '✓ Saved — reload to apply' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
}
function vvSaveConf() {
@@ -72,13 +76,8 @@ function vvSaveConf() {
const status = document.getElementById('vv-conf-status');
status.textContent = 'Saving...';
fetch('/plugins/varaverk/api/config.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({file, content})
})
.then(r => r.json())
.then(d => { status.textContent = d.ok ? '✓ Saved' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
vvPost('/plugins/varaverk/api/config.php', {file, content})
.then(d => { status.textContent = d.ok ? '✓ Saved' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
}
</script>
Plugin/usr/local/emhttp/plugins/varaverk/pages/scheduler.php
+44 -33
View File
@@ -23,6 +23,7 @@ $tree = vv_job_tree();
<input type="text" class="vv-cron" value="<?= htmlspecialchars($orch['cron']) ?>"
placeholder="cron expression">
<button class="vv-btn-sm vv-run-btn" onclick="vvRunJob(this)">&#9654; Run</button>
<button class="vv-btn-sm vv-dry-btn" onclick="vvDryRun(this)">&#9654; Dry Run</button>
<button class="vv-log-btn vv-btn-sm" onclick="vvToggleLog(this)">Log</button>
<span class="vv-job-status"></span>
<?php if (!empty($orch['children'])): ?>
@@ -55,6 +56,7 @@ $tree = vv_job_tree();
<input type="text" class="vv-cron" value="<?= htmlspecialchars($child['cron']) ?>"
placeholder="cron expression">
<button class="vv-btn-sm vv-run-btn" onclick="vvRunJob(this)">&#9654; Run</button>
<button class="vv-btn-sm vv-dry-btn" onclick="vvDryRun(this)">&#9654; Dry Run</button>
<button class="vv-log-btn vv-btn-sm" onclick="vvToggleLog(this)">Log</button>
<span class="vv-job-status"></span>
</div>
@@ -83,20 +85,24 @@ $tree = vv_job_tree();
<script>
const vvLogTimers = {};
function vvPost(url, data) {
const params = new URLSearchParams({csrf_token, ...data});
return fetch(url, {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: params
}).then(r => r.json());
}
// Toggle auto-saves its single job immediately
function vvSaveJob(el) {
const job = el.closest('[data-id]');
const id = job.dataset.id;
const enabled = job.querySelector('.vv-enabled').checked;
const enabled = job.querySelector('.vv-enabled').checked ? '1' : '0';
const cron = job.querySelector('.vv-cron').value.trim();
const status = job.querySelector('.vv-job-status');
fetch('/plugins/varaverk/api/scheduler.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({id, enabled, cron})
})
.then(r => r.json())
.then(d => { if (status) vvFlashStatus(status, d.ok ? '✓' : '✗ ' + (d.error ?? ''), d.ok); });
vvPost('/plugins/varaverk/api/scheduler.php', {id, enabled, cron})
.then(d => { if (status) vvFlashStatus(status, d.ok ? '✓' : '✗ ' + (d.error ?? ''), d.ok); });
}
// Save button at card bottom: saves all jobs (orch + children) in this card
@@ -110,18 +116,13 @@ function vvSaveCard(btn) {
status.textContent = 'Saving…';
jobs.forEach(job => {
const id = job.dataset.id;
const enabled = job.querySelector('.vv-enabled').checked;
const enabled = job.querySelector('.vv-enabled').checked ? '1' : '0';
const cron = job.querySelector('.vv-cron').value.trim();
fetch('/plugins/varaverk/api/scheduler.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({id, enabled, cron})
})
.then(r => r.json())
.then(d => {
if (!d.ok) allOk = false;
if (--pending === 0) vvFlashStatus(status, allOk ? '✓ Saved' : '✗ Some failed', allOk);
});
vvPost('/plugins/varaverk/api/scheduler.php', {id, enabled, cron})
.then(d => {
if (!d.ok) allOk = false;
if (--pending === 0) vvFlashStatus(status, allOk ? '✓ Saved' : '✗ Some failed', allOk);
});
});
}
@@ -133,18 +134,29 @@ function vvRunJob(btn) {
if (logBtn && !logBtn.classList.contains('active')) vvToggleLog(logBtn);
fetch('/plugins/varaverk/api/run.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({id})
})
.then(r => r.json())
.then(d => {
if (!d.ok) {
const pre = job.querySelector('.vv-log-pre');
if (pre) pre.textContent = '✗ ' + (d.error ?? 'Failed to start');
}
});
vvPost('/plugins/varaverk/api/run.php', {id})
.then(d => {
if (!d.ok) {
const pre = job.querySelector('.vv-log-pre');
if (pre) pre.textContent = '✗ ' + (d.error ?? 'Failed to start');
}
});
}
function vvDryRun(btn) {
const job = btn.closest('[data-id]');
const id = job.dataset.id;
const logBtn = job.querySelector('.vv-log-btn');
if (logBtn && !logBtn.classList.contains('active')) vvToggleLog(logBtn);
vvPost('/plugins/varaverk/api/dryrun.php', {id})
.then(d => {
if (!d.ok) {
const pre = job.querySelector('.vv-log-pre');
if (pre) pre.textContent = '✗ ' + (d.error ?? 'Failed to start dry run');
}
});
}
function vvToggleAdvanced(btn) {
@@ -193,8 +205,7 @@ function vvFetchLog(panel, id) {
function vvClearLog(btn) {
const panel = btn.closest('.vv-log-panel');
const job = btn.closest('[data-id]');
fetch('/plugins/varaverk/api/log.php?id=' + encodeURIComponent(job.dataset.id) + '&clear=1',
{method: 'POST'})
vvPost('/plugins/varaverk/api/log.php', {id: job.dataset.id, clear: '1'})
.then(() => vvFetchLog(panel, job.dataset.id))
.catch(() => {});
}