FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Dry Run button; fix CSRF token on all POST API calls

Browse Source 
All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.

Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.
This commit is contained in:
Gmer4Lfe
2026-05-23 17:50:47 -04:00
parent 131d9093b0
commit d0b842a489
9 changed files with 98 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/usr/local/emhttp/plugins/varaverk/api/dryrun.php
+26
View File
@@ -0,0 +1,26 @@
<?php
header('Content-Type: application/json');
require_once dirname(__DIR__) . '/include/scheduler.php';
$id = trim($_POST['id'] ?? '');
if (!$id || !preg_match('/^[a-zA-Z0-9_.\/\-]+\.sh$/', $id) || str_contains($id, '..')) {
echo json_encode(['ok' => false, 'error' => 'Invalid id']);
exit;
}
$script = SCRIPTS_DIR . '/' . $id;
if (!file_exists($script)) {
echo json_encode(['ok' => false, 'error' => 'Script not found: ' . $id]);
exit;
}
$logFile = vv_job_log_path($id);
$logDir = dirname($logFile);
if (!is_dir($logDir)) mkdir($logDir, 0755, true);
file_put_contents($logFile, date('[Y-m-d H:i:s]') . " [DRY RUN] started\n", FILE_APPEND);
exec('nohup env DRY_RUN=1 bash ' . escapeshellarg($script) . ' >> ' . escapeshellarg($logFile) . ' 2>&1 </dev/null &');
echo json_encode(['ok' => true]);