FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Dry Run button; fix CSRF token on all POST API calls

Browse Source 
All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.

Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.
This commit is contained in:
Gmer4Lfe
2026-05-23 17:50:47 -04:00
parent 131d9093b0
commit d0b842a489
9 changed files with 98 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/usr/local/emhttp/plugins/varaverk/pages/config.php
+15 -16
View File
@@ -50,19 +50,23 @@ $currentScriptsDir = SCRIPTS_DIR;
</div>
<script>
function vvPost(url, data) {
const params = new URLSearchParams({csrf_token, ...data});
return fetch(url, {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: params
}).then(r => r.json());
}
function vvSaveSettings() {
const dir = document.getElementById('vv-scripts-dir').value.trim();
const status = document.getElementById('vv-settings-status');
if (!dir) { status.textContent = '✗ Path required'; return; }
status.textContent = 'Saving...';
fetch('/plugins/varaverk/api/settings.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({scripts_dir: dir})
})
.then(r => r.json())
.then(d => { status.textContent = d.ok ? '✓ Saved — reload to apply' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
vvPost('/plugins/varaverk/api/settings.php', {scripts_dir: dir})
.then(d => { status.textContent = d.ok ? '✓ Saved — reload to apply' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
}
function vvSaveConf() {
@@ -72,13 +76,8 @@ function vvSaveConf() {
const status = document.getElementById('vv-conf-status');
status.textContent = 'Saving...';
fetch('/plugins/varaverk/api/config.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({file, content})
})
.then(r => r.json())
.then(d => { status.textContent = d.ok ? '✓ Saved' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
vvPost('/plugins/varaverk/api/config.php', {file, content})
.then(d => { status.textContent = d.ok ? '✓ Saved' : '✗ ' + (d.error ?? 'Error'); })
.catch(() => { status.textContent = '✗ Request failed'; });
}
</script>