FailedProxy/Varaverk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Dry Run button; fix CSRF token on all POST API calls

Browse Source 
All fetch() POSTs now send application/x-www-form-urlencoded with the
page-injected csrf_token, satisfying unRAID's auto_prepend CSRF check.
All PHP API handlers switched from php://input JSON to $_POST.

Also adds Dry Run button (orange, between Run and Log) that sets
DRY_RUN=1 in the script environment before executing.
This commit is contained in:
Gmer4Lfe
2026-05-23 17:50:47 -04:00
parent 131d9093b0
commit d0b842a489
9 changed files with 98 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Plugin/usr/local/emhttp/plugins/varaverk/pages/scheduler.php
+44 -33
View File
@@ -23,6 +23,7 @@ $tree = vv_job_tree();
<input type="text" class="vv-cron" value="<?= htmlspecialchars($orch['cron']) ?>"
placeholder="cron expression">
<button class="vv-btn-sm vv-run-btn" onclick="vvRunJob(this)">&#9654; Run</button>
<button class="vv-btn-sm vv-dry-btn" onclick="vvDryRun(this)">&#9654; Dry Run</button>
<button class="vv-log-btn vv-btn-sm" onclick="vvToggleLog(this)">Log</button>
<span class="vv-job-status"></span>
<?php if (!empty($orch['children'])): ?>
@@ -55,6 +56,7 @@ $tree = vv_job_tree();
<input type="text" class="vv-cron" value="<?= htmlspecialchars($child['cron']) ?>"
placeholder="cron expression">
<button class="vv-btn-sm vv-run-btn" onclick="vvRunJob(this)">&#9654; Run</button>
<button class="vv-btn-sm vv-dry-btn" onclick="vvDryRun(this)">&#9654; Dry Run</button>
<button class="vv-log-btn vv-btn-sm" onclick="vvToggleLog(this)">Log</button>
<span class="vv-job-status"></span>
</div>
@@ -83,20 +85,24 @@ $tree = vv_job_tree();
<script>
const vvLogTimers = {};
function vvPost(url, data) {
const params = new URLSearchParams({csrf_token, ...data});
return fetch(url, {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: params
}).then(r => r.json());
}
// Toggle auto-saves its single job immediately
function vvSaveJob(el) {
const job = el.closest('[data-id]');
const id = job.dataset.id;
const enabled = job.querySelector('.vv-enabled').checked;
const enabled = job.querySelector('.vv-enabled').checked ? '1' : '0';
const cron = job.querySelector('.vv-cron').value.trim();
const status = job.querySelector('.vv-job-status');
fetch('/plugins/varaverk/api/scheduler.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({id, enabled, cron})
})
.then(r => r.json())
.then(d => { if (status) vvFlashStatus(status, d.ok ? '✓' : '✗ ' + (d.error ?? ''), d.ok); });
vvPost('/plugins/varaverk/api/scheduler.php', {id, enabled, cron})
.then(d => { if (status) vvFlashStatus(status, d.ok ? '✓' : '✗ ' + (d.error ?? ''), d.ok); });
}
// Save button at card bottom: saves all jobs (orch + children) in this card
@@ -110,18 +116,13 @@ function vvSaveCard(btn) {
status.textContent = 'Saving…';
jobs.forEach(job => {
const id = job.dataset.id;
const enabled = job.querySelector('.vv-enabled').checked;
const enabled = job.querySelector('.vv-enabled').checked ? '1' : '0';
const cron = job.querySelector('.vv-cron').value.trim();
fetch('/plugins/varaverk/api/scheduler.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({id, enabled, cron})
})
.then(r => r.json())
.then(d => {
if (!d.ok) allOk = false;
if (--pending === 0) vvFlashStatus(status, allOk ? '✓ Saved' : '✗ Some failed', allOk);
});
vvPost('/plugins/varaverk/api/scheduler.php', {id, enabled, cron})
.then(d => {
if (!d.ok) allOk = false;
if (--pending === 0) vvFlashStatus(status, allOk ? '✓ Saved' : '✗ Some failed', allOk);
});
});
}
@@ -133,18 +134,29 @@ function vvRunJob(btn) {
if (logBtn && !logBtn.classList.contains('active')) vvToggleLog(logBtn);
fetch('/plugins/varaverk/api/run.php', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({id})
})
.then(r => r.json())
.then(d => {
if (!d.ok) {
const pre = job.querySelector('.vv-log-pre');
if (pre) pre.textContent = '✗ ' + (d.error ?? 'Failed to start');
}
});
vvPost('/plugins/varaverk/api/run.php', {id})
.then(d => {
if (!d.ok) {
const pre = job.querySelector('.vv-log-pre');
if (pre) pre.textContent = '✗ ' + (d.error ?? 'Failed to start');
}
});
}
function vvDryRun(btn) {
const job = btn.closest('[data-id]');
const id = job.dataset.id;
const logBtn = job.querySelector('.vv-log-btn');
if (logBtn && !logBtn.classList.contains('active')) vvToggleLog(logBtn);
vvPost('/plugins/varaverk/api/dryrun.php', {id})
.then(d => {
if (!d.ok) {
const pre = job.querySelector('.vv-log-pre');
if (pre) pre.textContent = '✗ ' + (d.error ?? 'Failed to start dry run');
}
});
}
function vvToggleAdvanced(btn) {
@@ -193,8 +205,7 @@ function vvFetchLog(panel, id) {
function vvClearLog(btn) {
const panel = btn.closest('.vv-log-panel');
const job = btn.closest('[data-id]');
fetch('/plugins/varaverk/api/log.php?id=' + encodeURIComponent(job.dataset.id) + '&clear=1',
{method: 'POST'})
vvPost('/plugins/varaverk/api/log.php', {id: job.dataset.id, clear: '1'})
.then(() => vvFetchLog(panel, job.dataset.id))
.catch(() => {});
}