From b3e355b29bdd75e1ac5fe47017a5f281a4177932 Mon Sep 17 00:00:00 2001 From: Tom Mortensen Date: Wed, 22 Jan 2025 21:22:32 -0800 Subject: [PATCH] xss hardening --- .../DockerSettings.page | 26 +++++----- .../include/Helpers.php | 8 ++- emhttp/plugins/dynamix/DashStats.page | 28 +++++------ emhttp/plugins/dynamix/DeviceAttributes.page | 2 +- .../plugins/dynamix/DeviceCapabilities.page | 2 +- emhttp/plugins/dynamix/DeviceIdentify.page | 2 +- emhttp/plugins/dynamix/DeviceInfo.page | 35 ++++++------- emhttp/plugins/dynamix/DiskSettings.page | 14 +++--- emhttp/plugins/dynamix/NFS.page | 2 +- emhttp/plugins/dynamix/NetworkExtra.page | 4 +- emhttp/plugins/dynamix/Selftest.page | 2 +- emhttp/plugins/dynamix/ShareEdit.page | 4 +- emhttp/plugins/dynamix/SysDevs.page | 2 +- emhttp/plugins/dynamix/Syslinux.page | 6 +-- emhttp/plugins/dynamix/SyslogSettings.page | 4 +- emhttp/plugins/dynamix/UserEdit.page | 9 ++-- emhttp/plugins/dynamix/UserList.page | 10 ++-- emhttp/plugins/dynamix/include/.login.php | 4 +- .../plugins/dynamix/include/.set-password.php | 4 +- .../dynamix/include/DefaultPageLayout.php | 6 +-- emhttp/plugins/dynamix/include/DiskList.php | 2 +- emhttp/plugins/dynamix/include/Helpers.php | 12 ++--- .../plugins/dynamix/include/PageBuilder.php | 15 ++++-- emhttp/plugins/dynamix/include/Secure.php | 2 +- emhttp/plugins/dynamix/include/ShareList.php | 2 +- emhttp/plugins/dynamix/include/Wrappers.php | 11 +++- .../plugins/dynamix/include/local_prepend.php | 4 +- .../dynamix/include/update.vfio-pci-cfg.php | 2 +- emhttp/plugins/dynamix/nchan/device_list | 29 ++++++----- .../dynamix/scripts/system_information | 2 +- emhttp/plugins/dynamix/template.php | 2 +- emhttp/redirect.htm | 50 +++++++++++++++++++ etc/rc.d/rc.nginx | 7 +++ 33 files changed, 190 insertions(+), 124 deletions(-) create mode 100644 emhttp/redirect.htm diff --git a/emhttp/plugins/dynamix.docker.manager/DockerSettings.page b/emhttp/plugins/dynamix.docker.manager/DockerSettings.page index 227be890b..2d128ba66 100644 --- a/emhttp/plugins/dynamix.docker.manager/DockerSettings.page +++ b/emhttp/plugins/dynamix.docker.manager/DockerSettings.page @@ -142,12 +142,12 @@ _(Enable container table readmore-js)_: :docker_readmore_help: _(Docker Stop Timeout)_ (_(seconds)_): -: +: :docker_timeout_help: _(Docker PID Limit)_: -: +: :docker_pid_limit_help: @@ -164,15 +164,15 @@ _(Docker data-root)_: _(Default appdata storage location)_: -: +: _(Modify with caution: unable to validate path until Array is Started)_ @@ -354,7 +354,7 @@ _(IPv4 custom network on interface)_ (_(optional)_): - **_(Gateway)_:** " title="_(IPv4 address A.B.C.D)_"> + **_(Gateway)_:** " title="_(IPv4 address A.B.C.D)_"> > **_(DHCP pool)_:** >/ >/ - **_(Gateway)_:**" title="_(IPv6 address nnnn:xxxx::yyyy)_"> + **_(Gateway)_:**" title="_(IPv6 address nnnn:xxxx::yyyy)_"> > **_(DHCP pool)_:**>/ > + > - > + > - > + > @@ -1143,7 +1144,7 @@ _(zfs pool status)_:   : - + :info_zfs_scrub_help: @@ -1458,7 +1459,7 @@ _(SMART attribute notifications)_:

_(Caution)_: _(Renaming the pool will change the share storage allocations)_. _(After renaming the pool, check that your shares are assigned to the proper primary and secondary storage locations)_.

_(Name)_: -: +: diff --git a/emhttp/plugins/dynamix/DiskSettings.page b/emhttp/plugins/dynamix/DiskSettings.page index 8c6ad60d3..a5cb7cdf8 100644 --- a/emhttp/plugins/dynamix/DiskSettings.page +++ b/emhttp/plugins/dynamix/DiskSettings.page @@ -169,12 +169,12 @@ _(Default file system for Array disks)_: :disk_default_file_system_help: _(Shutdown time-out)_ (_(seconds)_): -: +: :disk_shutdown_timeout_help: _(Tunable (poll_attributes))_: -: +: :disk_tunable_poll_attributes_help: @@ -187,7 +187,7 @@ _(Tunable (enable NCQ))_: :disk_tunable_enable_ncq_help: _(Tunable (nr_requests))_: -: +: :disk_tunable_nr_requests_help: @@ -203,17 +203,17 @@ _(Tunable (scheduler))_: :disk_tunable_scheduler_help: _(Tunable (md_num_stripes))_: -: +: :disk_tunable_md_num_stripes_help: _(Tunable (md_queue_limit))_: -: +: :disk_tunable_md_queue_limit_help: _(Tunable (md_sync_limit))_: -: +: :disk_tunable_md_sync_limit_help: @@ -376,7 +376,7 @@ _(Default SMART controller type)_: :disk_default_smart_controller_help: _(Default SMART attribute notifications)_: -: _(Custom attributes (use comma to separate numbers))_ +: _(Custom attributes (use comma to separate numbers))_   diff --git a/emhttp/plugins/dynamix/NFS.page b/emhttp/plugins/dynamix/NFS.page index a2d25ecb9..dd7ef6a23 100644 --- a/emhttp/plugins/dynamix/NFS.page +++ b/emhttp/plugins/dynamix/NFS.page @@ -41,7 +41,7 @@ _(Enable NFS)_: :nfs_enable_help: _(Tunable (fuse_remember))_: -: +: :nfs_tunable_fuse_remember_help: diff --git a/emhttp/plugins/dynamix/NetworkExtra.page b/emhttp/plugins/dynamix/NetworkExtra.page index b821b0350..82f928436 100644 --- a/emhttp/plugins/dynamix/NetworkExtra.page +++ b/emhttp/plugins/dynamix/NetworkExtra.page @@ -93,12 +93,12 @@ _(Current listening interfaces)_:
_(Include listening interfaces)_: -: +: :eth_network_extra_include_help: _(Exclude listening interfaces)_: -: +: :eth_network_extra_exclude_help: diff --git a/emhttp/plugins/dynamix/Selftest.page b/emhttp/plugins/dynamix/Selftest.page index bd6e212a8..63f2981aa 100644 --- a/emhttp/plugins/dynamix/Selftest.page +++ b/emhttp/plugins/dynamix/Selftest.page @@ -1,7 +1,7 @@ Menu="Device:2 New:2" Title="Self-Test" Tag="wrench" -Cond="strpos(_var($disks[$name],'status'),'_NP')===false" +Cond="array_key_exists($name, $disks) || array_key_exists($name, $devs)" --- "", "name" => "", "comment" => "", diff --git a/emhttp/plugins/dynamix/SysDevs.page b/emhttp/plugins/dynamix/SysDevs.page index 7101f00ca..dce5eb649 100644 --- a/emhttp/plugins/dynamix/SysDevs.page +++ b/emhttp/plugins/dynamix/SysDevs.page @@ -34,7 +34,7 @@ function applyCfg() { if (string === "BIND=") { string = ""; } - $.get( "/plugins/dynamix/include/update.vfio-pci-cfg.php", { cfg: string } ) + $.post( "/plugins/dynamix/include/update.vfio-pci-cfg.php", { cfg: string } ) .done(function(d) { if (d==1) { addRebootNotice(message); diff --git a/emhttp/plugins/dynamix/Syslinux.page b/emhttp/plugins/dynamix/Syslinux.page index 15acdbf09..94d4f40ed 100644 --- a/emhttp/plugins/dynamix/Syslinux.page +++ b/emhttp/plugins/dynamix/Syslinux.page @@ -194,15 +194,15 @@ _(Syslinux configuration)_: $label = ($i) ? array_shift($area):$title; $start = in_array($menu,$area); if ($start) unset($area[array_search($menu,$area)]); -?> +?> title="_(Set default boot menu)_" onchange="changeMenu(this.form,this.id,true)"> - +
_(Syslinux configuration)_: -: +:
_(Server boot mode)_: diff --git a/emhttp/plugins/dynamix/SyslogSettings.page b/emhttp/plugins/dynamix/SyslogSettings.page index 9029986d1..0914c7088 100644 --- a/emhttp/plugins/dynamix/SyslogSettings.page +++ b/emhttp/plugins/dynamix/SyslogSettings.page @@ -95,7 +95,7 @@ _(Local syslog server)_: - + :syslog_local_server_help: @@ -155,7 +155,7 @@ _(Local syslog number of files)_: _(Remote syslog server)_: -: +: - - done()"; + return; +} $user = "/boot/config/plugins/dynamix/users/$name.png"; $void = ""; $icon = ""; diff --git a/emhttp/plugins/dynamix/UserList.page b/emhttp/plugins/dynamix/UserList.page index c81cfdc46..963e6ee6a 100644 --- a/emhttp/plugins/dynamix/UserList.page +++ b/emhttp/plugins/dynamix/UserList.page @@ -15,19 +15,17 @@ Tag="users" */ ?>
_(Management Access)_
-

root
+

root
_(Shares Access)_
-

+

@@ -35,6 +33,6 @@ _(No users are defined)_. _(Click **Add User** to create a user for remote share
-
- + +
diff --git a/emhttp/plugins/dynamix/include/.login.php b/emhttp/plugins/dynamix/include/.login.php index 6f0805707..73b6b554b 100644 --- a/emhttp/plugins/dynamix/include/.login.php +++ b/emhttp/plugins/dynamix/include/.login.php @@ -480,10 +480,10 @@ $theme_dark = in_array($display['theme'], ['black', 'gray']);

- +

- +

diff --git a/emhttp/plugins/dynamix/include/.set-password.php b/emhttp/plugins/dynamix/include/.set-password.php index 2717eb0f6..091f31be3 100644 --- a/emhttp/plugins/dynamix/include/.set-password.php +++ b/emhttp/plugins/dynamix/include/.set-password.php @@ -306,8 +306,8 @@ $THEME_DARK = in_array($display['theme'],['black','gray']);
-

-

+

+

.

.

diff --git a/emhttp/plugins/dynamix/include/DefaultPageLayout.php b/emhttp/plugins/dynamix/include/DefaultPageLayout.php index 1c3de385d..6cb750a5c 100644 --- a/emhttp/plugins/dynamix/include/DefaultPageLayout.php +++ b/emhttp/plugins/dynamix/include/DefaultPageLayout.php @@ -720,7 +720,7 @@ if (isset($myPage['Load']) && $myPage['Load']>0) echo "\n + + + diff --git a/etc/rc.d/rc.nginx b/etc/rc.d/rc.nginx index 9f55a42dc..ff32d0b50 100755 --- a/etc/rc.d/rc.nginx +++ b/etc/rc.d/rc.nginx @@ -459,6 +459,13 @@ build_locations(){ allow all; } # + # redirect.htm available without authentication + # + location = /redirect { + rewrite ^ /redirect.htm break; + allow all; + } + # # proxy update.htm and logging.htm scripts to emhttpd listening on local socket # location = /update.htm {