xBeaTz/anjuma-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: protect proxmox api endpoints with session authentication

Browse Source 
- Added authentication checks to pve_action.php and pve_list.php
- Require valid logged-in session before API access
- Restrict Proxmox actions to admin users only
- Return HTTP 401 for unauthenticated requests
- Return HTTP 403 for unauthorized users
- Keep existing API logic unchanged
This commit is contained in:
xBeaTz
2026-07-22 02:03:20 +02:00
parent d858e062f1
commit 882155a7b4
2 changed files with 76 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/pve_action.php
+27 -13
View File
@@ -1,4 +1,19 @@
<?php <?php
require_once __DIR__ . '/../config/session.php';
if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
http_response_code(401);
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['ok' => false, 'error' => 'Unauthorized']);
exit;
}
if (($_SESSION['role'] ?? 'user') !== 'admin') {
http_response_code(403);
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['ok' => false, 'error' => 'Forbidden']);
exit;
}
require_once __DIR__ . '/../lib/PveApi.php'; require_once __DIR__ . '/../lib/PveApi.php';
$cfg = require __DIR__ . '/../config/pve.php'; $cfg = require __DIR__ . '/../config/pve.php';
$pve = new PveApi($cfg); $pve = new PveApi($cfg);
@@ -6,22 +21,21 @@ $pve = new PveApi($cfg);
header('Content-Type: application/json; charset=utf-8'); header('Content-Type: application/json; charset=utf-8');
try { try {
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
http_response_code(405); http_response_code(405);
echo json_encode(['ok' => false, 'error' => 'Method not allowed']); echo json_encode(['ok' => false, 'error' => 'Method not allowed']);
exit; exit;
} }
$vmid = (int)($_POST['vmid'] ?? 0); $vmid = (int)($_POST['vmid'] ?? 0);
$action = (string)($_POST['action'] ?? ''); $action = (string)($_POST['action'] ?? '');
// optional: hier deine Dashboard-Auth checken! if ($vmid <= 0) throw new InvalidArgumentException("vmid fehlt/ungültig");
if ($vmid <= 0) throw new InvalidArgumentException("vmid fehlt/ungültig");
$upid = $pve->powerAction($vmid, $action); $upid = $pve->powerAction($vmid, $action);
echo json_encode(['ok' => true, 'vmid' => $vmid, 'action' => $action, 'upid' => $upid]); echo json_encode(['ok' => true, 'vmid' => $vmid, 'action' => $action, 'upid' => $upid]);
} catch (Throwable $e) { } catch (Throwable $e) {
http_response_code(400); http_response_code(400);
echo json_encode(['ok' => false, 'error' => $e->getMessage()]); echo json_encode(['ok' => false, 'error' => $e->getMessage()]);
} }
api/pve_list.php
+49 -36
View File
@@ -1,4 +1,18 @@
<?php <?php
require_once __DIR__ . '/../config/session.php';
if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
http_response_code(401);
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['ok' => false, 'error' => 'Unauthorized']);
exit;
}
if (($_SESSION['role'] ?? 'user') !== 'admin') {
http_response_code(403);
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['ok' => false, 'error' => 'Forbidden']);
exit;
}
require_once __DIR__ . '/../lib/PveApi.php'; require_once __DIR__ . '/../lib/PveApi.php';
$cfg = require __DIR__ . '/../config/pve.php'; $cfg = require __DIR__ . '/../config/pve.php';
@@ -7,49 +21,48 @@ $pve = new PveApi($cfg);
header('Content-Type: application/json; charset=utf-8'); header('Content-Type: application/json; charset=utf-8');
try { try {
$lxcs = $pve->listLxc(); // array mit vmid, name, status, cpu, mem, etc. $lxcs = $pve->listLxc();
$vms = $pve->listQemu(); // array mit vmid, name, status, cpu, mem, etc. $vms = $pve->listQemu();
$all = []; $all = [];
foreach ($lxcs as $c) { foreach ($lxcs as $c) {
$vmid = (int)($c['vmid'] ?? 0); $vmid = (int)($c['vmid'] ?? 0);
if ($vmid >= 100 && $vmid <= 199) { if ($vmid >= 100 && $vmid <= 199) {
$all[] = [ $all[] = [
'vmid' => $vmid, 'vmid' => $vmid,
'type' => 'lxc', 'type' => 'lxc',
'name' => (string)($c['name'] ?? "LXC {$vmid}"), 'name' => (string)($c['name'] ?? "LXC {$vmid}"),
'status' => (string)($c['status'] ?? 'unknown'), 'status' => (string)($c['status'] ?? 'unknown'),
'uptime' => (int)($c['uptime'] ?? 0), 'uptime' => (int)($c['uptime'] ?? 0),
'cpu' => (float)($c['cpu'] ?? 0), 'cpu' => (float)($c['cpu'] ?? 0),
'mem' => (int)($c['mem'] ?? 0), 'mem' => (int)($c['mem'] ?? 0),
'maxmem' => (int)($c['maxmem'] ?? 0), 'maxmem' => (int)($c['maxmem'] ?? 0),
]; ];
}
} }
}
foreach ($vms as $v) { foreach ($vms as $v) {
$vmid = (int)($v['vmid'] ?? 0); $vmid = (int)($v['vmid'] ?? 0);
if ($vmid >= 200 && $vmid <= 299) { if ($vmid >= 200 && $vmid <= 299) {
$all[] = [ $all[] = [
'vmid' => $vmid, 'vmid' => $vmid,
'type' => 'qemu', 'type' => 'qemu',
'name' => (string)($v['name'] ?? "VM {$vmid}"), 'name' => (string)($v['name'] ?? "VM {$vmid}"),
'status' => (string)($v['status'] ?? 'unknown'), 'status' => (string)($v['status'] ?? 'unknown'),
'uptime' => (int)($v['uptime'] ?? 0), 'uptime' => (int)($v['uptime'] ?? 0),
'cpu' => (float)($v['cpu'] ?? 0), 'cpu' => (float)($v['cpu'] ?? 0),
'mem' => (int)($v['mem'] ?? 0), 'mem' => (int)($v['mem'] ?? 0),
'maxmem' => (int)($v['maxmem'] ?? 0), 'maxmem' => (int)($v['maxmem'] ?? 0),
]; ];
}
} }
}
// Sort: erst LXCs, dann VMs oder nach vmid usort($all, fn($a, $b) => $a['vmid'] <=> $b['vmid']);
usort($all, fn($a, $b) => $a['vmid'] <=> $b['vmid']);
echo json_encode(['ok' => true, 'items' => $all], JSON_UNESCAPED_UNICODE); echo json_encode(['ok' => true, 'items' => $all], JSON_UNESCAPED_UNICODE);
} catch (Throwable $e) { } catch (Throwable $e) {
http_response_code(400); http_response_code(400);
echo json_encode(['ok' => false, 'error' => $e->getMessage()]); echo json_encode(['ok' => false, 'error' => $e->getMessage()]);
} }