xBeaTz
882155a7b4
- Added authentication checks to pve_action.php and pve_list.php - Require valid logged-in session before API access - Restrict Proxmox actions to admin users only - Return HTTP 401 for unauthenticated requests - Return HTTP 403 for unauthorized users - Keep existing API logic unchanged
69 lines
2.1 KiB
PHP
69 lines
2.1 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../config/session.php';
|
|
|
|
if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) {
|
|
http_response_code(401);
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
echo json_encode(['ok' => false, 'error' => 'Unauthorized']);
|
|
exit;
|
|
}
|
|
if (($_SESSION['role'] ?? 'user') !== 'admin') {
|
|
http_response_code(403);
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
echo json_encode(['ok' => false, 'error' => 'Forbidden']);
|
|
exit;
|
|
}
|
|
|
|
require_once __DIR__ . '/../lib/PveApi.php';
|
|
$cfg = require __DIR__ . '/../config/pve.php';
|
|
$pve = new PveApi($cfg);
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
|
|
try {
|
|
$lxcs = $pve->listLxc();
|
|
$vms = $pve->listQemu();
|
|
|
|
$all = [];
|
|
|
|
foreach ($lxcs as $c) {
|
|
$vmid = (int)($c['vmid'] ?? 0);
|
|
if ($vmid >= 100 && $vmid <= 199) {
|
|
$all[] = [
|
|
'vmid' => $vmid,
|
|
'type' => 'lxc',
|
|
'name' => (string)($c['name'] ?? "LXC {$vmid}"),
|
|
'status' => (string)($c['status'] ?? 'unknown'),
|
|
'uptime' => (int)($c['uptime'] ?? 0),
|
|
'cpu' => (float)($c['cpu'] ?? 0),
|
|
'mem' => (int)($c['mem'] ?? 0),
|
|
'maxmem' => (int)($c['maxmem'] ?? 0),
|
|
];
|
|
}
|
|
}
|
|
|
|
foreach ($vms as $v) {
|
|
$vmid = (int)($v['vmid'] ?? 0);
|
|
if ($vmid >= 200 && $vmid <= 299) {
|
|
$all[] = [
|
|
'vmid' => $vmid,
|
|
'type' => 'qemu',
|
|
'name' => (string)($v['name'] ?? "VM {$vmid}"),
|
|
'status' => (string)($v['status'] ?? 'unknown'),
|
|
'uptime' => (int)($v['uptime'] ?? 0),
|
|
'cpu' => (float)($v['cpu'] ?? 0),
|
|
'mem' => (int)($v['mem'] ?? 0),
|
|
'maxmem' => (int)($v['maxmem'] ?? 0),
|
|
];
|
|
}
|
|
}
|
|
|
|
usort($all, fn($a, $b) => $a['vmid'] <=> $b['vmid']);
|
|
|
|
echo json_encode(['ok' => true, 'items' => $all], JSON_UNESCAPED_UNICODE);
|
|
|
|
} catch (Throwable $e) {
|
|
http_response_code(400);
|
|
echo json_encode(['ok' => false, 'error' => $e->getMessage()]);
|
|
}
|