shukivaknin/gniza4cp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
162 Commits 1 Branch 0 Tags
5ffd365c43376037020cb09b9f8eb5aa4c495036
Commit Graph

4 Commits

Author SHA1 Message Date
shuki
5ffd365c43 Use inline styles for cPanel navbar to avoid Jupiter CSS conflicts 
cPanel's Jupiter theme overrides DaisyUI's .navbar component class.
Replace with plain flex layout using inline styles.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 19:33:56 +02:00
shuki
b1c475da00 Add navigation tabs to cPanel plugin navbar 
Adds "Select Source" and "Restore" links to match the WHM navbar style.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 19:27:34 +02:00
shuki
cc7e46a88f Fix CSRF token write failure and SMTP test token sync 
- Add fallback write when O_EXCL _safe_write fails for CSRF tokens
  (ensures token is always persisted to disk)
- Update SMTP test JS to sync new CSRF token into main form hidden field
  (prevents stale token after SMTP test consumes the original)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 00:09:24 +02:00
shuki
1f68ea1058 Security hardening, static analysis fixes, and expanded test coverage 
- Fix CRITICAL: safe config parser replacing shell source, sshpass -e,
  CSRF with /dev/urandom, symlink-safe file I/O
- Fix HIGH: input validation for timestamps/accounts, path traversal
  prevention in Runner.pm, AJAX CSRF on all endpoints
- Fix MEDIUM: umask 077, chmod 700 on config dirs, Config.pm TOCTOU lock,
  rsync exit code capture bug, RSYNC_EXTRA_OPTS character validation
- ShellCheck: fix word-splitting in notify.sh, safe rm in pkgacct.sh,
  suppress cross-file SC2034 false positives
- Perl::Critic: return undef→bare return, return (sort), unpack @_,
  explicit return on void subs, rename Config::write→save
- Remove dead code: enforce_retention_all(), rsync_dry_run()
- Add require_cmd checks for rsync/ssh/hostname/gzip at startup
- Escape $hint/$tip in CGI helper functions for defense-in-depth
- Expand tests from 17→40: validate_timestamp, validate_account_name,
  _safe_source_config (including malicious input), numeric validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-04 23:57:26 +02:00