shukivaknin/gniza4cp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
167 Commits 1 Branch 0 Tags
a162536585ebdaecb9dd6107a55177eccf627a53
Commit Graph

7 Commits

Author SHA1 Message Date
shuki
a162536585 Rename product from gniza to gniza4cp across entire codebase 
- CLI binary: bin/gniza -> bin/gniza4cp
- Install path: /usr/local/gniza4cp/
- Config path: /etc/gniza4cp/
- Log path: /var/log/gniza4cp/
- WHM plugin: gniza4cp-whm/
- cPanel plugin: cpanel/gniza4cp/
- AdminBin: Gniza4cp::Restore
- Perl modules: Gniza4cpWHM::*, Gniza4cpCPanel::*
- DaisyUI theme: gniza4cp
- All internal references, branding, paths updated
- Git remote updated to gniza4cp repo
 2026-03-05 21:03:30 +02:00
shuki
c20c019048 Add cPanel user activity logs page and WHM user log visibility 
- Add per-user activity logging to AdminBin: every RESTORE_* action
  writes to /var/log/gniza/cpanel-<user>.log with action details and
  gniza command output
- New logs.live.cgi CGI with paginated activity list and detail view
- WHM logs.cgi now shows cpanel-*.log files with Owner column and
  structured activity entry viewer with expandable command output
- Add Logs nav item to cPanel plugin, update install.sh

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 19:37:08 +02:00
shuki
9dc427a1e6 Fix AdminBin: use get_caller_username() instead of REMOTE_USER 
AdminBin modules run as root, so $ENV{'REMOTE_USER'} is not set.
The correct way to get the authenticated cPanel user is via the
parent class method get_caller_username().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 02:31:50 +02:00
shuki
c672c9d8ee Fix AdminBin: move run() after variable declarations 
__PACKAGE__->run() was called before my variables were declared,
so $MAIN_CONFIG and $REMOTES_DIR were undef when action methods ran.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 02:01:28 +02:00
shuki
065f83d691 Fix AdminBin: add shebang and __PACKAGE__->run() 
cPanel's adminbin framework requires the module to be directly
executable with a shebang line, and Script::Call modules need
__PACKAGE__->run() to bootstrap.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 01:57:56 +02:00
shuki
3b6d9ea88f Fix AdminBin compilation: declare $in/$out before open3 
Variables declared with 'my' inside open3() were scoped to that call,
causing 'Global symbol requires explicit package name' errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 01:52:19 +02:00
shuki
1f68ea1058 Security hardening, static analysis fixes, and expanded test coverage 
- Fix CRITICAL: safe config parser replacing shell source, sshpass -e,
  CSRF with /dev/urandom, symlink-safe file I/O
- Fix HIGH: input validation for timestamps/accounts, path traversal
  prevention in Runner.pm, AJAX CSRF on all endpoints
- Fix MEDIUM: umask 077, chmod 700 on config dirs, Config.pm TOCTOU lock,
  rsync exit code capture bug, RSYNC_EXTRA_OPTS character validation
- ShellCheck: fix word-splitting in notify.sh, safe rm in pkgacct.sh,
  suppress cross-file SC2034 false positives
- Perl::Critic: return undef→bare return, return (sort), unpack @_,
  explicit return on void subs, rename Config::write→save
- Remove dead code: enforce_retention_all(), rsync_dry_run()
- Add require_cmd checks for rsync/ssh/hostname/gzip at startup
- Escape $hint/$tip in CGI helper functions for defense-in-depth
- Expand tests from 17→40: validate_timestamp, validate_account_name,
  _safe_source_config (including malicious input), numeric validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-04 23:57:26 +02:00