Commit Graph

21 Commits

Author SHA1 Message Date
shuki
b7232f9c69 Replace blurry 48x48 cPanel icon with crisp 128x128 PNG
Reverts SVG approach (cPanel sprites don't support SVG) and
regenerates PNG at higher resolution from the SVG source.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 04:20:14 +02:00
shuki
e48907ecd4 Switch cPanel plugin icon from PNG to SVG for crisp rendering
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 04:18:00 +02:00
shuki
4408917aec Redesign cPanel restore plugin to match WHM workflow
Replace the 8-card category grid with a unified restore workflow:
- index.live.cgi: now serves as Step 1 (remote + snapshot selection)
- restore.live.cgi: Step 2 (Full Account/Selective mode toggle with
  type checkboxes, exclude paths, file browser), Step 3 (multi-type
  confirmation), Step 4 (multi-type execution via AdminBin)

Also update cPanel plugin icon from gniza.svg source.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 03:13:53 +02:00
shuki
9dc427a1e6 Fix AdminBin: use get_caller_username() instead of REMOTE_USER
AdminBin modules run as root, so $ENV{'REMOTE_USER'} is not set.
The correct way to get the authenticated cPanel user is via the
parent class method get_caller_username().

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 02:31:50 +02:00
shuki
8822f93438 Fix JS syntax errors: convert qq{} to heredocs in restore.live.cgi
Perl's qq{} delimiter matches balanced braces, which conflicted with
JavaScript curly braces, producing empty function bodies. Converted
_print_step1_js and _print_step2_js to heredoc blocks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 02:16:58 +02:00
shuki
d26a327595 Add cPanel chrome (sidebar/topbar) to plugin pages
Use $cpanel->header() and $cpanel->footer() from LiveAPI to wrap
plugin content in cPanel's standard layout with sidebar navigation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 02:08:56 +02:00
shuki
97eb3ff2ed Remove Content-Type header from index.live.cgi
cPanel's live engine provides the HTTP headers and page chrome
(sidebar, topbar). CGI should not output its own Content-Type.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 02:04:00 +02:00
shuki
c672c9d8ee Fix AdminBin: move run() after variable declarations
__PACKAGE__->run() was called before my variables were declared,
so $MAIN_CONFIG and $REMOTES_DIR were undef when action methods ran.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 02:01:28 +02:00
shuki
af46c76e62 Fix LIVEAPI error: initialize Cpanel::LiveAPI in .live.cgi files
cPanel's live engine requires .live.cgi files to create a
Cpanel::LiveAPI connection. Without it, the engine cannot
establish communication with the CGI subprocess.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 01:59:53 +02:00
shuki
065f83d691 Fix AdminBin: add shebang and __PACKAGE__->run()
cPanel's adminbin framework requires the module to be directly
executable with a shebang line, and Script::Call modules need
__PACKAGE__->run() to bootstrap.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 01:57:56 +02:00
shuki
3b6d9ea88f Fix AdminBin compilation: declare $in/$out before open3
Variables declared with 'my' inside open3() were scoped to that call,
causing 'Global symbol requires explicit package name' errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 01:52:19 +02:00
shuki
a769281e88 Rename cPanel plugin to GNIZA Backups
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 01:49:53 +02:00
shuki
0aa5e26a02 Fix cPanel icon: use 48x48 PNG for sprite compatibility
The SVG had negative coordinates that rendered off-screen in cPanel's
sprite sheet. Export to clean 48x48 PNG (2.8KB) instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 01:48:14 +02:00
shuki
70ef4d3bcd Use gniza SVG icon for cPanel plugin
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 01:40:22 +02:00
shuki
c1555da3c7 Use gniza backup PNG icon for cPanel plugin
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 00:52:59 +02:00
shuki
66e9cb9def Revert cPanel icon to original gniza-logo.svg
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 00:50:55 +02:00
shuki
5bb85c35ef Fix cPanel icon: replace headphones with backup/restore icon
Server box with data rows (navy) and circular restore arrow (copper)
matching gniza brand colors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 00:42:42 +02:00
shuki
f297d40a85 Add lightweight cPanel icon and update plugin registration
Replace 378KB VTracer-traced logo with a clean 1KB 48x48 SVG icon
for cPanel's icon system. Update install.json, install.sh, and
uninstall.sh to reference the new icon. Also update README with
skip-suspended flag and schedule config fields.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 00:40:57 +02:00
shuki
a87ca4a823 Fix cPanel plugin registration: correct install.json format and include icon
- install.json: use cPanel's required fields (type, id, group_id, uri)
  instead of incorrect keys (target_type, category, url)
- Include icon SVG in tar.gz archive (install_plugin validates icon exists)
- Without correct fields, install_plugin silently skipped registration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 00:34:43 +02:00
shuki
cc7e46a88f Fix CSRF token write failure and SMTP test token sync
- Add fallback write when O_EXCL _safe_write fails for CSRF tokens
  (ensures token is always persisted to disk)
- Update SMTP test JS to sync new CSRF token into main form hidden field
  (prevents stale token after SMTP test consumes the original)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 00:09:24 +02:00
shuki
1f68ea1058 Security hardening, static analysis fixes, and expanded test coverage
- Fix CRITICAL: safe config parser replacing shell source, sshpass -e,
  CSRF with /dev/urandom, symlink-safe file I/O
- Fix HIGH: input validation for timestamps/accounts, path traversal
  prevention in Runner.pm, AJAX CSRF on all endpoints
- Fix MEDIUM: umask 077, chmod 700 on config dirs, Config.pm TOCTOU lock,
  rsync exit code capture bug, RSYNC_EXTRA_OPTS character validation
- ShellCheck: fix word-splitting in notify.sh, safe rm in pkgacct.sh,
  suppress cross-file SC2034 false positives
- Perl::Critic: return undef→bare return, return (sort), unpack @_,
  explicit return on void subs, rename Config::write→save
- Remove dead code: enforce_retention_all(), rsync_dry_run()
- Add require_cmd checks for rsync/ssh/hostname/gzip at startup
- Escape $hint/$tip in CGI helper functions for defense-in-depth
- Expand tests from 17→40: validate_timestamp, validate_account_name,
  _safe_source_config (including malicious input), numeric validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-04 23:57:26 +02:00