shukivaknin/gniza4cp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
166 Commits 1 Branch 0 Tags
f0171a9eb4c82d22ba9a1fdd6edda0d5d727d2f6
Commit Graph

5 Commits

Author SHA1 Message Date
shuki
0bd75402d1 Rename cPanel nav: merge Select Source and Restore into single Restore tab 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 19:38:56 +02:00
shuki
5ffd365c43 Use inline styles for cPanel navbar to avoid Jupiter CSS conflicts 
cPanel's Jupiter theme overrides DaisyUI's .navbar component class.
Replace with plain flex layout using inline styles.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 19:33:56 +02:00
shuki
b1c475da00 Add navigation tabs to cPanel plugin navbar 
Adds "Select Source" and "Restore" links to match the WHM navbar style.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 19:27:34 +02:00
shuki
cc7e46a88f Fix CSRF token write failure and SMTP test token sync 
- Add fallback write when O_EXCL _safe_write fails for CSRF tokens
  (ensures token is always persisted to disk)
- Update SMTP test JS to sync new CSRF token into main form hidden field
  (prevents stale token after SMTP test consumes the original)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-05 00:09:24 +02:00
shuki
1f68ea1058 Security hardening, static analysis fixes, and expanded test coverage 
- Fix CRITICAL: safe config parser replacing shell source, sshpass -e,
  CSRF with /dev/urandom, symlink-safe file I/O
- Fix HIGH: input validation for timestamps/accounts, path traversal
  prevention in Runner.pm, AJAX CSRF on all endpoints
- Fix MEDIUM: umask 077, chmod 700 on config dirs, Config.pm TOCTOU lock,
  rsync exit code capture bug, RSYNC_EXTRA_OPTS character validation
- ShellCheck: fix word-splitting in notify.sh, safe rm in pkgacct.sh,
  suppress cross-file SC2034 false positives
- Perl::Critic: return undef→bare return, return (sort), unpack @_,
  explicit return on void subs, rename Config::write→save
- Remove dead code: enforce_retention_all(), rsync_dry_run()
- Add require_cmd checks for rsync/ssh/hostname/gzip at startup
- Escape $hint/$tip in CGI helper functions for defense-in-depth
- Expand tests from 17→40: validate_timestamp, validate_account_name,
  _safe_source_config (including malicious input), numeric validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-04 23:57:26 +02:00