From 30398b36530aaaefc75516ccc61a43efae8ca407 Mon Sep 17 00:00:00 2001 From: Larry Browning Date: Sat, 27 Jun 2026 18:46:50 +0800 Subject: [PATCH 1/2] Fix multiple issues in vhosts panel and Httpd class Security: - Replace $_SERVER['HTTP_HOST'] with Docker internal hostname to prevent SSRF - Add cURL connect/read timeouts (3s/5s) to prevent hung PHP-FPM workers Robustness: - Add fopen() error handling in getVhostBackend() with logged warning - Clean up IPv6 address parsing using array_pop/implode/array_slice - Replace hardcoded PHP container IP with dynamic gethostname()/SERVER_ADDR - Fix XHR timeout race: use native xhr.ontimeout instead of manual setTimeout - Make vhost AJAX endpoint return consistent JSON with status/message fields Cleanup: - Fix unscoped JS variable (i) in for-loop - Change read-only status check from POST to GET - Fix operator precedence in XHR status check (readyState vs status) - Remove dead/commented-out code in checkDns() - Add backup files and local shell scripts to .gitignore Co-Authored-By: Claude --- .devilbox/www/htdocs/_ajax_callback.php | 9 ++- .devilbox/www/htdocs/vhosts.php | 57 +++++++++---------- .devilbox/www/include/lib/container/Httpd.php | 15 +++-- .gitignore | 4 ++ 4 files changed, 49 insertions(+), 36 deletions(-) diff --git a/.devilbox/www/htdocs/_ajax_callback.php b/.devilbox/www/htdocs/_ajax_callback.php index c98b98aca..3d0469a09 100644 --- a/.devilbox/www/htdocs/_ajax_callback.php +++ b/.devilbox/www/htdocs/_ajax_callback.php @@ -27,7 +27,14 @@ // ?vhost= // else if (isset($_GET['vhost'])) { - echo loadClass('Httpd')->checkVirtualHost($_GET['vhost']); + $vhostResult = loadClass('Httpd')->checkVirtualHost($_GET['vhost']); + if (strlen($vhostResult) === 0) { + echo json_encode(array('status' => 'ok', 'message' => '')); + } else if (strpos($vhostResult, 'error') === 0) { + echo json_encode(array('status' => 'error', 'message' => substr($vhostResult, 10))); + } else { + echo json_encode(array('status' => 'warning', 'message' => substr($vhostResult, 12))); + } } diff --git a/.devilbox/www/htdocs/vhosts.php b/.devilbox/www/htdocs/vhosts.php index 4b37386e7..262a01496 100644 --- a/.devilbox/www/htdocs/vhosts.php +++ b/.devilbox/www/htdocs/vhosts.php @@ -53,7 +53,7 @@
- + @@ -170,7 +170,7 @@ - php (172.16.238.10) + () @@ -195,26 +195,32 @@ function updateStatus(vhost) { var xhttp = new XMLHttpRequest(); xhttp.onreadystatechange = function() { - var error = ''; var el_valid; var el_href; - if (this.readyState == 4 && this.status == 200 || this.status == 426) { + if (this.readyState == 4 && (this.status == 200 || this.status == 426)) { el_valid = document.getElementById('valid-' + vhost); el_href = document.getElementById('href-' + vhost); - error = this.responseText; - if (error.length && error.match(/^error/)) { + try { + var data = JSON.parse(this.responseText); + + if (data.status === 'error') { + el_valid.className += ' bg-danger'; + el_valid.innerHTML = 'ERR'; + el_href.innerHTML = data.message; + } else if (data.status === 'warning') { + el_valid.className += ' bg-warning'; + el_valid.innerHTML = 'WARN'; + el_href.innerHTML = data.message; + checkDns(vhost); + } else { + checkDns(vhost); + } + } catch (e) { el_valid.className += ' bg-danger'; el_valid.innerHTML = 'ERR'; - el_href.innerHTML = error; - } else if (error.length && error.match(/^warning/)) { - el_valid.className += ' bg-warning'; - el_valid.innerHTML = 'WARN'; - el_href.innerHTML = error.replace('warning', ''); - checkDns(vhost); - } else { - checkDns(vhost); + el_href.innerHTML = 'Invalid response'; } } }; @@ -240,43 +246,34 @@ function checkDns(vhost) { // Timeout after XXX seconds and mark it invalid DNS xhttp.timeout = getEnv('DNS_CHECK_TIMEOUT');?>000; - xhttp.onreadystatechange = function(e) { + xhttp.onreadystatechange = function() { var el_valid = document.getElementById('valid-' + vhost); var el_href = document.getElementById('href-' + vhost); - var error = this.responseText; if (this.readyState == 4 && (this.status == 200 || this.status == 426)) { - clearTimeout(xmlHttpTimeout); el_valid.className += ' bg-success'; if (el_valid.innerHTML != 'WARN') { el_valid.innerHTML = 'OK'; } - //el_href.innerHTML = '(ext) '+name+port+'' + el_href.innerHTML; el_href.innerHTML = ''+name+port+''; - } else { - //console.log(vhost); } - } - xhttp.open('POST', proto+'//'+name+port+'/devilbox-api/status.json', true); - xhttp.send(); - - // Timeout to abort in 1 second - var xmlHttpTimeout = setTimeout(ajaxTimeout, getEnv('DNS_CHECK_TIMEOUT');?>000); - function ajaxTimeout(e) { + }; + xhttp.ontimeout = function() { var el_valid = document.getElementById('valid-' + vhost); var el_href = document.getElementById('href-' + vhost); - var error = this.responseText; el_valid.className += ' bg-danger'; el_valid.innerHTML = 'ERR'; el_href.innerHTML = 'No Host DNS record found. Add the following to /etc/hosts:
127.0.0.1 '+vhost+'.getTldSuffix();?>'; - } + }; + xhttp.open('GET', proto+'//'+name+port+'/devilbox-api/status.json', true); + xhttp.send(); } var vhosts = document.getElementsByName('vhost[]'); - for (i = 0; i < vhosts.length; i++) { + for (var i = 0; i < vhosts.length; i++) { updateStatus(vhosts[i].value); } })(); diff --git a/.devilbox/www/include/lib/container/Httpd.php b/.devilbox/www/include/lib/container/Httpd.php index 8553a4fab..3c993b0bd 100644 --- a/.devilbox/www/include/lib/container/Httpd.php +++ b/.devilbox/www/include/lib/container/Httpd.php @@ -138,6 +138,8 @@ public function canConnect(&$err, $hostname, $data = array()) $ch = curl_init($url); curl_setopt($ch, CURLOPT_NOBODY, true); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false); + curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 3); + curl_setopt($ch, CURLOPT_TIMEOUT, 5); curl_exec($ch); $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); @@ -212,6 +214,10 @@ public function getVhostBackend($vhost) } $fp = fopen($file, 'r'); + if ($fp === false) { + loadClass('Logger')->error('Could not open backend config: ' . $file); + return 'default'; + } $cont = stream_get_contents($fp); fclose($fp); @@ -223,13 +229,12 @@ public function getVhostBackend($vhost) // conf:::: $arr = explode(':', $cont); + // conf:::: + // Note: may contain ':' for IPv6 addresses (e.g., [::1]) + $port = array_pop($arr); $type = $arr[1]; $prot = $arr[2]; - $addr = ''; // this may contain ':' itself due to IPv6 addresses - for ($i=3; $i<(count($arr)-1); $i++) { - $addr .= $arr[$i]; - } - $port = $arr[count($arr) - 1]; + $addr = implode(':', array_slice($arr, 3)); return $prot.'://'.$addr.':'.$port; } diff --git a/.gitignore b/.gitignore index e461d8237..3ed209bc1 100644 --- a/.gitignore +++ b/.gitignore @@ -16,6 +16,7 @@ # Ignore variable data /.env /backups/* +*-bak* # Ignore Data dirs /data/www/* @@ -136,6 +137,9 @@ /cfg/php-startup-8.2/*.sh /cfg/php-startup-8.3/*.sh /cfg/php-startup-8.4/*.sh +# Ignore my local scripts... +/*php*.sh +/star*.sh # Ignore custom Varnish configs /cfg/varnish-4/*.vcl From 933f603eb615ae70fd89bba05ddd313d71de6015 Mon Sep 17 00:00:00 2001 From: Larry Browning Date: Sat, 27 Jun 2026 19:10:30 +0800 Subject: [PATCH 2/2] Fix vhost DNS check to use configured HTTP port canConnect() was always connecting on port 80, but the PHP container's socat forwarding listens on HOST_PORT_HTTPD (e.g. 8001), not 80. This made every vhost show WARN because the internal cURL check targeted 127.0.0.1:80 where nothing was listening. Use getPort() to append the configured port to the cURL URL. Co-Authored-By: Claude --- .devilbox/www/include/lib/container/Httpd.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.devilbox/www/include/lib/container/Httpd.php b/.devilbox/www/include/lib/container/Httpd.php index 3c993b0bd..8a8069cbe 100644 --- a/.devilbox/www/include/lib/container/Httpd.php +++ b/.devilbox/www/include/lib/container/Httpd.php @@ -134,7 +134,7 @@ public function canConnect(&$err, $hostname, $data = array()) } // Silence errors and try to connect - $url = 'http://'.$hostname.'/'.$GLOBALS['DEVILBOX_API_PAGE']; + $url = 'http://'.$hostname.$this->getPort().'/'.$GLOBALS['DEVILBOX_API_PAGE']; $ch = curl_init($url); curl_setopt($ch, CURLOPT_NOBODY, true); curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);