Security-, Bugfix- und UX-Überarbeitung auf Basis des Code-Reviews
Sicherheit: - Bulk-Erstellung serverseitig auf eingeloggte Nutzer beschränkt; expire_minutes wird validiert (anonym: nur Default/Template-Werte, eingeloggt: max. 1 Jahr) - IP-basiertes Rate-Limit über neue Tabelle request_throttle (Voucher-Erstellung + Passwort-Reset-Anfragen), Session-Fallback für Alt-Installationen; Migration 0002 - session_regenerate_id() nach Login, Secure-Cookie-Flag bei HTTPS - Admin-/Aktiv-Status wird pro Request live aus der DB geprüft (Rechteentzug & Deaktivierung wirken sofort); Schutz vor Selbst-Degradierung im Benutzer-Edit - Alle state-ändernden Admin-Aktionen von GET auf POST umgestellt (kein CSRF-Token mehr in URLs) - login_simple.php (Legacy, Debug-Leak) entfernt; cron_test.php nur noch für Admins; .htaccess auf Apache-2.4-Syntax inkl. cron_test.php - M365 Client Secret wird nicht mehr ins Formular zurückgegeben - Updater: Zip-Slip-/Pfad-Traversal-Schutz, Backup vor dem Anwenden mit automatischem Rollback bei Fehlern, AuditLogger-Bug behoben - cron_sync: Token-Vergleich mit hash_equals; login_attempts-Pruning - CSV-Export gegen Excel-Formula-Injection abgesichert Bugfixes: - M365-Login: Fallback auf userPrincipalName, wenn Graph kein 'mail' liefert (Nutzer ohne Exchange-Postfach konnten sich nie anmelden) - PRG-Pattern überall: F5 erzeugt keine Duplikat-Voucher und wiederholt keine Admin-Aktionen (Session-Flash-Messages) - QR-Code nicht mehr invertiert (schwarz auf weiß, scanbar) - Bulk-Erstellung nutzt den UniFi 'n'-Parameter: 1 API-Call statt n× Login + Voucherlisten-Abruf; exaktes Code-Matching per create_time statt "global neuester Voucher" - Mailer: doppelte Zeilenumbrüche behoben, AUTH nur mit Credentials, SMTP-Dot-Stuffing, CLI-sicherer EHLO-Host - forgot_password: System-URL-Auto-Detect (Reset-Link war sonst relativ/kaputt) + Rate-Limit - Audit-Log-Labels an tatsächliche Action-Keys angepasst; Voucher-Erstellung (einzeln & bulk) wird jetzt auditiert - Site-Edit testet die Verbindung auch ohne Passwortänderung UX/UI: - Alert-/Badge-Styles zentral in global.css mit Dark-Mode-Variablen (vorher 7× dupliziert mit hart codierten Hellfarben) - Sticky-Formulare + Tab-Erhalt nach Validierungsfehlern (Bulk), Settings kehren nach dem Speichern zum aktiven Tab zurück - Gültigkeit menschenlesbar (z.B. "8 Stunden" statt "480 Minuten") - Voucher-Name-Default "Gast/Guest" im öffentlichen Modus - Favicon auch auf Login-/öffentlichen Seiten - Verbindungstest-Button pro Site-Karte (Health-Check) - i18n-Pass: Confirm-Dialoge, Toasts, Fehl-/Erfolgsmeldungen in de/en - Sprachumschalter ohne fetch+reload (kein Re-Submit-Dialog) - A11y: Esc schließt Modals, aria-live für Toasts, aria-labels auf Icon-Buttons; APP_KEY-Warnbanner im Dashboard - Dashboard-Sync: set_time_limit passend zur Site-Anzahl; Voucher-Sync mit Map statt SELECT pro Voucher Tooling: - GitHub-Actions-Workflow: PHP-Lint aller Dateien + de/en-Key-Parität https://claude.ai/code/session_01KKVpVPJjrTKGoRgpJcySD4
This commit is contained in:
Claude
parent
f747a3d429
commit
6e19958a37
31 changed files with 1040 additions and 628 deletions
129
admin/sites.php
129
admin/sites.php
|
|
@ -8,6 +8,7 @@ require_once __DIR__ . '/../includes/Database.php';
|
|||
require_once __DIR__ . '/../includes/Auth.php';
|
||||
require_once __DIR__ . '/../includes/UniFiController.php';
|
||||
require_once __DIR__ . '/../includes/I18n.php';
|
||||
require_once __DIR__ . '/../includes/Helpers.php';
|
||||
|
||||
$auth = new Auth();
|
||||
$auth->requireAdmin();
|
||||
|
|
@ -18,6 +19,31 @@ I18n::init();
|
|||
$error = '';
|
||||
$success = '';
|
||||
|
||||
// AJAX: Verbindungstest mit gespeicherten Zugangsdaten (Health-Check pro Site)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['ajax_test_site'])) {
|
||||
header('Content-Type: application/json');
|
||||
if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
echo json_encode(['success' => false, 'message' => __('error_csrf')]);
|
||||
exit;
|
||||
}
|
||||
$site = $db->fetchOne("SELECT * FROM sites WHERE id=?", [(int)$_POST['ajax_test_site']]);
|
||||
if (!$site) {
|
||||
echo json_encode(['success' => false, 'message' => __('error_site_not_found')]);
|
||||
exit;
|
||||
}
|
||||
$test = UniFiController::testConnection(
|
||||
$site['unifi_controller_url'],
|
||||
$site['unifi_username'],
|
||||
Crypto::decrypt($site['unifi_password']),
|
||||
$site['site_id']
|
||||
);
|
||||
echo json_encode([
|
||||
'success' => $test === true,
|
||||
'message' => $test === true ? __('site_test_ok') : __('site_test_fail') . ': ' . $test,
|
||||
]);
|
||||
exit;
|
||||
}
|
||||
|
||||
// Edit site
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['edit_site'])) {
|
||||
if (!$auth->validateCsrfToken($_POST['csrf_token']??'')) {
|
||||
|
|
@ -34,15 +60,23 @@ if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['edit_site'])) {
|
|||
if (empty($name)||empty($siteIdStr)||empty($controllerUrl)||empty($username)) throw new Exception(__('error_fill_all'));
|
||||
if (!empty($password)) {
|
||||
$test = UniFiController::testConnection($controllerUrl,$username,$password,$siteIdStr);
|
||||
if ($test !== true) throw new Exception('Verbindung fehlgeschlagen: '.$test);
|
||||
if ($test !== true) throw new Exception(__('site_test_fail').': '.$test);
|
||||
$db->execute("UPDATE sites SET name=?,site_id=?,unifi_controller_url=?,unifi_username=?,unifi_password=?,public_access=? WHERE id=?",
|
||||
[$name,$siteIdStr,$controllerUrl,$username,Crypto::encrypt($password),$publicAccess,$siteId]);
|
||||
} else {
|
||||
// Auch ohne Passwortaenderung testen (mit gespeichertem Passwort) –
|
||||
// sonst fallen Tippfehler in URL/Username erst beim naechsten Voucher auf.
|
||||
$stored = $db->fetchOne("SELECT unifi_password FROM sites WHERE id=?", [$siteId]);
|
||||
if (!$stored) throw new Exception(__('error_site_not_found'));
|
||||
$test = UniFiController::testConnection($controllerUrl,$username,Crypto::decrypt($stored['unifi_password']),$siteIdStr);
|
||||
if ($test !== true) throw new Exception(__('site_test_fail').': '.$test);
|
||||
$db->execute("UPDATE sites SET name=?,site_id=?,unifi_controller_url=?,unifi_username=?,public_access=? WHERE id=?",
|
||||
[$name,$siteIdStr,$controllerUrl,$username,$publicAccess,$siteId]);
|
||||
}
|
||||
$auth->writeAuditLog($_SESSION['user_id'],'site_edit','site',$siteId,"Site {$name} aktualisiert");
|
||||
$success = __('sites_updated');
|
||||
flashSet(__('sites_updated'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
} catch (Exception $e) { $error = $e->getMessage(); }
|
||||
}
|
||||
}
|
||||
|
|
@ -61,36 +95,46 @@ if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['add_site'])) {
|
|||
$publicAccess = isset($_POST['public_access']) ? 1 : 0;
|
||||
if (empty($name)||empty($siteId)||empty($controllerUrl)||empty($username)) throw new Exception(__('error_fill_all'));
|
||||
$test = UniFiController::testConnection($controllerUrl,$username,$password,$siteId);
|
||||
if ($test !== true) throw new Exception('Verbindung fehlgeschlagen: '.$test);
|
||||
if ($test !== true) throw new Exception(__('site_test_fail').': '.$test);
|
||||
$newId = $db->execute("INSERT INTO sites (name,site_id,unifi_controller_url,unifi_username,unifi_password,public_access) VALUES (?,?,?,?,?,?)",
|
||||
[$name,$siteId,$controllerUrl,$username,Crypto::encrypt($password),$publicAccess]);
|
||||
$auth->writeAuditLog($_SESSION['user_id'],'site_create','site',$newId,"Site {$name} erstellt");
|
||||
$success = __('sites_added');
|
||||
flashSet(__('sites_added'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
} catch (Exception $e) { $error = $e->getMessage(); }
|
||||
}
|
||||
}
|
||||
|
||||
// Delete site
|
||||
if (isset($_GET['delete']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$delId = (int)$_GET['delete'];
|
||||
// Delete site (POST + PRG)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['delete_site'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$delId = (int)$_POST['delete_site'];
|
||||
$db->query("DELETE FROM sites WHERE id=?", [$delId]);
|
||||
$auth->writeAuditLog($_SESSION['user_id'],'site_delete','site',$delId,'Site gelöscht');
|
||||
$success = __('sites_deleted');
|
||||
flashSet(__('sites_deleted'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
} else { $error = __('error_csrf'); }
|
||||
}
|
||||
|
||||
// Toggle site
|
||||
if (isset($_GET['toggle']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$site = $db->fetchOne("SELECT is_active FROM sites WHERE id=?", [(int)$_GET['toggle']]);
|
||||
// Toggle site (POST + PRG)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['toggle_site'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$site = $db->fetchOne("SELECT is_active FROM sites WHERE id=?", [(int)$_POST['toggle_site']]);
|
||||
if ($site) {
|
||||
$db->query("UPDATE sites SET is_active=? WHERE id=?", [$site['is_active']?0:1,(int)$_GET['toggle']]);
|
||||
$success = 'Site-Status aktualisiert!';
|
||||
$db->query("UPDATE sites SET is_active=? WHERE id=?", [$site['is_active']?0:1,(int)$_POST['toggle_site']]);
|
||||
flashSet(__('sites_status_updated'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
}
|
||||
} else { $error = __('error_csrf'); }
|
||||
}
|
||||
|
||||
if (empty($success) && empty($error) && ($flash = flashGet())) {
|
||||
$success = $flash['message'];
|
||||
}
|
||||
|
||||
$sites = $db->fetchAll("SELECT * FROM sites ORDER BY name");
|
||||
$currentPage = 'sites';
|
||||
?>
|
||||
|
|
@ -104,9 +148,6 @@ $currentPage = 'sites';
|
|||
<style>
|
||||
.page-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 28px; flex-wrap: wrap; gap: 12px; }
|
||||
.page-title { font-size: 26px; font-weight: 700; color: var(--text-primary); }
|
||||
.alert { padding: 13px 18px; border-radius: 10px; font-size: 14px; margin-bottom: 20px; }
|
||||
.alert-error { background: #fee; border: 1px solid #fcc; color: #c33; }
|
||||
.alert-success { background: #efe; border: 1px solid #cfc; color: #3c3; }
|
||||
.sites-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(330px, 1fr)); gap: 18px; }
|
||||
.site-card { background: var(--bg-card); border: 2px solid var(--border-color); border-radius: 14px; padding: 20px; transition: border-color .2s, box-shadow .2s; }
|
||||
.site-card:hover { border-color: var(--accent); box-shadow: 0 4px 14px rgba(102,126,234,.15); }
|
||||
|
|
@ -116,10 +157,6 @@ $currentPage = 'sites';
|
|||
.site-info { margin: 14px 0; font-size: 13px; color: var(--text-secondary); }
|
||||
.site-info-item { display: flex; align-items: center; gap: 8px; margin-bottom: 7px; }
|
||||
.site-actions { display: flex; gap: 7px; margin-top: 14px; padding-top: 14px; border-top: 1px solid var(--border-color); flex-wrap: wrap; }
|
||||
.badge { display: inline-block; padding: 3px 9px; border-radius: 5px; font-size: 11px; font-weight: 500; margin: 2px; }
|
||||
.badge-success { background: #d4edda; color: #155724; }
|
||||
.badge-warning { background: #fff3cd; color: #856404; }
|
||||
.badge-info { background: var(--bg-badge-info); color: var(--text-badge-info); }
|
||||
.btn { padding: 8px 15px; border-radius: 8px; border: none; font-weight: 500; cursor: pointer; text-decoration: none; display: inline-flex; align-items: center; gap: 7px; transition: all .2s; font-size: 13px; }
|
||||
.btn-primary { background: var(--accent); color: white; }
|
||||
.btn-primary:hover { background: var(--accent-hover); }
|
||||
|
|
@ -204,16 +241,27 @@ $currentPage = 'sites';
|
|||
class="btn btn-secondary btn-sm">
|
||||
<i class="fas fa-edit"></i> <?= __('btn_edit') ?>
|
||||
</button>
|
||||
<a href="?toggle=<?= $site['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
class="btn btn-secondary btn-sm">
|
||||
<i class="fas fa-<?= $site['is_active'] ? 'pause' : 'play' ?>"></i>
|
||||
<?= $site['is_active'] ? __('sites_deactivate') : __('sites_activate') ?>
|
||||
</a>
|
||||
<a href="?delete=<?= $site['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
class="btn btn-danger btn-sm"
|
||||
onclick="return confirm('Möchten Sie diese Site wirklich löschen?')">
|
||||
<i class="fas fa-trash"></i>
|
||||
</a>
|
||||
<form method="post" style="display:inline;">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="toggle_site" value="<?= $site['id'] ?>">
|
||||
<button type="submit" class="btn btn-secondary btn-sm">
|
||||
<i class="fas fa-<?= $site['is_active'] ? 'pause' : 'play' ?>"></i>
|
||||
<?= $site['is_active'] ? __('sites_deactivate') : __('sites_activate') ?>
|
||||
</button>
|
||||
</form>
|
||||
<button type="button" class="btn btn-secondary btn-sm" onclick="testSite(<?= $site['id'] ?>, this)"
|
||||
title="<?= __('site_test_btn') ?>" aria-label="<?= __('site_test_btn') ?>">
|
||||
<i class="fas fa-plug"></i>
|
||||
</button>
|
||||
<form method="post" style="display:inline;"
|
||||
onsubmit="return confirm('<?= addslashes(__('confirm_delete_site')) ?>')">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="delete_site" value="<?= $site['id'] ?>">
|
||||
<button type="submit" class="btn btn-danger btn-sm"
|
||||
title="<?= __('btn_delete') ?>" aria-label="<?= __('btn_delete') ?>">
|
||||
<i class="fas fa-trash"></i>
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<?php endforeach; ?>
|
||||
|
|
@ -355,6 +403,23 @@ document.getElementById('editSiteForm').addEventListener('submit', function() {
|
|||
if (e.target === this) closeModal(id);
|
||||
});
|
||||
});
|
||||
|
||||
async function testSite(siteId, btn) {
|
||||
const original = btn.innerHTML;
|
||||
btn.disabled = true;
|
||||
btn.innerHTML = '<i class="fas fa-spinner fa-spin"></i>';
|
||||
try {
|
||||
const fd = new FormData();
|
||||
fd.append('ajax_test_site', siteId);
|
||||
fd.append('csrf_token', '<?= $auth->getCsrfToken() ?>');
|
||||
const result = await fetch('sites.php', { method: 'POST', body: fd }).then(r => r.json());
|
||||
showToast(result.success ? 'success' : 'error', '<?= addslashes(__('site_test_btn')) ?>', result.message);
|
||||
} catch (e) {
|
||||
showToast('error', '<?= addslashes(__('site_test_btn')) ?>', e.message);
|
||||
}
|
||||
btn.disabled = false;
|
||||
btn.innerHTML = original;
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue