sebastian/proxmox-unified-console
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Release v1.0.1: PVE Auth Fix, Logout Cache-Buster und Docker-Hub Vorbereitung

Browse Source
This commit is contained in:
root
2026-08-23 21:15:05 +02:00
parent 4526301fd1
commit cc7bc514e1
6 changed files with 149 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api.php
+105 -29
View File
@@ -1,13 +1,13 @@
<?php
// /home/docker/pve_dashboard/src/api.php
ini_set('display_errors', 0); // Verhindert, dass PHP-Warnungen das JSON zerstören!
ini_set('display_errors', 0); // Verhindert, dass PHP-Warnungen das JSON zerstören
error_reporting(E_ALL);
require_once 'db.php';
header('Content-Type: application/json');
$action = $_GET['action'] ?? '';
// === ZENTRALE AUDIT LOG FUNKTION (Jetzt kugelsicher!) ===
// === ZENTRALE AUDIT LOG FUNKTION ===
function logAudit($actionName, $target = '') {
global $pdo;
try {
@@ -19,28 +19,46 @@ function logAudit($actionName, $target = '') {
$stmt = $pdo->prepare("INSERT INTO audit_logs (user_id, username, action, target) VALUES (?, ?, ?, ?)");
$stmt->execute([$userId, $username, $actionName, $target]);
} catch (Throwable $e) {
// Fehler im Logbuch ignorieren, damit das Dashboard nicht crasht!
error_log("Audit Log Fehler: " . $e->getMessage());
}
}
if ($action === 'login') {
$username = trim($_POST['username'] ?? ''); $password = $_POST['password'] ?? '';
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?"); $stmt->execute([$username]); $user = $stmt->fetch(PDO::FETCH_ASSOC);
$username = trim($_POST['username'] ?? '');
$password = $_POST['password'] ?? '';
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
$stmt->execute([$username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);
if ($user && password_verify($password, $user['password_hash'])) {
$_SESSION['user_id'] = $user['id']; $_SESSION['username'] = $user['username']; $_SESSION['role'] = $user['role'];
@session_start();
$_SESSION['user_id'] = $user['id'];
$_SESSION['username'] = $user['username'];
$_SESSION['role'] = $user['role'];
@session_write_close();
$ip = $_SERVER['REMOTE_ADDR'] ?? 'Unknown';
logAudit('User Login', 'IP: ' . $ip);
echo json_encode(['success' => true]);
} else echo json_encode(['success' => false, 'error' => 'Login fehlgeschlagen.']);
} else {
echo json_encode(['success' => false, 'error' => 'Login fehlgeschlagen.']);
}
exit;
}
if ($action === 'logout') {
logAudit('User Logout', '');
session_destroy(); echo json_encode(['success' => true]); exit;
@session_start();
session_destroy();
echo json_encode(['success' => true]);
exit;
}
if (!isset($_SESSION['user_id'])) { echo json_encode(['success' => false, 'error' => 'Zugriff verweigert.']); exit; }
@session_start();
if (!isset($_SESSION['user_id'])) {
echo json_encode(['success' => false, 'error' => 'Zugriff verweigert.']);
exit;
}
// === PASSWORT ÄNDERN ===
if ($action === 'change_password') {
@@ -68,30 +86,74 @@ if ($action === 'change_password') {
$isAdmin = ($_SESSION['role'] ?? '') === 'admin';
@session_write_close();
function getProxmoxData($ip, $tokenId, $tokenSecret, $endpoint, $type = 'pve', $method = "GET", $postData = null, $timeout = 4) {
// === PROXMOX API FETCHER (JETZT MIT TICKET-AUTH FÜR ALLE SYSTEME) ===
function getProxmoxData($ip, $tokenId, $tokenSecret, $endpoint, $type = 'pve', $method = "GET", $postData = null, $timeout = 6) {
$port = ($type === 'pbs') ? 8007 : 8006;
if ($type === 'pmg' || $type === 'pbs') {
$chAuth = curl_init("https://{$ip}:{$port}/api2/json/access/ticket");
curl_setopt_array($chAuth, [CURLOPT_RETURNTRANSFER => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_TIMEOUT => 2, CURLOPT_POST => true, CURLOPT_POSTFIELDS => http_build_query(['username' => $tokenId, 'password' => $tokenSecret])]);
$authRes = json_decode(curl_exec($chAuth), true); curl_close($chAuth);
if(!isset($authRes['data']['ticket'])) return ['data' => []];
$cookieName = ($type === 'pbs') ? 'PBSAuthCookie' : 'PMGAuthCookie';
$headers = ["Cookie: {$cookieName}=" . $authRes['data']['ticket'], "CSRFPreventionToken: " . $authRes['data']['CSRFPreventionToken']];
} else {
$headers = ["Authorization: PVEAPIToken={$tokenId}={$tokenSecret}"];
// 1. Ticket holen (Login)
$chAuth = curl_init("https://{$ip}:{$port}/api2/json/access/ticket");
curl_setopt_array($chAuth, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_TIMEOUT => 4,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query(['username' => $tokenId, 'password' => $tokenSecret])
]);
$authRes = json_decode(curl_exec($chAuth), true);
curl_close($chAuth);
if(!isset($authRes['data']['ticket'])) {
return ['data' => null, 'error' => 'Authentifizierung fehlgeschlagen'];
}
// 2. Passendes Cookie für das System wählen
$cookieName = 'PVEAuthCookie';
if ($type === 'pbs') $cookieName = 'PBSAuthCookie';
if ($type === 'pmg') $cookieName = 'PMGAuthCookie';
$headers = [
"Cookie: {$cookieName}=" . $authRes['data']['ticket'],
"CSRFPreventionToken: " . $authRes['data']['CSRFPreventionToken']
];
// 3. Eigentlichen API-Call ausführen
$ch = curl_init("https://{$ip}:{$port}{$endpoint}");
$options = [CURLOPT_RETURNTRANSFER => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_TIMEOUT => $timeout, CURLOPT_HTTPHEADER => $headers];
if ($method !== "GET") { $options[CURLOPT_CUSTOMREQUEST] = $method; if ($postData) $options[CURLOPT_POSTFIELDS] = is_array($postData) ? http_build_query($postData) : $postData; }
$options = [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_TIMEOUT => $timeout,
CURLOPT_HTTPHEADER => $headers
];
if ($method !== "GET") {
$options[CURLOPT_CUSTOMREQUEST] = $method;
if ($postData) {
$options[CURLOPT_POSTFIELDS] = is_array($postData) ? http_build_query($postData) : $postData;
}
}
curl_setopt_array($ch, $options);
$res = curl_exec($ch); curl_close($ch); return json_decode($res, true);
$res = curl_exec($ch);
curl_close($ch);
return json_decode($res, true) ?: [];
}
function checkVmPermission($pdo, $vmid) {
global $isAdmin; if ($isAdmin) return true;
@session_start(); $userId = $_SESSION['user_id'] ?? 0; @session_write_close();
$stmt = $pdo->prepare("SELECT permissions FROM users WHERE id = ?"); $stmt->execute([$userId]); return in_array($vmid, json_decode($stmt->fetchColumn(), true)['allowed_vms'] ?? []);
global $isAdmin;
if ($isAdmin) return true;
@session_start();
$userId = $_SESSION['user_id'] ?? 0;
@session_write_close();
$stmt = $pdo->prepare("SELECT permissions FROM users WHERE id = ?");
$stmt->execute([$userId]);
$perms = json_decode($stmt->fetchColumn() ?: '{}', true);
return in_array($vmid, $perms['allowed_vms'] ?? []);
}
if ($action === 'get_audit_logs') {
@@ -112,13 +174,22 @@ if ($action === 'get_recent_jobs') {
if (isset($tasks['data'])) { foreach ($tasks['data'] as $t) { $t['node_name'] = $node['name']; $allTasks[] = $t; } }
} elseif ($node['type'] === 'pmg') {
$nData = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes", 'pmg');
if (isset($nData['data'][0]['node'])) { $tasks = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes/{$nData['data'][0]['node']}/tasks?limit=10", 'pmg'); if (isset($tasks['data'])) { foreach ($tasks['data'] as $t) { $t['node_name'] = $node['name']; $allTasks[] = $t; } } }
if (isset($nData['data'][0]['node'])) {
$tasks = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes/{$nData['data'][0]['node']}/tasks?limit=10", 'pmg');
if (isset($tasks['data'])) { foreach ($tasks['data'] as $t) { $t['node_name'] = $node['name']; $allTasks[] = $t; } }
}
} else {
$nData = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes", 'pve');
if (isset($nData['data'])) { foreach ($nData['data'] as $nInfo) { $tasks = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes/{$nInfo['node']}/tasks?limit=10", 'pve'); if (isset($tasks['data'])) { foreach ($tasks['data'] as $t) { $t['node_name'] = $node['name']; $allTasks[] = $t; } } } }
if (isset($nData['data'])) {
foreach ($nData['data'] as $nInfo) {
$tasks = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes/{$nInfo['node']}/tasks?limit=10", 'pve');
if (isset($tasks['data'])) { foreach ($tasks['data'] as $t) { $t['node_name'] = $node['name']; $allTasks[] = $t; } }
}
}
}
}
usort($allTasks, function($a, $b) { return ($b['starttime'] ?? 0) <=> ($a['starttime'] ?? 0); }); echo json_encode(['success' => true, 'data' => array_slice($allTasks, 0, 15)]); exit;
usort($allTasks, function($a, $b) { return ($b['starttime'] ?? 0) <=> ($a['starttime'] ?? 0); });
echo json_encode(['success' => true, 'data' => array_slice($allTasks, 0, 15)]); exit;
}
if ($action === 'get_updates') {
@@ -129,7 +200,12 @@ if ($action === 'get_updates') {
if (isset($apt['data'])) { $c = count($apt['data']); $total += $c; if ($c > 0) $nodesNeed[] = $node['name'] . " (" . $c . ")"; }
} else {
$nData = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes", 'pve');
if (isset($nData['data'])) { foreach ($nData['data'] as $nInfo) { $apt = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes/{$nInfo['node']}/apt/update", 'pve'); if (isset($apt['data'])) { $c = count($apt['data']); $total += $c; if ($c > 0) $nodesNeed[] = $nInfo['node'] . " (" . $c . ")"; } } }
if (isset($nData['data'])) {
foreach ($nData['data'] as $nInfo) {
$apt = getProxmoxData($node['ip_address'], $node['token_id'], $node['token_secret'], "/api2/json/nodes/{$nInfo['node']}/apt/update", 'pve');
if (isset($apt['data'])) { $c = count($apt['data']); $total += $c; if ($c > 0) $nodesNeed[] = $nInfo['node'] . " (" . $c . ")"; }
}
}
}
}
echo json_encode(['success' => true, 'total' => $total, 'details' => implode(', ', $nodesNeed)]); exit;
src/app.js
+4 -1
View File
@@ -11,7 +11,10 @@ if (!window.APP.isLoggedIn) {
if(setupForm) { setupForm.addEventListener('submit', async function(e) { e.preventDefault(); const btn = this.querySelector('button[type="submit"]'); const oTxt = btn.innerText; btn.innerText = 'Verbinde...'; const fd = new FormData(); fd.append('name', document.getElementById('nodeName').value); fd.append('ip', document.getElementById('nodeIp').value); fd.append('user', document.getElementById('nodeUser').value); fd.append('pass', document.getElementById('nodePass').value); fd.append('type', 'pve'); try { const res = await (await fetch('api.php?action=add_node', { method: 'POST', body: fd })).json(); if(res.success) { btn.innerText = 'Erfolgreich!'; setTimeout(() => window.location.reload(), 1000); } else { alert(res.error); btn.innerText = oTxt; } } catch (e) { alert('Netzwerkfehler.'); btn.innerText = oTxt; } }); }
}
async function logout() { await fetch('api.php?action=logout'); window.location.reload(); }
async function logout() {
await fetch('api.php?action=logout');
window.location.href = window.location.pathname + '?t=' + Date.now();
}
if (window.APP.isLoggedIn && window.APP.nodeCount > 0) {
src/index.php
+3 -3
View File
@@ -39,11 +39,9 @@ $nodeCount = $stmt->fetchColumn();
<div class="flex items-center gap-4 text-sm">
<span class="text-gray-400">Hallo, <span class="text-white font-bold"><?= htmlspecialchars($_SESSION['username']) ?></span></span>
<!-- HIER IST DER SCHLÜSSEL BUTTON -->
<button onclick="openPasswordModal()" class="text-gray-400 hover:text-white transition-colors" title="Passwort ändern">
<svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4v-3.286l5.742-5.742C9.4 11.135 9 10.126 9 9a6 6 0 0112 0z"></path></svg>
</button>
<!-- ============================ -->
<button onclick="logout()" class="text-red-400 hover:text-red-300 font-medium transition-colors">Abmelden</button>
</div>
@@ -132,6 +130,8 @@ $nodeCount = $stmt->fetchColumn();
</footer>
<script> window.APP = { isLoggedIn: <?= $isLoggedIn ? 'true' : 'false' ?>, nodeCount: <?= $nodeCount ?>, username: '<?= htmlspecialchars($_SESSION['username'] ?? '') ?>' }; </script>
<script src="app.js"></script>
<!-- HIER IST DER CACHE-BUSTER, DAMIT DER LOGOUT IMMER GEHT! -->
<script src="app.js?v=<?= time() ?>"></script>
</body>
</html>