Harden VPSAG module: credential logging, path injection, suspension, signature, XSS

mirror of https://gitlab.com/ArkHost/WHMCS-ArkhostVPSAG.git synced 2026-07-23 23:36:06 +02:00

- Redact decrypted reseller API credentials from module logs (ArkhostVPSAG_Error).
- Validate client-controlled values before they enter upstream API URL paths
  (graph time, backup file, firewall rule id, ISO id, rDNS IP); restrict VPS ID
  to digits. Prevents path/parameter injection (IDOR).
- Suspend via Disable/Enable instead of Stop/Start, and reject state-changing
  client-area actions on non-active services (suspended client can't power on).
- Verify the provisioning callback signature with hash_equals instead of !=.
- Fix callback assigned-IP assembly: keep all extra IPv4s, join with real
  newlines (was dropping the first IP and using a literal backslash-n).
- Make callback html_entity_decode array-safe.
- Escape untrusted output: JSON_HEX_TAG-encode serverInfo for the <script>
  block, HTML-escape serverInfo/OS fields in template + error.tpl, escape
  firewall/backup values built via innerHTML.

This commit is contained in:

Yuri Karamian

2026-06-22 00:53:52 +02:00

parent 00a1921c77

commit 7ccc92a039

4 changed files with 104 additions and 38 deletions

									
										modules/servers/ArkhostVPSAG/template/error.tpl
									
		+1
		-1
	
												View File
												
				@@ -23,7 +23,7 @@

					<body class="text-center">

						<div class="alert alert-warning" role="alert">

							<div class="notice">

								<img src="{$image}" class="mr-2">{$error}

								<img src="{$image}" class="mr-2">{$error|escape}

							</div>

						</div>

					</body>