mirror of
https://gitlab.com/ArkHost/WHMCS-ArkhostVPSAG.git
synced 2026-07-23 23:36:06 +02:00
Yuri Karamian
7ccc92a039
- Redact decrypted reseller API credentials from module logs (ArkhostVPSAG_Error). - Validate client-controlled values before they enter upstream API URL paths (graph time, backup file, firewall rule id, ISO id, rDNS IP); restrict VPS ID to digits. Prevents path/parameter injection (IDOR). - Suspend via Disable/Enable instead of Stop/Start, and reject state-changing client-area actions on non-active services (suspended client can't power on). - Verify the provisioning callback signature with hash_equals instead of !=. - Fix callback assigned-IP assembly: keep all extra IPv4s, join with real newlines (was dropping the first IP and using a literal backslash-n). - Make callback html_entity_decode array-safe. - Escape untrusted output: JSON_HEX_TAG-encode serverInfo for the <script> block, HTML-escape serverInfo/OS fields in template + error.tpl, escape firewall/backup values built via innerHTML.
30 lines
672 B
Smarty
30 lines
672 B
Smarty
{**
|
|
* VPSAG WHMCS Server Provisioning version 1.4
|
|
*
|
|
* @package WHMCS
|
|
* @copyright ArkHost
|
|
* @link https://arkhost.com
|
|
* @author ArkHost <support@arkhost.com>
|
|
*}
|
|
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
|
|
<meta name="author" content="ArkHost">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
|
|
<title>ArkHost - VPS Panel</title>
|
|
|
|
|
|
</head>
|
|
<body class="text-center">
|
|
<div class="alert alert-warning" role="alert">
|
|
<div class="notice">
|
|
<img src="{$image}" class="mr-2">{$error|escape}
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html> |