myron/novacpx
1
0
Fork 0
mirror of https://github.com/myronblair/novacpx synced 2026-06-30 17:50:41 -05:00
Code Issues Packages Projects Releases Wiki Activity

feat: items #9-13 — password change, webmail SSO, DKIM live, file manager security, cache busting

Browse Source 
#9  auth.php: add self-service change-password action (current+new+confirm)
    accounts.php: fix admin change-password — accept account_id, fetch username
    for chpasswd (was using int ID), add Auth::require('admin') guard
    user.js: add Change Password page + navItem + submitChangePassword()

#10 EmailManager: store AES-256-CBC enc_password alongside SHA512-CRYPT hash
    webmail.php: rewrite login-url to use webmail_sso_tokens table
    novacpx-sso.php: Roundcube SSO bridge (validate token, decrypt, autosubmit)
    Migration 005: add enc_password column + webmail_sso_tokens table

#11 opendkim: installed, configured (/etc/opendkim.conf, signing.table,
    key.table, trusted.hosts), socket at /var/spool/postfix/opendkim/,
    Postfix milter wired, service enabled+running, key generation verified

#12 files.php: fix safe_path() for non-existent paths (write/mkdir),
    add safe_path_new() helper using parent-dir realpath check,
    fix delete guard (block deleting account root dirs),
    fix rename destination, clamp chmod to 0777

#13 nova.js: api() handles network errors, 429 rate-limit with retry-after,
    non-JSON responses (PHP fatal pages) — graceful error instead of throw
    admin/user/reseller index.php: filemtime-based cache-busting on all assets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Myron Blair
2026-06-08 01:19:33 +00:00
parent 62707d62ce
commit 6fdccc6dbd
27 changed files with 1736 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
db/migrations/002_features_14_17.sql
+59
View File
@@ -0,0 +1,59 @@
-- Migration 002: Features #14-17 (WordPress, Backup, Cloudflare, TOTP)
-- #17 TOTP columns on users (ignore errors if columns already exist)
ALTER TABLE users ADD COLUMN totp_secret VARCHAR(64) DEFAULT NULL;
ALTER TABLE users ADD COLUMN totp_enabled TINYINT(1) DEFAULT 0;
ALTER TABLE users ADD COLUMN totp_backup_codes TEXT DEFAULT NULL;
-- #16 Cloudflare columns on accounts
ALTER TABLE accounts ADD COLUMN cf_api_key VARCHAR(255) DEFAULT NULL;
ALTER TABLE accounts ADD COLUMN cf_api_email VARCHAR(255) DEFAULT NULL;
ALTER TABLE accounts ADD COLUMN cf_zone_id VARCHAR(64) DEFAULT NULL;
-- #16 Cloudflare zone_id on dns_zones
ALTER TABLE dns_zones ADD COLUMN cf_zone_id VARCHAR(64) DEFAULT NULL;
-- #14 WordPress installs
CREATE TABLE IF NOT EXISTS wordpress_installs (
id INT AUTO_INCREMENT PRIMARY KEY,
account_id INT NOT NULL,
domain VARCHAR(255) NOT NULL,
path VARCHAR(255) DEFAULT '/',
db_name VARCHAR(64) DEFAULT NULL,
db_user VARCHAR(64) DEFAULT NULL,
db_pass VARCHAR(128) DEFAULT NULL,
wp_version VARCHAR(20) DEFAULT NULL,
admin_user VARCHAR(64) DEFAULT NULL,
admin_email VARCHAR(255) DEFAULT NULL,
status ENUM('active','updating','suspended') DEFAULT 'active',
staging_of INT DEFAULT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
INDEX (account_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-- #15 Backups
CREATE TABLE IF NOT EXISTS backups (
id INT AUTO_INCREMENT PRIMARY KEY,
account_id INT NOT NULL,
filename VARCHAR(255) NOT NULL,
size BIGINT DEFAULT 0,
type ENUM('full','files','database') DEFAULT 'full',
status ENUM('pending','running','complete','failed') DEFAULT 'pending',
storage VARCHAR(50) DEFAULT 'local',
remote_path VARCHAR(500) DEFAULT NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
INDEX (account_id),
INDEX (status)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
CREATE TABLE IF NOT EXISTS backup_schedules (
id INT AUTO_INCREMENT PRIMARY KEY,
account_id INT NOT NULL UNIQUE,
frequency ENUM('hourly','daily','weekly','monthly') DEFAULT 'daily',
type ENUM('full','files','database') DEFAULT 'full',
retain_count INT DEFAULT 7,
last_run TIMESTAMP NULL,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
INDEX (account_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
db/migrations/003_proxy_hosts.sql
+19
View File
@@ -0,0 +1,19 @@
-- Migration 003: Nginx Proxy Hosts table
CREATE TABLE IF NOT EXISTS proxy_hosts (
id INT AUTO_INCREMENT PRIMARY KEY,
account_id INT UNSIGNED DEFAULT NULL,
domain VARCHAR(255) NOT NULL,
upstream VARCHAR(500) NOT NULL DEFAULT 'http://127.0.0.1:80',
ssl_enabled TINYINT(1) NOT NULL DEFAULT 0,
enabled TINYINT(1) NOT NULL DEFAULT 1,
custom_config TEXT DEFAULT NULL,
notes VARCHAR(500) DEFAULT NULL,
created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
updated_at DATETIME DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
INDEX (account_id),
UNIQUE KEY uq_domain (domain)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-- Panel settings for proxy mode
INSERT INTO settings (`key`, `value`) VALUES ('proxy_mode', 'disabled') ON DUPLICATE KEY UPDATE `key`=`key`;
INSERT INTO settings (`key`, `value`) VALUES ('proxy_auto_sync', '0') ON DUPLICATE KEY UPDATE `key`=`key`;
db/migrations/004_rate_limits.sql
+8
View File
@@ -0,0 +1,8 @@
-- Migration 004: API rate limiting table
CREATE TABLE IF NOT EXISTS api_rate_limits (
ip VARCHAR(45) NOT NULL,
endpoint VARCHAR(64) NOT NULL DEFAULT 'api',
hits INT UNSIGNED NOT NULL DEFAULT 1,
window_start INT UNSIGNED NOT NULL,
PRIMARY KEY (ip, endpoint)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
db/migrations/005_webmail_sso.sql
+22
View File
@@ -0,0 +1,22 @@
-- Migration 005: Webmail SSO — encrypted IMAP password + SSO tokens table
SET @col_exists = (
SELECT COUNT(*) FROM information_schema.COLUMNS
WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'email_accounts' AND COLUMN_NAME = 'enc_password'
);
SET @sql = IF(@col_exists = 0,
'ALTER TABLE email_accounts ADD COLUMN enc_password VARCHAR(512) DEFAULT NULL',
'SELECT 1'
);
PREPARE stmt FROM @sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
CREATE TABLE IF NOT EXISTS webmail_sso_tokens (
id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
token VARCHAR(64) NOT NULL,
email VARCHAR(320) NOT NULL,
enc_pass VARCHAR(512) NOT NULL,
expires_at DATETIME NOT NULL,
UNIQUE KEY uq_token (token),
INDEX idx_expires (expires_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;