mirror of
https://github.com/myronblair/novacpx
synced 2026-06-30 17:50:41 -05:00
myron
dbc5a01de9
#4: Postfix virtual mailbox config (virtual_mailbox_domains/maps, vmail user, maildir at /var/mail/vhosts/%d/%n). Dovecot SQL backend pointed at novacpx.email_accounts with SHA512-CRYPT passdb and per-domain Maildir userdb. #5: BIND9 confirmed working — dig @localhost resolves testdomain1.com correctly. #6: Certbot 2.9.0 confirmed installed; domains.document_root wired; infrastructure ready for live domain issuance (testdomain1.com not publicly resolvable so dry-run expected to fail). #7: Fixed all broken user-panel API queries — missing tables (databases, ftp_accounts, ssl_certs, cron_jobs, php_configs, notifications) created; `databases` reserved-word backtick-quoted across DatabaseManager+endpoints; domains.php is_primary→type=main, doc_root→document_root column fixes; DNSManager::createZone call signature fixed; stats/account auto-resolves account_id for user role. #8: assert_account_access() helper added to api/index.php; reseller ownership check wired into email, ftp, databases, domains, dns, ssl endpoints. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
50 lines
2.4 KiB
PHP
50 lines
2.4 KiB
PHP
<?php
|
|
$db = DB::getInstance();
|
|
$body = json_decode(file_get_contents('php://input'), true) ?? [];
|
|
require_once NOVACPX_LIB . '/FTPManager.php';
|
|
|
|
$user = Auth::getInstance()->user();
|
|
if ($user['role'] === 'user') {
|
|
$accountId = (int)($db->fetchOne("SELECT id FROM accounts WHERE user_id = ?", [$user['uid']])['id'] ?? 0);
|
|
} else {
|
|
$accountId = (int)($body['account_id'] ?? $_GET['account_id'] ?? 0);
|
|
if ($accountId && $user['role'] === 'reseller') assert_account_access($accountId);
|
|
}
|
|
|
|
match ($action) {
|
|
'list' => (function() use ($db, $accountId) {
|
|
Response::success($db->fetchAll("SELECT id, username, home_dir, quota_mb, status, created_at FROM ftp_accounts WHERE account_id = ?", [$accountId]));
|
|
})(),
|
|
|
|
'create' => (function() use ($db, $body, $accountId) {
|
|
if (!$accountId) Response::error("account_id required");
|
|
// Package limit check
|
|
$acctPkg = $db->fetchOne("SELECT p.max_ftp FROM accounts a LEFT JOIN packages p ON p.id=a.package_id WHERE a.id=?", [$accountId]);
|
|
if ($acctPkg && $acctPkg['max_ftp'] > 0) {
|
|
$count = (int)$db->fetchOne("SELECT COUNT(*) c FROM ftp_accounts WHERE account_id=?", [$accountId])['c'];
|
|
if ($count >= (int)$acctPkg['max_ftp']) Response::error("FTP account limit ({$acctPkg['max_ftp']}) reached for this package", 403);
|
|
}
|
|
$username = trim($body['username'] ?? '');
|
|
$password = $body['password'] ?? bin2hex(random_bytes(6));
|
|
$acct = $db->fetchOne("SELECT home_dir FROM accounts WHERE id = ?", [$accountId]);
|
|
$homeDir = $body['home_dir'] ?? ($acct['home_dir'] . '/public_html');
|
|
if (!$username) Response::error("username required");
|
|
$id = FTPManager::createAccount($accountId, $username, $password, $homeDir, (int)($body['quota_mb'] ?? 0));
|
|
audit('ftp.create', $username);
|
|
Response::success(['id' => $id, 'password' => $password], 'FTP account created');
|
|
})(),
|
|
|
|
'delete' => (function() use ($body) {
|
|
FTPManager::deleteAccount((int)($body['id'] ?? 0));
|
|
audit('ftp.delete', "ftp:{$body['id']}");
|
|
Response::success(null, 'FTP account deleted');
|
|
})(),
|
|
|
|
'change-password' => (function() use ($body) {
|
|
FTPManager::changePassword((int)($body['id'] ?? 0), $body['password'] ?? '');
|
|
Response::success(null, 'FTP password updated');
|
|
})(),
|
|
|
|
default => Response::error("Unknown ftp action: $action", 404),
|
|
};
|