Joseph.Rawlings/Virtnet.bond
Private
Public Access
1
0
Fork 0
Code Activity

fix(proxmox): harden console sessions and firewall rollout safety

Browse Source 
Reduce security and reliability risk across the Proxmox extension by removing password exposure from Livewire state, hardening console auth/cookie handling, and improving sanitized error paths. Improve firewall and router performance by adding safer lazy loading, bounded pagination, cross-server compatibility guards, and lower-overhead API workflows.

Made-with: Cursor
This commit is contained in:
Joseph.Rawlings
2026-03-28 19:34:46 -04:00
parent 9f996035db
commit 68043f0416
39 changed files with 1106 additions and 5013 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
extensions/Servers/Proxmox/Livewire/Reinstall.php
View File

@@ -15,12 +15,15 @@ class Reinstall extends Component
public $confirmReinstall = false;
public bool $isProtected = false;
public bool $protectionCheckFailed = false;
public $osList = [];
public function mount(Server $server): void
{
parent::mount($server);
$this->os = $server->os_id;
$this->checkProtectedStatus();
$this->loadOsList();
}
protected function checkProtectedStatus(): void
@@ -30,9 +33,11 @@ class Reinstall extends Component
$config = $proxmox->request('/nodes/' . $this->server->node->name . '/' . $this->server->node->vmType() . '/' . $this->server->vm_id . '/config')->json()['data'] ?? [];
// Protected can be 1, '1', true, or missing/null
$this->isProtected = isset($config['protection']) && ($config['protection'] == 1 || $config['protection'] === '1' || $config['protection'] === true);
$this->protectionCheckFailed = false;
} catch (\Throwable $e) {
// If we can't check, assume not protected
$this->isProtected = false;
// Fail closed for destructive operations when protection status cannot be verified
$this->isProtected = true;
$this->protectionCheckFailed = true;
}
}
@@ -42,7 +47,11 @@ class Reinstall extends Component
$this->checkProtectedStatus();
if ($this->isProtected) {
$this->notify('Cannot reinstall: This server is protected in Proxmox', 'error');
if ($this->protectionCheckFailed) {
$this->notify('Cannot reinstall: Unable to verify server protection status. Please try again.', 'error');
} else {
$this->notify('Cannot reinstall: This server is protected in Proxmox', 'error');
}
return;
}
@@ -54,41 +63,41 @@ class Reinstall extends Component
return;
}
$this->server->os_id = $this->os;
$this->server->save();
try {
$proxmox = new Proxmox;
$proxmox->reinstall($this->server);
} catch (\Throwable $e) {
$this->notify('Reinstall failed: ' . $e->getMessage(), 'error');
report($e);
$this->notify('Reinstall failed. Please try again in a moment.', 'error');
return;
}
$this->server->os_id = $this->os;
$this->server->save();
$this->redirect(route('proxmox.index'));
}
public function render()
protected function loadOsList(): void
{
if (!$this->server->node) {
return view('proxmox::reinstall', [
'osList' => collect(),
'isProtected' => $this->isProtected,
]);
$this->osList = collect();
return;
}
// assuming Server has relation `node()` -> Node model
$locationId = $this->server->node->location_id;
$isLxc = $this->server->node->is_lxc ?? false;
$isLxc = (bool) ($this->server->node->is_lxc ?? false);
// Filter OS templates by location AND type (LXC templates for LXC nodes, KVM for KVM)
$osList = \Paymenter\Extensions\Servers\Proxmox\Models\Location::findOrFail($locationId)
->os()
$this->osList = OS::query()
->where('location_id', $locationId)
->where('is_lxc', $isLxc)
->get();
}
public function render()
{
return view('proxmox::reinstall', [
'osList' => $osList,
'osList' => $this->osList,
'isProtected' => $this->isProtected,
]);
}