Joseph.Rawlings/Virtnet.bond
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(proxmox): harden console sessions and firewall rollout safety

Browse Source 
Reduce security and reliability risk across the Proxmox extension by removing password exposure from Livewire state, hardening console auth/cookie handling, and improving sanitized error paths. Improve firewall and router performance by adding safer lazy loading, bounded pagination, cross-server compatibility guards, and lower-overhead API workflows.

Made-with: Cursor
This commit is contained in:
Joseph.Rawlings
2026-03-28 19:34:46 -04:00
parent 9f996035db
commit 68043f0416
39 changed files with 1106 additions and 5013 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
extensions/Servers/Proxmox/Livewire/System.php
View File

@@ -72,6 +72,12 @@ class System extends Component
{
parent::mount($server);
if ($this->server->node?->is_lxc) {
$this->notify('System hardware settings are only available for virtual machines.', 'info');
$this->redirect(route('proxmox.server.overview', ['server' => $this->server->id]), navigate: true);
return;
}
$this->loadSystemConfiguration(false);
$this->loadCapabilities();
}
@@ -516,8 +522,8 @@ class System extends Component
[$storage, $volume] = explode(':', $storageVolume, 2);
// Only delete from cephpool (RBD storage) for now
if ($storage !== 'cephpool') {
// Only delete known storage volume references
if (trim($storage) === '') {
return;
}
@@ -589,6 +595,7 @@ class System extends Component
$slot = 'efidisk0';
$volumeName = 'vm-' . $this->server->vm_id . '-efidisk0';
$storagePool = $this->systemStoragePool();
try {
$proxmox = new Proxmox;
@@ -596,7 +603,7 @@ class System extends Component
// For RBD storage, create the volume first
try {
$proxmox->request(
'/nodes/' . $this->server->node->name . '/storage/cephpool/content',
'/nodes/' . $this->server->node->name . '/storage/' . $storagePool . '/content',
'post',
[
'filename' => $volumeName,
@@ -609,7 +616,7 @@ class System extends Component
// Continue to add device to config
}
$definition = 'cephpool:' . $volumeName . ',size=4M';
$definition = $storagePool . ':' . $volumeName . ',size=4M';
if ($this->newEfiPreenroll) {
$definition .= ',pre-enrolled-keys=1';
}
@@ -652,6 +659,7 @@ class System extends Component
}
$volumeName = 'vm-' . $this->server->vm_id . '-tpm';
$storagePool = $this->systemStoragePool();
try {
$proxmox = new Proxmox;
@@ -659,7 +667,7 @@ class System extends Component
// For RBD storage, create the volume first
try {
$proxmox->request(
'/nodes/' . $this->server->node->name . '/storage/cephpool/content',
'/nodes/' . $this->server->node->name . '/storage/' . $storagePool . '/content',
'post',
[
'filename' => $volumeName,
@@ -672,7 +680,7 @@ class System extends Component
// Continue to add device to config
}
$definition = 'cephpool:' . $volumeName . ',size=4M,version=' . $version;
$definition = $storagePool . ':' . $volumeName . ',size=4M,version=' . $version;
$this->applyDeviceChange($slot, $definition, 'TPM device added.');
$this->newTpmVersion = 'v2.0';
@@ -698,6 +706,11 @@ class System extends Component
}
}
protected function systemStoragePool(): string
{
return trim((string) ($this->server->node->storage_location ?? '')) ?: 'cephpool';
}
protected function storeOriginalValues(): void
{
$flags = array_values(array_unique($this->selectedCpuFlags ?? []));