Files
Joseph.Rawlings 68043f0416 fix(proxmox): harden console sessions and firewall rollout safety
Reduce security and reliability risk across the Proxmox extension by removing password exposure from Livewire state, hardening console auth/cookie handling, and improving sanitized error paths. Improve firewall and router performance by adding safer lazy loading, bounded pagination, cross-server compatibility guards, and lower-overhead API workflows.

Made-with: Cursor
2026-03-28 19:34:46 -04:00

108 lines
2.3 KiB
PHP

<?php
namespace Paymenter\Extensions\Servers\Proxmox\Models;
use App\Models\Service;
use Illuminate\Contracts\Encryption\DecryptException;
use Illuminate\Database\Eloquent\Model;
use Illuminate\Support\Facades\Crypt;
class Server extends Model
{
protected $table = 'ext_proxmox_servers';
protected $fillable = [
'user_id',
'node_id',
'os_id',
'service_id',
'vm_id',
'primary_ipv4',
'primary_ipv6',
'status',
'hostname',
'password',
'user_set_icon',
'user_set_icon_color',
'user_set_icon_prefix',
'tag1',
'tag1color',
'tag2',
'tag2color',
'tag3',
'tag3color',
];
protected $hidden = [
'password',
];
public function node()
{
return $this->belongsTo(Node::class);
}
public function os()
{
return $this->belongsTo(OS::class);
}
public function ipAddresses()
{
return $this->hasMany(IPAddress::class);
}
public function service()
{
return $this->belongsTo(Service::class);
}
public function primaryIpv4()
{
return $this->belongsTo(IPAddress::class, 'primary_ipv4');
}
public function primaryIpv6()
{
return $this->belongsTo(IPAddress::class, 'primary_ipv6');
}
public function statistics()
{
return $this->hasMany(ServerStatistics::class);
}
public function setPasswordAttribute(?string $value): void
{
if ($value === null || $value === '') {
$this->attributes['password'] = null;
return;
}
$this->attributes['password'] = Crypt::encryptString($value);
}
public function getPasswordAttribute(?string $value): ?string
{
if ($value === null || $value === '') {
return null;
}
try {
return Crypt::decryptString($value);
} catch (DecryptException) {
// Refuse to expose undecipherable values to callers.
report(new \RuntimeException('Failed to decrypt stored Proxmox server password.'));
return null;
}
}
public function hasStoredPassword(): bool
{
$rawPassword = $this->getRawOriginal('password');
return is_string($rawPassword) && trim($rawPassword) !== '';
}
}