diff --git a/src/main.go b/src/main.go index b40637e..e93d4df 100644 --- a/src/main.go +++ b/src/main.go @@ -59,9 +59,9 @@ var enableAutoUpdate = flag.Bool("cfgupgrade", true, "Enable auto config upgrade var ( name = "Zoraxy" - version = "3.1.0" + version = "3.1.1" nodeUUID = "generic" //System uuid, in uuidv4 format - development = false //Set this to false to use embedded web fs + development = true //Set this to false to use embedded web fs bootTime = time.Now().Unix() /* @@ -117,8 +117,8 @@ func SetupCloseHandler() { func ShutdownSeq() { SystemWideLogger.Println("Shutting down " + name) - SystemWideLogger.Println("Closing GeoDB ") - geodbStore.Close() + //SystemWideLogger.Println("Closing GeoDB") + //geodbStore.Close() SystemWideLogger.Println("Closing Netstats Listener") netstatBuffers.Close() SystemWideLogger.Println("Closing Statistic Collector") diff --git a/src/mod/dynamicproxy/dpcore/dpcore.go b/src/mod/dynamicproxy/dpcore/dpcore.go index 54bbaa0..6f870a2 100644 --- a/src/mod/dynamicproxy/dpcore/dpcore.go +++ b/src/mod/dynamicproxy/dpcore/dpcore.go @@ -350,13 +350,6 @@ func (p *ReverseProxy) ProxyHTTP(rw http.ResponseWriter, req *http.Request, rrr } } - //TODO: Figure out a way to proxy for proxmox - //if res.StatusCode == 501 || res.StatusCode == 500 { - // fmt.Println(outreq.Proto, outreq.RemoteAddr, outreq.RequestURI) - // fmt.Println(">>>", outreq.Method, res.Header, res.ContentLength, res.StatusCode) - // fmt.Println(outreq.Header, req.Host) - //} - //Add debug X-Proxy-By tracker res.Header.Set("x-proxy-by", "zoraxy/"+rrr.Version) diff --git a/src/mod/webserv/filemanager/filemanager.go b/src/mod/webserv/filemanager/filemanager.go index 21b6bea..761daef 100644 --- a/src/mod/webserv/filemanager/filemanager.go +++ b/src/mod/webserv/filemanager/filemanager.go @@ -42,6 +42,10 @@ func (fm *FileManager) HandleList(w http.ResponseWriter, r *http.Request) { // Construct the absolute path to the target directory targetDir := filepath.Join(fm.Directory, directory) + // Clean path to prevent path escape #274 + targetDir = filepath.ToSlash(filepath.Clean(targetDir)) + targetDir = strings.ReplaceAll(targetDir, "../", "") + // Open the target directory dirEntries, err := os.ReadDir(targetDir) if err != nil { diff --git a/src/web/components/status.html b/src/web/components/status.html index 0e0d19b..e783ba6 100644 --- a/src/web/components/status.html +++ b/src/web/components/status.html @@ -583,14 +583,14 @@ url: '/api/stats/netstatgraph?array=true', success: function(data){ if (rxValues.length == 0){ - rxValues = JSON.parse(JSON.stringify(data.Rx)); + rxValues.push(...data.Rx); }else{ rxValues.push(data.Rx[dataCount-1]); rxValues.shift(); } if (txValues.length == 0){ - txValues = JSON.parse(JSON.stringify(data.Tx)); + txValues.push(...data.Tx); }else{ txValues.push(data.Tx[dataCount-1]); txValues.shift(); diff --git a/src/web/script/utils.js b/src/web/script/utils.js index 289bd6b..abcc0bb 100644 --- a/src/web/script/utils.js +++ b/src/web/script/utils.js @@ -30,7 +30,7 @@ Object.defineProperty(String.prototype, 'capitalize', { //Add a new function to jquery for ajax override with csrf token injected $.cjax = function(payload){ - let requireTokenMethod = ["POST", "PUT", "DELETE"];; + let requireTokenMethod = ["POST", "PUT", "DELETE"]; if (requireTokenMethod.includes(payload.method) || requireTokenMethod.includes(payload.type)){ //csrf token is required let csrfToken = document.getElementsByTagName("meta")["zoraxy.csrf.Token"].getAttribute("content"); diff --git a/src/web/snippet/dockerContainersList.html b/src/web/snippet/dockerContainersList.html index 0058e3b..c71c09a 100644 --- a/src/web/snippet/dockerContainersList.html +++ b/src/web/snippet/dockerContainersList.html @@ -34,7 +34,7 @@