fix : securite regex et message erreur et endpoint #13
8
.env.example
Normal file
8
.env.example
Normal file
@@ -0,0 +1,8 @@
|
|||||||
|
API_SECRET_KEY=
|
||||||
|
DISCORD_BOT_TOKEN=
|
||||||
|
DISCORD_CHANNEL_ID=
|
||||||
|
BACKUPS_REMOTE_HOST=
|
||||||
|
BACKUPS_REMOTE_ROOT=
|
||||||
|
BACKUPS_MAX_FILES=
|
||||||
|
DISK_COMMAND_REMOTE=
|
||||||
|
DISK_COMMAND_LOCAL=
|
||||||
@@ -80,6 +80,7 @@
|
|||||||
import { computed, onMounted, ref } from "vue"
|
import { computed, onMounted, ref } from "vue"
|
||||||
import { Icon as IconifyIcon } from "@iconify/vue"
|
import { Icon as IconifyIcon } from "@iconify/vue"
|
||||||
import { apiFetch } from "~/composables/useApiAuth"
|
import { apiFetch } from "~/composables/useApiAuth"
|
||||||
|
import { useApiAuthHeader } from "~/composables/useApiAuth"
|
||||||
|
|
||||||
type BackupScript = {
|
type BackupScript = {
|
||||||
key: string
|
key: string
|
||||||
@@ -119,6 +120,7 @@ const scripts = ref<BackupScript[]>([])
|
|||||||
const output = ref<string>("")
|
const output = ref<string>("")
|
||||||
const message = ref<string>("")
|
const message = ref<string>("")
|
||||||
const isError = ref(false)
|
const isError = ref(false)
|
||||||
|
const apiAuthHeader = useApiAuthHeader()
|
||||||
|
|
||||||
const statusClass = computed(() => (isError.value ? "status-error" : "status-success"))
|
const statusClass = computed(() => (isError.value ? "status-error" : "status-success"))
|
||||||
|
|
||||||
@@ -137,7 +139,7 @@ const loadScripts = async () => {
|
|||||||
try {
|
try {
|
||||||
const data = await apiFetch<BackupScriptListResponse>("/api/backup-script")
|
const data = await apiFetch<BackupScriptListResponse>("/api/backup-script")
|
||||||
scripts.value = data.scripts
|
scripts.value = data.scripts
|
||||||
} catch (error) {
|
} catch {
|
||||||
scripts.value = []
|
scripts.value = []
|
||||||
isError.value = true
|
isError.value = true
|
||||||
message.value = "Erreur lors de l'opération"
|
message.value = "Erreur lors de l'opération"
|
||||||
@@ -174,9 +176,21 @@ const runScript = async (key: string) => {
|
|||||||
isError: false,
|
isError: false,
|
||||||
downloadFolders: data.downloadFolders || []
|
downloadFolders: data.downloadFolders || []
|
||||||
})
|
})
|
||||||
} catch (error: any) {
|
} catch (error: unknown) {
|
||||||
isError.value = true
|
isError.value = true
|
||||||
message.value = error?.data?.statusMessage || "Erreur lors de l'opération"
|
const statusMessage =
|
||||||
|
typeof error === "object" &&
|
||||||
|
error !== null &&
|
||||||
|
"data" in error &&
|
||||||
|
typeof error.data === "object" &&
|
||||||
|
error.data !== null &&
|
||||||
|
"statusMessage" in error.data &&
|
||||||
|
typeof error.data.statusMessage === "string"
|
||||||
|
? error.data.statusMessage
|
||||||
|
: null
|
||||||
|
|
||||||
|
message.value = statusMessage || "Erreur lors de l'opération"
|
||||||
|
message.value = error?.data?.statusMessage || "Erreur execution script"
|
||||||
output.value = ""
|
output.value = ""
|
||||||
emit("result", {
|
emit("result", {
|
||||||
key,
|
key,
|
||||||
|
|||||||
@@ -4,8 +4,8 @@
|
|||||||
<h2 class="card-title">Speedtest</h2>
|
<h2 class="card-title">Speedtest</h2>
|
||||||
<button
|
<button
|
||||||
class="reload-btn"
|
class="reload-btn"
|
||||||
@click="runTests"
|
|
||||||
:disabled="isTesting"
|
:disabled="isTesting"
|
||||||
|
@click="runTests"
|
||||||
>
|
>
|
||||||
<IconifyIcon
|
<IconifyIcon
|
||||||
icon="mdi:reload"
|
icon="mdi:reload"
|
||||||
@@ -20,8 +20,8 @@
|
|||||||
</template>
|
</template>
|
||||||
|
|
||||||
<div
|
<div
|
||||||
v-else
|
|
||||||
v-for="row in rows"
|
v-for="row in rows"
|
||||||
|
v-else
|
||||||
:key="`${row.label}-${row.url}`"
|
:key="`${row.label}-${row.url}`"
|
||||||
class="status-row"
|
class="status-row"
|
||||||
:class="row.status === 200 ? 'row-ok' : 'row-error'"
|
:class="row.status === 200 ? 'row-ok' : 'row-error'"
|
||||||
|
|||||||
@@ -32,14 +32,18 @@ function getDownloadFileName(contentDisposition: string | null, fallback: string
|
|||||||
return fallback
|
return fallback
|
||||||
}
|
}
|
||||||
|
|
||||||
export function withApiAuth(init: RequestInit = {}) {
|
export function useApiAuthHeader() {
|
||||||
// Les appels frontend reutilisent les cookies httpOnly poses cote serveur.
|
const runtimeConfig = useRuntimeConfig()
|
||||||
return {
|
const token = runtimeConfig.public.apiSecretKey
|
||||||
...init,
|
|
||||||
headers: {
|
if (!token) {
|
||||||
...toHeadersObject(init.headers)
|
return {}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Tous les appels frontend vers /api/* reutilisent ce header commun.
|
||||||
|
return {
|
||||||
|
Authorization: `Bearer ${token}`
|
||||||
}
|
}
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
export const apiFetch = $fetch.create({})
|
export const apiFetch = $fetch.create({})
|
||||||
@@ -73,3 +77,14 @@ export async function downloadApiFile(url: string, fileNameFallback: string) {
|
|||||||
link.remove()
|
link.remove()
|
||||||
URL.revokeObjectURL(objectUrl)
|
URL.revokeObjectURL(objectUrl)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
export function withApiAuth(init: RequestInit = {}) {
|
||||||
|
// Fusionne le header d'auth avec d'eventuels headers deja fournis.
|
||||||
|
return {
|
||||||
|
...init,
|
||||||
|
headers: {
|
||||||
|
...useApiAuthHeader(),
|
||||||
|
...toHeadersObject(init.headers)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|||||||
3
eslint.config.mjs
Normal file
3
eslint.config.mjs
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
import createConfigForNuxt from "@nuxt/eslint-config"
|
||||||
|
|
||||||
|
export default createConfigForNuxt()
|
||||||
@@ -7,7 +7,7 @@
|
|||||||
:src="logoSrc"
|
:src="logoSrc"
|
||||||
alt="Logo Malio"
|
alt="Logo Malio"
|
||||||
class="logo"
|
class="logo"
|
||||||
/>
|
>
|
||||||
</div>
|
</div>
|
||||||
<div class="brand-copy">
|
<div class="brand-copy">
|
||||||
<p class="brand-title">Supervisor</p>
|
<p class="brand-title">Supervisor</p>
|
||||||
@@ -67,7 +67,7 @@
|
|||||||
:src="logoSrc"
|
:src="logoSrc"
|
||||||
alt="Logo Malio"
|
alt="Logo Malio"
|
||||||
class="logo"
|
class="logo"
|
||||||
/>
|
>
|
||||||
</div>
|
</div>
|
||||||
<div class="brand-copy">
|
<div class="brand-copy">
|
||||||
<p class="brand-kicker">Control Center</p>
|
<p class="brand-kicker">Control Center</p>
|
||||||
|
|||||||
3138
package-lock.json
generated
3138
package-lock.json
generated
File diff suppressed because it is too large
Load Diff
10
package.json
10
package.json
@@ -7,14 +7,14 @@
|
|||||||
"dev": "nuxt dev",
|
"dev": "nuxt dev",
|
||||||
"generate": "nuxt generate",
|
"generate": "nuxt generate",
|
||||||
"preview": "nuxt preview",
|
"preview": "nuxt preview",
|
||||||
"postinstall": "nuxt prepare"
|
"postinstall": "nuxt prepare",
|
||||||
|
"lint": "eslint .",
|
||||||
|
"lint:fix": "eslint . --fix"
|
||||||
},
|
},
|
||||||
"dependencies": {
|
"dependencies": {
|
||||||
"@iconify/vue": "^5.0.0",
|
"@iconify/vue": "^5.0.0",
|
||||||
"iconify": "^1.4.0",
|
"@nuxt/eslint": "^1.15.2",
|
||||||
"nuxt": "^4.3.1",
|
"nuxt": "^4.3.1"
|
||||||
"vue": "^3.5.29",
|
|
||||||
"vue-router": "^4.6.4"
|
|
||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@semantic-release/changelog": "^6.0.3",
|
"@semantic-release/changelog": "^6.0.3",
|
||||||
|
|||||||
@@ -33,7 +33,7 @@
|
|||||||
</div>
|
</div>
|
||||||
|
|
||||||
<div class="grid-middle">
|
<div class="grid-middle">
|
||||||
<Speedtest class="animate-fade-in-up speedtest-card-mobile" style="animation-delay: 150ms" />
|
<SpeedTest class="animate-fade-in-up speedtest-card-mobile" style="animation-delay: 150ms" />
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
@@ -47,8 +47,8 @@
|
|||||||
</template>
|
</template>
|
||||||
|
|
||||||
<script setup lang="ts">
|
<script setup lang="ts">
|
||||||
definePageMeta({layout: false})
|
|
||||||
import {computed, onMounted, ref} from "vue"
|
import {computed, onMounted, ref} from "vue"
|
||||||
|
definePageMeta({layout: false})
|
||||||
import { apiFetch } from "~/composables/useApiAuth"
|
import { apiFetch } from "~/composables/useApiAuth"
|
||||||
|
|
||||||
type DiskSourceResult = {
|
type DiskSourceResult = {
|
||||||
@@ -75,7 +75,6 @@ type DiagramItem = {
|
|||||||
totalText: string
|
totalText: string
|
||||||
}
|
}
|
||||||
|
|
||||||
const selectedBackup = ref<string | null>(null)
|
|
||||||
const rawResults = ref<DiskSourceResult[]>([])
|
const rawResults = ref<DiskSourceResult[]>([])
|
||||||
const loading = ref(false)
|
const loading = ref(false)
|
||||||
const chartRadius = 52
|
const chartRadius = 52
|
||||||
|
|||||||
@@ -1,9 +1,9 @@
|
|||||||
import { execFile } from "node:child_process"
|
import { execFile } from "node:child_process"
|
||||||
import folderMap from "../config/backup-folders.json"
|
import folderMap from "../config/backup-folders.json"
|
||||||
|
|
||||||
const REMOTE_HOST = process.env.BACKUPS_REMOTE_HOST || "malio-b"
|
const REMOTE_HOST = process.env.BACKUPS_REMOTE_HOST
|
||||||
const REMOTE_ROOT = process.env.BACKUPS_REMOTE_ROOT || "/home/malio-b/backups"
|
const REMOTE_ROOT = process.env.BACKUPS_REMOTE_ROOT
|
||||||
const MAX_FILES_PER_FOLDER = Number(process.env.BACKUPS_MAX_FILES || "200")
|
const MAX_FILES_PER_FOLDER = Number(process.env.BACKUPS_MAX_FILES)
|
||||||
const isSafeFolder = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
|
const isSafeFolder = (value: string) => /^[a-zA-Z0-9._-]+$/.test(value)
|
||||||
const shellQuote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`
|
const shellQuote = (value: string) => `'${value.replace(/'/g, `'\\''`)}'`
|
||||||
const FOLDER_MAP = folderMap as Record<string, string>
|
const FOLDER_MAP = folderMap as Record<string, string>
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
import { execFile } from "child_process"
|
import { exec, execFile } from "child_process"
|
||||||
import diskSources from "../config/disk-commands.json"
|
import diskSources from "../config/disk-commands.json"
|
||||||
|
|
||||||
type DiskSource = {
|
type DiskSource = {
|
||||||
@@ -8,12 +8,12 @@ type DiskSource = {
|
|||||||
args?: string[]
|
args?: string[]
|
||||||
}
|
}
|
||||||
|
|
||||||
function getCommand(source: DiskSource) {
|
function getEnvCommand(source: DiskSource) {
|
||||||
const envKey = `DISK_COMMAND_${source.key.toUpperCase()}`
|
const envKey = `DISK_COMMAND_${source.key.toUpperCase()}`
|
||||||
const legacyEnvKey =
|
const legacyEnvKey =
|
||||||
source.key === "remote" ? "DISK_REMOTE_COMMAND" : source.key === "local" ? "DISK_LOCAL_COMMAND" : ""
|
source.key === "remote" ? "DISK_REMOTE_COMMAND" : source.key === "local" ? "DISK_LOCAL_COMMAND" : ""
|
||||||
|
|
||||||
return process.env[envKey] || (legacyEnvKey ? process.env[legacyEnvKey] : undefined) || source.command
|
return process.env[envKey] || (legacyEnvKey ? process.env[legacyEnvKey] : undefined) || null
|
||||||
}
|
}
|
||||||
|
|
||||||
function runCommand(command: string, args: string[] = []): Promise<string> {
|
function runCommand(command: string, args: string[] = []): Promise<string> {
|
||||||
@@ -28,11 +28,26 @@ function runCommand(command: string, args: string[] = []): Promise<string> {
|
|||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function runShellCommand(command: string): Promise<string> {
|
||||||
|
return new Promise((resolve, reject) => {
|
||||||
|
exec(command, (error, stdout, stderr) => {
|
||||||
|
if (error) {
|
||||||
|
reject(stderr || error.message)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
resolve(stdout)
|
||||||
|
})
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
export default defineEventHandler(async () => {
|
export default defineEventHandler(async () => {
|
||||||
const results = await Promise.all(
|
const results = await Promise.all(
|
||||||
(diskSources as DiskSource[]).map(async (source) => {
|
(diskSources as DiskSource[]).map(async (source) => {
|
||||||
try {
|
try {
|
||||||
const output = await runCommand(source.command, source.args || [])
|
const envCommand = getEnvCommand(source)
|
||||||
|
const output = envCommand
|
||||||
|
? await runShellCommand(envCommand)
|
||||||
|
: await runCommand(source.command, source.args || [])
|
||||||
return {
|
return {
|
||||||
key: source.key,
|
key: source.key,
|
||||||
label: source.label,
|
label: source.label,
|
||||||
|
|||||||
@@ -56,7 +56,7 @@ function buildContentDisposition(fileName: string) {
|
|||||||
return `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(fileName)}`
|
return `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(fileName)}`
|
||||||
}
|
}
|
||||||
|
|
||||||
function speedtestStream(event: any) {
|
function speedtestStream(event: H3Event) {
|
||||||
const size = 128 * 1024 * 1024
|
const size = 128 * 1024 * 1024
|
||||||
let sent = 0
|
let sent = 0
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user