Skip to content

Commit 93a6b60

Browse files
PDowneyPDowney
authored
Updates
1 parent 4c7be94 commit 93a6b60

6 files changed

Lines changed: 307 additions & 22 deletions

File tree

‎.github/workflows/software-version-check.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -297,18 +297,19 @@ jobs:
297297
echo "::warning::Failed to fetch Chart.js version, keeping current version"
298298
fi
299299
300-
# Font Awesome
301-
echo "::debug::Fetching Font Awesome version..."
302-
FONTAWESOME_API_RESPONSE=$(curl -s https://api.github.com/repos/FortAwesome/Font-Awesome/releases/latest)
300+
# Font Awesome (restricted to 7.0.x releases)
301+
echo "::debug::Fetching Font Awesome 7.0.x version..."
302+
FONTAWESOME_API_RESPONSE=$(curl -s https://api.github.com/repos/FortAwesome/Font-Awesome/releases)
303303
echo "::debug::Font Awesome API Response: $FONTAWESOME_API_RESPONSE"
304304
305-
LATEST_FONTAWESOME=$(echo "$FONTAWESOME_API_RESPONSE" | jq -r '.tag_name // empty' | sed 's/[^0-9\.]//g')
306-
echo "::debug::Parsed Font Awesome version: '$LATEST_FONTAWESOME'"
305+
# Filter for 7.0.x releases only, get the latest one
306+
LATEST_FONTAWESOME=$(echo "$FONTAWESOME_API_RESPONSE" | jq -r '[.[] | select(.tag_name | test("^7\\.0\\.[0-9]+$")) | .tag_name] | first // empty' | sed 's/[^0-9\.]//g')
307+
echo "::debug::Parsed Font Awesome 7.0.x version: '$LATEST_FONTAWESOME'"
307308
308309
if [[ -n "$LATEST_FONTAWESOME" && "$LATEST_FONTAWESOME" != "null" ]]; then
309310
check_version "FONTAWESOME_VER" "$LATEST_FONTAWESOME"
310311
else
311-
echo "::warning::Failed to fetch Font Awesome version, keeping current version"
312+
echo "::warning::Failed to fetch Font Awesome 7.0.x version, keeping current version"
312313
fi
313314
314315
# TinyFileManager

‎CHANGELOG.md‎

Lines changed: 138 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,140 @@ All notable changes to EngineScript will be documented in this file.
44

55
Changes are organized by date, with the most recent changes listed first.
66

7+
## 2025-11-17
8+
9+
### 🔒 SECURITY: Enhanced Feed Sanitization and XXE Protection
10+
11+
**Strengthened security** for external feed parsing with multi-layer sanitization and XML exploit protection
12+
13+
#### Security Improvements
14+
15+
**New `sanitizeFeedText()` Function:**
16+
- **HTML Entity Decoding** - Handles encoded entities (`<`, `>`, etc.) before stripping tags
17+
- **Tag Stripping** - Removes all HTML tags from feed content
18+
- **Null Byte Removal** - Eliminates null bytes that could enable SQL injection
19+
- **Whitespace Normalization** - Prevents formatting-based exploits
20+
- **HTML Encoding** - Re-encodes special characters for safe JSON output
21+
22+
**XML External Entity (XXE) Protection:**
23+
- `libxml_disable_entity_loader(true)` - Prevents external entity attacks
24+
- `LIBXML_NOENT` flag - Disables entity substitution
25+
- `LIBXML_NOCDATA` flag - Handles CDATA sections safely
26+
27+
**Applied Globally:**
28+
- All 11 feed parsing functions now use `sanitizeFeedText()`
29+
- RSS/Atom feeds (parseStatusFeed)
30+
- JSON APIs (Google Workspace, Wistia, Vultr, Postmark, StatusPage.io)
31+
32+
#### Impact
33+
34+
- ✅ **Zero SQL Injection Risk** - No database interactions exist
35+
- ✅ **XSS Prevention** - All output properly encoded for JSON
36+
- ✅ **XXE Protection** - XML exploits blocked at parser level
37+
- ✅ **Injection Prevention** - Multi-layer sanitization on all external content
38+
- ✅ **Safe Output** - All text properly escaped before JSON encoding
39+
40+
#### Technical Details
41+
42+
**Before:**
43+
```php
44+
$status['description'] = strip_tags($title);
45+
```
46+
47+
**After:**
48+
```php
49+
$status['description'] = sanitizeFeedText($title);
50+
51+
function sanitizeFeedText($text) {
52+
$text = html_entity_decode($text, ENT_QUOTES | ENT_HTML5, 'UTF-8');
53+
$text = strip_tags($text);
54+
$text = str_replace("\0", '', $text);
55+
$text = preg_replace('/\s+/', ' ', $text);
56+
$text = trim($text);
57+
$text = htmlspecialchars($text, ENT_QUOTES | ENT_HTML5, 'UTF-8', false);
58+
return $text;
59+
}
60+
```
61+
62+
---
63+
64+
### ✨ NEW SERVICES: Added 8 Email Service Providers to External Services Dashboard
65+
66+
**Added comprehensive email service monitoring** for popular transactional and marketing email platforms
67+
68+
#### New Services Added
69+
70+
**Email & Communication Category:**
71+
- **SparkPost** - `https://status.sparkpost.com/`
72+
- **Zoho** - `https://status.zoho.com/`
73+
- **Mailjet** - `https://status.mailjet.com/`
74+
- **MailerSend** - `https://status.mailersend.com/`
75+
- **Resend** - `https://resend-status.com/`
76+
- **SMTP2GO** - `https://smtp2gostatus.com/`
77+
- **SendLayer** - `https://status.sendlayer.com/`
78+
79+
**Note:** Mailchimp was initially added but removed - their status page (`https://status.mailchimp.com/`) does not provide a public API or RSS/Atom feed.
80+
81+
**Hosting & Infrastructure Category:**
82+
- **GoDaddy** - `https://status.godaddy.com/` (StatusPage API)
83+
84+
#### Implementation Details
85+
86+
**Frontend (`external-services.js`):**
87+
- Added 8 email service definitions with appropriate icons and feed configurations
88+
- SparkPost, Zoho, Mailjet, MailerSend, Resend, SMTP2GO, SendLayer use RSS/Atom feeds
89+
- GoDaddy uses StatusPage.io JSON API (CORS-enabled)
90+
91+
**Backend (`external-services-api.php`):**
92+
- Added 7 feed URLs to `$allowedFeeds` whitelist
93+
- Feed mappings: sparkpost, zoho, mailjet, mailersend, resend, smtp2go, sendlayer
94+
95+
**Styling (`external-services.css`):**
96+
- Added brand-specific color gradients for all 8 services
97+
- SparkPost (orange), Zoho (red), Mailjet (orange), MailerSend (blue)
98+
- Resend (black), SMTP2GO (blue), SendLayer (cyan), GoDaddy (teal)
99+
100+
#### Impact
101+
102+
- ✅ Comprehensive email service provider monitoring (8 services)
103+
- ✅ Coverage for transactional email (Resend, SendLayer, SMTP2GO, SparkPost)
104+
- ✅ Marketing platform monitoring (Zoho)
105+
- ✅ Enterprise email services (SparkPost, Mailjet, MailerSend)
106+
- ✅ Domain/hosting monitoring (GoDaddy)
107+
108+
---
109+
110+
### 🔧 VERSION CONTROL: Restricted Font Awesome Updates to 7.0.x Branch
111+
112+
**Prevented automatic updates** to Font Awesome 7.1.x due to CDN availability issues
113+
114+
#### Problem
115+
116+
- Version checker was fetching latest release (7.1.0)
117+
- Font Awesome 7.1.0 not available on CDN (cdnjs.cloudflare.com)
118+
- Caused ORB (Origin Request Blocked) errors in dashboard
119+
- Need to stay on stable 7.0.x branch until 7.1.x available on CDN
120+
121+
#### Changes Made
122+
123+
**`.github/workflows/software-version-check.yml`:**
124+
- Changed from `/releases/latest` to `/releases` endpoint
125+
- Added jq filter: `select(.tag_name | test("^7\\.0\\.[0-9]+$"))`
126+
- Now only detects and updates to 7.0.x patch releases
127+
- Will auto-update to 7.0.2, 7.0.3, etc. when released
128+
129+
**`README.md`:**
130+
- Corrected Font Awesome version from 7.1.0 → 7.0.1
131+
132+
#### Impact
133+
134+
- ✅ Prevents automatic updates to unavailable CDN versions
135+
- ✅ Will auto-update within 7.0.x patch releases
136+
- ✅ Maintains dashboard stability and reliability
137+
- ✅ Can manually update to 7.1.x when CDN availability confirmed
138+
139+
---
140+
7141
## 2025-11-14
8142

9143
### ⚡ PERFORMANCE: Increased Timeouts for Slow External Service Feeds
@@ -38,7 +172,7 @@ Changes are organized by date, with the most recent changes listed first.
38172
#### Feature
39173

40174
- **Category-Level Controls**: Each category header now includes a "Toggle All" button
41-
- **Smart Toggle Logic**:
175+
- **Smart Toggle Logic**:
42176
- If any services in category are unchecked → enables all
43177
- If all services are checked → disables all
44178
- **Visual Feedback**: Button icon changes between check-square and square based on state
@@ -294,6 +428,7 @@ async loadExternalServices() {
294428
#### False Positives Documented
295429

296430
Created `.codacy-review-notes.md` documenting 11 false positive warnings:
431+
297432
- CSRF warnings on GET requests (read-only operations, no state modification)
298433
- WordPress-specific warnings (`wp_unslash`) on non-WordPress code
299434
- `file_get_contents()` warnings for legitimate outbound HTTP API calls with timeout protection
@@ -303,6 +438,7 @@ Created `.codacy-review-notes.md` documenting 11 false positive warnings:
303438
#### Codacy Configuration
304439

305440
Created `.codacy.yml` to suppress expected API endpoint patterns:
441+
306442
- **Excludes WordPress core files** (`wp-config.php`) - not under our control
307443
- **Excludes API files** from WordPress-specific rules (nonce verification, wp_unslash)
308444
- **Allows required functions** in API endpoints: `header()`, `echo`, `exit`, `die`
@@ -312,6 +448,7 @@ Created `.codacy.yml` to suppress expected API endpoint patterns:
312448
- **Module inclusion allowed**: `require_once` with `__DIR__` constant (hardcoded paths)
313449

314450
Added inline `@codacy suppress` comments for all 14 legitimate API patterns:
451+
315452
- 11 suppressions in `external-services-api.php` (die, echo, exit, file_get_contents, stream_context_create)
316453
- 1 suppression in `api.php` (require_once for module inclusion)
317454
- All suppressions include clear explanations of why the pattern is necessary and safe

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,7 @@ Once configured, your uptime monitoring data will automatically appear in the ad
238238
|PHPMYADMIN|5.2.3|<https://www.phpmyadmin.net/downloads/>|
239239
|**Admin Control Panel**|||
240240
|Chart.js|4.5.1|<https://github.com/chartjs/Chart.js>|
241-
|Font Awesome|7.1.0|<https://github.com/FortAwesome/Font-Awesome>|
241+
|Font Awesome|7.0.1|<https://github.com/FortAwesome/Font-Awesome>|
242242
|TinyFileManager|2.6|<https://github.com/prasathmani/tinyfilemanager>|
243243
|**Object Cache**|||
244244
|REDIS||<https://redis.io/>|

‎config/var/www/admin/control-panel/external-services/external-services-api.php‎

Lines changed: 50 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,33 @@
1414
die('Direct access forbidden');
1515
}
1616

17+
/**
18+
* Sanitize text from external feeds to prevent injection attacks
19+
* @param string $text Raw text from feed
20+
* @return string Sanitized text safe for output
21+
*/
22+
function sanitizeFeedText($text) {
23+
// Convert HTML entities to characters first (handles &lt; &gt; etc)
24+
$text = html_entity_decode($text, ENT_QUOTES | ENT_HTML5, 'UTF-8');
25+
26+
// Strip all HTML tags
27+
$text = strip_tags($text);
28+
29+
// Remove null bytes (can cause SQL injection in some contexts)
30+
$text = str_replace("\0", '', $text);
31+
32+
// Normalize whitespace
33+
$text = preg_replace('/\s+/', ' ', $text);
34+
35+
// Trim
36+
$text = trim($text);
37+
38+
// Re-encode special characters for safe JSON output
39+
$text = htmlspecialchars($text, ENT_QUOTES | ENT_HTML5, 'UTF-8', false);
40+
41+
return $text;
42+
}
43+
1744
/**
1845
* Parse RSS/Atom feed and extract status information
1946
* @param string $feedUrl The URL of the RSS/Atom feed
@@ -40,9 +67,11 @@ function parseStatusFeed($feedUrl, $filter = null) {
4067
throw new Exception('Failed to fetch feed');
4168
}
4269

43-
// Suppress XML errors and parse
70+
// Suppress XML errors and parse with security flags
4471
libxml_use_internal_errors(true);
45-
$xml = simplexml_load_string($feedContent);
72+
// Disable external entities to prevent XXE attacks
73+
libxml_disable_entity_loader(true);
74+
$xml = simplexml_load_string($feedContent, 'SimpleXMLElement', LIBXML_NOENT | LIBXML_NOCDATA);
4675
libxml_clear_errors();
4776

4877
if ($xml === false) {
@@ -103,15 +132,15 @@ function parseStatusFeed($feedUrl, $filter = null) {
103132
$status['description'] = 'All Systems Operational';
104133
} elseif (preg_match('/outage|down|major|critical|offline/i', $title)) {
105134
$status['indicator'] = 'major';
106-
$status['description'] = strip_tags($description);
135+
$status['description'] = sanitizeFeedText($description);
107136
} elseif (preg_match('/degraded|issue|problem|investigating|identified|monitoring/i', $title)) {
108137
$status['indicator'] = 'minor';
109-
$status['description'] = strip_tags($description);
138+
$status['description'] = sanitizeFeedText($description);
110139
}
111140

112141
// Default: show title as-is if no patterns match
113142
if ($status['indicator'] !== 'none' && $status['indicator'] !== 'major' && $status['indicator'] !== 'minor') {
114-
$status['description'] = strip_tags($title);
143+
$status['description'] = sanitizeFeedText($title);
115144
}
116145
}
117146
// Check if it's an RSS feed
@@ -154,12 +183,12 @@ function parseStatusFeed($feedUrl, $filter = null) {
154183
$status['description'] = 'All Systems Operational';
155184
} elseif (preg_match('/outage|down|major|critical|offline/i', $title)) {
156185
$status['indicator'] = 'major';
157-
$status['description'] = strip_tags(!empty($description) ? $description : $title);
186+
$status['description'] = sanitizeFeedText(!empty($description) ? $description : $title);
158187
} elseif (preg_match('/degraded|issue|problem|investigating|identified|monitoring/i', $title)) {
159188
$status['indicator'] = 'minor';
160-
$status['description'] = strip_tags(!empty($description) ? $description : $title);
189+
$status['description'] = sanitizeFeedText(!empty($description) ? $description : $title);
161190
} else {
162-
$status['description'] = strip_tags($title);
191+
$status['description'] = sanitizeFeedText($title);
163192
}
164193
}
165194

@@ -243,7 +272,7 @@ function parseGoogleWorkspaceIncidents($apiUrl) {
243272

244273
return [
245274
'indicator' => $indicator,
246-
'description' => strip_tags($title)
275+
'description' => sanitizeFeedText($title)
247276
];
248277

249278
} catch (Exception $e) {
@@ -309,7 +338,7 @@ function parseWistiaSummary($apiUrl) {
309338

310339
return [
311340
'indicator' => $indicator,
312-
'description' => strip_tags($name)
341+
'description' => sanitizeFeedText($name)
313342
];
314343
}
315344

@@ -386,7 +415,7 @@ function parseVultrAlerts($apiUrl) {
386415

387416
return [
388417
'indicator' => $indicator,
389-
'description' => strip_tags($subject)
418+
'description' => sanitizeFeedText($subject)
390419
];
391420

392421
} catch (Exception $e) {
@@ -451,7 +480,7 @@ function parsePostmarkNotices($apiUrl) {
451480

452481
return [
453482
'indicator' => $indicator,
454-
'description' => strip_tags($title)
483+
'description' => sanitizeFeedText($title)
455484
];
456485

457486
} catch (Exception $e) {
@@ -496,7 +525,7 @@ function parseStatusPageAPI($apiUrl) {
496525

497526
return [
498527
'indicator' => $indicator,
499-
'description' => strip_tags($description)
528+
'description' => sanitizeFeedText($description)
500529
];
501530

502531
} catch (Exception $e) {
@@ -627,7 +656,14 @@ function handleStatusFeed() {
627656
'metafbs' => 'https://metastatus.com/outage-events-feed-fbs.rss',
628657
'metalogin' => 'https://metastatus.com/outage-events-feed-facebook-login.rss',
629658
'codacy' => 'https://status.codacy.com/history.rss',
630-
'openai' => 'https://status.openai.com/feed.atom'
659+
'openai' => 'https://status.openai.com/feed.atom',
660+
'sparkpost' => 'https://status.sparkpost.com/history.atom',
661+
'zoho' => 'https://status.zoho.com/rss',
662+
'mailjet' => 'https://status.mailjet.com/history.rss',
663+
'mailersend' => 'https://status.mailersend.com/history.rss',
664+
'resend' => 'https://resend-status.com/feed.rss',
665+
'smtp2go' => 'https://smtp2gostatus.com/history.atom',
666+
'sendlayer' => 'https://status.sendlayer.com/history/rss'
631667
];
632668

633669
if (!isset($allowedFeeds[$feedType])) {

‎config/var/www/admin/control-panel/external-services/external-services.css‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,6 +361,38 @@
361361
background: linear-gradient(135deg, #21759b, #2ea2cc);
362362
}
363363

364+
.service-icon.sparkpost-icon {
365+
background: linear-gradient(135deg, #fa6423, #ff7d3b);
366+
}
367+
368+
.service-icon.zoho-icon {
369+
background: linear-gradient(135deg, #e42527, #f03537);
370+
}
371+
372+
.service-icon.mailjet-icon {
373+
background: linear-gradient(135deg, #ff6600, #ff8533);
374+
}
375+
376+
.service-icon.mailersend-icon {
377+
background: linear-gradient(135deg, #0052ff, #3377ff);
378+
}
379+
380+
.service-icon.resend-icon {
381+
background: linear-gradient(135deg, #000, #333);
382+
}
383+
384+
.service-icon.smtp2go-icon {
385+
background: linear-gradient(135deg, #0066cc, #0080ff);
386+
}
387+
388+
.service-icon.sendlayer-icon {
389+
background: linear-gradient(135deg, #00c9ff, #33d4ff);
390+
}
391+
392+
.service-icon.godaddy-icon {
393+
background: linear-gradient(135deg, #1bdbba, #37e8cc);
394+
}
395+
364396
.service-icon i {
365397
font-size: 1.5rem;
366398
color: white;

0 commit comments

Comments
 (0)