Skip to content

Commit 9929f49

Browse files
PDowneyPDowney
authored
Updates
1 parent 14d3121 commit 9929f49

15 files changed

Lines changed: 3723 additions & 144 deletions

File tree

‎.github/workflows/software-version-check.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,36 @@ jobs:
226226
grep '^NGINX_DYN_TLS_PATCH_SHA=' enginescript-variables.txt >> .github/temp_versions.txt
227227
fi
228228
229+
# Chart.js
230+
echo "::debug::Fetching Chart.js version..."
231+
CHARTJS_API_RESPONSE=$(curl -s https://api.github.com/repos/chartjs/Chart.js/releases/latest)
232+
echo "::debug::Chart.js API Response: $CHARTJS_API_RESPONSE"
233+
234+
LATEST_CHARTJS=$(echo "$CHARTJS_API_RESPONSE" | jq -r '.tag_name // empty' | sed 's/v//')
235+
echo "::debug::Parsed Chart.js version: '$LATEST_CHARTJS'"
236+
237+
if [[ -n "$LATEST_CHARTJS" && "$LATEST_CHARTJS" != "null" ]]; then
238+
check_version "CHARTJS_VER" "$LATEST_CHARTJS"
239+
else
240+
echo "::warning::Failed to fetch Chart.js version, keeping current version"
241+
grep "^CHARTJS_VER=" enginescript-variables.txt >> .github/temp_versions.txt
242+
fi
243+
244+
# Font Awesome
245+
echo "::debug::Fetching Font Awesome version..."
246+
FONTAWESOME_API_RESPONSE=$(curl -s https://api.github.com/repos/FortAwesome/Font-Awesome/releases/latest)
247+
echo "::debug::Font Awesome API Response: $FONTAWESOME_API_RESPONSE"
248+
249+
LATEST_FONTAWESOME=$(echo "$FONTAWESOME_API_RESPONSE" | jq -r '.tag_name // empty' | sed 's/[^0-9\.]//g')
250+
echo "::debug::Parsed Font Awesome version: '$LATEST_FONTAWESOME'"
251+
252+
if [[ -n "$LATEST_FONTAWESOME" && "$LATEST_FONTAWESOME" != "null" ]]; then
253+
check_version "FONTAWESOME_VER" "$LATEST_FONTAWESOME"
254+
else
255+
echo "::warning::Failed to fetch Font Awesome version, keeping current version"
256+
grep "^FONTAWESOME_VER=" enginescript-variables.txt >> .github/temp_versions.txt
257+
fi
258+
229259
# Update date only if versions changed
230260
if [[ "$CHANGES_DETECTED" = true ]]; then
231261
echo "changes_detected=true" >> $GITHUB_OUTPUT
@@ -311,6 +341,8 @@ jobs:
311341
NGINX_DYN_TLS_PATCH_SHA=$(get_var NGINX_DYN_TLS_PATCH_SHA)
312342
SSE_PLUGIN_VER=$(get_var SSE_PLUGIN_VER)
313343
SWPO_PLUGIN_VER=$(get_var SWPO_PLUGIN_VER)
344+
CHARTJS_VER=$(get_var CHARTJS_VER)
345+
FONTAWESOME_VER=$(get_var FONTAWESOME_VER)
314346
315347
# Get patch date (Last-Modified header or today)
316348
PATCH_URL="https://github.com/kn007/patch/raw/master/nginx_dynamic_tls_records.patch"
@@ -336,6 +368,8 @@ jobs:
336368
-e "/|MARIADB|/s/|[^|]*|/|$MARIADB_VER|/2" \
337369
-e "/|PLUGIN: EngineScript: Simple Site Exporter|/s/|[^|]*|/|$SSE_PLUGIN_VER|/2" \
338370
-e "/|PLUGIN: EngineScript: Simple WP Optimizer|/s/|[^|]*|/|$SWPO_PLUGIN_VER|/2" \
371+
-e "/|Chart.js|/s/|[^|]*|/|$CHARTJS_VER|/2" \
372+
-e "/|Font Awesome|/s/|[^|]*|/|$FONTAWESOME_VER|/2" \
339373
README.md
340374
341375
# Always cleanup the temp file

‎CHANGELOG.md‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,97 @@ Changes are organized by date, with the most recent changes listed first.
66

77
## 2025-07-01
88

9+
### 🎨 ADMIN CONTROL PANEL MODERNIZATION
10+
- **Complete Admin Dashboard Redesign**: Fully modernized the admin control panel with a professional, interactive dashboard
11+
- **Modern UI/UX**: Replaced basic HTML template with responsive, dark-themed dashboard using modern CSS Grid and Flexbox
12+
- **Interactive Features**: Added real-time system monitoring, service status indicators, and performance charts
13+
- **Multi-page Dashboard**: Implemented single-page application with Overview, Sites, System, Security, Backups, Logs, and Tools sections
14+
- **Real-time Data**: Integrated Chart.js for interactive performance monitoring and resource usage visualization
15+
- **Responsive Design**: Mobile-first design that works seamlessly on desktop, tablet, and mobile devices
16+
- **Enhanced Navigation**: Sidebar navigation with active states and smooth transitions
17+
- **Live Server Clock**: Real-time server time display with automatic updates
18+
- **Service Monitoring**: Live status indicators for Nginx, PHP-FPM, MariaDB, and Redis with version information
19+
- **System Metrics**: Real-time CPU, memory, and disk usage monitoring with visual indicators
20+
- **Activity Feed**: Recent system activity and alerts with contextual icons and timestamps
21+
- **WordPress Site Management**: Enhanced site overview with status, SSL, and backup information
22+
- **Security Dashboard**: SSL certificate status, firewall monitoring, and malware scanning overview
23+
- **Log Viewer**: Real-time log viewing with filtering for different services (EngineScript, Nginx, PHP, MariaDB)
24+
- **Admin Tools Integration**: Quick access to phpMyAdmin, PHPinfo, phpSysinfo, and Adminer with availability checking
25+
- **Command Reference**: Complete EngineScript command reference with descriptions and usage examples
26+
- **Backend API Implementation**: Created comprehensive PHP-based REST API for dashboard functionality
27+
- **System Information API**: Real-time system stats including CPU, memory, disk usage, uptime, and load averages
28+
- **Service Status API**: Live monitoring of all EngineScript services with version detection
29+
- **WordPress Sites API**: Automated detection and management of WordPress installations
30+
- **Security Status API**: SSL certificate monitoring, firewall status, and malware scanner integration
31+
- **Backup Status API**: Integration with EngineScript backup systems for status reporting
32+
- **Log Access API**: Secure log file access with filtering and real-time updates
33+
- **Activity Monitoring**: System activity logging and alert generation for proactive monitoring
34+
- **Error Handling**: Comprehensive error handling with graceful fallbacks and user-friendly messages
35+
- **Enhanced Installation Process**: Updated admin control panel deployment script
36+
- **API Setup**: Automatic API endpoint configuration with proper routing
37+
- **Permission Management**: Secure file permissions and ownership configuration
38+
- **Feature Detection**: Dynamic feature availability based on installed components (e.g., Adminer availability)
39+
- **Nginx Integration**: Added nginx configuration snippets for optimal performance and security
40+
- **Security Enhancements**: Implemented robust security measures for the admin panel
41+
- **Access Control**: Restricted access to sensitive files and directories
42+
- **Security Headers**: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and Referrer-Policy
43+
- **Input Validation**: Server-side validation for all API endpoints
44+
- **Error Sanitization**: Prevents information disclosure through error messages
45+
- **Performance Optimizations**: Optimized dashboard for fast loading and smooth operation
46+
- **Asset Caching**: Proper cache headers for static assets with versioning support
47+
- **Compressed Delivery**: Gzip compression for text-based resources
48+
- **Lazy Loading**: Progressive loading of dashboard components to improve perceived performance
49+
- **Efficient API Design**: Optimized API endpoints to minimize server load and response times
50+
- **Documentation**: Comprehensive documentation for the new dashboard
51+
- **Feature Overview**: Complete feature documentation with usage examples
52+
- **API Documentation**: Detailed API endpoint documentation for future enhancements
53+
- **Installation Guide**: Step-by-step setup and configuration instructions
54+
- **Future Roadmap**: Planned enhancements including authentication, WebSocket integration, and advanced monitoring
55+
56+
### 🔧 NEW ENGINESCRIPT COMMAND
57+
- **Added es.sites Command**: New EngineScript alias to list all WordPress sites installed on the server
58+
- **Site Discovery**: Automatically discovers all WordPress installations in `/var/www/sites/*/html`
59+
- **Status Checking**: Tests HTTPS/HTTP connectivity for each site with color-coded status indicators
60+
- **Formatted Output**: Clean table format showing domain, document root, and online status
61+
- **WordPress Validation**: Verifies actual WordPress installations by checking for `wp-config.php`
62+
- **Configuration Status**: Shows whether sites are configured for automated tasks (backups, maintenance)
63+
- **Command Integration**: Integrates with existing EngineScript alias system and help documentation
64+
- **Error Handling**: Graceful handling of missing directories and inaccessible sites
65+
- **Usage Instructions**: Provides helpful commands for further site management
66+
67+
### 🛡️ SECURITY & AUTOMATION IMPROVEMENTS
68+
- **Frontend Dashboard Security**: Completed comprehensive security audit and hardening of the JavaScript dashboard
69+
- **Input Validation & Sanitization**: Implemented strict client-side input validation with parameter whitelisting
70+
- Added validation for page names, log types, time ranges, and tool names against predefined whitelists
71+
- Comprehensive input sanitization removing HTML special characters, JavaScript protocols, and dangerous patterns
72+
- Length limits implemented (1000 chars for general input, 50KB for log content)
73+
- **XSS Prevention**: Complete protection against Cross-Site Scripting attacks
74+
- Replaced unsafe `innerHTML` usage with secure `textContent` and `createElement()` methods
75+
- All dynamic content created using DOM manipulation instead of HTML string injection
76+
- API response data sanitized before display with comprehensive content filtering
77+
- Eliminated inline event handlers and prevented `eval()` usage
78+
- **URL & Navigation Security**: Secure handling of external URLs and navigation
79+
- Domain validation with regex patterns before opening external links
80+
- `window.open()` enhanced with `noopener,noreferrer` security flags
81+
- Dangerous protocols (`javascript:`, `data:`, `vbscript:`) filtered and removed
82+
- Frame protection implemented to prevent embedding in malicious frames
83+
- **Data Handling Security**: Secure processing of all API responses and user data
84+
- Strict type validation for all data objects received from API
85+
- Safe URL handling with domain validation before creating clickable links
86+
- Proper memory management with cleanup of charts and event listeners
87+
- Secure error handling without information disclosure
88+
- **Production Security Features**: Enhanced security for production environments
89+
- Console access disabled in production environments to prevent debugging
90+
- Error message sanitization to prevent sensitive information disclosure
91+
- Resource validation before loading external dependencies
92+
- Secure initialization and cleanup procedures
93+
- **Enhanced Security Documentation**: Updated comprehensive security documentation covering both frontend and backend
94+
- **Frontend Security Guide**: Detailed documentation of all JavaScript security measures
95+
- **Security Architecture**: Defense-in-depth approach with multiple security layers
96+
- **Testing Procedures**: Comprehensive security testing checklists for both frontend and backend
97+
- **Incident Response**: Updated emergency response procedures for security incidents
98+
- **Monitoring Integration**: Enhanced security monitoring and logging procedures
99+
9100
### 🔧 CODE QUALITY
10101
- **CI/CD Workflow Enhancement**: Comprehensively improved the GitHub Actions software-version-check workflow
11102
- **Robust Error Handling**: Added comprehensive error handling for all GitHub API calls to prevent "null" version values
@@ -379,3 +470,59 @@ Each entry is dated to show when changes were implemented. For questions about a
379470
- EUID is explicitly set to 0 in CI environment to bypass root checks
380471
- Enhanced debugging shows exact point of failure when scripts hang
381472
- Timeout failures now provide detailed log output for debugging
473+
474+
---
475+
476+
## 2025-07-01 - Security Update
477+
478+
### � DEPENDENCY MANAGEMENT
479+
- **Frontend Dependency Tracking**: Added Chart.js and Font Awesome to the automated software version checker
480+
- **Chart.js**: Now automatically monitored for updates (currently v4.5.0)
481+
- **Font Awesome**: Now automatically monitored for updates (currently v6.7.2)
482+
- **Version Variables**: Added `CHARTJS_VER` and `FONTAWESOME_VER` to `enginescript-variables.txt`
483+
- **Dynamic Substitution**: Admin control panel installation script now substitutes versions automatically
484+
- **GitHub Actions Integration**: Extended software-version-check.yml workflow to monitor frontend dependencies
485+
- **README Documentation**: Added Chart.js and Font Awesome to the software versions table
486+
487+
### �🔒 COMPREHENSIVE SECURITY HARDENING
488+
- **Frontend Dashboard Security**: Completed comprehensive security audit and hardening of the JavaScript dashboard
489+
- **Input Validation & Sanitization**: Implemented strict client-side input validation with parameter whitelisting
490+
- Added validation for page names, log types, time ranges, and tool names against predefined whitelists
491+
- Comprehensive input sanitization removing HTML special characters, JavaScript protocols, and dangerous patterns
492+
- Length limits implemented (1000 chars for general input, 50KB for log content)
493+
- **XSS Prevention**: Complete protection against Cross-Site Scripting attacks
494+
- Replaced unsafe `innerHTML` usage with secure `textContent` and `createElement()` methods
495+
- All dynamic content created using DOM manipulation instead of HTML string injection
496+
- API response data sanitized before display with comprehensive content filtering
497+
- Eliminated inline event handlers and prevented `eval()` usage
498+
- **URL & Navigation Security**: Secure handling of external URLs and navigation
499+
- Domain validation with regex patterns before opening external links
500+
- `window.open()` enhanced with `noopener,noreferrer` security flags
501+
- Dangerous protocols (`javascript:`, `data:`, `vbscript:`) filtered and removed
502+
- Frame protection implemented to prevent embedding in malicious frames
503+
- **Data Handling Security**: Secure processing of all API responses and user data
504+
- Strict type validation for all data objects received from API
505+
- Safe URL handling with domain validation before creating clickable links
506+
- Proper memory management with cleanup of charts and event listeners
507+
- Secure error handling without information disclosure
508+
- **Production Security Features**: Enhanced security for production environments
509+
- Console access disabled in production environments to prevent debugging
510+
- Error message sanitization to prevent sensitive information disclosure
511+
- Resource validation before loading external dependencies
512+
- Secure initialization and cleanup procedures
513+
- **Enhanced Security Documentation**: Updated comprehensive security documentation covering both frontend and backend
514+
- **Frontend Security Guide**: Detailed documentation of all JavaScript security measures
515+
- **Security Architecture**: Defense-in-depth approach with multiple security layers
516+
- **Testing Procedures**: Comprehensive security testing checklists for both frontend and backend
517+
- **Incident Response**: Updated emergency response procedures for security incidents
518+
- **Monitoring Integration**: Enhanced security monitoring and logging procedures
519+
520+
### 🛡️ BACKEND API SECURITY (Previously Implemented)
521+
- **Complete API Security Audit**: Comprehensive security review and hardening of PHP API backend
522+
- **Input Validation**: Strict validation and sanitization of all API inputs
523+
- **Command Injection Prevention**: Eliminated shell command vulnerabilities
524+
- **Path Traversal Protection**: Prevented directory traversal attacks
525+
- **Rate Limiting**: Implemented rate limiting with IP-based tracking
526+
- **Security Headers**: Added comprehensive security headers for all responses
527+
- **Error Handling**: Secure error handling without information disclosure
528+
- **Logging**: Comprehensive security event logging and monitoring

‎README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ Want to support EngineScript? [Sponsor this project](https://github.com/sponsors
153153
|**`es.menu`** |EngineScript menu |
154154
|**`es.permissions`** |Resets the permissions of all files in the WordPress directory *(server-wide)* |
155155
|**`es.restart`** |Restart Nginx and PHP |
156+
|**`es.sites`** |Lists all WordPress sites installed on the server with status information |
156157
|**`es.update`** |Update EngineScript |
157158
|**`es.variables`** |Opens the variable file in Nano. This file resets when EngineScript is updated |
158159

@@ -187,6 +188,11 @@ Want to support EngineScript? [Sponsor this project](https://github.com/sponsors
187188
|PHPMYADMIN|5.2.2|https://www.phpmyadmin.net/downloads/ |
188189
||
189190
||
191+
|**Admin Control Panel**|
192+
|Chart.js|4.5.0|https://github.com/chartjs/Chart.js |
193+
|Font Awesome|6.7.2|https://github.com/FortAwesome/Font-Awesome |
194+
||
195+
||
190196
|**Object Cache**|
191197
|REDIS|Latest|https://redis.io/ |
192198
||
@@ -232,6 +238,5 @@ Want to support EngineScript? [Sponsor this project](https://github.com/sponsors
232238
|LIBURING|2.9|https://github.com/axboe/liburing |
233239
|MYSQLTUNER|Latest|https://github.com/major/MySQLTuner-perl |
234240
|ZLIB|1.3.1|https://github.com/madler/zlib |
235-
|Admin Control Panel Template|-|https://github.com/bhjoco/onepage-medium |
236241

237242
----------

‎config/var/www/admin/control-panel/README.md‎

Lines changed: 41 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,47 @@
1-
# onepager-medium
1+
# EngineScript Admin Dashboard
22

3-
Live Preview: https://op.1lp.org/medium
3+
This directory contains the modern admin dashboard for EngineScript server management.
44

5-
Simple (only HTML & CSS), responsive one-pager for small businesses. Minimalist, clean design for longer content.
5+
## Files
66

7-
It's possible to display smaller image galleries, lists, tables, but also to insert a YouTube/Vimeo video or a Google/Wufoo form.
7+
- `index.html` - Main dashboard HTML file with modern, responsive design
8+
- `dashboard.css` - Modern CSS styling with dark theme and smooth animations
9+
- `dashboard.js` - Interactive JavaScript for real-time dashboard functionality
10+
- `favicon.png` - Dashboard favicon (simple placeholder)
811

9-
The template comes with a navigation bar (removable), facilitating jumping between sections (e.g., introduction, services, references, gallery, etc.). However, keep in mind that everything appears on one page, there are no subpages, so let's keep the wording concise.
12+
## Features
1013

11-
It could be ideal for small, individual entrepreneurs who want to quickly and succinctly present their activities to potential clients, but it can also function as an online resume.
14+
- **Responsive Design**: Works on desktop, tablet, and mobile devices
15+
- **Real-time Monitoring**: Live server statistics and service status
16+
- **Interactive Charts**: Performance monitoring with Chart.js
17+
- **Multi-page Dashboard**: Overview, Sites, System, Security, Backups, Logs, and Tools
18+
- **Service Management**: Monitor Nginx, PHP, MariaDB, and Redis
19+
- **WordPress Site Management**: View and manage WordPress installations
20+
- **Security Monitoring**: SSL certificates, firewall, and malware scanning
21+
- **Log Viewer**: Real-time log viewing with filtering
22+
- **Admin Tools**: Quick access to phpMyAdmin, PHPinfo, and other tools
1223

13-
Created by József Balázs-Hegedűs (www.balazshegedus.com).
14-
First published on www.egylapon.hu in 2023.
15-
Made public in 16.04.2024.
24+
## API Integration
25+
26+
The dashboard is designed to work with RESTful API endpoints for real-time data:
27+
28+
- `/api/system/*` - System information and statistics
29+
- `/api/sites/*` - WordPress site management
30+
- `/api/security/*` - Security status and alerts
31+
- `/api/backups/*` - Backup status and management
32+
- `/api/logs/*` - Log file access
33+
- `/api/services/*` - Service status monitoring
34+
35+
## Future Enhancements
36+
37+
- Real backend API implementation
38+
- User authentication and role-based access
39+
- WebSocket connections for real-time updates
40+
- Advanced monitoring and alerting
41+
- Site deployment and management tools
42+
- Automated backup scheduling
43+
- Security scanning and hardening tools
44+
45+
## Installation
46+
47+
The dashboard is automatically deployed by the EngineScript installation process to `/var/www/admin/enginescript/`.

0 commit comments

Comments
 (0)