Merge 9b1b174e52 into bf7031eabd

Allow more than one module on peer links

.gitignore

@@ -2,3 +2,4 @@
 src/xlxd
 ambed/ambed
 ambedtest/ambedtest
+.DS_Store

dashboard/changes.txt

@@ -1,169 +0,0 @@
-xlx db v2.4.1
-
-you can now hide the liveircddb menu button, if you are running your db in https.
-
-- "config.inc.php
-- "index.php"
-
-xlx db v2.4.0
-
-- "config.inc.php"
-- "index.php"
-- "js"
-- "layout.css"
-
-xlx db v2.3.9
-
-redesign for the callinghome.php
-
-- "config.inc.php"
-- "index.php"
-- "functions.php"
-
-xlx db v2.3.8
-
-add support for network traffic statistics via vnstat.
-
-- "config.inc.php"
-- "index.php"
-- "functions.php"
-
-add traffic.php
-
-xlx db v2.3.7
-
-add background color change on active page.
-
-- "config.inc.php"
-- "layout.css"
-- "index.php"
-
-xlx db v2.3.6
-
-add xlx reflector version to calling home.
-
-- "config.inc.php"
-- "class.reflector.php"
-
-xlx db v2.3.5
-
-now the page refresh is now suspended until you leave the filte fields.
-
-- "index.php"
-- "users.php"
-- "config.inc.php"
-
-xlx db v2.3.4
-
-add filter function to the dashboard. It can be enabled or disabled via the config.inc.php
-
-- "index.php"
-- "users.php"
-- "config.inc.php"	$PageOptions['UserPage']['ShowFilter'] added
-- "layout.css"
-
-xlx db v2.3.3
-
-now displays always the correct module for the last heard station.
-db v2.3.3 requires xlxd v1.4.1
-
-- "class.station.php"
-- "class.reflector.php"
-- "users.php"
-
-xlx db v2.3.2
-
-add random id for nodes, to show the correct linked module for multiple nodes with
-the same call signe linked to different modules.
-
-- "class.node.php"
-- "class.reflector.php"
-- "users.php"	
-
-xlx db v2.3.1
- 
-- "config.inc.php" 	$CallingHome['InterlinkFile'] added
-- "index.php"		added support for interlink visualization
-- "class.reflector.php" callingHome redisigned for interlink visualization	
-- "class.interlink.php"	interlink visualization
-
-xlx db v2.2.3
-
-- "config.inc.php" 	$CallingHome['HashFile'] and $CallingHome['OverrideIPAddress'] added
-- "index.php" 		supports new variables from config.inc.php
-- "class.reflector.php" supports new variables from config.inc.php
-- "country.csv " 	prefixes update	
-
-xlx db v2.2.2
-
-This version is a major release with voluntary self-registration feature build in.
-You need to edit the conf.inc.php to your needs.
-On the first run your personal hash to access the database is place in the server’s /tmp folder.
-Take care to make a backup of this file because this folder is cleaned up after a server reboot.
-
-This version is a major release
-
-xlx db v2.1.6
-
-With this version of the dashboard, serveral parameters
-are free configurable.
-Changes are made in "config.inc.php" 
-
-- "config.inc.php"
-- "index.php"
-- "users.php"
-- "peers.php
-- "repeaters.php"
-
-xlx db v2.1.5
-
-- "class.node.php" added "get prefix
-- "repeaters.php" check for XRF or REF link
-- "country.csv " prefixes update + gate symbol
-- "flags" gate.png 
-
-xlx db v2.1.4
-
-- "class.reflector.php" improved the flag search
-- "country.csv" added serveral prefixes
-- "flags" added Puerto Ricco and Åland Islands
-
-xlx db v2.1.3
-
-- "index.php" added support for multiradio repeaters
-- "users.php" added support for multiradio repeaters
-- "class.reflector.php" added support for multiradio repeaters
-- "repeaters.php" added suffix "D" for "dongle"
-
-xlx db v2.1.2
-
-- "index.php" bugfix to correct an error if XLX name is equal to XLX000
-
-xlx db v2.1.1
-
-- "peers.php" added hyperlink to the peers ip address
-
-xlx db v2.1.0
- 
-- "index.php" 
-   button "Peers" added
-   button "Repeaters/Nodes" shows now the number of connected devices
-   moved XLX name, version and service uptime to improve view on mobile devices
-
- - "class.peer.php" added
- 
- - "peers.php" added 
- 
- - "repeaters.php" limits nodes show up to 100 nodes
- 
-xlx db v2.0.6
-
-- "index.php" now reads out the XLX service uptime and not the server uptime
-- "country.csv" prefixes update
-- "class.reflector.php" flags showing improvements
-- "users.php" limits user show up to 40 users
-- "repeaters.php" limits nodes show up to 40 nodes
-
-xlx db v2.0.5
-
-- "class.reflector.php" extra callsign checking 

dashboard/pgs/class.interlink.php

@@ -1,48 +0,0 @@
-<?php
-
-class Interlink {
-
-   private $ReflectorName;
-   private $ReflectorAddress;
-   private $Modules;
-
-   public function __construct() { 
-      $this->ReflectorName    = null;
-      $this->ReflectorAddress = null;
-      $this->Modules          = null;
-   }
-   
-   public function SetName($RefName)    {      $this->ReflectorName = trim($RefName);        }
-   public function SetAddress($RefAdd)  {      $this->ReflectorAddress = trim($RefAdd);       }
-   public function GetName()            {      return $this->ReflectorName;                   }
-   public function GetAddress()         {      return $this->ReflectorAddress;                }
-   public function GetModules()         {      return $this->Modules;                         }
-   
-   
-   public function AddModule($Module) {
-      $Module = trim($Module);
-      if (strlen($Module) != 1) return false;
-      if (strpos($this->Modules, $Module) === false) {
-         $this->Modules .= $Module;
-      }
-      return true;
-   }
-   
-   public function RemoveModule($Module) {
-      $Module = trim($Module);
-      if (strlen($Module) != 1) return false;
-      if (strpos($this->Modules, $Module) !== false) {
-         $this->Modules = substr($this->Modules, 0, strpos($this->Modules, $Module)-1).substr($this->Modules, strpos($this->Modules, $Module)+1, strlen($this->Modules));
-      }
-      return true;
-   }
-   
-   public function HasModuleEnabled($Module) {
-      if (strlen($Module) != 1) return false;
-      return (strpos($this->Modules, $Module) !== false);
-   }
-   
-}
-      
-   
-   

dashboard/pgs/class.node.php

@@ -1,55 +0,0 @@
-<?php
-
-class Node {
-
-   private $Callsign;
-   private $IP;
-   private $LinkedModule;
-   private $Protocol;
-   private $ConnectTime;
-   private $LastHeardTime;
-   private $Suffix;
-   private $Prefix;
-   private $RandomID;
-
-   public function __construct($Callsign, $IP, $LinkedModule, $Protocol, $ConnectTime, $LastHeardTime, $RandomID) {
-
-      $this->IP            = $IP;
-
-      $this->Protocol      = $Protocol;
-      $this->ConnectTime   = ParseTime($ConnectTime);
-      $this->LastHeardTime = ParseTime($LastHeardTime);
-   
-      $this->FullCallsign  = trim(str_replace("   ", "-", $Callsign));
-      $this->FullCallsign  = str_replace("  ", "-", $this->FullCallsign);
-      $this->FullCallsign  = str_replace(" ", "-", $this->FullCallsign); 
-      
-      if (strpos($Callsign, " ") !== false) {
-         $this->Callsign      = trim(substr($Callsign, 0, strpos($Callsign, " ")));
-         $this->Suffix        = trim(substr($Callsign, strpos($Callsign, " "), strlen($Callsign)));
-         $this->Prefix        = strtoupper(trim(substr($Callsign, 0, 3)));
-      }
-      else {
-         $this->Callsign      = trim($Callsign);
-         $this->Suffix        = "";
-         $this->Prefix        = "";
-      }
-
-      $this->LinkedModule     = trim($LinkedModule);
-      $this->RandomID         = $RandomID;
-   }
-
-   public function GetFullCallsign()         { return $this->FullCallsign;   }
-   public function GetCallsign()             { return $this->Callsign;       }
-   public function GetIP()                   { return $this->IP;             }
-   public function GetLinkedModule()         { return $this->LinkedModule;   }
-   public function GetProtocol()             { return $this->Protocol;       }
-   public function GetConnectTime()          { return $this->ConnectTime;    }
-   public function GetLastHeardTime()        { return $this->LastHeardTime;  }
-   public function GetSuffix()               { return $this->Suffix;         }
-   public function GetPrefix()               { return $this->Prefix;         }
-   public function GetRandomID()             { return $this->RandomID;       }
-   
-}
-
-?>

dashboard/pgs/class.parsexml.php

@@ -1,29 +0,0 @@
-<?php
-
-class ParseXML {
-
-   public function __construct() {
-      return true;
-   }
-
-   public function GetElement($InputString, $ElementName) {
-      if (strpos($InputString, "<".$ElementName.">") === false) return false;
-      if (strpos($InputString, "</".$ElementName.">") === false) return false;
-
-      $Element = substr($InputString, strpos($InputString, "<".$ElementName.">")+strlen($ElementName)+2, strpos($InputString, "</".$ElementName.">")-strpos($InputString, "<".$ElementName.">")-strlen($ElementName)-2);
-      return $Element;
-
-   }
-
-   public function GetAllElements($InputString, $ElementName) {
-      $Elements = array();
-      while (strpos($InputString, $ElementName) !== false) {
-          $Elements[] = $this->GetElement($InputString, $ElementName);
-          $InputString = substr($InputString, strpos($InputString, "</".$ElementName.">")+strlen($ElementName)+3, strlen($InputString));
-      }
-      return $Elements;
-   }
-
-}
-
-?>

dashboard/pgs/class.peer.php

@@ -1,32 +0,0 @@
-<?php
-
-class Peer {
-   
-   private $Callsign;
-   private $IP;
-   private $LinkedModule;
-   private $Protocol;
-   private $ConnectTime;
-   private $LastHeardTime;
-   
-   public function __construct($Callsign, $IP, $LinkedModule, $Protocol, $ConnectTime, $LastHeardTime) {
-      
-      $this->IP            = $IP;
-      $this->Protocol      = $Protocol;
-      $this->ConnectTime   = ParseTime($ConnectTime);
-      $this->LastHeardTime = ParseTime($LastHeardTime);
-      $this->Callsign      = trim($Callsign);      
-      $this->LinkedModule  = trim($LinkedModule);
-   }
-   
-
-   public function GetCallsign()             { return $this->Callsign;       }
-   public function GetIP()                   { return $this->IP;             }
-   public function GetLinkedModule()         { return $this->LinkedModule;   }
-   public function GetProtocol()             { return $this->Protocol;       }
-   public function GetConnectTime()          { return $this->ConnectTime;    }
-   public function GetLastHeardTime()        { return $this->LastHeardTime;  }
-   
-}
-
-?>

dashboard/pgs/class.station.php

@@ -1,40 +0,0 @@
-<?php
-
-class Station {
-   
-   private $Callsign;
-   private $Via;
-   private $LastHeardTime;
-   private $Suffix;
-   private $CallsignOnly;
-   private $Peer;
-   private $OnModule;
-      
-   public function __construct($Callsign, $Via, $Peer, $LastHeardTime, $OnModule) {
-      $this->Callsign      = trim($Callsign);
-      $this->Via           = trim($Via);
-      $this->Peer          = trim($Peer);
-      $this->LastHeardTime = ParseTime($LastHeardTime);
-      if (strpos($Callsign, " / ") !== false) {
-         $this->Suffix = trim(substr($Callsign, strpos($Callsign, " / ")+3, strlen($Callsign)));
-      }
-      else {
-         $this->Suffix = "";
-      }
-      
-      $tmp = explode(" ", $Callsign);
-      $this->CallsignOnly = $tmp[0];
-      $this->OnModule     = $OnModule;
-   }
- 
-   public function GetCallsign()             { return $this->Callsign;       }
-   public function GetVIA()                  { return $this->Via;            }
-   public function GetPeer()                 { return $this->Peer;           }
-   public function GetLastHeardTime()        { return $this->LastHeardTime;  }
-   public function GetSuffix()               { return $this->Suffix;         }
-   public function GetCallsignOnly()         { return $this->CallsignOnly;   }
-   public function GetModule()               { return $this->OnModule;       }
-   
-}
-
-?>

dashboard1/changes.txt

@@ -0,0 +1,260 @@
+xlx db v2.4.3
+
+SECURITY UPDATE - All files updated to fix vulnerabilities
+
+This release addresses multiple security vulnerabilities including XSS (Cross-Site Scripting), 
+command injection, path traversal, and SSRF (Server-Side Request Forgery) attacks.
+
+Files Changed and Security Fixes:
+
+- "functions.php"
+  * Added sanitize_output() and sanitize_attribute() helper functions for XSS prevention
+  * Added validate_callsign(), validate_module(), validate_protocol() input validation functions
+  * Replaced exec() call in GetSystemUptime() with secure file reading from /proc/uptime
+  * Added input validation and shell argument escaping to VNStatGetData()
+  * Added array bounds checking to ParseTime() to prevent errors on malformed input
+
+- "class.interlink.php"
+  * Added input validation to SetName() - validates reflector name format
+  * Added input validation to SetAddress() - validates IP addresses and hostnames
+  * Added input validation to AddModule(), RemoveModule(), and HasModuleEnabled()
+
+- "class.node.php"
+  * Added input validation in constructor for all parameters
+  * IP addresses validated with filter_var()
+  * Protocol validated against whitelist
+  * Callsign format validated with regex
+  * LinkedModule validated as single A-Z letter
+
+- "class.parsexml.php"
+  * Added element name sanitization to prevent XML injection
+
+- "class.peer.php"
+  * Added input validation in constructor for all parameters
+  * Same validation as class.node.php for consistency
+
+- "class.reflector.php"
+  * Added path traversal prevention to SetXMLFile(), SetPIDFile(), and SetFlagFile()
+  * Added SSRF protection to CallHome() - blocks internal/private IP addresses
+  * Added validation to ReadInterlinkFile() to prevent path traversal
+  * Added XML entity encoding to PrepareInterlinkXML() and PrepareReflectorXML()
+  * Added URL validation to SetCallingHome()
+  * Added missing InterlinkCount(), GetInterlink(), and IsInterlinked() methods
+
+- "class.station.php"
+  * Added input validation in constructor for all parameters
+  * Callsign format validation
+  * Module validation
+
+- "modules.php"
+  * All output wrapped with sanitize_output() to prevent XSS
+
+- "peers.php"
+  * All peer data output sanitized with sanitize_output() and sanitize_attribute()
+  * URL and callsign outputs properly escaped
+
+- "reflectors.php"
+  * All XML element data sanitized before output
+  * Dashboard URLs and reflector names properly escaped
+
+- "repeaters.php"
+  * Added input validation for filter parameters
+  * All node/repeater data sanitized before output
+  * Flag images and URLs properly escaped
+  * IP addresses sanitized
+
+- "traffic.php"
+  * Added strict whitelist validation for interface parameter
+  * Interface names validated against configured list only
+
+- "users.php"
+  * Added input validation for filter parameters
+  * All station/user data sanitized before output
+  * Callsigns, suffixes, and module names properly escaped
+
+- "index.php"
+  * Added secure session configuration (HttpOnly, SameSite, Secure flags)
+  * Added security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy)
+  * Added whitelist validation for 'show' parameter
+  * Added validation for 'do' and 'callhome' parameters
+  * All configuration values sanitized before output to HTML
+  * JavaScript injection prevented in page refresh code
+  * All meta tags properly escaped
+
+Security Vulnerabilities Fixed:
+- XSS (Cross-Site Scripting) - All user input and XML data now properly escaped
+- Command Injection - Removed unsafe exec() calls, added shell argument escaping
+- Path Traversal - File paths validated and restricted to expected directories
+- SSRF (Server-Side Request Forgery) - CallHome validates URLs and blocks internal IPs
+- Session Hijacking - Added HttpOnly, SameSite, and Secure cookie flags
+- XML Injection - Element names sanitized, content stripped of tags
+
+xlx db v2.4.1
+
+you can now hide the liveircddb menu button, if you are running your db in https.
+
+- "config.inc.php
+- "index.php"
+
+xlx db v2.4.0
+
+- "config.inc.php"
+- "index.php"
+- "js"
+- "layout.css"
+
+xlx db v2.3.9
+
+redesign for the callinghome.php
+
+- "config.inc.php"
+- "index.php"
+- "functions.php"
+
+xlx db v2.3.8
+
+add support for network traffic statistics via vnstat.
+
+- "config.inc.php"
+- "index.php"
+- "functions.php"
+
+add traffic.php
+
+xlx db v2.3.7
+
+add background color change on active page.
+
+- "config.inc.php"
+- "layout.css"
+- "index.php"
+
+xlx db v2.3.6
+
+add xlx reflector version to calling home.
+
+- "config.inc.php"
+- "class.reflector.php"
+
+xlx db v2.3.5
+
+now the page refresh is now suspended until you leave the filte fields.
+
+- "index.php"
+- "users.php"
+- "config.inc.php"
+
+xlx db v2.3.4
+
+add filter function to the dashboard. It can be enabled or disabled via the config.inc.php
+
+- "index.php"
+- "users.php"
+- "config.inc.php"	$PageOptions['UserPage']['ShowFilter'] added
+- "layout.css"
+
+xlx db v2.3.3
+
+now displays always the correct module for the last heard station.
+db v2.3.3 requires xlxd v1.4.1
+
+- "class.station.php"
+- "class.reflector.php"
+- "users.php"
+
+xlx db v2.3.2
+
+add random id for nodes, to show the correct linked module for multiple nodes with
+the same call signe linked to different modules.
+
+- "class.node.php"
+- "class.reflector.php"
+- "users.php"	
+
+xlx db v2.3.1
+ 
+- "config.inc.php" 	$CallingHome['InterlinkFile'] added
+- "index.php"		added support for interlink visualization
+- "class.reflector.php" callingHome redisigned for interlink visualization	
+- "class.interlink.php"	interlink visualization
+
+xlx db v2.2.3
+
+- "config.inc.php" 	$CallingHome['HashFile'] and $CallingHome['OverrideIPAddress'] added
+- "index.php" 		supports new variables from config.inc.php
+- "class.reflector.php" supports new variables from config.inc.php
+- "country.csv " 	prefixes update	
+
+xlx db v2.2.2
+
+This version is a major release with voluntary self-registration feature build in.
+You need to edit the conf.inc.php to your needs.
+On the first run your personal hash to access the database is place in the server’s /tmp folder.
+Take care to make a backup of this file because this folder is cleaned up after a server reboot.
+
+This version is a major release
+
+xlx db v2.1.6
+
+With this version of the dashboard, serveral parameters
+are free configurable.
+Changes are made in "config.inc.php" 
+
+- "config.inc.php"
+- "index.php"
+- "users.php"
+- "peers.php
+- "repeaters.php"
+
+xlx db v2.1.5
+
+- "class.node.php" added "get prefix
+- "repeaters.php" check for XRF or REF link
+- "country.csv " prefixes update + gate symbol
+- "flags" gate.png 
+
+xlx db v2.1.4
+
+- "class.reflector.php" improved the flag search
+- "country.csv" added serveral prefixes
+- "flags" added Puerto Ricco and Åland Islands
+
+xlx db v2.1.3
+
+- "index.php" added support for multiradio repeaters
+- "users.php" added support for multiradio repeaters
+- "class.reflector.php" added support for multiradio repeaters
+- "repeaters.php" added suffix "D" for "dongle"
+
+xlx db v2.1.2
+
+- "index.php" bugfix to correct an error if XLX name is equal to XLX000
+
+xlx db v2.1.1
+
+- "peers.php" added hyperlink to the peers ip address
+
+xlx db v2.1.0
+ 
+- "index.php" 
+   button "Peers" added
+   button "Repeaters/Nodes" shows now the number of connected devices
+   moved XLX name, version and service uptime to improve view on mobile devices
+
+ - "class.peer.php" added
+ 
+ - "peers.php" added 
+ 
+ - "repeaters.php" limits nodes show up to 100 nodes
+ 
+xlx db v2.0.6
+
+- "index.php" now reads out the XLX service uptime and not the server uptime
+- "country.csv" prefixes update
+- "class.reflector.php" flags showing improvements
+- "users.php" limits user show up to 40 users
+- "repeaters.php" limits nodes show up to 40 nodes
+
+xlx db v2.0.5
+
+- "class.reflector.php" extra callsign checking