penguinehis/DragonCoreSSH-NewWEB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pam cache fix

Browse Source
This commit is contained in:
penguinehis
2026-07-14 00:41:55 -03:00
parent 492a7f2002
commit 1797c50ea3
4 changed files with 37 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1
View File
@@ -1,3 +1,4 @@
/shell2.exe /shell2.exe
/BOT_PLAN.md /BOT_PLAN.md
/SECURITY_REVIEW.md /SECURITY_REVIEW.md
/DragonCoreSSH-NewWEB.zip
admin/index.html
+13 -13
View File
@@ -16,7 +16,7 @@
setTimeout(function(){document.documentElement.classList.remove("i18n-pending");},2500); setTimeout(function(){document.documentElement.classList.remove("i18n-pending");},2500);
})(); })();
</script> </script>
<link rel="stylesheet" href="assets/app.css?v=20260713sections5"/> <link rel="stylesheet" href="assets/app.css?v=20260714pamfix1"/>
</head> </head>
<body> <body>
<div class="app"> <div class="app">
@@ -1542,17 +1542,17 @@
<!-- app.js was split into ordered modules for maintainability. They are plain <!-- app.js was split into ordered modules for maintainability. They are plain
classic scripts sharing one global scope; `defer` preserves execution order, classic scripts sharing one global scope; `defer` preserves execution order,
so behavior is identical to the old single file. Keep this load order. --> so behavior is identical to the old single file. Keep this load order. -->
<script defer src="assets/js/01-core.js?v=20260713sections5"></script> <script defer src="assets/js/01-core.js?v=20260714pamfix1"></script>
<script defer src="assets/js/02-shell.js?v=20260713sections5"></script> <script defer src="assets/js/02-shell.js?v=20260714pamfix1"></script>
<script defer src="assets/js/03-ssh-users.js?v=20260713sections5"></script> <script defer src="assets/js/03-ssh-users.js?v=20260714pamfix1"></script>
<script defer src="assets/js/04-xray.js?v=20260713sections5"></script> <script defer src="assets/js/04-xray.js?v=20260714pamfix1"></script>
<script defer src="assets/js/05-resellers.js?v=20260713sections5"></script> <script defer src="assets/js/05-resellers.js?v=20260714pamfix1"></script>
<script defer src="assets/js/06-servers.js?v=20260713sections5"></script> <script defer src="assets/js/06-servers.js?v=20260714pamfix1"></script>
<script defer src="assets/js/07-stats-logs.js?v=20260713sections5"></script> <script defer src="assets/js/07-stats-logs.js?v=20260714pamfix1"></script>
<script defer src="assets/js/08-server-config.js?v=20260713sections5"></script> <script defer src="assets/js/08-server-config.js?v=20260714pamfix1"></script>
<script defer src="assets/js/09-xray-wizard.js?v=20260713sections5"></script> <script defer src="assets/js/09-xray-wizard.js?v=20260714pamfix1"></script>
<script defer src="assets/js/11-update-status.js?v=20260713sections5"></script> <script defer src="assets/js/11-update-status.js?v=20260714pamfix1"></script>
<script defer src="assets/js/12-bot.js?v=20260713sections5"></script> <script defer src="assets/js/12-bot.js?v=20260714pamfix1"></script>
<script defer src="assets/js/10-boot.js?v=20260713sections5"></script> <script defer src="assets/js/10-boot.js?v=20260714pamfix1"></script>
</body> </body>
</html> </html>
security_http.go
+9 -2
View File
@@ -20,8 +20,15 @@ func securePanelHandler(next http.Handler) http.Handler {
w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()") w.Header().Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()")
w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
w.Header().Set("Content-Security-Policy", "default-src 'self'; base-uri 'none'; frame-ancestors 'none'; object-src 'none'; form-action 'self'; img-src 'self' data:; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'") w.Header().Set("Content-Security-Policy", "default-src 'self'; base-uri 'none'; frame-ancestors 'none'; object-src 'none'; form-action 'self'; img-src 'self' data:; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'")
if strings.HasPrefix(r.URL.Path, "/api/") || r.URL.Path == "/" || r.URL.Path == "/index.html" { // The panel is deployed in-place by update.sh. Do not let browsers or
w.Header().Set("Cache-Control", "no-store") // reverse proxies keep an older JavaScript bundle after an update, because
// stale form serializers can silently omit newly-added config fields.
if strings.HasPrefix(r.URL.Path, "/api/") ||
r.URL.Path == "/" || r.URL.Path == "/index.html" ||
strings.HasPrefix(r.URL.Path, "/assets/") {
w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate")
w.Header().Set("Pragma", "no-cache")
w.Header().Set("Expires", "0")
} }
if r.Body != nil && r.Method != http.MethodGet && r.Method != http.MethodHead { if r.Body != nil && r.Method != http.MethodGet && r.Method != http.MethodHead {
r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestBody) r.Body = http.MaxBytesReader(w, r.Body, maxAdminRequestBody)
server_config_api.go
+14
View File
@@ -87,6 +87,17 @@ func serverConfigPost(w http.ResponseWriter, r *http.Request) {
http.Error(w, "config exceeds 512 KiB", http.StatusRequestEntityTooLarge) http.Error(w, "config exceeds 512 KiB", http.StatusRequestEntityTooLarge)
return return
} }
// Keep track of optional field presence separately from its boolean value.
// This protects a newly-added setting from being reset by a stale cached
// panel bundle that does not know how to send the field yet.
var fieldPresence struct {
PAMAuthEnabled *bool `json:"pam_auth_enabled"`
}
if err := json.Unmarshal(body, &fieldPresence); err != nil {
http.Error(w, "invalid JSON: "+err.Error(), http.StatusBadRequest)
return
}
var newCfg Config var newCfg Config
if err := json.Unmarshal(body, &newCfg); err != nil { if err := json.Unmarshal(body, &newCfg); err != nil {
http.Error(w, "invalid JSON: "+err.Error(), http.StatusBadRequest) http.Error(w, "invalid JSON: "+err.Error(), http.StatusBadRequest)
@@ -104,6 +115,9 @@ func serverConfigPost(w http.ResponseWriter, r *http.Request) {
globalCfgMu.RLock() globalCfgMu.RLock()
if globalCfg != nil { if globalCfg != nil {
newCfg.Users = globalCfg.Users newCfg.Users = globalCfg.Users
if fieldPresence.PAMAuthEnabled == nil {
newCfg.PAMAuthEnabled = globalCfg.PAMAuthEnabled
}
} }
globalCfgMu.RUnlock() globalCfgMu.RUnlock()