CDN/cdn-star
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

main

Browse Source
This commit is contained in:
yuancheng
2026-07-19 18:27:27 +08:00
parent fe4b286ce1
commit 0febcf69f4
170 changed files with 19490 additions and 11878 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/expert/modem_fw_upgrade.php
+42 -123
View File
@@ -1,31 +1,4 @@
<?php
/**
* Modem firmware upgrade runner.
*
* Calls `sudo /usr/local/sbin/pistar-modemupgrade list` to enumerate
* supported modem variants, then `sudo /usr/local/sbin/pistar-
* modemupgrade <variant>` to flash the selected one. Output streams
* to /var/log/pi-star/pi-star_modemflash.log; tailed via AJAX.
*
* The selected variant is run through escapeshellarg() before being
* passed to the upgrade script (defence-in-depth — the picklist is
* already constrained to script-reported names).
*/
require_once($_SERVER['DOCUMENT_ROOT'].'/config/security_headers.php');
require_once($_SERVER['DOCUMENT_ROOT'].'/config/csrf.php');
require_once($_SERVER['DOCUMENT_ROOT'].'/config/banner_warnings.inc');
setSecurityHeaders();
// CSRF protection — see config/csrf.php for the full rationale.
// Must run BEFORE any output: bootstraps the session on GET (so
// Set-Cookie ships) and rejects forged POSTs cleanly with 403
// before any state change (sed-i, fopen+fwrite, sudo cp, etc.).
csrf_verify();
// Layer 2 of the default-password protection — see config/banner_warnings.inc.
// MUST run BEFORE any output so header('Location: ...') works.
pistar_warnings_enforce_redirect();
// Load the language support
require_once('../config/language.php');
// Load the Pi-Star Release file
@@ -42,61 +15,29 @@ setlocale(LC_ALL, "LC_CTYPE=en_GB.UTF-8;LC_NUMERIC=C;LC_TIME=C;LC_COLLATE=C;LC_M
if ($_SERVER["PHP_SELF"] == "/admin/expert/modem_fw_upgrade.php") {
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (isset($_POST['modem'])) {
// Whitelist-validate against the canonical modem list that
// pistar-modemupgrade itself reports. The script is the
// authoritative source of "what modem variants this device
// knows how to flash" — POSTed values that don't appear in
// that list are silently dropped (the operator just sees no
// flash happen). escapeshellarg() below is still defence-
// in-depth at the shell layer; this is the application-layer
// gate that stops the script from being invoked with
// attacker-controlled args at all. Mirrors the mmdvmcal
// command whitelist in admin/calibration.php.
$validModems = array_filter(array_map('trim',
explode("\n", (string)shell_exec('sudo /usr/local/sbin/pistar-modemupgrade list'))
));
if (in_array($_POST['modem'], $validModems, true)) {
$selectedOption = $_POST['modem'];
} else {
error_log('Pi-Star modem_fw_upgrade.php: rejected modem=' . substr((string)$_POST['modem'], 0, 64));
}
}
if (isset($_POST['modem'])) {
$selectedOption = $_POST['modem'];
}
}
if (!isset($_GET['ajax'])) {
// truncate creates+clears the log file in one synchronous call —
// see admin/update.php for the full rationale.
system('sudo truncate -s 0 /var/log/pi-star/pi-star_modemflash.log');
// No `NP=1` env-var prefix: the path-scoped sudoers refuses
// env-var pass-through without a SETENV: tag, so `sudo NP=1
// pistar-modemupgrade …` was rejected outright with "you are
// not allowed to set the following environment variables: NP"
// and the flash silently never started. The wrapper now
// auto-detects non-interactive mode via `[ -t 0 ]` (it's
// backgrounded here with no controlling terminal), so the
// explicit env var is no longer needed.
if (isset($selectedOption)) { system('sudo /usr/local/sbin/pistar-modemupgrade ' . escapeshellarg($selectedOption) . ' > /dev/null 2>&1 &'); }
system('sudo touch /var/log/pi-star/pi-star_modemflash.log > /dev/null 2>&1 &');
system('sudo echo "" > /var/log/pi-star/pi-star_modemflash.log > /dev/null 2>&1 &');
if (isset($selectedOption)) { system('sudo NP=1 /usr/local/sbin/pistar-modemupgrade ' . escapeshellarg($selectedOption) . ' > /dev/null 2>&1 &'); }
}
// passed sanity chk.
header('Cache-Control: no-cache');
// csrf_verify() at the top of the file already started the
// session via csrf_session_start(). Calling session_start() a
// second time emits a PHP Notice on PHP 8.x ("Ignoring
// session_start() because a session is already active") that
// gets logged to nginx error.log on every page load. The
// existing $_SESSION['update_offset'] log-tail logic below
// works unchanged against the already-active session.
session_start();
if (!isset($_GET['ajax'])) {
if (file_exists('/var/log/pi-star/pi-star_modemflash.log')) {
$_SESSION['update_offset'] = filesize('/var/log/pi-star/pi-star_modemflash.log');
} else {
$_SESSION['update_offset'] = 0;
if (file_exists('/var/log/pi-star/pi-star_modemflash.log')) {
$_SESSION['update_offset'] = filesize('/var/log/pi-star/pi-star_modemflash.log');
} else {
$_SESSION['update_offset'] = 0;
}
}
if (isset($_GET['ajax'])) {
if (!file_exists('/var/log/pi-star/pi-star_modemflash.log')) {
exit();
@@ -113,10 +54,10 @@ if ($_SERVER["PHP_SELF"] == "/admin/expert/modem_fw_upgrade.php") {
else {
fseek($handle, 0, SEEK_END);
$_SESSION['update_offset'] = ftell($handle);
}
}
exit();
}
// Get the firmware version
if (file_exists('/usr/local/bin/firmware/version.txt')) {
$versionData = parse_ini_file('/usr/local/bin/firmware/version.txt', true);
@@ -140,32 +81,30 @@ if ($_SERVER["PHP_SELF"] == "/admin/expert/modem_fw_upgrade.php") {
<meta name="language" content="English" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<meta name="Author" content="Andrew Taylor (MW0MWZ)" />
<meta name="Description" content="Pi-Star Update" />
<meta name="KeyWords" content="Pi-Star" />
<meta name="Description" content="CDN Update" />
<meta name="KeyWords" content="CDN" />
<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
<meta http-equiv="pragma" content="no-cache" />
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon" />
<meta http-equiv="Expires" content="0" />
<title>Pi-Star - <?php echo $lang['digital_voice']." ".$lang['dashboard']." - Modem FW ".$lang['update'];?></title>
<title>CDN - <?php echo $lang['digital_voice']." ".$lang['dashboard']." - Modem FW ".$lang['update'];?></title>
<link rel="stylesheet" type="text/css" href="../css/pistar-css.php" />
<script type="text/javascript" src="/jquery.min.js"></script>
<script type="text/javascript" src="/jquery-timing.min.js"></script>
<script type="text/javascript">
function disableSubmitButtons()
{
function disableSubmitButtons() {
var inputs = document.getElementsByTagName('input');
for (var i = 0; i < inputs.length; i++) {
if (inputs[i].type === 'button') {
inputs[i].disabled = true;
inputs[i].value = 'Please Wait...';
inputs[i].value = 'Please Wait...';
}
}
}
function submitform()
{
disableSubmitButtons();
document.getElementById("up_fw").submit();
function submitform() {
disableSubmitButtons();
document.getElementById("up_fw").submit();
}
$(function() {
@@ -183,26 +122,20 @@ if ($_SERVER["PHP_SELF"] == "/admin/expert/modem_fw_upgrade.php") {
</script>
</head>
<body>
<?php pistar_warnings_render(); ?>
<div class="container">
<?php include './header-menu.inc'; ?>
<div class="contentwide">
<table width="100%">
<h2>Modem Firmware Upgrade Utility</h2>
<?php if (empty($_POST['modem'])) { ?>
<tr><th>Modem Firmware Upgrade Utility</th></tr>
<tr><td>
<br />
<h2>Modem Firmware Upgrade Utility</h2>
<p>This tool will attempt to upgrade your selected modem to the latest version available firmware version:<br />
<?php echo $fw_ver_msg; ?></p>
<p>When ready, select your modem type below and click, "Upgrade Modem". Do not interrupt the process or<br />
navigate away from the page while the process is running.</p>
<p><strong>Please understand what you are doing, as well as the risks associated with flashing your modem.</strong></p>
<p><em>(IMPORTANT: Please note, we are not firmware developers, and we offer no support for firmware.<br />
We provide utilities to update the firmware. For firmware support, you will need to utilise other<br />
support resources from the firmware developers/maintainers or the web.)</em></p>
</td></tr>
<tr><td>
<div class="settings-card">
<p>This tool will attempt to upgrade your selected modem to the latest version available firmware version:<br />
<?php echo $fw_ver_msg; ?></p>
<p>When ready, select your modem type below and click, "Upgrade Modem". Do not interrupt the process or<br />
navigate away from the page while the process is running.</p>
<p><strong>Please understand what you are doing, as well as the risks associated with flashing your modem.</strong></p>
<p><em>(IMPORTANT: Please note, we are not firmware developers, and we offer no support for firmware.<br />
We provide utilities to update the firmware. For firmware support, you will need to utilise other<br />
support resources from the firmware developers/maintainers or the web.)</em></p>
<?php
$friendlyNames = [
@@ -224,7 +157,6 @@ if ($_SERVER["PHP_SELF"] == "/admin/expert/modem_fw_upgrade.php") {
'hs_hat_generic_duplex' => 'MMDVM_HS_GENERIC_DUPLEX (14.7456MHz TCXO) GPIO',
'hs_hat_generic_duplex-usb' => 'MMDVM_HS_GENERIC_DUPLEX (14.7456MHz TCXO) USB',
'hs_hat_nano_hotspot' => 'Nano_hotSPOT by BI7JTA (14.7456MHz TCXO) GPIO',
'hs_hat_nano_hotspot-duplex' => 'Nano_hotSPOT Dual by VR2VYE & BI7JTA (14.7456MHz TCXO) GPIO',
'dvmega_gpio' => 'DV-Mega Raspberry Pi Hat (Single or Dual Band) GPIO',
'dvmega_usb_uno' => 'DV-Mega Arduino Uno Shield USB (ttyUSB0)',
'dvmega_usb_mega' => 'DV-Mega Arduino Mega Shield USB (ttyUSB0)',
@@ -249,15 +181,14 @@ if ($_SERVER["PHP_SELF"] == "/admin/expert/modem_fw_upgrade.php") {
// Create the select element
echo '<p><form method="post" id="up_fw">';
echo csrf_field_html();
echo '<label for="modem">Select Modem:</label>';
echo '<select id="modem" name="modem">';
echo '<option value="" disabled selected>Please choose device type...</option>';
// Output each option with user-friendly names
foreach ($options as $option) {
$friendlyName = isset($friendlyNames[$option]) ? $friendlyNames[$option] : $option;
echo '<option value="' . htmlspecialchars($option) . '">' . htmlspecialchars($friendlyName) . '</option>';
}
echo '<option value="" disabled selected>Please choose device type...</option>';
// Output each option with user-friendly names
foreach ($options as $option) {
$friendlyName = isset($friendlyNames[$option]) ? $friendlyNames[$option] : $option;
echo '<option value="' . htmlspecialchars($option) . '">' . htmlspecialchars($friendlyName) . '</option>';
}
echo '</select>';
echo '<input type="button" value="Upgrade Modem" onclick="submitform()">';
echo '</form></p>';
@@ -265,33 +196,21 @@ if ($_SERVER["PHP_SELF"] == "/admin/expert/modem_fw_upgrade.php") {
echo '<p>Error executing the command.</p>';
}
?>
</form>
</td></tr>
</table>
</div>
<div class="footer">
Pi-Star / Pi-Star Dashboard, &copy; Andy Taylor (MW0MWZ) 2014-<?php echo date("Y"); ?>.<br />
Modem Flashing Tool &copy; Chip Cuccio (W0CHP) 2020-<?php echo date("Y");?><br />
Need help? Click <a style="color: #ffffff;" href="https://www.facebook.com/groups/pistarusergroup/" target="_new">here for the Support Group</a><br />
Get your copy of Pi-Star from <a style="color: #ffffff;" href="http://www.pistar.uk/downloads/" target="_blank">here</a>.<br />
</div>
</div>
</body>
</html>
<?php } else { ?>
<tr><th>Modem Flash/Upgrade Output</th></tr>
<tr><td align="left"><div id="tail">Starting FW Upgrade, please wait...<br /></div></td></tr>
</table>
<div class="settings-card" style="padding-top:16px;">
<div id="tail">Starting FW Upgrade, please wait...<br /></div>
</div>
<div class="footer">
Pi-Star / Pi-Star Dashboard, &copy; Andy Taylor (MW0MWZ) 2014-<?php echo date("Y"); ?>.<br />
Modem Flashing Tool &copy; Chip Cuccio (W0CHP) 2020-<?php echo date("Y");?><br />
Need help? Click <a style="color: #ffffff;" href="https://www.facebook.com/groups/pistarusergroup/" target="_new">here for the Support Group</a><br />
Get your copy of Pi-Star from <a style="color: #ffffff;" href="http://www.pistar.uk/downloads/" target="_blank">here</a>.<br />
</div>
</div>
</body>
</html>
<?php }
}
?>