" link never ""` * (or `unlink`) against the running ircDDBGateway. * * Hit directly via /admin/admin.php (the form action self-posts); * not inline-included by any current parent page. The historical * "Loaded inline by /admin/index.php" docstring claim was stale — * there is no `include 'admin.php'` site in the codebase today. * Reachable only by direct navigation; admin/configure.php * configures the *password* for the same `remotecontrold` daemon * but doesn't issue link/unlink commands. * * Service-status row pgreps for the six daemons (DStarRepeater, * MMDVMHost, ircDDBgateway, timeserver, pistar-watchdog, * pistar-keeper) and renders a green/red dot per service. * * Input validation: preg_match whitelist on Module / RefName / * Letter / Link verb (uppercase A-Z and digits only). That guards * against shell-quote escape but does not substitute for CSRF — * a forged POST with valid-looking values could otherwise trigger * link/unlink under the operator's basic-auth session. csrf_verify() * below closes that gap before any sudo runs. */ require_once($_SERVER['DOCUMENT_ROOT'] . '/config/security_headers.php'); require_once($_SERVER['DOCUMENT_ROOT'] . '/config/csrf.php'); setSecurityHeaders(); // CSRF protection — see config/csrf.php for the full rationale. // Must run BEFORE any output: bootstraps the session on GET (so // Set-Cookie ships and csrf_field() at line ~98 has a token to // emit) and rejects forged POSTs cleanly with 403 before the // `sudo remotecontrold "" link|unlink ...` state-change // in the POST handler runs. csrf_verify(); ?> Service Status

DStarRepeaterDStarRepeater	MMDVMHostDStarRepeater	ircDDBgatewayircDDBgateway	timeservertimeserver	pistar-watchdogpistar-watchdog	pistar-keeperpistar-keeper
"; } else { echo ""; } ?>	"; } else { echo ""; } ?>	"; } else { echo ""; } ?>	"; } else { echo ""; } ?>	"; } else { echo ""; } ?>	"; } else { echo ""; } ?>

Reflector Connector\n"; echo "\n\n\n

Command OutputCommand Output
"; // remotecontrold output is text from the daemon; escape on // display defence-in-depth (the input fields above were // already preg_match-whitelist-validated). echo htmlspecialchars((string)exec($linkCommand), ENT_QUOTES, 'UTF-8'); echo "

\n"; } if (($_POST["Link"] ?? '') == "UNLINK") { echo "Reflector Connector\n"; echo "\n\n\n

Command OutputCommand Output
"; echo htmlspecialchars((string)exec($unlinkCommand), ENT_QUOTES, 'UTF-8'); echo "

\n"; } } unset($_POST); echo ''; else: ?> Reflector Connector

Radio ModuleRadio Module	ReflectorReflector	Link / Un-LinkLink / Un-Link	ActionAction
1) { $ci = 0; } $module = $configs[$param]; $rcall = sprintf("%-7.7s%-1.1s",$MYCALL,$module); $param="repeaterCall" . $i; if(isset($configs[$param])) { $rptrcall=sprintf("%-7.7s%-1.1s",$configs[$param],$module); } else { $rptrcall = $rcall;} print "$rptrcall\n"; } } ?>	".substr($dcsLine, 0, 6)."\n"; } fclose($dcsFile); echo " REF001\n"; while (!feof($dplusFile)) { $dplusLine = fgets($dplusFile); if (strpos($dplusLine, 'REF') !== FALSE && strpos($dplusLine, '#') === FALSE && strpos($dplusLine, 'REF001') === FALSE) echo " ".substr($dplusLine, 0, 6)."\n"; } fclose($dplusFile); while (!feof($dextraFile)) { $dextraLine = fgets($dextraFile); if (strpos($dextraLine, 'XRF') !== FALSE && strpos($dextraLine, '#') === FALSE) echo " ".substr($dextraLine, 0, 6)."\n"; } fclose($dextraFile); ?> A B C D E F G H I J K L M N O P Q R S T U V W X Y Z	Link UnLink

\n"; echo "PiStar-Keeper Logbook\n"; echo "\n"; echo " \n"; echo " \n"; echo " \n"; exec ("tail -n 5 /var/pistar-keeper/pistar-keeper.log", $lines); $counter = 0; foreach ($lines as $line) { echo "\n"; $counter++; } echo "

PiStar-Keeper Log Entries (UTC)PiStar-Keeper Log Entries (UTC)
".$lines[$counter]."

\n"; }