. Uses
* setSecurityHeadersAllowDifferentPorts() to relax the default same-
* origin frame restriction so the iframe can target a non-80 port on
* the same host.
*
* No file edits, no privileged calls — pure UI wrapper.
*/
require_once($_SERVER['DOCUMENT_ROOT'].'/config/security_headers.php');
require_once($_SERVER['DOCUMENT_ROOT'].'/config/banner_warnings.inc');
setSecurityHeadersAllowDifferentPorts();
// Layer 2 of the default-password protection — see config/banner_warnings.inc.
// MUST run BEFORE any output so header('Location: ...') works.
pistar_warnings_enforce_redirect();
// Load the language support
require_once('../config/language.php');
// Load the Pi-Star Release file
$pistarReleaseConfig = '/etc/pistar-release';
$configPistarRelease = array();
$configPistarRelease = parse_ini_file($pistarReleaseConfig, true);
// Load the Version Info
require_once('../config/version.php');
if (file_exists('/etc/default/shellinabox')) {
$getPortCommand = "grep -m 1 'SHELLINABOX_PORT=' /etc/default/shellinabox | awk -F '=' '/SHELLINABOX_PORT=/ {print $2}'";
$shellPort = exec($getPortCommand);
}
// HTTP_HOST is client-controllable (any HTTP client can send any
// `Host:` header). Echoing it raw into HTML attributes — as the
// iframe `src` and the anchor `href` below do — gives a passing
// attacker a reflected XSS surface: a request with a crafted Host
// header would render an iframe pointing at attacker-controlled
// content inside this page.
//
// Two-layer defence:
// 1. Strip everything that isn't a hostname character. The set
// `[a-zA-Z0-9.\-\[\]:]` covers DNS names, IPv4 dotted-quad,
// IPv6 bracketed literals, and the optional `:port` suffix.
// Anything else (CRLF, `<`, `"`, `'`, semicolons, spaces,
// parens, slashes) is dropped — the regex is what closes
// the XSS / response-splitting class.
// 2. htmlspecialchars on top, so even if the regex were
// relaxed in the future the value still can't break out
// of the `"…"` HTML attribute it lands in.
$shellHost = preg_replace(
'/[^a-zA-Z0-9.\-\[\]:]/',
'',
isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : ''
);
if ($shellHost === '') {
// Pathological case: HTTP_HOST contained nothing usable. Fall
// back to the LAN IP that nginx listens on rather than emitting
// a broken iframe `src=":port"`.
$shellHost = 'localhost';
}
$shellHostHtml = htmlspecialchars($shellHost, ENT_QUOTES, 'UTF-8');
$shellPortHtml = htmlspecialchars((string)(isset($shellPort) ? $shellPort : ''), ENT_QUOTES, 'UTF-8');
// Sanity Check that this file has been opened correctly
if ($_SERVER["PHP_SELF"] == "/admin/expert/ssh_access.php") {
?>
Pi-Star - <?php echo $lang['digital_voice']." ".$lang['dashboard']." - SSH";?>