diff --git a/CHANGELOG.md b/CHANGELOG.md index 23a48c7..f32b519 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,8 +6,11 @@ All notable changes to Proxmox VE for WHMCS will be documented in this file. https://github.com/The-Network-Crew/Proxmox-VE-for-WHMCS/milestones ### 💅 Polish -- Client Area: Polish the interface numbering -- Client Area: Add ipconfig, onboot & sshkeys +- Client Area: Polish the interface numbering, v4/v6 +- Client Area: Add boot, ipconfig, onboot & sshkeys + +### 🐛 Bug Fix +- noVNC: Cleaner cookie removal; router tidy-up (#167) ## [1.2.17] - 2025-10-19 - _"VNC & Hyperscale!"_ diff --git a/modules/servers/pvewhmcs/novnc_router.php b/modules/servers/pvewhmcs/novnc_router.php index b2e9335..55c88d7 100644 --- a/modules/servers/pvewhmcs/novnc_router.php +++ b/modules/servers/pvewhmcs/novnc_router.php @@ -1,11 +1,11 @@ . */ -// Delete the authentication cookie, if it exists -if (isset($_COOKIE['PVEAuthCookie'])) { - unset($_COOKIE['PVEAuthCookie']); +// --------------------------------------- +// Clear any existing PVEAuthCookie first +// --------------------------------------- +setcookie('PVEAuthCookie', '', [ + 'expires' => time() - 3600, + 'path' => '/', + 'domain' => '', + 'secure' => true, + 'httponly' => false, + 'samesite' => 'None', +]); + +// --------------------------------------- +// Check required GET parameters +// --------------------------------------- +if (!isset($_GET['pveticket'], $_GET['host'], $_GET['path'], $_GET['vncticket'])) { + echo 'Error: Missing required info to route your request. Please try again.'; + exit; } -if (isset($_GET['pveticket']) && isset($_GET['host']) && isset($_GET['path']) && isset($_GET['vncticket'])) { - // Take passed-in variables and re-assign for usage - $pveticket = $_GET['pveticket']; - $vncticket = $_GET['vncticket']; - $host = $_GET['host']; - $path = $_GET['path']; +// --------------------------------------- +// Assign GET parameters +// --------------------------------------- +$pveticket = $_GET['pveticket']; +$vncticket = $_GET['vncticket']; +$host = $_GET['host']; +$path = $_GET['path']; - // Get the requesting hostname/domain from the WHMCS-originated request - $whmcsdomain = parse_url($_SERVER['HTTP_HOST']); - // Now extract just the domain parts we need (FUTURE: capacity/option for multi-part TLDs) - $domainonly = preg_replace("/^(.*?)\.(.*)$/","$2",$whmcsdomain['path']); - // Set the cookie as Proxmox will be expecting it, so it is WHMCS to VNC without further login - setrawcookie('PVEAuthCookie', $pveticket, [ - 'expires' => 0, - 'path' => '/', - 'domain' => $domainonly, - 'secure' => true, - 'httponly' => false, - 'samesite' => 'None', - ]); +// --------------------------------------- +// Determine main domain for cookie +// --------------------------------------- +$hostParts = explode('.', $_SERVER['HTTP_HOST']); +$mainDomain = implode('.', array_slice($hostParts, -2)); // example.com - // Create the final noVNC URL with the re-encoded vncticket - $hostname = gethostbyaddr($host); - $redirect_url = '/modules/servers/pvewhmcs/novnc/vnc.html?autoconnect=true&encrypt=true&host=' . $hostname . '&port=8006&password=' . urlencode($vncticket) . '&path=' . urlencode($path); +// --------------------------------------- +// Set the PVEAuthCookie for Proxmox +// --------------------------------------- +setrawcookie('PVEAuthCookie', $pveticket, [ + 'expires' => 0, + 'path' => '/', + 'domain' => '.' . $mainDomain, + 'secure' => true, + 'httponly' => false, + 'samesite' => 'None', +]); + +// --------------------------------------- +// Build final noVNC URL +// --------------------------------------- +$hostname = gethostbyaddr($host); +$redirect_url = '/modules/servers/pvewhmcs/novnc/vnc.html?autoconnect=true&encrypt=true' + . '&host=' . $hostname + . '&port=8006' + . '&password=' . urlencode($vncticket) + . '&path=' . urlencode($path); + +// --------------------------------------- +// Redirect to noVNC +// --------------------------------------- +header('Location: ' . $redirect_url); +exit; - // Redirect the visitor to noVNC & we're done - header('Location: ' . $redirect_url); - exit; -} else { - // Passed in values not present, exit - echo 'Error: Missing required info to route your request. Please try again.'; - exit; -} ?> \ No newline at end of file