ajax.php

Go to the documentation of this file.

<?php
/*
 * Copyright (c) 2021-2026 Bearsampp
 * License:  GNU General Public License version 3 or later; see LICENSE.txt
 * Author: Bear
 * Website: https://bearsampp.com
 * Github: https://github.com/Bearsampp
 */

$ajaxProcRaw       = isset($_POST['proc']) ? $_POST['proc'] : '';
$ajaxReadOnlyProcs = array(
    'summary',
    'latestversion',
    'apache',
    'mailpit',
    'memcached',
    'mariadb',
    'mysql',
    'nodejs',
    'php',
    'postgresql',
    'xlight',
    'reloadstatus',
);
 
if (in_array($ajaxProcRaw, $ajaxReadOnlyProcs, true)) {
    require_once __DIR__ . '/../../classes/class.log.php';
    Log::startSilentBuffer();
    ob_start();
 
    register_shutdown_function(function () use ($ajaxProcRaw) {
        try {
            $output = ob_get_contents();
            if ($output === false) {
                $output = '';
            }
            $fingerprint = md5($output);
 
            if (!class_exists('Path')) {
                // Bootstrap failed before Path was available -> keep the entries.
                Log::commitSilentBuffer();
 
                return;
            }
            $fingerprintFile = Path::getTmpPath() . '/homepage-ajax-state-' . md5($ajaxProcRaw) . '.md5';
            $stored          = @file_get_contents($fingerprintFile);
 
            if ($stored !== false && trim($stored) === $fingerprint) {
                // Homepage state unchanged -> discard this poll's log entries.
                Log::rollbackSilentBuffer();
            } else {
                // State changed (service started/stopped, version changed, ...) ->
                // write this poll's log entries and remember the new state.
                @file_put_contents($fingerprintFile, $fingerprint, LOCK_EX);
                Log::commitSilentBuffer();
            }
        } catch (Exception $e) {
            // On any failure, commit (write) the entries rather than lose them.
            Log::commitSilentBuffer();
        }
    });
}

include_once __DIR__ . '/../../root.php';

$procMap = [
    'summary'                 => __DIR__ . '/ajax/ajax.summary.php',
    'latestversion'           => __DIR__ . '/ajax/ajax.latestversion.php',
    'apache'                  => __DIR__ . '/ajax/ajax.apache.php',
    'mailpit'                 => __DIR__ . '/ajax/ajax.mailpit.php',
    'memcached'               => __DIR__ . '/ajax/ajax.memcached.php',
    'mariadb'                 => __DIR__ . '/ajax/ajax.mariadb.php',
    'mysql'                   => __DIR__ . '/ajax/ajax.mysql.php',
    'nodejs'                  => __DIR__ . '/ajax/ajax.nodejs.php',
    'php'                     => __DIR__ . '/ajax/ajax.php.php',
    'postgresql'              => __DIR__ . '/ajax/ajax.postgresql.php',
    'xlight'                  => __DIR__ . '/ajax/ajax.xlight.php',
    'quickpick'               => __DIR__ . '/ajax/ajax.quickpick.php',
    'toggleenhancedquickpick' => __DIR__ . '/ajax/ajax.toggle.enhancedquickpick.php',
    'applymoduleconfig'       => __DIR__ . '/ajax/ajax.apply.moduleconfig.php',
    'reloadstatus'            => __DIR__ . '/ajax/ajax.reload.status.php',
    'clearcache'              => __DIR__ . '/ajax/ajax.clearcache.php'
];

$proc = UtilInput::cleanPostVar('proc', 'text');  // Ensure 'proc' is cleaned and read correctly

$csrfProtectedEndpoints = [
    'quickpick',                    // Installs modules
    'toggleenhancedquickpick',      // Changes configuration
    'applymoduleconfig',            // Applies configuration changes
    'clearcache'                    // Clears cache files
];

if (in_array($proc, $csrfProtectedEndpoints, true)) {
    // State-changing endpoints must be reached via POST only
    if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
        http_response_code(405);
        header('Content-Type: application/json');
        header('Cache-Control: no-store');
        echo json_encode(['error' => 'Method not allowed']);
        exit;
    }
 
    Csrf::init();
 
    if (!Csrf::validateRequest()) {
        http_response_code(403);
        header('Content-Type: application/json');
        header('Cache-Control: no-store');
        echo json_encode([
            'error'   => 'CSRF validation failed',
            'message' => 'Invalid or expired security token. Please refresh the page and try again.'
        ]);
        exit;
    }
 
    // Release the session lock so long-running handlers (module downloads /
    // extraction) do not block other requests sharing this session.
    session_write_close();
}

if (isset($procMap[$proc]) && file_exists($procMap[$proc])) {
    include $procMap[$proc];
} else {
    $errorMessage = 'Invalid proc parameter';
    if (!empty($proc)) {
        $errorMessage .= ': "' . htmlspecialchars($proc) . '" is not a valid procedure';
    } else {
        $errorMessage .= ': no procedure was specified';
    }
    echo json_encode(['error' => $errorMessage]);
}