From 10350cbcd83a790a592b15d04e8f4a53b59f5484 Mon Sep 17 00:00:00 2001 From: Myron Blair Date: Sun, 5 Jul 2026 20:13:21 -0500 Subject: [PATCH] Update infrastructure reference: document 2026-07-06 security review and fixes --- .../admin/downloads/INFRASTRUCTURE-REFERENCE.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md b/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md index fb9db59..9cecac9 100644 --- a/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md +++ b/public_html/admin/downloads/INFRASTRUCTURE-REFERENCE.md @@ -496,6 +496,19 @@ See Section 7 for full JARVIS details. **Login:** `myron / Joker1974!!!` **Admin portal:** http://jarvis.orbishosting.com/admin +### Security hardening (2026-07-06 code review) +Full front-end + admin panel review found and fixed 8 issues, 2 of them live critical exposures: +- **INFRASTRUCTURE-REFERENCE.md was publicly downloadable with zero auth** (static nginx path bypassed the admin session check entirely). Fixed: file moved to `/var/www/jarvis-private/INFRASTRUCTURE-REFERENCE.md` (owned `www-data:www-data`, mode 640, NOT under `public_html` so nginx never serves it directly), and the DOCS tab now downloads it via a new authenticated `docs_download` action in `admin/index.php` that gates on the existing `loggedIn()` check and streams the file with `readfile()`. +- **Two full backup copies of the 5000-line admin panel (`index.php.bak2`, `index.php.bak.`) were sitting in `public_html/admin/` and downloadable with no auth**, exposing the entire admin source/attack surface. Relocated to `/root/jarvis-old-backups/` (no secrets were found in them, so no credential rotation was needed). +- `esc()` (the admin panel's JS HTML-escaper) doesn't escape `'`, so it doesn't protect values embedded inside a single-quoted JS string within an `onclick` attribute — HTML-decoding happens before the JS parser sees it. Added a proper `escJs()` helper (backslash + quote + newline escaping, then HTML-escape) and applied it to the Network/Alerts/Intents/Custom-News/Calendar-Feeds edit-modal `onclick` handlers, which were reachable by e.g. any device on the LAN setting a malicious DHCP/mDNS hostname. +- Same class of bug on the front-end dashboard (`assets/js/jarvis-app.js`, `assets/js/panels/jarvis-agents.js`): device names and news article titles/sources were inserted into `innerHTML` completely unescaped — a rogue LAN device or a malicious/compromised news feed could inject script that runs with the logged-in session. Added `escHtml()`/`escJs()` helpers directly in `jarvis-app.js` and applied them to device names, VM names, agent hostnames, and news content. +- `session.cookie_httponly` was **Off** server-wide (PHP default), meaning the actual session cookie — not just the app's own bearer token — was readable via `document.cookie` from any of the above XSS bugs. Fixed at the PHP-FPM level (`/etc/php/8.3/fpm/php.ini`): `session.cookie_httponly = 1`, `session.cookie_samesite = Lax`, `php8.3-fpm` restarted. Verified live: `Set-Cookie` now includes `HttpOnly; SameSite=Lax`. +- `api.php` had `Access-Control-Allow-Origin: *` — tightened to an explicit allow-list of the real JARVIS origin only, with `Access-Control-Allow-Credentials: true` only sent when the origin matches. +- Two admin actions (Arc Reactor restart/setup) called an undefined function `k()` instead of the real JSON responder `j()`, causing a PHP fatal error even though the underlying `systemctl` command still fired. Fixed (verified via direct API test — clean `{"ok":true,...}` response now). +- Calendar feed passwords were stored and returned in plaintext via `cal_feeds_list`'s `SELECT *`. Changed to return a `has_password` boolean instead of the raw password (the edit UI never actually displayed the password back anyway — write-only field, "leave blank to keep"). + +All fixes verified via direct API testing (SSH + curl through the login/action flow) since this doesn't have a staging environment. Pushed to `myronblair/jarvis` master, commit `24bc876`. + ### Architecture (end-to-end) ```