linux-dash

I've used this in the past: https://github.com/afaqurk/linux-dash Doesn't offer logs, but shouldn't be too difficult to implement. Edit: See demo here - http://linuxdash.afaqtariq.com/demo.html

It looks like a cool project and the interface pretty well done too. Good job. Is there something particular you want to specifically mention that has happened since you last shared the app five months ago? - https://news.ycombinator.com/item?id=7125153 Anyways, as this is shared here on a developer oriented forum, it would be fitting to speak of the actual implementation too. Taking quick look at the source, it seems to have some security issues ranging from XSS to potential CE. These seem to arise from common bad practices. I would advice going through the source code and making sure all values you echo as JSON are properly encoded and that you don't use anything as-is in a shell command. Few examples: - https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702... - https://github.com/afaqurk/linux-dash/blob/7bd5dcb637f815702... - ht

I was responding to the parent's unwillingness to audit the code, not so much about technical issues with PHP. The biggest security issue that I've noticed with PHP is more cultural: Developers are far more likely to write ad-hoc pages with subtle security issues than use well-tested frameworks and libraries because it seems easier. I would never expect to see Ruby or Python code that generates a JSON array like this [0], but I'm not at all surprised when I see it in PHP. It's too easy and tempting to do the wrong thing. [0]: https://github.com/afaqurk/linux-dash/blob/master/sh/users.p...

> WRONG. Because you have to use mysql_REAL_escape_string. Using mysql_real_escape_string is almost a sign you're doing something wrong. You should be using prepared statements with PDO or mysqli. > The point is that I can't audit (and would rather not waste my time doing so) this PHP code. I wasn't going to bother, but this post is pretty high up on the front page. There's some XSS issues with the JSON output, the Content-Type header isn't set to 'application/json' so PHP decides to set it to 'text/html'. Now anyone that controls ipecho.net[0] or can execute commands as any user on the server[1] can XSS users of the panel. If you'd like to confirm, go to /sh/ps.php and notice where the page breaks due to strings in the JSON being interpreted as HTML. [0] https://github.com/afaqurk/linux-dash/blob/master/sh/ip.php#... [1] https://github.c

There's no installation, just git clone and move to your www directory. $ git clone https://github.com/afaqurk/linux-dash.git $ mv linux-dash/ /var/www/

This is a bit off topic but I created a tool a little while back for my specific (very basic) needs: https://github.com/afaqurk/linux-dash Demo here: http://afaq.dreamhosters.com/linux-dash/ Easily extensible if anyone wants to use it.