admin
67053335d1
gates / gates (push) Successful in 13m17s
Every catalog app installed, used, backed up, removed keeping data, reinstalled, restored and removed with data on a fresh box from the public ISO (demo-hp VM 9360, Tester4), endpoint-level. Worst: a reinstall's capture rewrites the kept unit so its restore breaks the app (R-1269, P2), the restore still reports success (R-1270, P2), and „use my kept data" loaded another box's future-dated database (R-1271, P2). Drill catalog fixes for the morning list (n8n usage data; OpenGist 256M, proven by a cgroup probe). VM 9360 and LXC 9361 destroyed; hub host Tester4-aa9466 left for the operator. REPORT-catalog-sweep-2026-10-24.md.
29 lines
1.8 KiB
Bash
Executable File
29 lines
1.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# claim.sh BASE DOMAIN CODE_ENV PW_ENV [WRONG] — the household's „A szerver beállítása" page, headless.
|
|
# BASE = https://<box ip>; DOMAIN = the customer domain (Host: felhom.<domain>). CODE_ENV / PW_ENV are the NAMES
|
|
# of env vars holding the setup code and the new dashboard password (run under `sec run`). With WRONG=1 one letter
|
|
# of the code is changed (a household's typo). Prints status codes, the Location and the page's visible message —
|
|
# never a secret. Endpoint-level: the same POST the page's form sends.
|
|
set -euo pipefail
|
|
BASE=$1; DOM=$2; CODE=${!3}; PW=${!4}; WRONG=${5:-0}
|
|
H="Host: felhom.$DOM"; T=$(mktemp -d); chmod 700 "$T"; trap 'rm -rf "$T"' EXIT
|
|
if [ "$WRONG" = 1 ]; then CODE="${CODE:0:2}$( [ "${CODE:2:1}" = q ] && echo w || echo q )${CODE:3}"; fi
|
|
curl -sk -H "$H" -D "$T/h1" -o "$T/b1" "$BASE/claim"
|
|
echo "GET /claim $(head -1 "$T/h1" | tr -d '\r')"
|
|
CK=$(grep -oiE 'felhom_claim_csrf=[^;]+' "$T/h1" | head -1)
|
|
CS=$(grep -oE 'name="_csrf" value="[^"]+"' "$T/b1" | head -1 | sed 's/.*value="//;s/"$//')
|
|
echo "csrf_len ${#CS} cookie_present $([ -n "$CK" ] && echo yes || echo no)"
|
|
curl -sk -H "$H" -H "Cookie: $CK" -D "$T/h2" -o "$T/b2" -X POST \
|
|
--data-urlencode "_csrf=$CS" --data-urlencode "code=$CODE" \
|
|
--data-urlencode "new_password=$PW" --data-urlencode "confirm_password=$PW" "$BASE/claim"
|
|
echo "POST /claim $(head -1 "$T/h2" | tr -d '\r') $(grep -i '^location:' "$T/h2" | tr -d '\r')"
|
|
python3 - "$T/b2" <<'EOF'
|
|
import re, sys, html
|
|
t = open(sys.argv[1], encoding="utf-8", errors="replace").read()
|
|
for cls in ("error", "alert", "flash", "banner", "notice"):
|
|
for m in re.finditer(r'class="[^"]*%s[^"]*"[^>]*>(.*?)</' % cls, t, re.S):
|
|
s = re.sub(r"\s+", " ", html.unescape(re.sub(r"<[^>]+>", " ", m.group(1)))).strip()
|
|
if s:
|
|
print("message:", s[:300])
|
|
EOF
|