RedlHosting/redl-gamepanel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Сборка REDL: панель на PHP 8, капча-тумблер, закрытые уязвимости, установщики в один клик

Browse Source 
- панель работает на PHP 8.4 (оригинал под PHP 7.0): elFinder utf8_encode, apache_get_modules, warnings
- капча выключена и управляется из админки (флаг captcha_enable + блок настроек)
- закрыты две SQL-инъекции без авторизации (createAuthLog: пароль из POST и CF-Connecting-IP)
- убрано хранение паролей в открытом виде в authlog, XSS в поле ref
- установщики install-panel.sh и install-node.sh (оригинальный затирал sources.list репозиториями Debian 9)
- современный Dockerfile (оригинальный на debian:stretch больше не собирается)
- планировщик и автозапуск работают без systemd
- брендинг REDL.IO, год 2026, ссылки на redl.io
- документация на русском: ИЗМЕНЕНИЯ, БЕЗОПАСНОСТЬ, ИНСТРУКЦИЯ
This commit is contained in:
redl
2026-07-30 02:00:01 +00:00
commit 6ee2744e3a
492 changed files with 354172 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
panel/application/controllers/result/anypay.php
+70
View File
@@ -0,0 +1,70 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class anypayController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
if($this->request->server['REQUEST_METHOD'] == 'POST') {
$errorPOST = $this->validatePOST();
if(!$errorPOST) {
$ammount = $this->request->post['amount'];
$invid = $this->request->post['pay_id'];
$signature = $this->request->post['sign'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
$user = $this->usersModel->getUserById($userid);
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
return "OK$invid\n";
} else {
return "Error: $errorPOST";
}
} else {
return "Error: Invalid request!";
}
}
private function validatePOST() {
$result = null;
$ammount = $this->request->post['amount'];
$invid = $this->request->post['pay_id'];
$signature = $this->request->post['sign'];
$login = $this->config->anypay_login;
$password = $this->config->anypay_password;
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invid))) {
$result = "Invalid invoice!";
}
elseif(strtoupper($signature) != strtoupper(md5("$login:$ammount:$invid:$password"))) {
$result = "Invalid signature!";
}
return $result;
}
}
?>
panel/application/controllers/result/enot.php
+70
View File
@@ -0,0 +1,70 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class enotController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
if($this->request->server['REQUEST_METHOD'] == 'POST') {
$errorPOST = $this->validatePOST();
if(!$errorPOST) {
$ammount = $this->request->post['amount'];
$invid = $this->request->post['merchant_id'];
$signature = $this->request->post['sign_2'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
$user = $this->usersModel->getUserById($userid);
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
return "OK$invid\n";
} else {
return "Error: $errorPOST";
}
} else {
return "Error: Invalid request!";
}
}
private function validatePOST() {
$result = null;
$ammount = $this->request->post['amount'];
$invid = $this->request->post['merchant_id'];
$signature = $this->request->post['sign_2'];
$login = $this->config->enot_login;
$password2 = $this->config->enot_password2;
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invid))) {
$result = "Invalid invoice!";
}
elseif(strtoupper($signature) != strtoupper(md5("$login:$ammount:$password2:$invid"))) {
$result = "Invalid signature!";
}
return $result;
}
}
?>
panel/application/controllers/result/freekassa.php
+69
View File
@@ -0,0 +1,69 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class freekassaController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
if($this->request->server['REQUEST_METHOD'] == 'POST') {
$errorPOST = $this->validatePOST();
if(!$errorPOST) {
$ammount = $this->request->post['OutSum'];
$invid = $this->request->post['InvId'];
$signature = $this->request->post['SignatureValue'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
return "OK$invid\n";
} else {
return "Error: $errorPOST";
}
} else {
return "Error: Invalid request!";
}
}
private function validatePOST() {
$result = null;
$ammount = $this->request->post['OutSum'];
$invid = $this->request->post['InvId'];
$signature = $this->request->post['SignatureValue'];
$password2 = $this->config->fk_password2;
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invid))) {
$result = "Invalid invoice!";
}
elseif(strtoupper($signature) != strtoupper(md5("$ammount:$invid:$password2"))) {
$result = "Invalid signature!";
}
return $result;
}
}
?>
panel/application/controllers/result/litekassa.php
+70
View File
@@ -0,0 +1,70 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class litekassaController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
if($this->request->server['REQUEST_METHOD'] == 'POST') {
$errorPOST = $this->validatePOST();
if(!$errorPOST) {
$ammount = $this->request->post['AMOUNT'];
$invid = $this->request->post['ORDER_ID'];
$signature = $this->request->post['SIGN'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
return "OK$invid\n";
} else {
return "Error: $errorPOST";
}
} else {
return "Error: Invalid request!";
}
}
private function validatePOST() {
$result = null;
$ammount = $this->request->post['AMOUNT'];
$invid = $this->request->post['ORDER_ID'];
$signature = $this->request->post['SIGN'];
$password = $this->config->lk_password;
$login = $this->config->lk_login;
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invid))) {
$result = "Invalid invoice!";
}
elseif(strtoupper($signature) != strtoupper(md5("$login:$ammount:$password:$invid"))) {
$result = "Invalid signature!";
}
return $result;
}
}
?>
panel/application/controllers/result/qiwi.php
+98
View File
@@ -0,0 +1,98 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class qiwiController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
if($this->request->server['REQUEST_METHOD'] == 'POST') {
$errorPOST = $this->validatePOST();
if(!$errorPOST) {
$jsonPaymentData = json_decode(file_get_contents('php://input'), true);
$ammount = $jsonPaymentData['bill']['amount']['value'];
$invid = $jsonPaymentData['bill']['billId'];
$signature = $jsonPaymentData['bill']['siteId'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
$user = $this->usersModel->getUserById($userid);
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
return "OK$invid\n";
} else {
return "Error: $errorPOST";
}
} else {
return "Error: Invalid request!";
}
}
private function checkNotificationSignature($signature, array $notificationBody, $merchantSecret) {
$notificationBody = array_replace_recursive(
[
'bill' => [
'billId' => null,
'amount' => [
'value' => null,
'currency' => null,
],
'siteId' => null,
'status' => ['value' => null],
],
],
$notificationBody
);
$processedNotificationData = [
'billId' => (string) $notificationBody['bill']['billId'],
'amount.value' => number_format(round(floatval($notificationBody['bill']['amount']['value']), 2, PHP_ROUND_HALF_DOWN), 2, '.', ''),
'amount.currency' => (string) $notificationBody['bill']['amount']['currency'],
'siteId' => (string) $notificationBody['bill']['siteId'],
'status' => (string) $notificationBody['bill']['status']['value'],
];
ksort($processedNotificationData);
$processedNotificationDataKeys = join('|', $processedNotificationData);
$hash = hash_hmac('SHA256', $processedNotificationDataKeys, $merchantSecret);
return $hash === $signature;
}
private function validatePOST() {
$result = null;
$jsonPaymentData = json_decode(file_get_contents('php://input'), true);
$invid = $jsonPaymentData['bill']['billId'];
$signature = array_key_exists('HTTP_X_API_SIGNATURE_SHA256', $_SERVER) ? stripslashes($this->request->server['HTTP_X_API_SIGNATURE_SHA256']) : '';
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invid))) {
$result = "Invalid invoice!";
}elseif(!$this->checkNotificationSignature($signature, $jsonPaymentData, $this->config->qiwisecretkey)) {
$result = "Invalid signature!";
}
return $result;
}
}
?>
panel/application/controllers/result/robokassa.php
+69
View File
@@ -0,0 +1,69 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class robokassaController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
if($this->request->server['REQUEST_METHOD'] == 'POST') {
$errorPOST = $this->validatePOST();
if(!$errorPOST) {
$ammount = $this->request->post['OutSum'];
$invid = $this->request->post['InvId'];
$signature = $this->request->post['SignatureValue'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
return "OK$invid\n";
} else {
return "Error: $errorPOST";
}
} else {
return "Error: Invalid request!";
}
}
private function validatePOST() {
$result = null;
$ammount = $this->request->post['OutSum'];
$invid = $this->request->post['InvId'];
$signature = $this->request->post['SignatureValue'];
$password2 = $this->config->rk_password2;
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invid))) {
$result = "Invalid invoice!";
}
elseif(strtoupper($signature) != strtoupper(md5("$ammount:$invid:$password2"))) {
$result = "Invalid signature!";
}
return $result;
}
}
?>
panel/application/controllers/result/unitpay.php
+105
View File
@@ -0,0 +1,105 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class unitpayController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
error_reporting(0);
function md5sign($params, $secretKey) {
ksort($params);
unset($params['sign']);
return md5(join(null, $params).$secretKey);
}
function responseError($message) {
$error = array(
"jsonrpc" => "2.0",
"error" => array(
"code" => -32000,
"message" => $message
),
'id' => 1
);
echo json_encode($error); exit();
}
function responseSuccess($message) {
$success = array(
"jsonrpc" => "2.0",
"result" => array(
"message" => $message
),
'id' => 1
);
echo json_encode($success); exit();
}
$secretKey = $this->config->unitpay_secret;
$method = $_GET['method'];
$params = $_GET['params'];
if ($params['sign'] != md5($params, $secretKey)) {
responseError("Не соответсвие MD5 хешей");
}
switch($method) {
case 'check':
if (!$this->link = @mysqli_connect($this->config->db_hostname, $this->config->db_username, $this->config->db_password, $this->config->database)) {
die('Ошибка: Не удалось соединиться с сервером базы данных!');
}
break;
case 'pay':
if (!$this->link = @mysqli_connect($this->config->db_hostname, $this->config->db_username, $this->config->db_password, $this->config->database)) {
die('Ошибка: Не удалось соединиться с сервером базы данных!');
}
$invid = $_GET['params']['account'];
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invid))) {
responseError("Invalid invoice!");
}
$ammount = $_GET['params']['sum'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
$user = $this->usersModel->getUserById($userid);
if($invoice['invoice_ammount'] == $ammount){
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
}
break;
case 'error':
responseError("Ошибка,{$params['errorMessage']}"); exit;
break;
default:
responseError("Только: check, pay"); exit;
}
responseSuccess("Успех");
}
}
?>
panel/application/controllers/result/yandexkassa.php
+78
View File
@@ -0,0 +1,78 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
class yandexkassaController extends Controller {
public function index() {
$this->load->model('users');
$this->load->model('invoices');
$this->load->model('waste');
if($this->request->server['REQUEST_METHOD'] == 'POST') {
$errorPOST = $this->validatePOST();
if(!$errorPOST) {
$ammount = $this->request->post['amount'];
$invid = $this->request->post['label'];
$invoice = $this->invoicesModel->getInvoiceById($invid);
$userid = $invoice['user_id'];
if($ammount > 50){
$this->usersModel->updateUser($userid, $userData = array('user_promised_pay' => 0));
}
$wasteData = array(
'user_id' => $userid,
'waste_ammount' => $ammount,
'waste_status' => 0,
'waste_usluga' => "Пополнение баланса пользователя",
);
$this->wasteModel->createWaste($wasteData);
$this->usersModel->upUserBalance($userid, $ammount);
$bonus_percent = $this->config->bonus_percent;
$getbonus = ($ammount * (1 + $bonus_percent / 100)) - $ammount;
$this->usersModel->upUserBonuses($userid, $getbonus);
$this->invoicesModel->updateInvoice($invid, array('invoice_status' => 1));
return "OK$invid\n";
} else {
return "Error: $errorPOST";
}
} else {
return "Error: Invalid request!";
}
}
private function validatePOST() {
$result = null;
$ammount = $this->request->post['amount'];
$invoiceid = $this->request->post['label'];
$signature = $this->request->post['sha1_hash'];
$notification_type = $this->request->post['notification_type'];
$operation_id = $this->request->post['operation_id'];
$amount = $this->request->post['amount'];
$currency = $this->request->post['currency'];
$datetime = $this->request->post['datetime'];
$sender = $this->request->post['sender'];
$codepro = $this->request->post['codepro'];
$unaccepted = $this->request->post['unaccepted'];
$password = $this->config->yk_password1;
if(!$this->invoicesModel->getTotalInvoices(array('invoice_id' => (int)$invoiceid))) {
$result = "Invalid invoice!";
}elseif($signature != sha1($notification_type.'&'.$operation_id.'&'.$amount.'&'.$currency.'&'.$datetime.'&'.$sender.'&'.$codepro.'&'.$password.'&'.$invoiceid)) {
$result = "Invalid signature!";
}elseif($codepro === true) {
$result = "Invalid codepro!";
}elseif($unaccepted === true) {
$result = "Invalid unaccepted!";
}
return $result;
}
}
?>