Сборка REDL: панель на PHP 8, капча-тумблер, закрытые уязвимости, установщики в один клик

- панель работает на PHP 8.4 (оригинал под PHP 7.0): elFinder utf8_encode, apache_get_modules, warnings
- капча выключена и управляется из админки (флаг captcha_enable + блок настроек)
- закрыты две SQL-инъекции без авторизации (createAuthLog: пароль из POST и CF-Connecting-IP)
- убрано хранение паролей в открытом виде в authlog, XSS в поле ref
- установщики install-panel.sh и install-node.sh (оригинальный затирал sources.list репозиториями Debian 9)
- современный Dockerfile (оригинальный на debian:stretch больше не собирается)
- планировщик и автозапуск работают без systemd
- брендинг REDL.IO, год 2026, ссылки на redl.io
- документация на русском: ИЗМЕНЕНИЯ, БЕЗОПАСНОСТЬ, ИНСТРУКЦИЯ
This commit is contained in:
2026-07-30 02:00:01 +00:00
commit 6ee2744e3a
492 changed files with 354172 additions and 0 deletions
+103
View File
@@ -0,0 +1,103 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
?>
<?php echo $header ?>
<div class="content d-flex flex-column flex-column-fluid" id="kt_content">
<div class="d-flex flex-column-fluid">
<div class="container">
<div class="row">
<div class="col-xl-12">
<?php foreach($news as $item): ?>
<div class="card card-custom mb-4">
<div class="card-body">
<div class="d-flex align-items-center">
<div class="symbol symbol-45 symbol-light mr-5">
<span class="symbol-label">
<span class="svg-icon svg-icon-lg svg-icon-primary">
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<rect x="0" y="0" width="24" height="24"></rect>
<path d="M8,3 L8,3.5 C8,4.32842712 8.67157288,5 9.5,5 L14.5,5 C15.3284271,5 16,4.32842712 16,3.5 L16,3 L18,3 C19.1045695,3 20,3.8954305 20,5 L20,21 C20,22.1045695 19.1045695,23 18,23 L6,23 C4.8954305,23 4,22.1045695 4,21 L4,5 C4,3.8954305 4.8954305,3 6,3 L8,3 Z" fill="#000000" opacity="0.3"></path>
<path d="M11,2 C11,1.44771525 11.4477153,1 12,1 C12.5522847,1 13,1.44771525 13,2 L14.5,2 C14.7761424,2 15,2.22385763 15,2.5 L15,3.5 C15,3.77614237 14.7761424,4 14.5,4 L9.5,4 C9.22385763,4 9,3.77614237 9,3.5 L9,2.5 C9,2.22385763 9.22385763,2 9.5,2 L11,2 Z" fill="#000000"></path>
<rect fill="#000000" opacity="0.3" x="7" y="10" width="5" height="2" rx="1"></rect>
<rect fill="#000000" opacity="0.3" x="7" y="14" width="9" height="2" rx="1"></rect>
</g>
</svg>
</span>
</span>
</div>
<div class="d-flex flex-column flex-grow-1">
<a href="/news/view/index/<?echo $item['news_id']?>" class="text-dark-75 text-hover-primary mb-1 font-size-lg font-weight-bolder"><?php echo $item['news_title'] ?></a>
<div class="d-flex">
<div class="d-flex align-items-center pr-5" data-toggle="tooltip" title="" data-placement="right" data-original-title="Дата публикации">
<span class="svg-icon svg-icon-md svg-icon-primary pr-1">
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<rect x="0" y="0" width="24" height="24"></rect>
<path d="M12,22 C7.02943725,22 3,17.9705627 3,13 C3,8.02943725 7.02943725,4 12,4 C16.9705627,4 21,8.02943725 21,13 C21,17.9705627 16.9705627,22 12,22 Z" fill="#000000" opacity="0.3"></path>
<path d="M11.9630156,7.5 L12.0475062,7.5 C12.3043819,7.5 12.5194647,7.69464724 12.5450248,7.95024814 L13,12.5 L16.2480695,14.3560397 C16.403857,14.4450611 16.5,14.6107328 16.5,14.7901613 L16.5,15 C16.5,15.2109164 16.3290185,15.3818979 16.1181021,15.3818979 C16.0841582,15.3818979 16.0503659,15.3773725 16.0176181,15.3684413 L11.3986612,14.1087258 C11.1672824,14.0456225 11.0132986,13.8271186 11.0316926,13.5879956 L11.4644883,7.96165175 C11.4845267,7.70115317 11.7017474,7.5 11.9630156,7.5 Z" fill="#000000"></path>
</g>
</svg>
</span>
<span class="text-muted font-weight-bold"><?php echo date("d.m.Y в H:i", strtotime($item['news_date_add'])) ?></span>
</div>
<div class="d-flex align-items-center" data-toggle="tooltip" title="" data-placement="right" data-original-title="Просмотров">
<span class="svg-icon svg-icon-md svg-icon-primary pr-1">
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<rect x="0" y="0" width="24" height="24"></rect>
<path d="M5.5,4 L9.5,4 C10.3284271,4 11,4.67157288 11,5.5 L11,6.5 C11,7.32842712 10.3284271,8 9.5,8 L5.5,8 C4.67157288,8 4,7.32842712 4,6.5 L4,5.5 C4,4.67157288 4.67157288,4 5.5,4 Z M14.5,16 L18.5,16 C19.3284271,16 20,16.6715729 20,17.5 L20,18.5 C20,19.3284271 19.3284271,20 18.5,20 L14.5,20 C13.6715729,20 13,19.3284271 13,18.5 L13,17.5 C13,16.6715729 13.6715729,16 14.5,16 Z" fill="#000000"></path>
<path d="M5.5,10 L9.5,10 C10.3284271,10 11,10.6715729 11,11.5 L11,18.5 C11,19.3284271 10.3284271,20 9.5,20 L5.5,20 C4.67157288,20 4,19.3284271 4,18.5 L4,11.5 C4,10.6715729 4.67157288,10 5.5,10 Z M14.5,4 L18.5,4 C19.3284271,4 20,4.67157288 20,5.5 L20,12.5 C20,13.3284271 19.3284271,14 18.5,14 L14.5,14 C13.6715729,14 13,13.3284271 13,12.5 L13,5.5 C13,4.67157288 13.6715729,4 14.5,4 Z" fill="#000000" opacity="0.3"></path>
</g>
</svg>
</span>
<span class="text-muted font-weight-bold"><?php echo $item['look']?></span>
</div>
</div>
</div>
<div class="dropdown dropdown-inline ml-2" data-toggle="tooltip" title="" data-placement="left" data-original-title="Перейти">
<a href="/news/view/index/<?echo $item['news_id']?>" class="btn btn-hover-light-primary btn-sm btn-icon">
<i class="fa fa-sign-in-alt"></i>
</a>
</div>
</div>
<div class="pt-3">
<p class="text-dark-75 font-size-lg font-weight-normal pt-5 mb-2"><?
$string = nl2br($item['news_text']);
$string = strip_tags($string);
$string = substr($string, 0, 250);
$string = rtrim($string, "!,.-");
$string = substr($string, 0, strrpos($string, ' '));
echo $string."… ";
?></p>
</div>
</div>
</div>
<?php endforeach; ?>
<?php if(empty($news)): ?>
<div class="col-xl-12">
<div class="alert alert-custom alert-light-primary fade show mb-4" role="alert">
<div class="alert-icon">
<i class="flaticon-exclamation"></i>
</div>
<div class="alert-text">К сожалению, на данный момент на хостинге нет новостей.</div>
<div class="alert-close">
<button type="button" class="close" data-dismiss="alert" aria-label="Close">
<span aria-hidden="true">
<i class="ki ki-close"></i>
</span>
</button>
</div>
</div>
</div>
<?php endif; ?>
<?php echo $pagination ?>
</div>
</div>
</div>
</div>
</div>
<?php echo $footer ?>
+150
View File
@@ -0,0 +1,150 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko and Alexander Zemlyanoy (https://vk.com/id00v / https://vk.com/mrsasha082)
*/
?>
<?php echo $header ?>
<div class="content d-flex flex-column flex-column-fluid" id="kt_content">
<div class="d-flex flex-column-fluid">
<div class="container">
<div class="row">
<div class="col-xl-12">
<div class="card card-custom mb-4">
<div class="card-body">
<div class="d-flex align-items-center">
<div class="symbol symbol-45 symbol-light mr-5">
<span class="symbol-label">
<span class="svg-icon svg-icon-lg svg-icon-primary">
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<rect x="0" y="0" width="24" height="24"></rect>
<path d="M8,3 L8,3.5 C8,4.32842712 8.67157288,5 9.5,5 L14.5,5 C15.3284271,5 16,4.32842712 16,3.5 L16,3 L18,3 C19.1045695,3 20,3.8954305 20,5 L20,21 C20,22.1045695 19.1045695,23 18,23 L6,23 C4.8954305,23 4,22.1045695 4,21 L4,5 C4,3.8954305 4.8954305,3 6,3 L8,3 Z" fill="#000000" opacity="0.3"></path>
<path d="M11,2 C11,1.44771525 11.4477153,1 12,1 C12.5522847,1 13,1.44771525 13,2 L14.5,2 C14.7761424,2 15,2.22385763 15,2.5 L15,3.5 C15,3.77614237 14.7761424,4 14.5,4 L9.5,4 C9.22385763,4 9,3.77614237 9,3.5 L9,2.5 C9,2.22385763 9.22385763,2 9.5,2 L11,2 Z" fill="#000000"></path>
<rect fill="#000000" opacity="0.3" x="7" y="10" width="5" height="2" rx="1"></rect>
<rect fill="#000000" opacity="0.3" x="7" y="14" width="9" height="2" rx="1"></rect>
</g>
</svg>
</span>
</span>
</div>
<div class="d-flex flex-column flex-grow-1">
<a href="javascript:;" class="text-dark-75 text-hover-primary mb-1 font-size-lg font-weight-bolder"><?echo $new['news_title']?></a>
<div class="d-flex">
<div class="d-flex align-items-center pr-5" data-toggle="tooltip" title="" data-placement="right" data-original-title="Дата публикации">
<span class="svg-icon svg-icon-md svg-icon-primary pr-1">
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<rect x="0" y="0" width="24" height="24"></rect>
<path d="M12,22 C7.02943725,22 3,17.9705627 3,13 C3,8.02943725 7.02943725,4 12,4 C16.9705627,4 21,8.02943725 21,13 C21,17.9705627 16.9705627,22 12,22 Z" fill="#000000" opacity="0.3"></path>
<path d="M11.9630156,7.5 L12.0475062,7.5 C12.3043819,7.5 12.5194647,7.69464724 12.5450248,7.95024814 L13,12.5 L16.2480695,14.3560397 C16.403857,14.4450611 16.5,14.6107328 16.5,14.7901613 L16.5,15 C16.5,15.2109164 16.3290185,15.3818979 16.1181021,15.3818979 C16.0841582,15.3818979 16.0503659,15.3773725 16.0176181,15.3684413 L11.3986612,14.1087258 C11.1672824,14.0456225 11.0132986,13.8271186 11.0316926,13.5879956 L11.4644883,7.96165175 C11.4845267,7.70115317 11.7017474,7.5 11.9630156,7.5 Z" fill="#000000"></path>
</g>
</svg>
</span>
<span class="text-muted font-weight-bold"><?echo $new['news_date_add']?></span>
</div>
<div class="d-flex align-items-center" data-toggle="tooltip" title="" data-placement="right" data-original-title="Просмотров">
<span class="svg-icon svg-icon-md svg-icon-primary pr-1">
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="24px" height="24px" viewBox="0 0 24 24" version="1.1">
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
<rect x="0" y="0" width="24" height="24"></rect>
<path d="M5.5,4 L9.5,4 C10.3284271,4 11,4.67157288 11,5.5 L11,6.5 C11,7.32842712 10.3284271,8 9.5,8 L5.5,8 C4.67157288,8 4,7.32842712 4,6.5 L4,5.5 C4,4.67157288 4.67157288,4 5.5,4 Z M14.5,16 L18.5,16 C19.3284271,16 20,16.6715729 20,17.5 L20,18.5 C20,19.3284271 19.3284271,20 18.5,20 L14.5,20 C13.6715729,20 13,19.3284271 13,18.5 L13,17.5 C13,16.6715729 13.6715729,16 14.5,16 Z" fill="#000000"></path>
<path d="M5.5,10 L9.5,10 C10.3284271,10 11,10.6715729 11,11.5 L11,18.5 C11,19.3284271 10.3284271,20 9.5,20 L5.5,20 C4.67157288,20 4,19.3284271 4,18.5 L4,11.5 C4,10.6715729 4.67157288,10 5.5,10 Z M14.5,4 L18.5,4 C19.3284271,4 20,4.67157288 20,5.5 L20,12.5 C20,13.3284271 19.3284271,14 18.5,14 L14.5,14 C13.6715729,14 13,13.3284271 13,12.5 L13,5.5 C13,4.67157288 13.6715729,4 14.5,4 Z" fill="#000000" opacity="0.3"></path>
</g>
</svg>
</span>
<span class="text-muted font-weight-bold"><?echo $new['look']?></span>
</div>
</div>
</div>
</div>
<div class="pt-3">
<p class="text-dark-75 font-size-lg font-weight-normal pt-5 mb-2"><?echo nl2br($new['news_text'])?></p>
</div>
</div>
</div>
<form id="sendForm" action="" method="POST">
<div class="card card-custom mb-4">
<div class="card-body">
<div class="d-flex align-items-center">
<div class="symbol symbol-40 mr-5">
<span class="symbol-label">
<img src="<?php echo $url ?><?if($item['user_img']) {echo $item['user_img'];}else{ echo '/application/public/img/user.png';}?>" class="h-75" alt="">
</span>
</div>
<span class="text-muted font-weight-bold font-size-lg">Хочешь оставить свой комментарий?</span>
</div>
<hr>
<div class="input-group">
<input type="text" class="form-control" type="text" id="text" name="text" placeholder="Ваш комментарий...">
<div class="input-group-append">
<button class="btn btn-primary btn-icon" type="submit"><i class="flaticon2-paper-plane"></i></button>
</div>
</div>
</div>
</div>
<?php foreach($messages as $item): ?>
<div class="card card-custom mb-4">
<div class="card-body">
<div class="d-flex align-items-center">
<div class="symbol symbol-50 mr-5">
<span class="symbol-label">
<img src="<?php echo $url ?><?if($item['user_img']) {echo $item['user_img'];}else{ echo '/application/public/img/user.png';}?>" class="h-75" alt="">
</span>
</div>
<div class="d-flex flex-column flex-grow-1">
<a href="javascript:;" class="text-dark-75 text-hover-primary mb-1 font-size-lg font-weight-bolder"><?php if($item['user_firstname']){echo $item['user_firstname'];} else {echo 'Гость';} ?> <?php echo $item['user_lastname'] ?></a>
<span class="text-muted font-weight-bold"><?php echo nl2br($item['news_message']) ?></span>
</div>
<span class="text-muted font-weight-normal font-size-sm"><?php echo date("d.m.Y в H:i", strtotime($item['news_message_date_add'])) ?></span>
</div>
</div>
</div>
<?php endforeach; ?>
<?php if(empty($messages)): ?>
<div class="alert alert-custom alert-light-primary fade show mb-4" role="alert">
<div class="alert-icon">
<i class="flaticon-exclamation"></i>
</div>
<div class="alert-text">К сожалению, на данный момент нет комментариев.</div>
<div class="alert-close">
<button type="button" class="close" data-dismiss="alert" aria-label="Close">
<span aria-hidden="true">
<i class="ki ki-close"></i>
</span>
</button>
</div>
</div>
<?php endif; ?>
</form>
</div>
</div>
</div>
</div>
</div>
<script>
$('#sendForm').ajaxForm({
url: '/news/view/ajax/<?php echo $new['news_id'] ?>',
dataType: 'text',
success: function(data) {
console.log(data);
data = $.parseJSON(data);
switch(data.status) {
case 'error':
toastr.error(data.error);
$('button[type=submit]').prop('disabled', false);
break;
case 'success':
toastr.success(data.success);
$('#text').val('');
setTimeout("reload()", 1500);
ajax_url("/news/view/"+data);
break;
}
},
beforeSubmit: function(arr, $form, options) {
$('button[type=submit]').prop('disabled', true);
}
});
</script>
<?php echo $footer ?>
+153
View File
@@ -0,0 +1,153 @@
<?php
/*
Copyright (c) 2020 HOSTINPL (HOSTING-RUS) https://vk.com/hosting_rus
Developed by Samir Shelenko (https://vk.com/id00v)
*/
?>
<?php echo $header ?>
<div class="kt-container kt-container--fluid kt-grid__item kt-grid__item--fluid" style="margin: 15px 0;">
<div class="kt-portlet">
<div class="kt-portlet__head">
<div class="kt-portlet__head-label">
<h3 class="kt-portlet__head-title">
<?echo $new['news_title']?>
<small><?echo $new['look']?> Просмотров.</small>
</h3>
</div>
<div class="kt-portlet__head-toolbar">
<?echo $new['news_date_add']?>
</div>
</div>
<div class="kt-portlet__body">
<div class="kt-portlet__content">
<p>
<?echo nl2br($new['news_text'])?>
</p>
</div>
</div>
</div>
<form id="sendForm" action="" method="POST">
<div class="kt-portlet">
<div class="kt-portlet__head">
<div class="kt-portlet__head-label">
<h3 class="kt-portlet__head-title">
Оставить комментарий
</h3>
</div>
</div>
<div class="kt-portlet__body">
<div class="media-body">
<textarea class="form-control todo-taskbody-taskdesc" rows="4" name="text" id="text"></textarea>
</div>
<hr>
<button type="submit" class="btn btn-brand m-btn m-btn--air btn-outline btn-block sbold uppercase">Оставить комментарий</button>
</div>
</div>
<div class="kt-portlet kt-portlet--height-fluid">
<div class="kt-portlet__head">
<div class="kt-portlet__head-label">
<h3 class="kt-portlet__head-title">Комментарии</h3>
</div>
</div>
<div class="kt-portlet__body">
<div class="kt-widget3">
<?php foreach($messages as $item): ?>
<div class="kt-widget3__item">
<div class="kt-widget3__header">
<div class="kt-widget3__user-img">
<img class="kt-widget3__img" src="<?php echo $url ?><?if($item['user_img']) {echo $item['user_img'];}else{ echo '/application/public/img/user.png';}?>" alt="">
</div>
<div class="kt-widget3__info">
<a href="#" class="kt-widget3__username">
<?php if($item['user_firstname']){echo $item['user_firstname'];} else {echo 'Гость';} ?> <?php echo $item['user_lastname'] ?>
</a><br>
<span class="kt-widget3__time"><?php echo date("d.m.Y в H:i", strtotime($item['news_message_date_add'])) ?></span>
</div>
<span class="kt-widget3__status kt-font-info">
<?php if($item['user_access_level'] == 1): ?>
Пользователь
<?php endif; ?>
<?php if($item['user_access_level'] == 2): ?>
Тех.поддержка
<?php endif; ?>
<?php if($item['user_access_level'] == 3): ?>
Администратор
<?php endif; ?>
</span>
</div>
<div class="kt-widget3__body">
<p class="kt-widget3__text"><?php echo nl2br($item['news_message']) ?></p>
</div>
</div>
<?php endforeach; ?>
<?php if(empty($messages)): ?>
<div class="alert alert-danger">
На данный момент нет коментариев.
</div>
<?php endif; ?>
</div>
</div>
</div>
</form>
</div>
<script>
$('#sendForm').ajaxForm({
url: '/news/view/ajax/<?php echo $new['news_id'] ?>',
dataType: 'text',
success: function(data) {
console.log(data);
data = $.parseJSON(data);
switch(data.status) {
case 'error':
toastr.error(data.error);
$('button[type=submit]').prop('disabled', false);
break;
case 'success':
toastr.success(data.success);
$('#text').val('');
setTimeout("reload()", 1500);
ajax_url("/news/view/"+data);
break;
}
},
beforeSubmit: function(arr, $form, options) {
$('button[type=submit]').prop('disabled', true);
}
});</script>
<script type="text/javascript">
$(function(){
$('#form_pr').submit(function(e){
//отменяем стандартное действие при отправке формы
e.preventDefault();
//берем из формы метод передачи данных
var m_method=$(this).attr('method');
//получаем данные, введенные пользователем в формате input1=value1&input2=value2...,то есть в стандартном формате передачи данных формы
var m_data=$(this).serialize();
$.ajax({
type: m_method,
url: '/news/view/ajax/<?php echo $new['news_id'] ?>',
data: m_data,
success: function(data) {
console.log(data);
data = $.parseJSON(data);
switch(data.status) {
case 'error':
toastr.error(data.error);
$('button[type=submit]').prop('disabled', false);
break;
case 'success':
toastr.success(data.success);
$('#text').val('');
setTimeout("reload()", 1500);
break;
}
},
beforeSubmit: function(arr, $form, options) {
$('button[type=submit]').prop('disabled', true);
}
});
});
});
</script>
<?php echo $footer ?>