Feature/os 261 add support in monitor to create output for panel backport

[SimonFair]

Summary by CodeRabbit

• New Features

  • Added EULA viewer for license file display.
  • Enhanced system monitoring with temperature and health event tracking.

• Bug Fixes

  • Fixed Docker container dropdown UI layering issue.
  • Improved VM countdown message rendering.

• Security

  • Enhanced request authorization with stricter path validation.
  • Improved file upload safety and command handling.

• Documentation

  • Updated README with Unraid OS information.

• Chores

  • Improved language pack installation and removal robustness.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 69eadcb5-06fd-4eb6-93fe-7417cbf7b287

📥 Commits

Reviewing files that changed from the base of the PR and between 982b3c2 and 6b01726.

⛔ Files ignored due to path filters (3)

• emhttp/plugins/unRAIDServer/icons/eula.png is excluded by !**/*.png
• emhttp/plugins/unRAIDServer/icons/license.png is excluded by !**/*.png
• emhttp/plugins/unRAIDServer/images/unRAIDServer.png is excluded by !**/*.png

📒 Files selected for processing (11)

• emhttp/auth-request.php
• emhttp/plugins/dynamix.docker.manager/javascript/docker.js
• emhttp/plugins/dynamix.plugin.manager/scripts/language
• emhttp/plugins/dynamix.vm.manager/VMMachines.page
• emhttp/plugins/dynamix/include/FileUpload.php
• emhttp/plugins/dynamix/include/ToggleState.php
• emhttp/plugins/dynamix/scripts/monitor
• emhttp/plugins/unRAIDServer/EULA.page
• emhttp/plugins/unRAIDServer/README.md
• emhttp/plugins/unRAIDServer/unRAIDServer.plg
• etc/rc.d/rc.docker

Disabled knowledge base sources:

• Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

Walkthrough

This PR consolidates security hardening, new monitoring infrastructure, and the unRAIDServer plugin framework. It refactors authorization and file operations to use canonical paths and validated inputs, adds panelcontrol event payload generation, implements a comprehensive plugin install/remove procedure with version compatibility checks, and includes supporting features like EULA rendering and Docker network gateway fallback.

Changes

Security hardening, panelcontrol monitoring, and unRAIDServer plugin framework

Layer / File(s)	Summary
Request path canonicalization and authorization emhttp/auth-request.php	Auth logic now resolves request URIs to canonical filesystem paths via realpath, verifies containment within trusted docroot, detects unraid-components requests, and validates allowed public assets via strict mapping-based whitelist instead of inlined checks. Removed JSCache.php inclusion.
File operations safety and validation helpers emhttp/plugins/dynamix/include/FileUpload.php, emhttp/plugins/dynamix.plugin.manager/scripts/language	Introduces recursive remove_tree() and valid_language_pack_name() helpers; refactors file save/delete to validate filenames against whitelists and resolve paths via realpath + safe-base prefix checks; replaces shell-based unzip in language pack install with PHP ZipArchive filtering and error-aware cleanup.
Shell command escaping hardening emhttp/plugins/dynamix/include/ToggleState.php	Updates emcmd() to use escapeshellarg() for safer shell argument passing instead of unquoted interpolation.
VM countdown message HTML injection prevention emhttp/plugins/dynamix.vm.manager/VMMachines.page	Builds countdown message as DOM nodes with jQuery, embedding message text via json_encode() instead of raw HTML interpolation to prevent injection.
Panelcontrol monitoring payload generation and persistence emhttp/plugins/dynamix/scripts/monitor	Generates structured panelcontrol events (temperature thresholds, storage health, errors) with severity ranking; builds schema-conforming payload with per-target highest-severity states and summary counts; persists JSON output via temp-file write with change detection.
unRAIDServer plugin installation and removal framework emhttp/plugins/unRAIDServer/unRAIDServer.plg	Defines complete plugin manifest with multi-stage install (unRAID-5 compatibility, ReiserFS blocking, CPU verification, network wait, infozip handling, artifact verification, Unraid Connect API checking) and post-install configuration adjustments (wireguard migration, SSL bundles, bootloader/cron/share configs, legacy artifact cleanup); implements removal with previous-release restoration.
Docker network gateway fallback configuration etc/rc.d/rc.docker	Adds configured_gateway() helper to read network.cfg and derive gateway values for specified interfaces and VLAN segments; provides fallback gateway assignment in docker_network_start when ip route discovery returns empty for IPv4 and IPv6.
Docker container dropdown UI layering emhttp/plugins/dynamix.docker.manager/javascript/docker.js	Adjusts container dropdown stacking by setting high z-index on dropdown element and appending invisible spacer list item for layout/overflow behavior control.
EULA page and documentation updates emhttp/plugins/unRAIDServer/EULA.page, emhttp/plugins/unRAIDServer/README.md	Adds new EULA.page plugin page that reads and Markdown-renders /boot/license.txt for license viewing; updates README.md with Unraid OS credit to Lime Technology, Inc.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• unraid/webgui#2639: Updates the same addDockerContainerContext function to adjust dropdown z-index and layout in docker.js.

Suggested labels

7.3

Poem

🐰 Paths canonicalized, files locked down tight,
Shells now escape, and HTML's made right,
Gateways configured, the plugin takes flight—
Security hardens through each staged checkpoint. ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🔧 PR Test Plugin Available

A test plugin has been generated for this PR that includes the modified files.

Version: 2026.05.28.1124
Build: View Workflow Run

📥 Installation Instructions:

Install via Unraid Web UI:

1. Go to Plugins → Install Plugin
2. Copy and paste this URL:

https://preview.dl.unraid.net/pr-plugins/pr-2653/webgui-pr-2653.plg

3. Click Install

Alternative: Direct Download

• 📦 Download PLG
• 📦 Download TXZ

⚠️ Important Notes:

• Testing only: This plugin is for testing PR changes
• Backup included: Original files are automatically backed up
• Easy removal: Files are restored when plugin is removed
• Conflicts: Remove this plugin before installing production updates
• Post-merge behavior: This preview stays available after merge until preview storage expires or it is manually cleaned up

📝 Modified Files:

Click to expand file list

emhttp/auth-request.php
emhttp/plugins/dynamix.docker.manager/javascript/docker.js
emhttp/plugins/dynamix.plugin.manager/scripts/language
emhttp/plugins/dynamix.vm.manager/VMMachines.page
emhttp/plugins/dynamix/include/FileUpload.php
emhttp/plugins/dynamix/include/ToggleState.php
emhttp/plugins/dynamix/scripts/monitor
emhttp/plugins/unRAIDServer/EULA.page
emhttp/plugins/unRAIDServer/README.md
emhttp/plugins/unRAIDServer/icons/eula.png
emhttp/plugins/unRAIDServer/icons/license.png
emhttp/plugins/unRAIDServer/images/unRAIDServer.png
emhttp/plugins/unRAIDServer/unRAIDServer.plg
etc/rc.d/rc.docker

🔄 To Remove:

Navigate to Plugins → Installed Plugins and remove webgui-pr-2653, or run:

plugin remove webgui-pr-2653

---

_{🤖 This comment is automatically generated and will be updated with each new push to this PR.}