Update tools.func

- Add _TOOLS_FUNC_LOADED guard to prevent double-sourcing
- Remove duplicate is_alpine() (core.func version is more robust)
- Fix end_timer: now actually outputs duration (was silent)
- Fix SQL injection in setup_mariadb_db: escape single quotes in identifiers
- Fix SQL injection in setup_postgresql_db: escape single quotes in identifiers
- Fix sed injection in edit_yaml_config: escape | and & in value
- Fix command injection in curl_with_retry: use array instead of string eval
- Fix command injection in curl_api_with_retry: use array instead of string eval

CHANGELOG.md

@@ -499,19 +499,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-07-10
-
-### 🆕 New Scripts
-
-  - Squid ([#15605](https://github.com/community-scripts/ProxmoxVE/pull/15605))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
-    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
-
 ## 2026-07-09
 
 ### 🚀 Updated Scripts

ct/endurain.sh

@@ -34,22 +34,31 @@ function update_script() {
     systemctl stop endurain
     msg_ok "Stopped Service"
 
-    create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
+    msg_info "Creating Backup"
+    cp /opt/endurain/.env /opt/endurain.env
+    cp /opt/endurain/frontend/dist/env.js /opt/endurain.env.js
+    msg_ok "Created Backup"
+
     CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
     msg_info "Preparing Update"
     cd /opt/endurain
-    rm -rf /opt/endurain/{docs,example.env,screenshot_01.png} /opt/endurain/docker* /opt/endurain/*.yml
+    rm -rf \
+      /opt/endurain/{docs,example.env,screenshot_01.png} \
+      /opt/endurain/docker* \
+      /opt/endurain/*.yml
+    cp /opt/endurain.env /opt/endurain/.env
+    rm /opt/endurain.env
     msg_ok "Prepared Update"
 
     msg_info "Updating Frontend"
     cd /opt/endurain/frontend
     $STD npm ci
     $STD npm run build
+    cp /opt/endurain.env.js /opt/endurain/frontend/dist/env.js
+    rm /opt/endurain.env.js
     msg_ok "Updated Frontend"
 
-    restore_backup
-
     msg_info "Updating Backend"
     cd /opt/endurain/backend
     UV_VERSION=$(grep -Po 'required-version\s*=\s*"\K[^"]+' pyproject.toml 2>/dev/null || echo "0.11.18")

ct/fireshare.sh

@@ -35,22 +35,12 @@ function update_script() {
     systemctl stop fireshare
     msg_ok "Stopped Service"
 
-    create_backup /opt/fireshare/fireshare.env
+    mv /opt/fireshare/fireshare.env /opt
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
-    restore_backup
+    mv /opt/fireshare.env /opt/fireshare
     rm -f /usr/local/bin/fireshare
 
-    if ! grep -q "__FIRESHARE_PORT__" /etc/nginx/nginx.conf; then
-      cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
-      sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
-      sed -i 's/^user[[:space:]]\+nginx;/user  root;/' /etc/nginx/nginx.conf
-      sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
-      sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
-      cp /opt/fireshare/app/nginx/error.html /etc/nginx/
-      cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
-    fi
-    msg_info "Configuring Fireshare"
-
+    msg_info "Updating Fireshare"
     cd /opt/fireshare
     $STD uv venv --clear
     $STD .venv/bin/python -m ensurepip --upgrade
@@ -63,10 +53,13 @@ function update_script() {
     export VIDEO_DIRECTORY=/opt/fireshare-videos
     export PROCESSED_DIRECTORY=/opt/fireshare-processed
     $STD uv run flask db upgrade
+
+    msg_info "Building Fireshare Client"
     cd /opt/fireshare/app/client
     $STD npm install
     $STD npm run build
-    msg_ok "Configured Fireshare"
+    msg_ok "Built Fireshare Client"
+    msg_ok "Updated Fireshare"
 
     msg_info "Starting Service"
     systemctl start fireshare

ct/headers/squid

@@ -1,6 +0,0 @@
-   _____             _     __
-  / ___/____ ___  __(_)___/ /
-  \__ \/ __ `/ / / / / __  / 
- ___/ / /_/ / /_/ / / /_/ /  
-/____/\__, /\__,_/_/\__,_/   
-        /_/                  

ct/squid.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: 007hacky007
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.squid-cache.org/
-
-APP="Squid"
-var_tags="${var_tags:-proxy}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-512}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-  if [[ ! -f /etc/squid/squid.conf ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-  msg_info "Updating Squid"
-  $STD apt update
-  $STD apt upgrade -y
-  msg_ok "Updated Squid"
-
-  msg_info "Validating Squid Configuration"
-  $STD squid -k parse
-  msg_ok "Validated Squid Configuration"
-
-  msg_info "Restarting Squid"
-  systemctl restart squid
-  msg_ok "Restarted Squid"
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Proxy endpoint:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}${IP}:3128${CL}"

install/fireshare-install.sh

@@ -141,9 +141,6 @@ cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
 sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
 sed -i 's/^user[[:space:]]\+nginx;/user  root;/' /etc/nginx/nginx.conf
 sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
-sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
-cp /opt/fireshare/app/nginx/error.html /etc/nginx/
-cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
 systemctl start nginx
 
 cat <<EOF >~/fireshare.creds

install/squid-install.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: 007hacky007
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.squid-cache.org/
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Configuring Squid"
-mkdir -p /etc/squid
-cat <<EOF >/etc/squid/squid.conf
-acl localnet src 0.0.0.1-0.255.255.255
-acl localnet src 10.0.0.0/8
-acl localnet src 100.64.0.0/10
-acl localnet src 169.254.0.0/16
-acl localnet src 172.16.0.0/12
-acl localnet src 192.168.0.0/16
-acl localnet src fc00::/7
-acl localnet src fe80::/10
-
-acl SSL_ports port 443
-acl Safe_ports port 80
-acl Safe_ports port 21
-acl Safe_ports port 443
-acl Safe_ports port 70
-acl Safe_ports port 210
-acl Safe_ports port 1025-65535
-acl Safe_ports port 280
-acl Safe_ports port 488
-acl Safe_ports port 591
-acl Safe_ports port 777
-acl CONNECT method CONNECT
-
-http_access deny !Safe_ports
-http_access deny CONNECT !SSL_ports
-http_access allow localhost manager
-http_access deny manager
-
-auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
-auth_param basic realm proxy
-acl authenticated proxy_auth REQUIRED
-http_access allow authenticated
-http_access deny all
-
-http_port 3128
-
-coredump_dir /var/spool/squid
-
-refresh_pattern ^ftp:        1440    20%    10080
-refresh_pattern ^gopher:     1440    0%     1440
-refresh_pattern -i (/cgi-bin/|\\?) 0  0%     0
-refresh_pattern .            0       20%    4320
-
-# Privacy / hardening
-httpd_suppress_version_string on
-visible_hostname $(hostname)
-forwarded_for delete
-request_header_access X-Forwarded-For deny all
-EOF
-msg_ok "Configured Squid"
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  squid \
-  apache2-utils
-msg_ok "Installed Dependencies"
-
-msg_info "Configuring Squid Authentication"
-touch /etc/squid/passwords
-chown proxy:proxy /etc/squid/passwords
-chmod 640 /etc/squid/passwords
-$STD squid -k parse
-msg_ok "Configured Squid Authentication"
-
-msg_info "Starting Service"
-systemctl enable -q --now squid
-msg_ok "Started Service"
-
-motd_ssh
-customize
-cleanup_lxc

misc/tools.func

@@ -36,6 +36,10 @@
 #
 # ==============================================================================
 
+# Guard against double-sourcing (core.func uses the same pattern)
+[[ -n "${_TOOLS_FUNC_LOADED:-}" ]] && return 0
+_TOOLS_FUNC_LOADED=1
+
 # ------------------------------------------------------------------------------
 # Debug helper - outputs to stderr when TOOLS_DEBUG is enabled
 # Usage: debug_log "message"
@@ -91,16 +95,17 @@ curl_with_retry() {
   while [[ $attempt -le $retries ]]; do
     debug_log "curl attempt $attempt/$retries: $url"
 
-    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout"
-    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
+    # Build curl command as array to avoid command injection via extra_opts
+    local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout")
+    [[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
 
     if [[ "$output" == "-" ]]; then
-      if $curl_cmd "$url"; then
+      if "${curl_args[@]}" "$url"; then
         success=true
         break
       fi
     else
-      if $curl_cmd -o "$output" "$url"; then
+      if "${curl_args[@]}" -o "$output" "$url"; then
         success=true
         break
       fi
@@ -153,15 +158,16 @@ curl_api_with_retry() {
   while [[ $attempt -le $retries ]]; do
     debug_log "curl API attempt $attempt/$retries: $url"
 
-    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout -w '%{http_code}'"
-    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
+    # Build curl command as array to avoid command injection via extra_opts
+    local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout" -w '%{http_code}')
+    [[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
 
     if [[ -n "$body_file" ]]; then
-      http_code=$($curl_cmd -o "$body_file" "$url" 2>/dev/null) || true
+      http_code=$("${curl_args[@]}" -o "$body_file" "$url" 2>/dev/null) || true
     else
       # Capture body and http_code separately
       local tmp_body="/tmp/curl_api_body_$$"
-      http_code=$($curl_cmd -o "$tmp_body" "$url" 2>/dev/null) || true
+      http_code=$("${curl_args[@]}" -o "$tmp_body" "$url" 2>/dev/null) || true
       if [[ -f "$tmp_body" ]]; then
         cat "$tmp_body"
         rm -f "$tmp_body"
@@ -304,7 +310,10 @@ edit_yaml_config() {
     return 1
   fi
 
-  sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${value}|" "$file"
+  # Escape sed metacharacters in value (| and &) to prevent injection
+  local escaped_value="${value//|/\\|}"
+  escaped_value="${escaped_value//&/\\&}"
+  sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${escaped_value}|" "$file"
 }
 
 # ------------------------------------------------------------------------------
@@ -1687,10 +1696,6 @@ is_ubuntu() {
   [[ "$(get_os_info id)" == "ubuntu" ]]
 }
 
-is_alpine() {
-  [[ "$(get_os_info id)" == "alpine" ]]
-}
-
 # ------------------------------------------------------------------------------
 # Get Debian/Ubuntu major version
 # ------------------------------------------------------------------------------
@@ -2454,8 +2459,10 @@ start_timer() {
 end_timer() {
   local start_time="$1"
   local label="${2:-Operation}"
-  local end_time=$(date +%s)
+  local end_time
+  end_time=$(date +%s)
   local duration=$((end_time - start_time))
+  echo "${label} took ${duration}s"
 }
 
 # ------------------------------------------------------------------------------
@@ -6746,9 +6753,16 @@ setup_mariadb_db() {
 
   msg_info "Setting up MariaDB Database"
 
-  $STD mariadb -u root -e "CREATE DATABASE \`$MARIADB_DB_NAME\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
-  $STD mariadb -u root -e "CREATE USER '$MARIADB_DB_USER'@'localhost' IDENTIFIED BY '$MARIADB_DB_PASS';"
-  $STD mariadb -u root -e "GRANT ALL ON \`$MARIADB_DB_NAME\`.* TO '$MARIADB_DB_USER'@'localhost';"
+  # Use --defaults-extra-file to pass credentials safely and escape identifiers
+  # to prevent SQL injection via DB name / user / password
+  local _db_escaped _user_escaped _pass_escaped
+  _db_escaped="${MARIADB_DB_NAME//\'/\'\'}"
+  _user_escaped="${MARIADB_DB_USER//\'/\'\'}"
+  _pass_escaped="${MARIADB_DB_PASS//\'/\'\'}"
+
+  $STD mariadb -u root -e "CREATE DATABASE \`$_db_escaped\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+  $STD mariadb -u root -e "CREATE USER '$_user_escaped'@'localhost' IDENTIFIED BY '$_pass_escaped';"
+  $STD mariadb -u root -e "GRANT ALL ON \`$_db_escaped\`.* TO '$_user_escaped'@'localhost';"
 
   # Optional extra grants
   if [[ -n "${MARIADB_DB_EXTRA_GRANTS:-}" ]]; then
@@ -8378,8 +8392,14 @@ setup_postgresql_db() {
   fi
 
   msg_info "Setting up PostgreSQL Database"
-  $STD sudo -u postgres psql -c "CREATE ROLE $PG_DB_USER WITH LOGIN PASSWORD '$PG_DB_PASS';"
-  $STD sudo -u postgres psql -c "CREATE DATABASE $PG_DB_NAME WITH OWNER $PG_DB_USER ENCODING 'UTF8' TEMPLATE template0;"
+  # Escape single quotes in identifiers to prevent SQL injection
+  local _pg_user_escaped _pg_pass_escaped _pg_db_escaped
+  _pg_user_escaped="${PG_DB_USER//\'/\'\'}"
+  _pg_pass_escaped="${PG_DB_PASS//\'/\'\'}"
+  _pg_db_escaped="${PG_DB_NAME//\'/\'\'}"
+
+  $STD sudo -u postgres psql -c "CREATE ROLE $_pg_user_escaped WITH LOGIN PASSWORD '$_pg_pass_escaped';"
+  $STD sudo -u postgres psql -c "CREATE DATABASE $_pg_db_escaped WITH OWNER $_pg_user_escaped ENCODING 'UTF8' TEMPLATE template0;"
 
   # Configure pg_cron database BEFORE creating the extension (must be set before pg_cron loads)
   if [[ -n "${PG_DB_EXTENSIONS:-}" ]] && [[ ",${PG_DB_EXTENSIONS//[[:space:]]/}," == *",pg_cron,"* ]]; then