maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

add security question for deleting api-keys to avoid accidental deletion

Browse Source 
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann
2022-08-27 15:02:48 +02:00
parent 13571f1f16
commit bbe82286aa
3 changed files with 44 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
api_keys.php
View File

@@ -1,5 +1,5 @@
<?php <?php
if (! defined('AREA')) { if (!defined('AREA')) {
header("Location: index.php"); header("Location: index.php");
exit(); exit();
} }
@@ -27,39 +27,47 @@ use Froxlor\Database\Database;
$del_stmt = Database::prepare("DELETE FROM `" . TABLE_API_KEYS . "` WHERE id = :id"); $del_stmt = Database::prepare("DELETE FROM `" . TABLE_API_KEYS . "` WHERE id = :id");
$success_message = ""; $success_message = "";
$id = isset($_GET['id']) ? (int) $_GET['id'] : 0; $id = isset($_POST['id']) ? (int) $_POST['id'] : (isset($_GET['id']) ? (int) $_GET['id'] : 0);
$area = AREA; $area = AREA;
// do the delete and then just show a success-message and the apikeys list again // do the delete and then just show a success-message and the apikeys list again
if ($action == 'delete') { if ($action == 'delete') {
if ($id > 0) { if ($id > 0) {
$chk = (AREA == 'admin' && $userinfo['customers_see_all'] == '1') ? true : false; if (isset($_POST['send']) && $_POST['send'] == 'send') {
if (AREA == 'customer') { $chk = (AREA == 'admin' && $userinfo['customers_see_all'] == '1') ? true : false;
$chk_stmt = Database::prepare(" if (AREA == 'customer') {
SELECT c.customerid FROM `" . TABLE_PANEL_CUSTOMERS . "` c $chk_stmt = Database::prepare("
LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.customerid = c.customerid SELECT c.customerid FROM `" . TABLE_PANEL_CUSTOMERS . "` c
WHERE ak.`id` = :id AND c.`customerid` = :cid LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.customerid = c.customerid
"); WHERE ak.`id` = :id AND c.`customerid` = :cid
$chk = Database::pexecute_first($chk_stmt, array( ");
'id' => $id, $chk = Database::pexecute_first($chk_stmt, array(
'cid' => $userinfo['customerid'] 'id' => $id,
)); 'cid' => $userinfo['customerid']
} elseif (AREA == 'admin' && $userinfo['customers_see_all'] == '0') { ));
$chk_stmt = Database::prepare(" } elseif (AREA == 'admin' && $userinfo['customers_see_all'] == '0') {
SELECT a.adminid FROM `" . TABLE_PANEL_ADMINS . "` a $chk_stmt = Database::prepare("
LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.adminid = a.adminid SELECT a.adminid FROM `" . TABLE_PANEL_ADMINS . "` a
WHERE ak.`id` = :id AND a.`adminid` = :aid LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.adminid = a.adminid
"); WHERE ak.`id` = :id AND a.`adminid` = :aid
$chk = Database::pexecute_first($chk_stmt, array( ");
'id' => $id, $chk = Database::pexecute_first($chk_stmt, array(
'aid' => $userinfo['adminid'] 'id' => $id,
)); 'aid' => $userinfo['adminid']
} ));
if ($chk !== false) { }
Database::pexecute($del_stmt, array( if ($chk !== false) {
Database::pexecute($del_stmt, array(
'id' => $id
));
$success_message = sprintf($lng['apikeys']['apikey_removed'], $id);
}
} else {
\Froxlor\UI\HTML::askYesNo('api_reallydelete', $filename, array(
'page' => $page,
'action' => $action,
'id' => $id 'id' => $id
)); ), $id);
$success_message = sprintf($lng['apikeys']['apikey_removed'], $id);
} }
} }
} elseif ($action == 'add') { } elseif ($action == 'add') {
@@ -85,10 +93,10 @@ if ($action == 'delete') {
} elseif ($action == 'jqEditApiKey') { } elseif ($action == 'jqEditApiKey') {
$keyid = isset($_POST['id']) ? (int) $_POST['id'] : 0; $keyid = isset($_POST['id']) ? (int) $_POST['id'] : 0;
$allowed_from = isset($_POST['allowed_from']) ? $_POST['allowed_from'] : ""; $allowed_from = isset($_POST['allowed_from']) ? $_POST['allowed_from'] : "";
$valid_until = isset($_POST['valid_until']) ? (int) $_POST['valid_until'] : - 1; $valid_until = isset($_POST['valid_until']) ? (int) $_POST['valid_until'] : -1;
// validate allowed_from // validate allowed_from
if (! empty($allowed_from)) { if (!empty($allowed_from)) {
$ip_list = array_map('trim', explode(",", $allowed_from)); $ip_list = array_map('trim', explode(",", $allowed_from));
$_check_list = $ip_list; $_check_list = $ip_list;
foreach ($_check_list as $idx => $ip) { foreach ($_check_list as $idx => $ip) {
@@ -100,8 +108,8 @@ if ($action == 'delete') {
$allowed_from = implode(",", array_unique($ip_list)); $allowed_from = implode(",", array_unique($ip_list));
} }
if ($valid_until <= 0 || ! is_numeric($valid_until)) { if ($valid_until <= 0 || !is_numeric($valid_until)) {
$valid_until = - 1; $valid_until = -1;
} }
$upd_stmt = Database::prepare(" $upd_stmt = Database::prepare("

2
lng/english.lng.php
View File

@@ -2138,3 +2138,5 @@ $lng['serversettings']['phpfpm_settings']['allow_all_customers']['description']
$lng['error']['pathmustberelative'] = 'The user does not have the permission to specify directories outside the customers home-directory. Please specify a relative path (no leading /).'; $lng['error']['pathmustberelative'] = 'The user does not have the permission to specify directories outside the customers home-directory. Please specify a relative path (no leading /).';
$lng['serversettings']['acmeshpath']['title'] = 'Path to acme.sh'; $lng['serversettings']['acmeshpath']['title'] = 'Path to acme.sh';
$lng['serversettings']['acmeshpath']['description'] = 'Set this to where acme.sh is installed to, including the acme.sh script<br>Default is <b>/root/.acme.sh/acme.sh</b>'; $lng['serversettings']['acmeshpath']['description'] = 'Set this to where acme.sh is installed to, including the acme.sh script<br>Default is <b>/root/.acme.sh/acme.sh</b>';
$lng['question']['api_reallydelete'] = 'Do you really want to delete the api-key #%d?';

2
lng/german.lng.php
View File

@@ -1784,3 +1784,5 @@ $lng['serversettings']['phpfpm_settings']['allow_all_customers']['description']
$lng['error']['pathmustberelative'] = 'Der Benutzer hat nicht die benötigten Berechtigungen, um Pfade außerhalb des Kunden-Heimatverzeichnisses anzugeben. Bitte einen relativen Pfad angeben (kein führendes /).'; $lng['error']['pathmustberelative'] = 'Der Benutzer hat nicht die benötigten Berechtigungen, um Pfade außerhalb des Kunden-Heimatverzeichnisses anzugeben. Bitte einen relativen Pfad angeben (kein führendes /).';
$lng['serversettings']['acmeshpath']['title'] = 'Pfad zu acme.sh'; $lng['serversettings']['acmeshpath']['title'] = 'Pfad zu acme.sh';
$lng['serversettings']['acmeshpath']['description'] = 'Installationspfad zu acme.sh, inklusive acme.sh Script<br>Standard ist <b>/root/.acme.sh/acme.sh</b>'; $lng['serversettings']['acmeshpath']['description'] = 'Installationspfad zu acme.sh, inklusive acme.sh Script<br>Standard ist <b>/root/.acme.sh/acme.sh</b>';
$lng['question']['api_reallydelete'] = 'Api-Key #%d wirklich löschen?';