maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

escape directories/files correctly - TODO: store the user-inputs in the database correctly (source of the data), checking in the cronjob is only just-in-case, refs #717

Browse Source 
Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann (d00p)
2013-03-06 17:56:42 +01:00
parent debdbf5d41
commit cb6db7385a
4 changed files with 38 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
scripts/jobs/cron_tasks.inc.http.10.apache.php
View File

@@ -108,7 +108,7 @@ class apache
$this->virtualhosts_data[$vhosts_filename] = '';
}
$this->virtualhosts_data[$vhosts_filename].= ' <Directory "' . $this->settings['system']['documentroot_prefix'] . '">' . "\n";
$this->virtualhosts_data[$vhosts_filename].= ' <Directory "' . makeCorrectDir($this->settings['system']['documentroot_prefix']) . '">' . "\n";
// >=apache-2.4 enabled?
if ($this->settings['system']['apache24'] == '1') {
$this->virtualhosts_data[$vhosts_filename].= ' Require all granted' . "\n";
@@ -148,22 +148,22 @@ class apache
if($this->settings['defaultwebsrverrhandler']['err401'] != '')
{
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 401 ' . $this->settings['defaultwebsrverrhandler']['err401'] . "\n";
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 401 "' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err401']) . '"'."\n";
}
if($this->settings['defaultwebsrverrhandler']['err403'] != '')
{
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 403 ' . $this->settings['defaultwebsrverrhandler']['err403'] . "\n";
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 403 "' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err403']) . '"' . "\n";
}
if($this->settings['defaultwebsrverrhandler']['err404'] != '')
{
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 404 ' . $this->settings['defaultwebsrverrhandler']['err404'] . "\n";
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 404 "' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err404']) . '"' . "\n";
}
if($this->settings['defaultwebsrverrhandler']['err500'] != '')
{
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 500 ' . $this->settings['defaultwebsrverrhandler']['err500'] . "\n";
$this->virtualhosts_data[$vhosts_filename].= 'ErrorDocument 500 "' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err500']) . '"' . "\n";
}
}
@@ -513,7 +513,7 @@ class apache
&& $this->settings['system']['deactivateddocroot'] != '')
{
$webroot_text.= ' # Using docroot for deactivated users...' . "\n";
$webroot_text.= ' DocumentRoot "' . $this->settings['system']['deactivateddocroot'] . "\"\n";
$webroot_text.= ' DocumentRoot "' . makeCorrectDir($this->settings['system']['deactivateddocroot']) . "\"\n";
$this->_deactivated = true;
}
else
@@ -1022,19 +1022,19 @@ class apache
if(isset($row_diroptions['error404path'])
&& $row_diroptions['error404path'] != '')
{
$this->diroptions_data[$diroptions_filename].= ' ErrorDocument 404 ' . $row_diroptions['error404path'] . "\n";
$this->diroptions_data[$diroptions_filename].= ' ErrorDocument 404 "' . makeCorrectFile($row_diroptions['error404path']) . '"' . "\n";
}
if(isset($row_diroptions['error403path'])
&& $row_diroptions['error403path'] != '')
{
$this->diroptions_data[$diroptions_filename].= ' ErrorDocument 403 ' . $row_diroptions['error403path'] . "\n";
$this->diroptions_data[$diroptions_filename].= ' ErrorDocument 403 "' . makeCorrectFile($row_diroptions['error403path']) . '"' . "\n";
}
if(isset($row_diroptions['error500path'])
&& $row_diroptions['error500path'] != '')
{
$this->diroptions_data[$diroptions_filename].= ' ErrorDocument 500 ' . $row_diroptions['error500path'] . "\n";
$this->diroptions_data[$diroptions_filename].= ' ErrorDocument 500 "' . makeCorrectFile($row_diroptions['error500path']) . '"' . "\n";
}
if($cperlenabled
@@ -1352,42 +1352,6 @@ class apache
}
}
}
if($this->settings['phpfpm']['enabled'] == '1')
{
foreach($this->virtualhosts_data as $vhosts_filename => $vhosts_file)
{
$this->known_vhostfilenames[] = basename($vhosts_filename);
}
foreach($this->known_vhostfilenames as $vhostfilename){
$known_phpfpm_files[]=preg_replace('/^(05|10|20|21|22|30|50|51)_(froxlor|syscp)_(dirfix|ipandport|normal_vhost|wildcard_vhost|ssl_vhost)_/', '', $vhostfilename);
}
$configdir = $this->settings['phpfpm']['configdir'];
$phpfpm_file_dirhandle = opendir($this->settings['phpfpm']['configdir']);
if ($phpfpm_file_dirhandle !== false) {
while (false !== ($phpfpm_filename = readdir($phpfpm_file_dirhandle))) {
if (is_array($known_phpfpm_files)
&& $phpfpm_filename != '.'
&& $phpfpm_filename != '..'
&& !in_array($phpfpm_filename, $known_phpfpm_files)
&& file_exists(makeCorrectFile($this->settings['phpfpm']['configdir'] . '/' . $phpfpm_filename))
) {
fwrite($this->debugHandler, ' apache::wipeOutOldVhostConfigs: unlinking PHP5-FPM ' . $phpfpm_filename . "\n");
$this->logger->logAction(CRON_ACTION, LOG_NOTICE, 'unlinking ' . $phpfpm_filename);
unlink(makeCorrectFile($this->settings['phpfpm']['configdir'] . '/' . $phpfpm_filename));
}
if (!is_array($known_phpfpm_files)) {
$this->logger->logAction(CRON_ACTION, LOG_WARNING, "WARNING!! PHP-FPM Configs Not written!!");
}
}
} else {
$this->logger->logAction(CRON_ACTION, LOG_WARNING, "WARNING!! PHP-FPM configuration path could not be read (".$this->settings['phpfpm']['configdir'].")");
}
}
}
/*
@@ -1418,5 +1382,3 @@ class apache
}
}
}
?>

10
scripts/jobs/cron_tasks.inc.http.15.apache_fcgid.php
View File

@@ -39,9 +39,9 @@ class apache_fcgid extends apache
{
$php_options_text.= ' SuexecUserGroup "' . $domain['loginname'] . '" "' . $domain['loginname'] . '"' . "\n";
if ($domain['ssl'] == 1 && $ssl_vhost) {
$php_options_text.= ' FastCgiExternalServer ' . makeCorrectDir($php->getInterface()->getAliasConfigDir()) . 'ssl-fpm.external -socket ' . $php->getInterface()->getSocketFile() . ' -user ' . $domain['loginname'] . ' -group ' . $domain['loginname'] . " -idle-timeout " . $this->settings['phpfpm']['idle_timeout'] . "\n";
$php_options_text.= ' FastCgiExternalServer ' . $php->getInterface()->getAliasConfigDir() . 'ssl-fpm.external -socket ' . $php->getInterface()->getSocketFile() . ' -user ' . $domain['loginname'] . ' -group ' . $domain['loginname'] . " -idle-timeout " . $this->settings['phpfpm']['idle_timeout'] . "\n";
} else {
$php_options_text.= ' FastCgiExternalServer ' . makeCorrectDir($php->getInterface()->getAliasConfigDir()) . 'fpm.external -socket ' . $php->getInterface()->getSocketFile() . ' -user ' . $domain['loginname'] . ' -group ' . $domain['loginname'] . " -idle-timeout " . $this->settings['phpfpm']['idle_timeout'] . "\n";
$php_options_text.= ' FastCgiExternalServer ' . $php->getInterface()->getAliasConfigDir() . 'fpm.external -socket ' . $php->getInterface()->getSocketFile() . ' -user ' . $domain['loginname'] . ' -group ' . $domain['loginname'] . " -idle-timeout " . $this->settings['phpfpm']['idle_timeout'] . "\n";
}
$php_options_text.= ' <Directory "' . makeCorrectDir($domain['documentroot']) . '">' . "\n";
$php_options_text.= ' <FilesMatch "\.php$">' . "\n";
@@ -58,9 +58,9 @@ class apache_fcgid extends apache
}
$php_options_text.= ' </Directory>' . "\n";
if ($domain['ssl'] == 1 && $ssl_vhost) {
$php_options_text.= ' Alias /fastcgiphp ' . makeCorrectDir($php->getInterface()->getAliasConfigDir()) . 'ssl-fpm.external' . "\n";
$php_options_text.= ' Alias /fastcgiphp ' . $php->getInterface()->getAliasConfigDir() . 'ssl-fpm.external' . "\n";
} else {
$php_options_text.= ' Alias /fastcgiphp ' . makeCorrectDir($php->getInterface()->getAliasConfigDir()) . 'fpm.external' . "\n";
$php_options_text.= ' Alias /fastcgiphp ' . $php->getInterface()->getAliasConfigDir() . 'fpm.external' . "\n";
}
}
else
@@ -74,7 +74,7 @@ class apache_fcgid extends apache
else
{
$php_options_text.= ' SuexecUserGroup "' . $domain['loginname'] . '" "' . $domain['loginname'] . '"' . "\n";
$php_options_text.= ' <Directory "' . $domain['documentroot'] . '">' . "\n";
$php_options_text.= ' <Directory "' . makeCorrectDir($domain['documentroot']) . '">' . "\n";
$file_extensions = explode(' ', $phpconfig['file_extensions']);
$php_options_text.= ' <FilesMatch "\.(' . implode('|', $file_extensions) . ')$">' . "\n";
$php_options_text.= ' SetHandler fcgid-script' . "\n";

10
scripts/jobs/cron_tasks.inc.http.20.lighttpd.php
View File

@@ -255,7 +255,7 @@ class lighttpd
$this->lighttpd_data[$vhost_filename] = '';
}
$this->lighttpd_data[$vhost_filename] = 'server.error-handler-404 = "'.$this->settings['defaultwebsrverrhandler']['err404'].'"';
$this->lighttpd_data[$vhost_filename] = 'server.error-handler-404 = "'.makeCorrectFile($this->settings['defaultwebsrverrhandler']['err404']).'"';
}
}
@@ -720,7 +720,7 @@ class lighttpd
}
}
$diroption_text.= '"' . $row_htpasswds['path'] . '" =>' . "\n";
$diroption_text.= '"' . makeCorrectDir($row_htpasswds['path']) . '" =>' . "\n";
$diroption_text.= '(' . "\n";
$diroption_text.= ' "method" => "basic",' . "\n";
$diroption_text.= ' "realm" => "'.$row_htpasswds['authname'].'",' . "\n";
@@ -829,7 +829,7 @@ class lighttpd
&& $this->settings['system']['deactivateddocroot'] != '')
{
$webroot_text.= ' # Using docroot for deactivated users...' . "\n";
$webroot_text.= ' server.document-root = "' . $this->settings['system']['deactivateddocroot'] . "\"\n";
$webroot_text.= ' server.document-root = "' . makeCorrectDir($this->settings['system']['deactivateddocroot']) . "\"\n";
$this->_deactivated = true;
}
else
@@ -996,10 +996,10 @@ class lighttpd
{
if(!is_dir($this->settings['system']['apacheconf_htpasswddir']))
{
mkdir($this->settings['system']['apacheconf_htpasswddir']);
mkdir(makeCorrectDir($this->settings['system']['apacheconf_htpasswddir']));
}
$filename = $this->settings['system']['apacheconf_htpasswddir'] . '/' . $key;
$filename = makeCorrectFile($this->settings['system']['apacheconf_htpasswddir'] . '/' . $key);
$htpasswd_handler = fopen($filename, 'w');
fwrite($htpasswd_handler, $data);
fclose($htpasswd_handler);

39
scripts/jobs/cron_tasks.inc.http.30.nginx.php
View File

@@ -117,22 +117,22 @@ class nginx
if($this->settings['defaultwebsrverrhandler']['err401'] != '')
{
$this->nginx_data[$vhosts_filename].= 'error_page 401 ' . $this->settings['defaultwebsrverrhandler']['err401'] . ';' . "\n";
$this->nginx_data[$vhosts_filename].= 'error_page 401 ' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err401']) . ';' . "\n";
}
if($this->settings['defaultwebsrverrhandler']['err403'] != '')
{
$this->nginx_data[$vhosts_filename].= 'error_page 403 ' . $this->settings['defaultwebsrverrhandler']['err403'] . ';' . "\n";
$this->nginx_data[$vhosts_filename].= 'error_page 403 ' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err403']) . ';' . "\n";
}
if($this->settings['defaultwebsrverrhandler']['err404'] != '')
{
$this->nginx_data[$vhosts_filename].= 'error_page 404 ' . $this->settings['defaultwebsrverrhandler']['err404'] . ';' . "\n";
$this->nginx_data[$vhosts_filename].= 'error_page 404 ' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err404']) . ';' . "\n";
}
if($this->settings['defaultwebsrverrhandler']['err500'] != '')
{
$this->nginx_data[$vhosts_filename].= 'error_page 500 ' . $this->settings['defaultwebsrverrhandler']['err500'] . ';' . "\n";
$this->nginx_data[$vhosts_filename].= 'error_page 500 ' . makeCorrectFile($this->settings['defaultwebsrverrhandler']['err500']) . ';' . "\n";
}
}
@@ -464,17 +464,17 @@ class nginx
{
if(!empty($row['error404path']))
{
$path_options.= "\t".'error_page 404 ' . $row['error404path'] . ';' . "\n";
$path_options.= "\t".'error_page 404 ' . makeCorrectFile($row['error404path']) . ';' . "\n";
}
if(!empty($row['error403path']))
{
$path_options.= "\t".'error_page 403 ' . $row['error403path'] . ';' . "\n";
$path_options.= "\t".'error_page 403 ' . makeCorrectFile($row['error403path']) . ';' . "\n";
}
if(!empty($row['error500path']))
{
$path_options.= "\t".'error_page 502 503 504 ' . $row['error500path'] . ';' . "\n";
$path_options.= "\t".'error_page 502 503 504 ' . makeCorrectFile($row['error500path']) . ';' . "\n";
}
// if($row['options_indexes'] != '0')
@@ -507,7 +507,7 @@ class nginx
default:
if ($single['path']=='/'){
$path_options.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$path_options.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$path_options.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
// remove already used entries so we do not have doubles
unset($htpasswds[$idx]);
}
@@ -546,7 +546,7 @@ class nginx
}
$path_options.= "\t" . 'location ~ \(.pl|.cgi)$ {' . "\n";
$path_options.= "\t\t" . 'gzip off; #gzip makes scripts feel slower since they have to complete before getting gzipped' . "\n";
$path_options.= "\t\t" . 'fastcgi_pass '. $this->settings['system']['perl_server'] . ';' . "\n";
$path_options.= "\t\t" . 'fastcgi_pass '. $this->settings['system']['perl_server'] . ';' . "\n";
$path_options.= "\t\t" . 'fastcgi_index index.cgi;' . "\n";
$path_options.= "\t\t" . 'include '.$this->settings['nginx']['fastcgiparams'].';'."\n";
$path_options.= "\t" . '}' . "\n";
@@ -571,9 +571,9 @@ class nginx
unset($htpasswds[$idx]);
break;
default:
$path_options.= "\t" . 'location ' . $single['path'] . ' {' . "\n";
$path_options.= "\t" . 'location ' . makeCorrectPath($single['path']) . ' {' . "\n";
$path_options.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$path_options.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$path_options.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$path_options.= "\t".'}' . "\n";
}
//}
@@ -645,7 +645,7 @@ class nginx
&& $this->settings['system']['deactivateddocroot'] != '')
{
$webroot_text.= "\t".'# Using docroot for deactivated users...' . "\n";
$webroot_text.= "\t".'root '.$this->settings['system']['deactivateddocroot'].';'."\n";
$webroot_text.= "\t".'root '.makeCorrectPath($this->settings['system']['deactivateddocroot']).';'."\n";
$this->_deactivated = true;
}
else
@@ -685,7 +685,7 @@ class nginx
$stats_text.= "\t" . 'location /awstats {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectFile($domain['customerroot'] . '/awstats/' . $domain['domain']) . ';' . "\n";
$stats_text.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$stats_text.= "\t" . '}' . "\n";
$stats_text.= "\t" . 'location /awstats-icon {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectDir($this->settings['system']['awstats_icons']) . ';' . "\n";
@@ -696,7 +696,7 @@ class nginx
$stats_text.= "\t" . 'location /webalizer {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectFile($domain['customerroot'] . '/webalizer/' . $domain['domain']) . ';' . "\n";
$stats_text.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$stats_text.= "\t" . '}' . "\n";
}
}
@@ -707,7 +707,7 @@ class nginx
$stats_text.= "\t" . 'location /awstats {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectFile($domain['customerroot'] . '/awstats/' . $domain['parentdomain']) . ';' . "\n";
$stats_text.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$stats_text.= "\t" . '}' . "\n";
$stats_text.= "\t" . 'location /awstats-icon {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectDir($this->settings['system']['awstats_icons']) . ';' . "\n";
@@ -718,7 +718,7 @@ class nginx
$stats_text.= "\t" . 'location /webalizer {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectFile($domain['customerroot'] . '/webalizer/' . $domain['parentdomain']) . ';' . "\n";
$stats_text.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$stats_text.= "\t" . '}' . "\n";
}
@@ -733,7 +733,7 @@ class nginx
$stats_text.= "\t" . 'location /awstats {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectFile($domain['customerroot'] . '/awstats/' . $domain['domain']) . ';' . "\n";
$stats_text.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$stats_text.= "\t" . '}' . "\n";
$stats_text.= "\t" . 'location /awstats-icon {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectDir($this->settings['system']['awstats_icons']) . ';' . "\n";
@@ -744,7 +744,7 @@ class nginx
$stats_text.= "\t" . 'location /webalizer {' . "\n";
$stats_text.= "\t\t" . 'root ' . makeCorrectFile($domain['customerroot'] . '/webalizer/' . $domain['domain']) . ';' . "\n";
$stats_text.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$stats_text.= "\t" . '}' . "\n";
}
@@ -758,7 +758,7 @@ class nginx
$stats_text.= "\t" . 'location /awstats {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectFile($domain['documentroot'] . '/awstats/' . $domain['domain']) . ';' . "\n";
$stats_text.= "\t\t" . 'auth_basic "Restricted Area";' . "\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . $single['usrf'] . ';'."\n";
$stats_text.= "\t\t" . 'auth_basic_user_file ' . makeCorrectFile($single['usrf']) . ';'."\n";
$stats_text.= "\t" . '}' . "\n";
$stats_text.= "\t" . 'location /awstats-icon {' . "\n";
$stats_text.= "\t\t" . 'alias ' . makeCorrectDir($this->settings['system']['awstats_icons']) . ';' . "\n";
@@ -766,7 +766,6 @@ class nginx
}
}
return $stats_text;
}