Compare commits

..

3 Commits

Author SHA1 Message Date
Michael Kaufmann
2c8bdfbbbc set version to 0.10.38 for upcoming maintenance release
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
2022-09-02 13:23:51 +02:00
Michael Kaufmann
bbe82286aa add security question for deleting api-keys to avoid accidental deletion
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
2022-08-27 15:02:48 +02:00
Michael Kaufmann
13571f1f16 correct Dropdown directory selection; fixes #1044
Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
2022-08-16 08:32:43 +02:00
8 changed files with 53 additions and 36 deletions

View File

@@ -1,5 +1,5 @@
<?php <?php
if (! defined('AREA')) { if (!defined('AREA')) {
header("Location: index.php"); header("Location: index.php");
exit(); exit();
} }
@@ -27,39 +27,47 @@ use Froxlor\Database\Database;
$del_stmt = Database::prepare("DELETE FROM `" . TABLE_API_KEYS . "` WHERE id = :id"); $del_stmt = Database::prepare("DELETE FROM `" . TABLE_API_KEYS . "` WHERE id = :id");
$success_message = ""; $success_message = "";
$id = isset($_GET['id']) ? (int) $_GET['id'] : 0; $id = isset($_POST['id']) ? (int) $_POST['id'] : (isset($_GET['id']) ? (int) $_GET['id'] : 0);
$area = AREA; $area = AREA;
// do the delete and then just show a success-message and the apikeys list again // do the delete and then just show a success-message and the apikeys list again
if ($action == 'delete') { if ($action == 'delete') {
if ($id > 0) { if ($id > 0) {
$chk = (AREA == 'admin' && $userinfo['customers_see_all'] == '1') ? true : false; if (isset($_POST['send']) && $_POST['send'] == 'send') {
if (AREA == 'customer') { $chk = (AREA == 'admin' && $userinfo['customers_see_all'] == '1') ? true : false;
$chk_stmt = Database::prepare(" if (AREA == 'customer') {
SELECT c.customerid FROM `" . TABLE_PANEL_CUSTOMERS . "` c $chk_stmt = Database::prepare("
LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.customerid = c.customerid SELECT c.customerid FROM `" . TABLE_PANEL_CUSTOMERS . "` c
WHERE ak.`id` = :id AND c.`customerid` = :cid LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.customerid = c.customerid
"); WHERE ak.`id` = :id AND c.`customerid` = :cid
$chk = Database::pexecute_first($chk_stmt, array( ");
'id' => $id, $chk = Database::pexecute_first($chk_stmt, array(
'cid' => $userinfo['customerid'] 'id' => $id,
)); 'cid' => $userinfo['customerid']
} elseif (AREA == 'admin' && $userinfo['customers_see_all'] == '0') { ));
$chk_stmt = Database::prepare(" } elseif (AREA == 'admin' && $userinfo['customers_see_all'] == '0') {
SELECT a.adminid FROM `" . TABLE_PANEL_ADMINS . "` a $chk_stmt = Database::prepare("
LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.adminid = a.adminid SELECT a.adminid FROM `" . TABLE_PANEL_ADMINS . "` a
WHERE ak.`id` = :id AND a.`adminid` = :aid LEFT JOIN `" . TABLE_API_KEYS . "` ak ON ak.adminid = a.adminid
"); WHERE ak.`id` = :id AND a.`adminid` = :aid
$chk = Database::pexecute_first($chk_stmt, array( ");
'id' => $id, $chk = Database::pexecute_first($chk_stmt, array(
'aid' => $userinfo['adminid'] 'id' => $id,
)); 'aid' => $userinfo['adminid']
} ));
if ($chk !== false) { }
Database::pexecute($del_stmt, array( if ($chk !== false) {
Database::pexecute($del_stmt, array(
'id' => $id
));
$success_message = sprintf($lng['apikeys']['apikey_removed'], $id);
}
} else {
\Froxlor\UI\HTML::askYesNo('api_reallydelete', $filename, array(
'page' => $page,
'action' => $action,
'id' => $id 'id' => $id
)); ), $id);
$success_message = sprintf($lng['apikeys']['apikey_removed'], $id);
} }
} }
} elseif ($action == 'add') { } elseif ($action == 'add') {
@@ -85,10 +93,10 @@ if ($action == 'delete') {
} elseif ($action == 'jqEditApiKey') { } elseif ($action == 'jqEditApiKey') {
$keyid = isset($_POST['id']) ? (int) $_POST['id'] : 0; $keyid = isset($_POST['id']) ? (int) $_POST['id'] : 0;
$allowed_from = isset($_POST['allowed_from']) ? $_POST['allowed_from'] : ""; $allowed_from = isset($_POST['allowed_from']) ? $_POST['allowed_from'] : "";
$valid_until = isset($_POST['valid_until']) ? (int) $_POST['valid_until'] : - 1; $valid_until = isset($_POST['valid_until']) ? (int) $_POST['valid_until'] : -1;
// validate allowed_from // validate allowed_from
if (! empty($allowed_from)) { if (!empty($allowed_from)) {
$ip_list = array_map('trim', explode(",", $allowed_from)); $ip_list = array_map('trim', explode(",", $allowed_from));
$_check_list = $ip_list; $_check_list = $ip_list;
foreach ($_check_list as $idx => $ip) { foreach ($_check_list as $idx => $ip) {
@@ -100,8 +108,8 @@ if ($action == 'delete') {
$allowed_from = implode(",", array_unique($ip_list)); $allowed_from = implode(",", array_unique($ip_list));
} }
if ($valid_until <= 0 || ! is_numeric($valid_until)) { if ($valid_until <= 0 || !is_numeric($valid_until)) {
$valid_until = - 1; $valid_until = -1;
} }
$upd_stmt = Database::prepare(" $upd_stmt = Database::prepare("

View File

@@ -723,7 +723,7 @@ opcache.validate_timestamps'),
('panel', 'logo_image_login', ''), ('panel', 'logo_image_login', ''),
('panel', 'logo_overridetheme', '0'), ('panel', 'logo_overridetheme', '0'),
('panel', 'logo_overridecustom', '0'), ('panel', 'logo_overridecustom', '0'),
('panel', 'version', '0.10.37'), ('panel', 'version', '0.10.38'),
('panel', 'db_version', '202112310'); ('panel', 'db_version', '202112310');

View File

@@ -1001,3 +1001,8 @@ if (\Froxlor\Froxlor::isFroxlorVersion('0.10.36')) {
showUpdateStep("Updating from 0.10.36 to 0.10.37", false); showUpdateStep("Updating from 0.10.36 to 0.10.37", false);
\Froxlor\Froxlor::updateToVersion('0.10.37'); \Froxlor\Froxlor::updateToVersion('0.10.37');
} }
if (\Froxlor\Froxlor::isFroxlorVersion('0.10.37')) {
showUpdateStep("Updating from 0.10.37 to 0.10.38", false);
\Froxlor\Froxlor::updateToVersion('0.10.38');
}

View File

@@ -99,7 +99,7 @@ class PhpSettings extends \Froxlor\Api\ApiCommand implements \Froxlor\Api\Resour
} }
// check whether we use that config as froxor-vhost config // check whether we use that config as froxor-vhost config
if (Settings::Get('system.mod_fcgid_defaultini_ownvhost') == $row['id'] || Settings::Get('phpfpm.vhost_defaultini') == $row['id']) { if ((Settings::Get('system.mod_fcgid') == '1' && Settings::Get('system.mod_fcgid_defaultini_ownvhost') == $row['id']) || (Settings::Get('phpfpm.enabled') == '1' && Settings::Get('phpfpm.vhost_defaultini') == $row['id'])) {
$domains[] = Settings::Get('system.hostname'); $domains[] = Settings::Get('system.hostname');
} }

View File

@@ -491,7 +491,7 @@ class FileDir
new \RecursiveDirectoryIterator($path, \RecursiveDirectoryIterator::SKIP_DOTS), new \RecursiveDirectoryIterator($path, \RecursiveDirectoryIterator::SKIP_DOTS),
$filter $filter
), ),
\RecursiveIteratorIterator::LEAVES_ONLY, \RecursiveIteratorIterator::SELF_FIRST,
\RecursiveIteratorIterator::CATCH_GET_CHILD \RecursiveIteratorIterator::CATCH_GET_CHILD
); );
// we can limit the recursion-depth, but will it be helpful or // we can limit the recursion-depth, but will it be helpful or

View File

@@ -7,7 +7,7 @@ final class Froxlor
{ {
// Main version variable // Main version variable
const VERSION = '0.10.37'; const VERSION = '0.10.38';
// Database version (YYYYMMDDC where C is a daily counter) // Database version (YYYYMMDDC where C is a daily counter)
const DBVERSION = '202112310'; const DBVERSION = '202112310';

View File

@@ -2138,3 +2138,5 @@ $lng['serversettings']['phpfpm_settings']['allow_all_customers']['description']
$lng['error']['pathmustberelative'] = 'The user does not have the permission to specify directories outside the customers home-directory. Please specify a relative path (no leading /).'; $lng['error']['pathmustberelative'] = 'The user does not have the permission to specify directories outside the customers home-directory. Please specify a relative path (no leading /).';
$lng['serversettings']['acmeshpath']['title'] = 'Path to acme.sh'; $lng['serversettings']['acmeshpath']['title'] = 'Path to acme.sh';
$lng['serversettings']['acmeshpath']['description'] = 'Set this to where acme.sh is installed to, including the acme.sh script<br>Default is <b>/root/.acme.sh/acme.sh</b>'; $lng['serversettings']['acmeshpath']['description'] = 'Set this to where acme.sh is installed to, including the acme.sh script<br>Default is <b>/root/.acme.sh/acme.sh</b>';
$lng['question']['api_reallydelete'] = 'Do you really want to delete the api-key #%d?';

View File

@@ -1784,3 +1784,5 @@ $lng['serversettings']['phpfpm_settings']['allow_all_customers']['description']
$lng['error']['pathmustberelative'] = 'Der Benutzer hat nicht die benötigten Berechtigungen, um Pfade außerhalb des Kunden-Heimatverzeichnisses anzugeben. Bitte einen relativen Pfad angeben (kein führendes /).'; $lng['error']['pathmustberelative'] = 'Der Benutzer hat nicht die benötigten Berechtigungen, um Pfade außerhalb des Kunden-Heimatverzeichnisses anzugeben. Bitte einen relativen Pfad angeben (kein führendes /).';
$lng['serversettings']['acmeshpath']['title'] = 'Pfad zu acme.sh'; $lng['serversettings']['acmeshpath']['title'] = 'Pfad zu acme.sh';
$lng['serversettings']['acmeshpath']['description'] = 'Installationspfad zu acme.sh, inklusive acme.sh Script<br>Standard ist <b>/root/.acme.sh/acme.sh</b>'; $lng['serversettings']['acmeshpath']['description'] = 'Installationspfad zu acme.sh, inklusive acme.sh Script<br>Standard ist <b>/root/.acme.sh/acme.sh</b>';
$lng['question']['api_reallydelete'] = 'Api-Key #%d wirklich löschen?';