fix missing id parameter after security question when deleting a ssl-certificate

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

api_keys.php

@@ -71,6 +71,8 @@ if ($action == 'delete') {
 		}
 	}
 } elseif ($action == 'add') {
+
+	if (isset($_POST['send']) && $_POST['send'] == 'send') {
 		$ins_stmt = Database::prepare("
 			INSERT INTO `" . TABLE_API_KEYS . "` SET
 			`apikey` = :key, `secret` = :secret, `adminid` = :aid, `customerid` = :cid, `valid_until` = '-1', `allowed_from` = ''
@@ -90,8 +92,18 @@ if ($action == 'delete') {
 			'cid' => $cid
 		));
 		$success_message = $lng['apikeys']['apikey_added'];
+	} else {
+		\Froxlor\UI\HTML::askYesNo('api_reallyadd', $filename, array(
+			'page' => $page,
+			'action' => $action
+		), $id);
+	}
 } elseif ($action == 'jqEditApiKey') {
 	$keyid = isset($_POST['id']) ? (int) $_POST['id'] : 0;
+	if (empty($keyid)) {
+		echo json_encode(false);
+		exit;
+	}
 	$allowed_from = isset($_POST['allowed_from']) ? $_POST['allowed_from'] : "";
 	$valid_until = isset($_POST['valid_until']) ? (int) $_POST['valid_until'] : -1;
 

dns_editor.php

@@ -58,6 +58,7 @@ if ($action == 'add_record' && ! empty($_POST)) {
 	// remove entry
 	$entry_id = isset($_GET['id']) ? (int) $_GET['id'] : 0;
 	if ($entry_id > 0) {
+		if (isset($_POST['send']) && $_POST['send'] == 'send') {
 			try {
 				DomainZones::getLocal($userinfo, array(
 					'entry_id' => $entry_id,
@@ -68,6 +69,13 @@ if ($action == 'add_record' && ! empty($_POST)) {
 			} catch (Exception $e) {
 				$errors = str_replace("\n", "<br>", $e->getMessage());
 			}
+		} else {
+			\Froxlor\UI\HTML::askYesNo('dnsentry_reallydelete', $filename, array(
+				'page' => $page,
+				'action' => $action,
+				'id' => $id
+			), $id);
+		}
 	}
 }
 

index.php

@@ -22,6 +22,7 @@ require './lib/init.php';
 use Froxlor\Database\Database;
 use Froxlor\Settings;
 use Froxlor\FroxlorLogger;
+use Froxlor\Validate\Validate;
 
 if ($action == '') {
 	$action = 'login';
@@ -352,8 +353,7 @@ if ($action == '2fa_entercode') {
 				$message = sprintf($lng['error']['login_blocked'], Settings::Get('login.deactivatetime'));
 				break;
 			case 4:
-				$cmail = isset($_GET['customermail']) ? $_GET['customermail'] : 'unknown';
-				$message = str_replace('%s', $cmail, $lng['error']['errorsendingmail']);
+				$message = $lng['error']['errorsendingmailpub'];
 				break;
 			case 5:
 				$message = $lng['error']['user_banned'];
@@ -425,6 +425,19 @@ if ($action == 'forgotpwd') {
 			}
 		}
 
+		$no_action = false;
+		if ($adminchecked) {
+			if (Settings::Get('panel.allow_preset_admin') != '1') {
+				$message = $lng['pwdreminder']['notallowed'];
+				unset($adminchecked);
+			}
+		} else {
+			if (Settings::Get('panel.allow_preset') != '1') {
+				$message = $lng['pwdreminder']['notallowed'];
+			}
+		}
+
+		if (empty($message)) {
 			if ($result_stmt !== null) {
 				$user = $result_stmt->fetch(PDO::FETCH_ASSOC);
 
@@ -566,18 +579,8 @@ if ($action == 'forgotpwd') {
 					unset($user);
 				}
 			} else {
-			$message = $lng['login']['usernotfound'];
-		}
-	}
-
-	if ($adminchecked) {
-		if (Settings::Get('panel.allow_preset_admin') != '1') {
 				$message = $lng['pwdreminder']['notallowed'];
-			unset($adminchecked);
 			}
-	} else {
-		if (Settings::Get('panel.allow_preset') != '1') {
-			$message = $lng['pwdreminder']['notallowed'];
 		}
 	}
 

install/froxlor.sql

@@ -723,7 +723,7 @@ opcache.validate_timestamps'),
 	('panel', 'logo_image_login', ''),
 	('panel', 'logo_overridetheme', '0'),
 	('panel', 'logo_overridecustom', '0'),
-	('panel', 'version', '0.10.38'),
+	('panel', 'version', '0.10.38.3'),
 	('panel', 'db_version', '202112310');
 
 

install/updates/froxlor/0.10/update_0.10.inc.php

@@ -1006,3 +1006,18 @@ if (\Froxlor\Froxlor::isFroxlorVersion('0.10.37')) {
         showUpdateStep("Updating from 0.10.37 to 0.10.38", false);
         \Froxlor\Froxlor::updateToVersion('0.10.38');
 }
+
+if (\Froxlor\Froxlor::isFroxlorVersion('0.10.38')) {
+        showUpdateStep("Updating from 0.10.38 to 0.10.38.1", false);
+        \Froxlor\Froxlor::updateToVersion('0.10.38.1');
+}
+
+if (\Froxlor\Froxlor::isFroxlorVersion('0.10.38.1')) {
+        showUpdateStep("Updating from 0.10.38.1 to 0.10.38.2", false);
+        \Froxlor\Froxlor::updateToVersion('0.10.38.2');
+}
+
+if (\Froxlor\Froxlor::isFroxlorVersion('0.10.38.2')) {
+	showUpdateStep("Updating from 0.10.38.2 to 0.10.38.3", false);
+	\Froxlor\Froxlor::updateToVersion('0.10.38.3');
+}

lib/Froxlor/Api/Commands/Admins.php

@@ -227,7 +227,7 @@ class Admins extends \Froxlor\Api\ApiCommand implements \Froxlor\Api\ResourceEnt
 			$ipaddress = $this->getParam('ipaddress', true, - 1);
 
 			// validation
-			$name = \Froxlor\Validate\Validate::validate($name, 'name', '', '', array(), true);
+			$name = \Froxlor\Validate\Validate::validate($name, 'name', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
 			$idna_convert = new \Froxlor\Idna\IdnaWrapper();
 			$email = $idna_convert->encode(\Froxlor\Validate\Validate::validate($email, 'email', '', '', array(), true));
 			$def_language = \Froxlor\Validate\Validate::validate($def_language, 'default language', '', '', array(), true);
@@ -527,7 +527,7 @@ class Admins extends \Froxlor\Api\ApiCommand implements \Froxlor\Api\ResourceEnt
 				}
 
 				// validation
-				$name = \Froxlor\Validate\Validate::validate($name, 'name', '', '', array(), true);
+				$name = \Froxlor\Validate\Validate::validate($name, 'name', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
 				$idna_convert = new \Froxlor\Idna\IdnaWrapper();
 				$email = $idna_convert->encode(\Froxlor\Validate\Validate::validate($email, 'email', '', '', array(), true));
 				$def_language = \Froxlor\Validate\Validate::validate($def_language, 'default language', '', '', array(), true);

lib/Froxlor/Api/Commands/Customers.php

@@ -404,12 +404,12 @@ class Customers extends \Froxlor\Api\ApiCommand implements \Froxlor\Api\Resource
 				}
 
 				// validation
-				$name = \Froxlor\Validate\Validate::validate($name, 'name', '', '', array(), true);
-				$firstname = \Froxlor\Validate\Validate::validate($firstname, 'first name', '', '', array(), true);
-				$company = \Froxlor\Validate\Validate::validate($company, 'company', '', '', array(), true);
-				$street = \Froxlor\Validate\Validate::validate($street, 'street', '', '', array(), true);
+				$name = \Froxlor\Validate\Validate::validate($name, 'name', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
+				$firstname = \Froxlor\Validate\Validate::validate($firstname, 'first name', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
+				$company = \Froxlor\Validate\Validate::validate($company, 'company', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
+				$street = \Froxlor\Validate\Validate::validate($street, 'street', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
 				$zipcode = \Froxlor\Validate\Validate::validate($zipcode, 'zipcode', '/^[0-9 \-A-Z]*$/', '', array(), true);
-				$city = \Froxlor\Validate\Validate::validate($city, 'city', '', '', array(), true);
+				$city = \Froxlor\Validate\Validate::validate($city, 'city', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
 				$phone = \Froxlor\Validate\Validate::validate($phone, 'phone', '/^[0-9\- \+\(\)\/]*$/', '', array(), true);
 				$fax = \Froxlor\Validate\Validate::validate($fax, 'fax', '/^[0-9\- \+\(\)\/]*$/', '', array(), true);
 				$idna_convert = new \Froxlor\Idna\IdnaWrapper();
@@ -998,12 +998,12 @@ class Customers extends \Froxlor\Api\ApiCommand implements \Froxlor\Api\Resource
 		// validation
 		if ($this->isAdmin()) {
 			$idna_convert = new \Froxlor\Idna\IdnaWrapper();
-			$name = \Froxlor\Validate\Validate::validate($name, 'name', '', '', array(), true);
-			$firstname = \Froxlor\Validate\Validate::validate($firstname, 'first name', '', '', array(), true);
-			$company = \Froxlor\Validate\Validate::validate($company, 'company', '', '', array(), true);
-			$street = \Froxlor\Validate\Validate::validate($street, 'street', '', '', array(), true);
+			$name = \Froxlor\Validate\Validate::validate($name, 'name', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
+			$firstname = \Froxlor\Validate\Validate::validate($firstname, 'first name', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
+			$company = \Froxlor\Validate\Validate::validate($company, 'company', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
+			$street = \Froxlor\Validate\Validate::validate($street, 'street', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
 			$zipcode = \Froxlor\Validate\Validate::validate($zipcode, 'zipcode', '/^[0-9 \-A-Z]*$/', '', array(), true);
-			$city = \Froxlor\Validate\Validate::validate($city, 'city', '', '', array(), true);
+			$city = \Froxlor\Validate\Validate::validate($city, 'city', \Froxlor\Validate\Validate::REGEX_DESC_TEXT, '', array(), true);
 			$phone = \Froxlor\Validate\Validate::validate($phone, 'phone', '/^[0-9\- \+\(\)\/]*$/', '', array(), true);
 			$fax = \Froxlor\Validate\Validate::validate($fax, 'fax', '/^[0-9\- \+\(\)\/]*$/', '', array(), true);
 			$email = $idna_convert->encode(\Froxlor\Validate\Validate::validate($email, 'email', '', '', array(), true));

lib/Froxlor/Database/Database.php

@@ -190,11 +190,17 @@ class Database
 	 */
 	public static function getSqlUsernameLength()
 	{
+		// MariaDB supports up to 80 characters but only 64 for databases and as we use the loginname also for
+		// database names, we set the limit to 64 here
+		if (strpos(strtolower(Database::getAttribute(\PDO::ATTR_SERVER_VERSION)), "mariadb") !== false) {
+			$mysql_max = 64;
+		} else {
 			// MySQL user names can be up to 32 characters long (16 characters before MySQL 5.7.8).
 			$mysql_max = 32;
 			if (version_compare(Database::getAttribute(\PDO::ATTR_SERVER_VERSION), '5.7.8', '<')) {
 				$mysql_max = 16;
 			}
+		}
 		return $mysql_max;
 	}
 

lib/Froxlor/Froxlor.php

@@ -7,7 +7,7 @@ final class Froxlor
 {
 
 	// Main version variable
-	const VERSION = '0.10.38';
+	const VERSION = '0.10.38.3';
 
 	// Database version (YYYYMMDDC where C is a daily counter)
 	const DBVERSION = '202112310';

lib/Froxlor/Settings/Store.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace Froxlor\Settings;
 
 use Froxlor\Database\Database;
@@ -63,9 +64,9 @@ class Store
 		if (count($ids) > 0) {
 			$defaultips_new = explode(',', $newfieldvalue);
 
-			if (! empty($defaultips_old) && ! empty($newfieldvalue)) {
+			if (!empty($defaultips_old) && !empty($newfieldvalue)) {
 				$in_value = $defaultips_old . ", " . $newfieldvalue;
-			} elseif (! empty($defaultips_old) && empty($newfieldvalue)) {
+			} elseif (!empty($defaultips_old) && empty($newfieldvalue)) {
 				$in_value = $defaultips_old;
 			} else {
 				$in_value = $newfieldvalue;
@@ -280,11 +281,11 @@ class Store
 		if ($returnvalue !== false && is_array($fielddata) && isset($fielddata['settinggroup']) && $fielddata['settinggroup'] == 'system' && isset($fielddata['varname']) && $fielddata['varname'] == 'mysql_access_host') {
 			$mysql_access_host_array = array_map('trim', explode(',', $newfieldvalue));
 
-			if (in_array('127.0.0.1', $mysql_access_host_array) && ! in_array('localhost', $mysql_access_host_array)) {
+			if (in_array('127.0.0.1', $mysql_access_host_array) && !in_array('localhost', $mysql_access_host_array)) {
 				$mysql_access_host_array[] = 'localhost';
 			}
 
-			if (! in_array('127.0.0.1', $mysql_access_host_array) && in_array('localhost', $mysql_access_host_array)) {
+			if (!in_array('127.0.0.1', $mysql_access_host_array) && in_array('localhost', $mysql_access_host_array)) {
 				$mysql_access_host_array[] = '127.0.0.1';
 			}
 
@@ -306,8 +307,8 @@ class Store
 
 	private static function cleanMySQLAccessHost($value)
 	{
-		if (substr($value, 0, 1) == '[' && substr($value, - 1) == ']') {
-			return substr($value, 1, - 1);
+		if (substr($value, 0, 1) == '[' && substr($value, -1) == ']') {
+			return substr($value, 1, -1);
 		}
 		return $value;
 	}
@@ -373,7 +374,7 @@ class Store
 	{
 		if (isset($fielddata['settinggroup'], $fielddata['varname']) && is_array($fielddata) && $fielddata['settinggroup'] !== '' && $fielddata['varname'] !== '') {
 			$save_to = null;
-            $path = \Froxlor\Froxlor::getInstallDir().'/img/';
+			$path = \Froxlor\Froxlor::getInstallDir() . '/img/';
 			$path = \Froxlor\FileDir::makeCorrectDir($path);
 
 			// New file?
@@ -391,8 +392,18 @@ class Store
 				}
 
 				// Make sure mime-type matches an image
-                if (!in_array(mime_content_type($_FILES[$fieldname]['tmp_name']), ['image/jpeg','image/jpg','image/png','image/gif'])) {
-                    throw new \Exception("Uploaded file not a valid image");
+				if (function_exists('finfo_open')) {
+					$finfo = finfo_open(FILEINFO_MIME_TYPE);
+					$mimetype = finfo_file($finfo, $_FILES[$fieldname]['tmp_name']);
+					finfo_close($finfo);
+				} else {
+					$mimetype = mime_content_type($_FILES[$fieldname]['tmp_name']);
+				}
+				if (empty($mimetype)) {
+					$mimetype = 'application/octet-stream';
+				}
+				if (!in_array($mimetype, ['image/jpeg', 'image/jpg', 'image/png', 'image/gif'])) {
+					throw new \Exception("Uploaded file is not a valid image");
 				}
 
 				// Determine file extension
@@ -400,16 +411,25 @@ class Store
 				$file_extension = strtolower(array_pop($spl));
 				unset($spl);
 
+				if (!in_array($file_extension, [
+					'jpeg',
+					'jpg',
+					'png',
+					'gif'
+				])) {
+					throw new Exception("Invalid file-extension, use one of: jpeg, jpg, png, gif");
+				}
+
 				// Move file
-                if (!move_uploaded_file($_FILES[$fieldname]['tmp_name'], $path.$fielddata['image_name'].'.'.$file_extension)) {
+				if (!move_uploaded_file($_FILES[$fieldname]['tmp_name'], $path . $fielddata['image_name'] . '.' . $file_extension)) {
 					throw new \Exception("Unable to save image to img folder");
 				}
 
-                $save_to = 'img/'.$fielddata['image_name'].'.'.$file_extension.'?v='.time();
+				$save_to = 'img/' . $fielddata['image_name'] . '.' . $file_extension . '?v=' . time();
 			}
 
 			// Delete file?
-            if ($fielddata['value'] !== "" && array_key_exists($fieldname.'_delete', $_POST) && $_POST[$fieldname.'_delete']) {
+			if ($fielddata['value'] !== "" && array_key_exists($fieldname . '_delete', $_POST) && $_POST[$fieldname . '_delete']) {
 				@unlink(\Froxlor\Froxlor::getInstallDir() . '/' . explode('?', $fielddata['value'], 2)[0]);
 				$save_to = '';
 			}

lib/init.php

@@ -59,7 +59,7 @@ header('Expires: ' . gmdate('D, d M Y H:i:s \G\M\T', time()));
 // Inline-JS is no longer allowed and used
 // See: http://people.mozilla.org/~bsterne/content-security-policy/index.html
 // New stuff see: https://www.owasp.org/index.php/List_of_useful_HTTP_headers and https://www.owasp.org/index.php/Content_Security_Policy
-$csp_content = "default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self';";
+$csp_content = "default-src 'self'; script-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self'; object-src 'self'; frame-src 'self'; frame-ancestors 'self';";
 header("Content-Security-Policy: " . $csp_content);
 header("X-Content-Security-Policy: " . $csp_content);
 header("X-WebKit-CSP: " . $csp_content);

lng/english.lng.php

@@ -673,6 +673,7 @@ $lng['admin']['message'] = 'Write a Message';
 $lng['admin']['text'] = 'Message';
 $lng['menu']['message'] = 'Messages';
 $lng['error']['errorsendingmail'] = 'The message to "%s" failed';
+$lng['error']['errorsendingmailpub'] = 'The message to the given email-address failed';
 $lng['error']['cannotreaddir'] = 'Unable to read directory "%s"';
 $lng['message']['success'] = 'Successfully sent message to %s recipients';
 $lng['message']['norecipients'] = 'No e-mail has been sent because there are no recipients in the database';
@@ -760,7 +761,7 @@ $lng['pwdreminder']['success'] = 'Password reset successfully requested. Please
 // ADDED IN 1.2.19-svn18
 
 $lng['serversettings']['allow_password_reset']['title'] = 'Allow password reset by customers';
-$lng['pwdreminder']['notallowed'] = 'Password reset is disabled';
+$lng['pwdreminder']['notallowed'] = 'Unknown user or password reset is disabled';
 
 // ADDED IN 1.2.19-svn21
 
@@ -2139,4 +2140,7 @@ $lng['error']['pathmustberelative'] = 'The user does not have the permission to
 $lng['serversettings']['acmeshpath']['title'] = 'Path to acme.sh';
 $lng['serversettings']['acmeshpath']['description'] = 'Set this to where acme.sh is installed to, including the acme.sh script<br>Default is <b>/root/.acme.sh/acme.sh</b>';
 
-$lng['question']['api_reallydelete'] = 'Do you really want to delete the api-key #%d?';
+$lng['question']['api_reallydelete'] = 'Do you really want to delete the api-key?';
+$lng['question']['api_reallyadd'] = 'Do you really want to create a new api-key?';
+$lng['question']['dnsentry_reallydelete'] = 'Do you really want to delete the dns entry?';
+$lng['question']['certificate_reallydelete'] = 'Do you really want to delete the certificate?';

lng/german.lng.php

@@ -666,6 +666,7 @@ $lng['admin']['message'] = 'Rundmail senden';
 $lng['admin']['text'] = 'Nachricht';
 $lng['menu']['message'] = 'Nachrichten';
 $lng['error']['errorsendingmail'] = 'Das Versenden der Nachricht an "%s" schlug fehl.';
+$lng['error']['errorsendingmailpub'] = 'Das Versenden der Nachricht an die angegebene E-Mail Adresse schlug fehl.';
 $lng['error']['cannotreaddir'] = 'Der Ordner "%s" kann nicht gelesen werden';
 $lng['message']['success'] = 'Nachricht erfolgreich an "%s" Empfänger gesendet';
 $lng['message']['norecipients'] = 'Es wurde keine E-Mail versendet, da sich keine Empfänger in der Datenbank befinden';
@@ -753,7 +754,7 @@ $lng['pwdreminder']['success'] = 'Das Zurücksetzen des Passworts wurde erfolgre
 // ADDED IN 1.2.19-svn18
 
 $lng['serversettings']['allow_password_reset']['title'] = 'Erlaube das Zurücksetzen des Kundenpassworts.';
-$lng['pwdreminder']['notallowed'] = 'Das Zurücksetzen des Passworts ist deaktiviert.';
+$lng['pwdreminder']['notallowed'] = 'Unbekannter Benutzer oder Zurücksetzen des Passworts ist deaktiviert.';
 
 // ADDED IN 1.2.19-svn21
 
@@ -1785,4 +1786,7 @@ $lng['error']['pathmustberelative'] = 'Der Benutzer hat nicht die benötigten Be
 $lng['serversettings']['acmeshpath']['title'] = 'Pfad zu acme.sh';
 $lng['serversettings']['acmeshpath']['description'] = 'Installationspfad zu acme.sh, inklusive acme.sh Script<br>Standard ist <b>/root/.acme.sh/acme.sh</b>';
 
-$lng['question']['api_reallydelete'] = 'Api-Key #%d wirklich löschen?';
+$lng['question']['api_reallydelete'] = 'Api-Key wirklich löschen?';
+$lng['question']['api_reallyadd'] = 'Einen neuen Api-Key erstellen?';
+$lng['question']['dnsentry_reallydelete'] = 'Zonen-Eintrag wirklich löschen?';
+$lng['question']['certificate_reallydelete'] = 'Zertifikat wirklich löschen?';

ssl_certificates.php

@@ -29,8 +29,9 @@ $success_message = "";
 
 // do the delete and then just show a success-message and the certificates list again
 if ($action == 'delete') {
-	$id = isset($_GET['id']) ? (int) $_GET['id'] : 0;
+	$id = isset($_POST['id']) ? (int) $_POST['id'] : (isset($_GET['id']) ? (int) $_GET['id'] : 0);
 	if ($id > 0) {
+		if (isset($_POST['send']) && $_POST['send'] == 'send') {
 			try {
 				$json_result = Certificates::getLocal($userinfo, array(
 					'id' => $id
@@ -39,6 +40,13 @@ if ($action == 'delete') {
 			} catch (Exception $e) {
 				\Froxlor\UI\Response::dynamic_error($e->getMessage());
 			}
+		} else {
+			\Froxlor\UI\HTML::askYesNo('certificate_reallydelete', $filename, array(
+				'page' => $page,
+				'action' => $action,
+				'id' => $id
+			), $id);
+		}
 	}
 }
 

tests/Froxlor/ValidateTest.php

@@ -198,7 +198,7 @@ class ValidateTest extends TestCase
 		$result = Validate::validateUsername('web123sql2', true, $mysql_max);
 		$this->assertTrue($result);
 		// too long
-		$result = Validate::validateUsername('myperfectsuperduperwebuser123sql2', true, $mysql_max);
+		$result = Validate::validateUsername('myperfectsuperduperwebuserwhosnameisenormouslylongandprettyandshouldinnowaybeaccepted123sql2', true, $mysql_max);
 		$this->assertFalse($result);
 		// not unix-conform
 		$result = Validate::validateUsername('web123-sql2', true, $mysql_max);