diff --git a/interface/lib/classes/auth.inc.php b/interface/lib/classes/auth.inc.php index e281c032db662aa1ee63f30d6bb1a52625d9b8dd..4c977572267277c6add039dd5f0b282446ad26ea 100644 --- a/interface/lib/classes/auth.inc.php +++ b/interface/lib/classes/auth.inc.php @@ -222,6 +222,56 @@ class auth { $salt.="$"; return crypt($cleartext_password, $salt); } + + public function csrf_token_get($form_name) { + /* CSRF PROTECTION */ + // generate csrf protection id and key + $_csrf_id = uniqid($form_name . '_'); // form id + $_csrf_key = sha1(uniqid(microtime(true), true)); // the key + if(!isset($_SESSION['_csrf'])) $_SESSION['_csrf'] = array(); + if(!isset($_SESSION['_csrf_timeout'])) $_SESSION['_csrf_timeout'] = array(); + $_SESSION['_csrf'][$_csrf_id] = $_csrf_key; + $_SESSION['_csrf_timeout'][$_csrf_id] = time() + 3600; // timeout hash in 1 hour + + return array('csrf_id' => $_csrf_id,'csrf_key' => $_csrf_key); + } + + public function csrf_token_check() { + global $app; + + if(isset($_POST) && is_array($_POST)) { + $_csrf_valid = false; + if(isset($_POST['_csrf_id']) && isset($_POST['_csrf_key'])) { + $_csrf_id = trim($_POST['_csrf_id']); + $_csrf_key = trim($_POST['_csrf_key']); + if(isset($_SESSION['_csrf']) && isset($_SESSION['_csrf'][$_csrf_id]) && isset($_SESSION['_csrf_timeout']) && isset($_SESSION['_csrf_timeout'][$_csrf_id])) { + if($_SESSION['_csrf'][$_csrf_id] === $_csrf_key && $_SESSION['_csrf_timeout'] >= time()) $_csrf_valid = true; + } + } + if($_csrf_valid !== true) { + $app->log('CSRF attempt blocked. Referer: ' . (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : 'unknown'), LOGLEVEL_WARN); + $app->error($app->lng('err_csrf_attempt_blocked')); + } + $_SESSION['_csrf'][$_csrf_id] = null; + $_SESSION['_csrf_timeout'][$_csrf_id] = null; + unset($_SESSION['_csrf'][$_csrf_id]); + unset($_SESSION['_csrf_timeout'][$_csrf_id]); + + if(isset($_SESSION['_csrf_timeout']) && is_array($_SESSION['_csrf_timeout'])) { + $to_unset = array(); + foreach($_SESSION['_csrf_timeout'] as $_csrf_id => $timeout) { + if($timeout < time()) $to_unset[] = $_csrf_id; + } + foreach($to_unset as $_csrf_id) { + $_SESSION['_csrf'][$_csrf_id] = null; + $_SESSION['_csrf_timeout'][$_csrf_id] = null; + unset($_SESSION['_csrf'][$_csrf_id]); + unset($_SESSION['_csrf_timeout'][$_csrf_id]); + } + unset($to_unset); + } + } + } } diff --git a/interface/lib/classes/tform_base.inc.php b/interface/lib/classes/tform_base.inc.php index 104217db57eb7ff99fd91a38143cd8627b134ff5..784e96a448fe49f2407987cb2f080480edc717cf 100644 --- a/interface/lib/classes/tform_base.inc.php +++ b/interface/lib/classes/tform_base.inc.php @@ -416,12 +416,10 @@ class tform_base { /* CSRF PROTECTION */ // generate csrf protection id and key - $_csrf_id = uniqid($this->formDef['name'] . '_'); - $_csrf_value = sha1(uniqid(microtime(true), true)); - if(!isset($_SESSION['_csrf'])) $_SESSION['_csrf'] = array(); - if(!isset($_SESSION['_csrf_timeout'])) $_SESSION['_csrf_timeout'] = array(); - $_SESSION['_csrf'][$_csrf_id] = $_csrf_value; - $_SESSION['_csrf_timeout'][$_csrf_id] = time() + 3600; // timeout hash in 1 hour + $csrf_token = $app->auth->csrf_token_get($this->formDef['name']); + $_csrf_id = $csrf_token['csrf_id']; + $_csrf_value = $csrf_token['csrf_key']; + $this->formDef['tabs'][$tab]['fields']['_csrf_id'] = array( 'datatype' => 'VARCHAR', 'formtype' => 'TEXT', @@ -714,10 +712,6 @@ class tform_base { unset($_POST); unset($record); } - $_SESSION['_csrf'][$_csrf_id] = null; - $_SESSION['_csrf_timeout'][$_csrf_id] = null; - unset($_SESSION['_csrf'][$_csrf_id]); - unset($_SESSION['_csrf_timeout'][$_csrf_id]); if(isset($_SESSION['_csrf_timeout']) && is_array($_SESSION['_csrf_timeout'])) { $to_unset = array(); diff --git a/interface/lib/lang/de.lng b/interface/lib/lang/de.lng index 1fc1152558a023be746430c57791445239ace5c2..fb35c30bda012869f3cc84b1f69cd7a1a5adfb4e 100644 --- a/interface/lib/lang/de.lng +++ b/interface/lib/lang/de.lng @@ -43,6 +43,7 @@ $wb['top_menu_dashboard'] = 'Übersicht'; $wb['latest_news_txt'] = 'Neuigkeiten'; $wb['err_csrf_attempt_blocked'] = 'CSRF-Versuch blockiert.'; $wb['top_menu_vm'] = 'vServer'; +$wb['err_csrf_attempt_blocked'] = 'CSRF-Versuch blockiert.'; $wb['daynamesmin_su'] = 'So'; $wb['daynamesmin_mo'] = 'Mo'; $wb['daynamesmin_tu'] = 'Di'; diff --git a/interface/web/admin/language_add.php b/interface/web/admin/language_add.php index 8c488c34c97618ca2c23f9bb0948f00645157906..f58a2db16dbb6ce159149a8a6e17e86e9a7b6ddc 100644 --- a/interface/web/admin/language_add.php +++ b/interface/web/admin/language_add.php @@ -65,6 +65,10 @@ $app->tpl->setVar('language_option', $language_option); $app->tpl->setVar('error', $error); if(isset($_POST['lng_new']) && strlen($_POST['lng_new']) == 2 && $error == '') { + + //* CSRF Check + $app->auth->csrf_token_check(); + $lng_new = $_POST['lng_new']; if(!preg_match("/^[a-z]{2}$/i", $lng_new)) die('unallowed characters in language name.'); @@ -94,6 +98,11 @@ if(isset($_POST['lng_new']) && strlen($_POST['lng_new']) == 2 && $error == '') { $app->tpl->setVar('msg', $msg); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('language_add'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + //* load language file $lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_add.lng'; include $lng_file; diff --git a/interface/web/admin/language_complete.php b/interface/web/admin/language_complete.php index d8f4bbda8616a57a8ce563564e6be70a0aaa90a0..d28e89aa2576ee51d8b6e41030c10fdbded2c3c4 100644 --- a/interface/web/admin/language_complete.php +++ b/interface/web/admin/language_complete.php @@ -67,6 +67,9 @@ $app->tpl->setVar('error', $error); // Export the language file if(isset($_POST['lng_select']) && $error == '') { + //* CSRF Check + $app->auth->csrf_token_check(); + // complete the global langauge file merge_langfile(ISPC_LIB_PATH."/lang/".$selected_language.".lng", ISPC_LIB_PATH."/lang/en.lng"); @@ -157,6 +160,11 @@ function merge_langfile($langfile, $masterfile) { $app->tpl->setVar('msg', $msg); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('language_merge'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + //* load language file $lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_complete.lng'; include $lng_file; diff --git a/interface/web/admin/language_edit.php b/interface/web/admin/language_edit.php index 7d83b9bb7479dc1276f912d933dd68210b768aef..c94a5eb2804ed1ef0323a960d49ef58e2c621f5e 100644 --- a/interface/web/admin/language_edit.php +++ b/interface/web/admin/language_edit.php @@ -55,6 +55,10 @@ $msg = ''; //* Save data if(isset($_POST['records']) && is_array($_POST['records'])) { + + //* CSRF Check + $app->auth->csrf_token_check(); + $file_content = " $val) { $val = stripslashes($val); @@ -93,6 +97,11 @@ if(isset($wb) && is_array($wb)) { unset($wb); } +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('language_edit'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + //* load language file $lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_edit.lng'; diff --git a/interface/web/admin/language_import.php b/interface/web/admin/language_import.php index d53575ba26d456e073dd06fdc7d417f7a2537ac0..00d105cc67e7b8260703361971b4bfefb732bd9f 100644 --- a/interface/web/admin/language_import.php +++ b/interface/web/admin/language_import.php @@ -129,6 +129,10 @@ $error = ''; // Export the language file if(isset($_FILES['file']['name']) && is_uploaded_file($_FILES['file']['tmp_name'])) { + + //* CSRF Check + $app->auth->csrf_token_check(); + $lines = file($_FILES['file']['tmp_name']); // initial check $parts = explode('|', $lines[0]); @@ -183,6 +187,11 @@ if(isset($_FILES['file']['name']) && is_uploaded_file($_FILES['file']['tmp_name' $app->tpl->setVar('msg', $msg); $app->tpl->setVar('error', $error); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('language_import'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + //* load language file $lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_import.lng'; include $lng_file; diff --git a/interface/web/admin/remote_action_ispcupdate.php b/interface/web/admin/remote_action_ispcupdate.php index 263400665873c71a00137bcfb8d2e8d423e7bd5a..f22661e1d47282215c4921f04241f7bfe9407154 100644 --- a/interface/web/admin/remote_action_ispcupdate.php +++ b/interface/web/admin/remote_action_ispcupdate.php @@ -66,6 +66,10 @@ $msg = ''; //* Note: Disabled post action if (1 == 0 && isset($_POST['server_select'])) { + + //* CSRF Check + $app->auth->csrf_token_check(); + $server = $_POST['server_select']; $servers = array(); if ($server == '*') { @@ -88,6 +92,11 @@ if (1 == 0 && isset($_POST['server_select'])) { $app->tpl->setVar('msg', $msg); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('ispupdate'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + $app->tpl->setVar($wb); $app->tpl_defaults(); diff --git a/interface/web/admin/remote_action_osupdate.php b/interface/web/admin/remote_action_osupdate.php index 8f48e29f2d472d6937c37e73af54237c3f0f8bd3..5e73cdfd0f874bccc5d3ee780112ea56113cff35 100644 --- a/interface/web/admin/remote_action_osupdate.php +++ b/interface/web/admin/remote_action_osupdate.php @@ -62,6 +62,10 @@ $msg = ''; * If the user wants to do the action, write this to our db */ if (isset($_POST['server_select'])) { + + //* CSRF Check + $app->auth->csrf_token_check(); + $server = $_POST['server_select']; $servers = array(); if ($server == '*') { @@ -84,6 +88,11 @@ if (isset($_POST['server_select'])) { $app->tpl->setVar('msg', $msg); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('osupdate'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + $app->tpl->setVar($wb); $app->tpl_defaults(); diff --git a/interface/web/admin/server_config_edit.php b/interface/web/admin/server_config_edit.php index d64b6dd7dbae3b45eeb9c7133268c4689d9c9889..4c03e7ee431ef77f8358bfee0b98d1b59048f49b 100644 --- a/interface/web/admin/server_config_edit.php +++ b/interface/web/admin/server_config_edit.php @@ -93,10 +93,14 @@ class page_action extends tform_actions { } } - $server_config_array[$section] = $app->tform->encode($this->dataRecord, $section); - $server_config_str = $app->ini_parser->get_ini_string($server_config_array); + if($app->tform->errorMessage == '') { + $server_config_array[$section] = $app->tform->encode($this->dataRecord, $section); + $server_config_str = $app->ini_parser->get_ini_string($server_config_array); - $app->db->datalogUpdate('server', array("config" => $server_config_str), 'server_id', $server_id); + $app->db->datalogUpdate('server', array("config" => $server_config_str), 'server_id', $server_id); + } else { + $app->error('Security breach!'); + } } } diff --git a/interface/web/client/client_message.php b/interface/web/client/client_message.php index 0e3bd2e9fec9f0885eac5b11baf5fd949266534c..eb8bcdbae244e1e5a93958cd2a3f8cabf042ffb6 100644 --- a/interface/web/client/client_message.php +++ b/interface/web/client/client_message.php @@ -51,7 +51,10 @@ $error = ''; //* Save data if(isset($_POST) && count($_POST) > 1) { - + + //* CSRF Check + $app->auth->csrf_token_check(); + //* Check values if(!preg_match("/^\w+[\w\.\-\+]*\w{0,}@\w+[\w.-]*\w+\.[a-zA-Z0-9\-]{2,30}$/i", $_POST['sender'])) $error .= $wb['sender_invalid_error'].'
'; if(empty($_POST['subject'])) $error .= $wb['subject_invalid_error'].'
'; @@ -161,6 +164,11 @@ if(!empty($field_names) && is_array($field_names)){ } $app->tpl->setVar('message_variables', trim($message_variables)); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('client_message'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + $app->tpl->setVar('okmsg', $msg); $app->tpl->setVar('error', $error); diff --git a/interface/web/dns/dns_wizard.php b/interface/web/dns/dns_wizard.php index 198245b29315a69218356c82b316da67c4a2b5a0..18002593dffb2561c8fb58606b900957504bb2dd 100644 --- a/interface/web/dns/dns_wizard.php +++ b/interface/web/dns/dns_wizard.php @@ -197,7 +197,10 @@ if ($domains_settings['use_domain_module'] == 'y') { } if($_POST['create'] == 1) { - + + //* CSRF Check + $app->auth->csrf_token_check(); + $error = ''; if ($post_server_id) @@ -430,6 +433,11 @@ if($_POST['create'] == 1) { $app->tpl->setVar("title", 'DNS Wizard'); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('dns_wizard'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + $lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_dns_wizard.lng'; include $lng_file; $app->tpl->setVar($wb); diff --git a/interface/web/sites/lib/lang/ar_shell_user.lng b/interface/web/sites/lib/lang/ar_shell_user.lng index 0b274d33aa34dc0c3e0b4f4ed4c688ea39bf9672..eac85fd35b33884f45c66e07e3c16a728b3e35c1 100644 --- a/interface/web/sites/lib/lang/ar_shell_user.lng +++ b/interface/web/sites/lib/lang/ar_shell_user.lng @@ -1,6 +1,6 @@ \ No newline at end of file + + + \ No newline at end of file diff --git a/interface/web/tools/dns_import_tupa.php b/interface/web/tools/dns_import_tupa.php index b81a83bdec6277f32bcf5842312a49842fea5ac3..849a097680f74a6f7bd68584340f3fc4c76fa1f0 100644 --- a/interface/web/tools/dns_import_tupa.php +++ b/interface/web/tools/dns_import_tupa.php @@ -45,6 +45,9 @@ $error = ''; // Resyncing dns zones if(isset($_POST['start']) && $_POST['start'] == 1) { + + //* CSRF Check + $app->auth->csrf_token_check(); //* Set variable sin template $app->tpl->setVar('dbhost', $_POST['dbhost']); @@ -181,6 +184,10 @@ if(isset($_POST['start']) && $_POST['start'] == 1) { $app->tpl->setVar('msg', $msg); $app->tpl->setVar('error', $error); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('dns_import'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); $app->tpl_defaults(); $app->tpl->pparse(); diff --git a/interface/web/tools/import_ispconfig.php b/interface/web/tools/import_ispconfig.php index 0998d1840ef049e43116858636089f0cec814ccd..efcf022506e91230df23b9e3c668f32c74c81c75 100644 --- a/interface/web/tools/import_ispconfig.php +++ b/interface/web/tools/import_ispconfig.php @@ -49,6 +49,10 @@ include $lng_file; $app->tpl->setVar($wb); if(isset($_POST['connected'])) { + + //* CSRF Check + $app->auth->csrf_token_check(); + $connected = $app->functions->intval($_POST['connected']); if($connected == 0) { @@ -133,6 +137,11 @@ $app->tpl->setVar('remote_session_id', $remote_session_id); $app->tpl->setVar('msg', $msg); $app->tpl->setVar('error', $error); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('ispconfig_import'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + $app->tpl_defaults(); $app->tpl->pparse(); diff --git a/interface/web/tools/resync.php b/interface/web/tools/resync.php index e99e5119db4abcfcaa4a1503ff027e8d19f8d491..2e6af49d77adc48fc072e4365151f1fb1b39a95a 100644 --- a/interface/web/tools/resync.php +++ b/interface/web/tools/resync.php @@ -368,6 +368,10 @@ class page_action extends tform_actions { } } + $csrf_token = $app->auth->csrf_token_get('tools_resync'); + $app->tpl->setVar('_csrf_id', $csrf_token['csrf_id']); + $app->tpl->setVar('_csrf_key', $csrf_token['csrf_key']); + parent::onShowEnd(); } @@ -418,7 +422,12 @@ class page_action extends tform_actions { function onSubmit() { global $app; - + + if(isset($_POST) && count($_POST) > 1) { + //* CSRF Check + $app->auth->csrf_token_check(); + } + //* all services if($this->dataRecord['resync_all'] == 1) { $this->dataRecord['resync_sites'] = 1; diff --git a/interface/web/vm/openvz_action.php b/interface/web/vm/openvz_action.php index 757f55e8b63d3006016a6aea1395767fbf60bca8..4b429eb44d5cdd889a0f79f5b564e53eb89deb1a 100644 --- a/interface/web/vm/openvz_action.php +++ b/interface/web/vm/openvz_action.php @@ -17,6 +17,10 @@ $notify_msg = ''; if($vm_id == 0) die('Invalid VM ID'); +if(isset($_POST) && count($_POST) > 1) { + //* CSRF Check + $app->auth->csrf_token_check(); +} $vm = $app->db->queryOneRecord("SELECT server_id, veid FROM openvz_vm WHERE vm_id = ?", $vm_id); $veid = $app->functions->intval($vm['veid']); $server_id = $app->functions->intval($vm['server_id']); @@ -112,6 +116,11 @@ if($action == 'show') { $app->tpl->setVar($options); $app->tpl->setVar('error', $error_msg); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('openvz_action'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + $app->tpl_defaults(); $app->tpl->pparse(); diff --git a/server/plugins-available/shelluser_base_plugin.inc.php b/server/plugins-available/shelluser_base_plugin.inc.php index a0ae9a51f1eec6e3fb54a115627cb34a72ec3aef..d66428b78195c15b246310cecfac2e8b87013b03 100755 --- a/server/plugins-available/shelluser_base_plugin.inc.php +++ b/server/plugins-available/shelluser_base_plugin.inc.php @@ -237,7 +237,7 @@ class shelluser_base_plugin { $app->system->chgrp(escapeshellcmd($data['new']['dir'].'/home'),escapeshellcmd($data['new']['pgroup'])); } $app->file->mkdirs(escapeshellcmd($homedir), '0750'); - $app->system->chown(escapeshellcmd($homedir),escapeshellcmd($data['new']['username'])); + $app->system->chown(escapeshellcmd($homedir),escapeshellcmd($data['new']['puser'])); $app->system->chgrp(escapeshellcmd($homedir),escapeshellcmd($data['new']['pgroup'])); $app->system->web_folder_protection($web['document_root'], true); } else { @@ -407,6 +407,12 @@ class shelluser_base_plugin { } $sshrsa = trim($sshrsa); $usrdir = escapeshellcmd($this->data['new']['dir']); + //* Home directory of the new shell user + if($this->data['new']['chroot'] == 'jailkit') { + $usrdir = escapeshellcmd($this->data['new']['dir']); + } else { + $usrdir = escapeshellcmd($this->data['new']['dir'].'/home/'.$this->data['new']['username']); + } $sshdir = $usrdir.'/.ssh'; $sshkeys= $usrdir.'/.ssh/authorized_keys';