diff --git a/install/sql/ispconfig3.sql b/install/sql/ispconfig3.sql index 6fa9e3561d5e5b678d43108eb28640039f3704a7..d2df925babe0c6b8de7a0d30b68520387bb90bb4 100644 --- a/install/sql/ispconfig3.sql +++ b/install/sql/ispconfig3.sql @@ -1057,8 +1057,9 @@ CREATE TABLE `web_domain` ( `ssl_bundle` mediumtext NULL, `ssl_action` varchar(16) NULL, `stats_password` varchar(255) default NULL, - `allow_override` varchar(32) NOT NULL default 'All', + `allow_override` varchar(255) NOT NULL default 'All', `apache_directives` text, + `php_open_basedir` text, `active` enum('n','y') NOT NULL default 'y', PRIMARY KEY (`domain_id`) ) ENGINE=MyISAM AUTO_INCREMENT=1; diff --git a/install/tpl/server.ini.master b/install/tpl/server.ini.master index 240a8fa3346e199b4778a256ac8e9899bcb2f899..ee2cb9459447ed4d60cadc0ef7f4f7dba0ab4405 100644 --- a/install/tpl/server.ini.master +++ b/install/tpl/server.ini.master @@ -44,6 +44,8 @@ group=www-data apps_vhost_port=8081 apps_vhost_ip=_default_ apps_vhost_servername= +php_open_basedir=[website_path]/web:[website_path]/tmp:/usr/share/php5:/tmp:/usr/share/phpmyadmin +htaccess_allow_override=All [dns] bind_user=root diff --git a/interface/web/admin/form/server_config.tform.php b/interface/web/admin/form/server_config.tform.php index 9119507b3007789e6d2c4c0fb7001026c325ceeb..631df038892fe1cdefb5c549e268aecf92076484 100644 --- a/interface/web/admin/form/server_config.tform.php +++ b/interface/web/admin/form/server_config.tform.php @@ -387,6 +387,28 @@ $form["tabs"]['web'] = array ( 'width' => '40', 'maxlength' => '255' ), + 'php_open_basedir' => array ( + 'datatype' => 'VARCHAR', + 'formtype' => 'TEXT', + 'default' => '', + 'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY', + 'errmsg'=> 'php_open_basedir_error_empty'), + ), + 'value' => '', + 'width' => '40', + 'maxlength' => '255' + ), + 'htaccess_allow_override' => array ( + 'datatype' => 'VARCHAR', + 'formtype' => 'TEXT', + 'default' => '', + 'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY', + 'errmsg'=> 'htaccess_allow_override_error_empty'), + ), + 'value' => '', + 'width' => '40', + 'maxlength' => '255' + ), 'apps_vhost_port' => array ( 'datatype' => 'VARCHAR', 'formtype' => 'TEXT', diff --git a/interface/web/admin/lib/lang/en_server_config.lng b/interface/web/admin/lib/lang/en_server_config.lng index 890d8e494987b95ba2d76ad05add4122fb37abd4..603245d7d40016568ef67ad33a98b3ede60d4979 100644 --- a/interface/web/admin/lib/lang/en_server_config.lng +++ b/interface/web/admin/lib/lang/en_server_config.lng @@ -61,4 +61,8 @@ $wb["named_conf_path_error_empty"] = 'BIND named.conf path is empty.'; $wb["named_conf_local_path_error_empty"] = 'BIND named.conf.local path is empty.'; $wb["mail_filter_syntax_txt"] = 'Mailfilter Syntax'; $wb["pop3_imap_daemon_txt"] = 'POP3/IMAP Daemon'; +$wb["php_open_basedir_txt"] = 'PHP open_basedir'; +$wb["php_open_basedir_error_empty"] = 'PHP open_basedir is empty.'; +$wb["htaccess_allow_override_txt"] = '.htaccess AllowOverride'; +$wb["htaccess_allow_override_error_empty"] = '.htaccess AllowOverride is empty.'; ?> \ No newline at end of file diff --git a/interface/web/admin/templates/server_config_web_edit.htm b/interface/web/admin/templates/server_config_web_edit.htm index ca1c3aed90b73597cdc351f2433d3aecd6f064ce..cfe9c7e046b3471b598545b17d24cd4f7ecd07cf 100644 --- a/interface/web/admin/templates/server_config_web_edit.htm +++ b/interface/web/admin/templates/server_config_web_edit.htm @@ -16,7 +16,7 @@
-
+
@@ -42,6 +42,14 @@
+ + +
+
+ + +
+
diff --git a/interface/web/sites/form/web_domain.tform.php b/interface/web/sites/form/web_domain.tform.php index 882a784ee78e9f6e85544cebcc83429b596eefa4..182ce126644e8c67e677a85674eea262338c43a3 100644 --- a/interface/web/sites/form/web_domain.tform.php +++ b/interface/web/sites/form/web_domain.tform.php @@ -403,7 +403,18 @@ $form["tabs"]['advanced'] = array ( 'datatype' => 'VARCHAR', 'formtype' => 'TEXT', 'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY', - 'errmsg'=> 'documentroot_error_empty'), + 'errmsg'=> 'allow_override_error_empty'), + ), + 'default' => 'All', + 'value' => '', + 'width' => '30', + 'maxlength' => '255' + ), + 'php_open_basedir' => array ( + 'datatype' => 'VARCHAR', + 'formtype' => 'TEXT', + 'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY', + 'errmsg'=> 'php_open_basedir_error_empty'), ), 'default' => 'All', 'value' => '', diff --git a/interface/web/sites/templates/web_domain_advanced.htm b/interface/web/sites/templates/web_domain_advanced.htm index 3e70de941e95cbdef4a076002ee249ea0ebe9845..a9b9d026493c51ba9de1b6b9b8ea840ce70eb28e 100644 --- a/interface/web/sites/templates/web_domain_advanced.htm +++ b/interface/web/sites/templates/web_domain_advanced.htm @@ -19,7 +19,11 @@
-
+
+ + +
diff --git a/interface/web/sites/web_domain_edit.php b/interface/web/sites/web_domain_edit.php index 5887be6e01bd7e6c959e7cd6457cf4a38acf81d1..e874387145c150204c3bb16959008b1eb4b7f09f 100644 --- a/interface/web/sites/web_domain_edit.php +++ b/interface/web/sites/web_domain_edit.php @@ -293,11 +293,13 @@ class page_action extends tform_actions { } // Set the values for document_root, system_user and system_group - $system_user = 'web'.$this->id; - $system_group = 'client'.$client_id; - $document_root = str_replace("[client_id]",$client_id,$document_root); + $system_user = $app->db->quote('web'.$this->id); + $system_group = $app->db->quote('client'.$client_id); + $document_root = $app->db->quote(str_replace("[client_id]",$client_id,$document_root)); + $php_open_basedir = $app->db->quote(str_replace("[website_path]",$document_root,$web_config["php_open_basedir"])); + $htaccess_allow_override = $app->db->quote($web_config["htaccess_allow_override"]); - $sql = "UPDATE web_domain SET system_user = '$system_user', system_group = '$system_group', document_root = '$document_root' WHERE domain_id = ".$this->id; + $sql = "UPDATE web_domain SET system_user = '$system_user', system_group = '$system_group', document_root = '$document_root', allow_override = '$htaccess_allow_override', php_open_basedir = '$php_open_basedir' WHERE domain_id = ".$this->id; $app->db->query($sql); } @@ -372,9 +374,9 @@ class page_action extends tform_actions { if(($_SESSION["s"]["user"]["typ"] == 'admin' || $app->auth->has_clients($_SESSION['s']['user']['userid'])) && isset($this->dataRecord["client_group_id"]) && $this->dataRecord["client_group_id"] != $this->oldDataRecord["client_group_id"]) { // Set the values for document_root, system_user and system_group - $system_user = 'web'.$this->id; - $system_group = 'client'.$client_id; - $document_root = str_replace("[client_id]",$client_id,$document_root); + $system_user = $app->db->quote('web'.$this->id); + $system_group = $app->db->quote('client'.$client_id); + $document_root = $app->db->quote(str_replace("[client_id]",$client_id,$document_root)); $sql = "UPDATE web_domain SET system_user = '$system_user', system_group = '$system_group', document_root = '$document_root' WHERE domain_id = ".$this->id; //$sql = "UPDATE web_domain SET system_user = '$system_user', system_group = '$system_group' WHERE domain_id = ".$this->id; @@ -393,6 +395,17 @@ class page_action extends tform_actions { unset($subdomain); } + //* Set allow_override and php_open_basedir if empty + if($web_rec['allow_override'] == '') { + $sql = "UPDATE web_domain SET allow_override = '".$app->db->quote($web_config["htaccess_allow_override"])."' WHERE domain_id = ".$this->id; + $app->db->query($sql); + } + if($web_rec['php_open_basedir'] == '') { + $php_open_basedir = $app->db->quote(str_replace("[website_path]",$document_root,$web_config["php_open_basedir"])); + $sql = "UPDATE web_domain SET php_open_basedir = '$php_open_basedir' WHERE domain_id = ".$this->id; + $app->db->query($sql); + } + } function onAfterDelete() { diff --git a/server/conf/php-cgi-starter.master b/server/conf/php-cgi-starter.master index 94b36649336601413327f5c628a0c4897a02f5cf..3c00f9dba86d13dd721a0d72c4595f36daaaaefc 100644 --- a/server/conf/php-cgi-starter.master +++ b/server/conf/php-cgi-starter.master @@ -2,6 +2,6 @@ exec \ -d open_basedir= \ --d upload_tmp_dir=/tmp \ --d session.save_path=/tmp +-d upload_tmp_dir=/tmp \ +-d session.save_path=/tmp # -d safe_mode=${SAFE_MODE} \ No newline at end of file diff --git a/server/conf/php-fcgi-starter.master b/server/conf/php-fcgi-starter.master index f880c83453986cd13df297b2e3853d60f0a29645..97a162872474a4f5ffdac9e5c0e15d4f3685e1e5 100644 --- a/server/conf/php-fcgi-starter.master +++ b/server/conf/php-fcgi-starter.master @@ -10,7 +10,7 @@ export PHP_DOCUMENT_ROOT PHP_FCGI_MAX_REQUESTS= export PHP_FCGI_MAX_REQUESTS exec \ - -d open_basedir=":/usr/share/php5:/tmp:/usr/share/phpmyadmin" \ + -d open_basedir="" \ -d upload_tmp_dir=/tmp \ -d session.save_path=/tmp \ $1 \ No newline at end of file diff --git a/server/conf/vhost.conf.master b/server/conf/vhost.conf.master index 08227d1ab18be5dc5a5fa5a0bc6a43c7f6fde107..7d3f34265289a7dee30c38f3421553181af56bd5 100644 --- a/server/conf/vhost.conf.master +++ b/server/conf/vhost.conf.master @@ -96,7 +96,7 @@ php_admin_value upload_tmp_dir /tmp php_admin_value session.save_path /tmp - php_admin_value open_basedir /web:/tmp:/usr/share/php5:/tmp:/usr/share/phpmyadmin + php_admin_value open_basedir @@ -257,7 +257,7 @@ php_admin_value upload_tmp_dir /tmp php_admin_value session.save_path /tmp - php_admin_value open_basedir /web:/tmp:/usr/share/php5:/tmp:/usr/share/phpmyadmin + php_admin_value open_basedir diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php index 6e6e0fd8879a7ac3c1b6eac411bd0cd6b003a750..2aecc1d33f589bd61e556341063d5ebd2259c819 100644 --- a/server/plugins-available/apache2_plugin.inc.php +++ b/server/plugins-available/apache2_plugin.inc.php @@ -555,6 +555,7 @@ class apache2_plugin { $vhost_data["web_basedir"] = $web_config["website_basedir"]; $vhost_data["security_level"] = $web_config["security_level"]; $vhost_data["allow_override"] = ($data["new"]["allow_override"] == '')?'All':$data["new"]["allow_override"]; + $vhost_data["php_open_basedir"] = ($data["new"]["php_open_basedir"] == '')?$data["new"]["document_root"]:$data["new"]["php_open_basedir"]; // Check if a SSL cert exists $ssl_dir = $data["new"]["document_root"]."/ssl"; @@ -706,12 +707,15 @@ class apache2_plugin { $fcgi_tpl = new tpl(); $fcgi_tpl->newTemplate("php-fcgi-starter.master"); - $fcgi_tpl->setVar('php_ini_path',$fastcgi_config["fastcgi_phpini_path"]); - $fcgi_tpl->setVar('document_root',$data["new"]["document_root"]); - $fcgi_tpl->setVar('php_fcgi_children',$fastcgi_config["fastcgi_children"]); - $fcgi_tpl->setVar('php_fcgi_max_requests',$fastcgi_config["fastcgi_max_requests"]); - $fcgi_tpl->setVar('php_fcgi_bin',$fastcgi_config["fastcgi_bin"]); - $fcgi_tpl->setVar('security_level',$web_config["security_level"]); + $fcgi_tpl->setVar('php_ini_path',escapeshellcmd($fastcgi_config["fastcgi_phpini_path"])); + $fcgi_tpl->setVar('document_root',escapeshellcmd($data["new"]["document_root"])); + $fcgi_tpl->setVar('php_fcgi_children',escapeshellcmd($fastcgi_config["fastcgi_children"])); + $fcgi_tpl->setVar('php_fcgi_max_requests',escapeshellcmd($fastcgi_config["fastcgi_max_requests"])); + $fcgi_tpl->setVar('php_fcgi_bin',escapeshellcmd($fastcgi_config["fastcgi_bin"])); + $fcgi_tpl->setVar('security_level',intval($web_config["security_level"])); + + $php_open_basedir = ($data["new"]["php_open_basedir"] == '')?$data["new"]["document_root"]:$data["new"]["php_open_basedir"]; + $cgi_tpl->setVar('open_basedir', escapeshellcmd($php_open_basedir)); $fcgi_starter_script = escapeshellcmd($fastcgi_starter_path.$fastcgi_config["fastcgi_starter_script"]); file_put_contents($fcgi_starter_script,$fcgi_tpl->grab()); @@ -759,7 +763,10 @@ class apache2_plugin { $cgi_tpl->newTemplate("php-cgi-starter.master"); // This works, because php "rewrites" a symlink to the physical path - $cgi_tpl->setVar('open_basedir', $data["new"]["document_root"]); + $php_open_basedir = ($data["new"]["php_open_basedir"] == '')?$data["new"]["document_root"]:$data["new"]["php_open_basedir"]; + $cgi_tpl->setVar('open_basedir', escapeshellcmd($php_open_basedir)); + $cgi_tpl->setVar('document_root', escapeshellcmd($data["new"]["document_root"])); + // This will NOT work! //$cgi_tpl->setVar('open_basedir', "/var/www/" . $data["new"]["domain"]); $cgi_tpl->setVar('php_cgi_bin',$cgi_config["cgi_bin"]);