Commit e98a1583 authored by Till Brehm's avatar Till Brehm

Improved input validation for settings that are acessible by the admin user.

parent f2fc77f2
<?php
/*
Copyright (c) 2014, Till Brehm, projektfarm Gmbh
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
* Neither the name of ISPConfig nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
class validate_systemuser {
/*
Validator function to check if a given user is ok.
*/
function check_sysuser($field_name, $field_value, $validator) {
global $app;
$errmsg = $validator['errmsg'];
$check_names = (isset($validator['check_names']) && $validator['check_names'] == true)?true:false;
if($app->functions->is_allowed_user(trim(strtolower($field_value)),$check_names) == false) {
return $app->tform->wordbook[$errmsg]."<br>\r\n";
}
}
/*
Validator function to check if a given group is ok.
*/
function check_sysgroup($field_name, $field_value, $validator) {
global $app;
$errmsg = $validator['errmsg'];
$check_names = (isset($validator['check_names']) && $validator['check_names'] == true)?true:false;
if($app->functions->is_allowed_group(trim(strtolower($field_value)),$check_names) == false) {
return $app->tform->wordbook[$errmsg]."<br>\r\n";
}
}
}
......@@ -191,4 +191,54 @@ $wb['munin_url_error_regex'] = 'Invalid Munin URL';
$wb['munin_url_note_txt'] = 'Placeholder:';
$wb['backup_dir_is_mount_txt'] = 'Backup directory is a mount?';
$wb['monitor_system_updates_txt'] = 'Check for Linux updates';
$wb['invalid_apache_user_txt'] = 'Invalid apache user.';
$wb['invalid_apache_group_txt'] = 'Invalid apache group.';
$wb['backup_dir_error_regex'] = 'Invalid backup directory.';
$wb['maildir_path_error_regex'] = 'Invalid maildir path.';
$wb['homedir_path_error_regex'] = 'Invalid homedir path.';
$wb['mailuser_name_error_regex'] = 'Invalid mailuser name.';
$wb['mailuser_group_name_error_regex'] = 'Invalid mailuser group name.';
$wb['mailuser_uid_error_range'] = 'Mailuser uid must be >= 2000';
$wb['mailuser_gid_error_range'] = 'Mailuser gid must be >= 2000';
$wb['getmail_config_dir_error_regex'] = 'Invalid getmail config directory.';
$wb['website_basedir_error_regex'] = 'Invalid website basedir.';
$wb['website_symlinks_error_regex'] = 'Invalid website symlinks.';
$wb['vhost_conf_dir_error_regex'] = 'Invalid vhost config directory.';
$wb['vhost_conf_enabled_dir_error_regex'] = 'Invalid vhost conf enabled directory.';
$wb['nginx_vhost_conf_dir_error_regex'] = 'Invalid nginx config directory.';
$wb['nginx_vhost_conf_enabled_dir_error_regex'] = 'Invalid nginx conf enabled directory.';
$wb['ca_path_error_regex'] = 'Invalid CA path.';
$wb['invalid_nginx_user_txt'] = 'Invalid nginx user.';
$wb['invalid_nginx_group_txt'] = 'Invalid nginx group.';
$wb['php_ini_path_apache_error_regex'] = 'Invalid apache php.ini path.';
$wb['php_ini_path_cgi_error_regex'] = 'Invalid cgi php.ini path.';
$wb['php_fpm_init_script_error_regex'] = 'Invalid php-fpm init script.';
$wb['php_fpm_ini_path_error_regex'] = 'Invalid php-fpm ini path.';
$wb['php_fpm_pool_dir_error_regex'] = 'Invalid php-fpm pool directory.';
$wb['php_fpm_socket_dir_error_regex'] = 'Invalid php-fpm socket directory.';
$wb['php_open_basedir_error_regex'] = 'Invalid php open_basedir.';
$wb['awstats_data_dir_empty'] = 'awstats data directory is empty';
$wb['awstats_data_dir_error_regex'] = 'Invalid awstats data directory.';
$wb['awstats_pl_empty'] = 'awstats.pl setting is empty.';
$wb['awstats_pl_error_regex'] = 'Invalid awstats.pl path.';
$wb['awstats_buildstaticpages_pl_empty'] = 'awstats_buildstaticpages.pl is empty';
$wb['awstats_buildstaticpages_pl_error_regex'] = 'Invalid awstats_buildstaticpages.pl path.';
$wb['invalid_bind_user_txt'] = 'Invalid BIND user.';
$wb['invalid_bind_group_txt'] = 'Invalid BIND group.';
$wb['bind_zonefiles_dir_error_regex'] = 'Invalid BIND zonefiles directory.';
$wb['named_conf_path_error_regex'] = 'Invalid named.conf path.';
$wb['named_conf_local_path_error_regex'] = 'Invalid named.conf.local path.';
$wb['fastcgi_starter_path_error_regex'] = 'Invalid fastcgi starter path.';
$wb['fastcgi_starter_script_error_regex'] = 'Invalid fastcgi starter script.';
$wb['fastcgi_alias_error_regex'] = 'Invalid fastcgi alias.';
$wb['fastcgi_phpini_path_error_regex'] = 'Invalid fastcgi path.';
$wb['fastcgi_bin_error_regex'] = 'Invalid fastcgi bin.';
$wb['jailkit_chroot_home_error_regex'] = 'Invalid jaikit chroot home.';
$wb['jailkit_chroot_app_sections_error_regex'] = 'Invalid jaikit chroot sections.';
$wb['jailkit_chroot_app_programs_error_regex'] = 'Invalid jaikit chroot app programs.';
$wb['jailkit_chroot_cron_programs_error_regex'] = 'Invalid jaikit chroot cron programs.';
$wb['vlogger_config_dir_error_regex'] = 'Invalid vlogger config dir.';
$wb['cron_init_script_error_regex'] = 'Invalid cron init script.';
$wb['crontab_dir_error_regex'] = 'Invalid crontab directory.';
$wb['cron_wget_error_regex'] = 'Invalid cron wget path.';
?>
......@@ -166,6 +166,13 @@ if($app->auth->is_admin()) {
'formtype' => 'TEXT',
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
'errmsg'=> 'uid_error_empty'),
1 => array(
'type' => 'CUSTOM',
'class' => 'validate_systemuser',
'function' => 'check_sysuser',
'check_names' => true,
'errmsg' => 'invalid_system_user_or_group_txt'
),
),
'default' => '0',
'value' => '',
......@@ -177,6 +184,13 @@ if($app->auth->is_admin()) {
'formtype' => 'TEXT',
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
'errmsg'=> 'gid_error_empty'),
1 => array(
'type' => 'CUSTOM',
'class' => 'validate_systemuser',
'function' => 'check_sysgroup',
'check_names' => true,
'errmsg' => 'invalid_system_user_or_group_txt'
),
),
'default' => '0',
'value' => '',
......
......@@ -177,6 +177,13 @@ if($_SESSION["s"]["user"]["typ"] == 'admin') {
'formtype' => 'TEXT',
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
'errmsg'=> 'uid_error_empty'),
1 => array(
'type' => 'CUSTOM',
'class' => 'validate_systemuser',
'function' => 'check_sysuser',
'check_names' => true,
'errmsg' => 'invalid_system_user_or_group_txt'
),
),
'default' => '0',
'value' => '',
......@@ -188,6 +195,13 @@ if($_SESSION["s"]["user"]["typ"] == 'admin') {
'formtype' => 'TEXT',
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
'errmsg'=> 'uid_error_empty'),
1 => array(
'type' => 'CUSTOM',
'class' => 'validate_systemuser',
'function' => 'check_sysgroup',
'check_names' => true,
'errmsg' => 'invalid_system_user_or_group_txt'
),
),
'default' => '0',
'value' => '',
......
......@@ -154,14 +154,6 @@ class page_action extends tform_actions {
function onBeforeUpdate() {
global $app, $conf, $interfaceConf;
// Check system user and group
if(isset($this->dataRecord['uid'])) {
if($app->functions->is_allowed_user(strtolower($this->dataRecord['uid']),true) == false || $app->functions->is_allowed_group(strtolower($this->dataRecord['gid']),true) == false) {
$app->tform->errorMessage .= $app->tform->lng('invalid_system_user_or_group_txt');
}
}
/*
* If the names should be restricted -> do it!
*/
......
......@@ -190,13 +190,6 @@ class page_action extends tform_actions {
}
}
unset($blacklist);
// Check system user and group
if(isset($this->dataRecord['puser'])) {
if($app->functions->is_allowed_user(strtolower($this->dataRecord['puser']),true) == false || $app->functions->is_allowed_group(strtolower($this->dataRecord['pgroup']),true) == false) {
$app->tform->errorMessage .= $app->tform->lng('invalid_system_user_or_group_txt');
}
}
/*
* If the names should be restricted -> do it!
......
......@@ -341,6 +341,8 @@ class page_action extends tform_actions {
$this->dataRecord["ipv6_address"] = $parent_domain["ipv6_address"];
$this->dataRecord["client_group_id"] = $parent_domain["client_group_id"];
$this->dataRecord["vhost_type"] = 'name';
$this->dataRecord["system_user"] = $parent_domain["system_user"];
$this->dataRecord["system_group"] = $parent_domain["system_group"];
$this->parent_domain_record = $parent_domain;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment