From bff9826960ebd8237c9bcbca68c16013cff50024 Mon Sep 17 00:00:00 2001
From: Till Brehm <tbrehm@ispconfig.org>
Date: Wed, 20 Apr 2016 16:27:12 +0200
Subject: [PATCH] Added a check to prevent that password protected ssl keys get
saved. Thanks to Timo for finding the issue.
---
server/plugins-available/apache2_plugin.inc.php | 16 ++++++++++++++++
server/plugins-available/nginx_plugin.inc.php | 16 ++++++++++++++++
2 files changed, 32 insertions(+)
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index e635429193..9068509ee5 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -369,6 +369,22 @@ class apache2_plugin {
$app->dbmaster->query("UPDATE web_domain SET ssl_request = ?, ssl_cert = ?, ssl_key = ? WHERE domain = ?", $ssl_request, $ssl_cert, $ssl_key2, $data['new']['domain']);
$app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = ?", $data['new']['domain']);
}
+
+ //* Check that the SSL key is not password protected
+ if($data["new"]["ssl_action"] == 'save') {
+ if(stristr($data["new"]["ssl_key"],'Proc-Type: 4,ENCRYPTED')) {
+ $data["new"]["ssl_action"] = '';
+
+ $app->log('SSL Certificate not saved. The SSL key is encrypted.', LOGLEVEL_WARN);
+ $app->dbmaster->datalogError('SSL Certificate not saved. The SSL key is encrypted.');
+
+ /* Update the DB of the (local) Server */
+ $app->db->query("UPDATE web_domain SET ssl_action = '' WHERE domain = ?", $data['new']['domain']);
+
+ /* Update also the master-DB of the Server-Farm */
+ $app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = ?", $data['new']['domain']);
+ }
+ }
//* Save a SSL certificate to disk
if($data["new"]["ssl_action"] == 'save') {
diff --git a/server/plugins-available/nginx_plugin.inc.php b/server/plugins-available/nginx_plugin.inc.php
index c2b2abf886..42e9f9087a 100644
--- a/server/plugins-available/nginx_plugin.inc.php
+++ b/server/plugins-available/nginx_plugin.inc.php
@@ -219,6 +219,22 @@ class nginx_plugin {
$app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = ?", $data['new']['domain']);
}
+ //* Check that the SSL key is not password protected
+ if($data["new"]["ssl_action"] == 'save') {
+ if(stristr($data["new"]["ssl_key"],'Proc-Type: 4,ENCRYPTED')) {
+ $data["new"]["ssl_action"] = '';
+
+ $app->log('SSL Certificate not saved. The SSL key is encrypted.', LOGLEVEL_WARN);
+ $app->dbmaster->datalogError('SSL Certificate not saved. The SSL key is encrypted.');
+
+ /* Update the DB of the (local) Server */
+ $app->db->query("UPDATE web_domain SET ssl_action = '' WHERE domain = ?", $data['new']['domain']);
+
+ /* Update also the master-DB of the Server-Farm */
+ $app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = ?", $data['new']['domain']);
+ }
+ }
+
//* Save a SSL certificate to disk
if($data["new"]["ssl_action"] == 'save') {
$this->ssl_certificate_changed = true;
--
GitLab