Skip to content

Commit 07cef89

Browse files
ms217ms217
committed
Merge branch 'stable-3.1' of https://git.ispconfig.org/ispconfig/ispconfig3 into stable-3.1
2 parents 524b4d4 + 6c096ff commit 07cef89

File tree

7 files changed

+133
-22
lines changed

7 files changed

+133
-22
lines changed

‎install/lib/installer_base.lib.php‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -745,7 +745,7 @@ public function process_postfix_config($configfile) {
745745
copy($full_file_name, $config_dir.$configfile.'~');
746746
chmod($config_dir.$configfile.'~',0600);
747747
}
748-
748+
749749
//* Replace variables in config file template
750750
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/'.$configfile.'.master', 'tpl/'.$configfile.'.master');
751751
$content = str_replace('{mysql_server_ispconfig_user}', $conf['mysql']['ispconfig_user'], $content);
@@ -754,13 +754,13 @@ public function process_postfix_config($configfile) {
754754
$content = str_replace('{mysql_server_ip}', $conf['mysql']['ip'], $content);
755755
$content = str_replace('{server_id}', $conf['server_id'], $content);
756756
wf($full_file_name, $content);
757-
757+
758758
//* Changing mode and group of the new created config file
759759
caselog('chmod u=rw,g=r,o= '.escapeshellarg($full_file_name).' &> /dev/null',
760760
__FILE__, __LINE__, 'chmod on '.$full_file_name, 'chmod on '.$full_file_name.' failed');
761761
caselog('chgrp '.escapeshellarg($postfix_group).' '.escapeshellarg($full_file_name).' &> /dev/null',
762762
__FILE__, __LINE__, 'chgrp on '.$full_file_name, 'chgrp on '.$full_file_name.' failed');
763-
763+
764764
}
765765

766766
public function configure_jailkit() {
@@ -1097,7 +1097,7 @@ public function configure_postfix($options = '') {
10971097
}
10981098

10991099
unset($server_ini_array);
1100-
1100+
11011101
$myhostname = str_replace('.','\.',$conf['hostname']);
11021102

11031103
$postconf_placeholders = array('{config_dir}' => $config_dir,
@@ -1680,7 +1680,7 @@ public function configure_amavis() {
16801680

16811681
public function configure_rspamd() {
16821682
global $conf;
1683-
1683+
16841684
//* These postconf commands will be executed on installation and update
16851685
$server_ini_rec = $this->db->queryOneRecord("SELECT config FROM ?? WHERE server_id = ?", $conf["mysql"]["database"] . '.server', $conf['server_id']);
16861686
$server_ini_array = ini_to_array(stripslashes($server_ini_rec['config']));
@@ -2503,6 +2503,16 @@ public function configure_apps_vhost() {
25032503
$tpl->setVar('apps_vhost_dir',$conf['web']['website_basedir'].'/apps');
25042504
$tpl->setVar('apps_vhost_basedir',$conf['web']['website_basedir']);
25052505
$tpl->setVar('apps_vhost_servername',$apps_vhost_servername);
2506+
if(is_file($install_dir.'/interface/ssl/ispserver.crt') && is_file($install_dir.'/interface/ssl/ispserver.key')) {
2507+
$tpl->setVar('ssl_comment','');
2508+
} else {
2509+
$tpl->setVar('ssl_comment','#');
2510+
}
2511+
if(is_file($install_dir.'/interface/ssl/ispserver.crt') && is_file($install_dir.'/interface/ssl/ispserver.key') && is_file($install_dir.'/interface/ssl/ispserver.bundle')) {
2512+
$tpl->setVar('ssl_bundle_comment','');
2513+
} else {
2514+
$tpl->setVar('ssl_bundle_comment','#');
2515+
}
25062516
$tpl->setVar('apache_version',getapacheversion());
25072517
if($this->is_update == true) {
25082518
$tpl->setVar('logging',get_logging_state());

‎install/tpl/apache_apps.vhost.master‎

Lines changed: 50 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
######################################################
32
# This virtual host contains the configuration
43
# for the ISPConfig apps vhost
@@ -15,6 +14,56 @@
1514
SetHandler None
1615
</FilesMatch>
1716

17+
# SSL Configuration
18+
<tmpl_var name="ssl_comment">SSLEngine On
19+
<tmpl_if name='apache_version' op='>=' value='2.3.16' format='version'>
20+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
21+
<tmpl_else>
22+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv2 -SSLv3
23+
</tmpl_if>
24+
<tmpl_var name="ssl_comment">SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
25+
<tmpl_var name="ssl_comment">SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
26+
<tmpl_var name="ssl_bundle_comment">SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle
27+
28+
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
29+
<tmpl_var name="ssl_comment">SSLHonorCipherOrder On
30+
<tmpl_if name='apache_version' op='>=' value='2.4.3' format='version'>
31+
<tmpl_var name="ssl_comment">SSLCompression Off
32+
</tmpl_if>
33+
<tmpl_if name='apache_version' op='>=' value='2.4.11' format='version'>
34+
<tmpl_var name="ssl_comment">SSLSessionTickets Off
35+
</tmpl_if>
36+
37+
<IfModule mod_headers.c>
38+
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
39+
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'"
40+
<tmpl_var name="ssl_comment">Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
41+
Header set X-Content-Type-Options: nosniff
42+
Header set X-Frame-Options: SAMEORIGIN
43+
Header set X-XSS-Protection: "1; mode=block"
44+
Header always edit Set-Cookie (.*) "$1; HTTPOnly"
45+
<tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; Secure"
46+
<IfVersion >= 2.4.7>
47+
Header setifempty Strict-Transport-Security "max-age=15768000"
48+
</IfVersion>
49+
<IfVersion < 2.4.7>
50+
Header set Strict-Transport-Security "max-age=15768000"
51+
</IfVersion>
52+
RequestHeader unset Proxy early
53+
</IfModule>
54+
55+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
56+
<tmpl_var name="ssl_comment">SSLUseStapling On
57+
<tmpl_var name="ssl_comment">SSLStaplingResponderTimeout 5
58+
<tmpl_var name="ssl_comment">SSLStaplingReturnResponderErrors Off
59+
</tmpl_if>
60+
61+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
62+
<IfModule mod_ssl.c>
63+
<tmpl_var name="ssl_comment">SSLStaplingCache shmcb:/var/run/ocsp(128000)
64+
</IfModule>
65+
</tmpl_if>
66+
1867
<IfModule mod_headers.c>
1968
RequestHeader unset Proxy early
2069
</IfModule>

‎interface/lib/classes/sites_database_plugin.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@ public function processDatabaseUpdate($form_page) {
4949
$backup_format_db = $web['backup_format_db'];
5050
$backup_copies = $app->functions->intval($web['backup_copies']);
5151

52-
$sql = "UPDATE web_database SET sys_groupid = ?, backup_interval = ?, backup_copies = ?, backup_format_web = ?, backup_format_db = ? WHERE database_id = ?";
53-
$app->db->query($sql, $sys_groupid, $backup_interval, $backup_copies, $backup_format_web, $backup_format_db, $form_page->id);
52+
$sql = "UPDATE web_database SET sys_groupid = ?, backup_interval = ?, backup_copies = ? WHERE database_id = ?";
53+
$app->db->query($sql, $sys_groupid, $backup_interval, $backup_copies, $form_page->id);
5454
}
5555
}
5656

‎interface/lib/plugins/sites_web_vhost_domain_plugin.inc.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,13 @@ function sites_web_vhost_domain_edit($event_name, $page_form) {
5252
if($_SESSION["s"]["user"]["typ"] == 'admin' && isset($page_form->dataRecord["client_group_id"])) {
5353
$client_group_id = $app->functions->intval($page_form->dataRecord["client_group_id"]);
5454
$app->uses('getconf');
55-
$global_config = $app->getconf->get_global_config('sites');
56-
if($global_config['client_protection'] == 'y') {
57-
$app->db->query("UPDATE web_domain SET sys_groupid = ?, sys_perm_group = 'ru' WHERE domain_id = ?", $client_group_id, $this->id);
55+
$global_config = $app->getconf->get_global_config('sites');
56+
if($global_config['client_protection'] == 'y') {
57+
$app->db->query("UPDATE web_domain SET sys_groupid = ?, sys_perm_group = 'ru' WHERE domain_id = ?", $client_group_id, $page_form->id);
5858
} else {
5959
$sysuser = $app->db->queryOneRecord('SELECT userid FROM sys_user WHERE default_group = ?',$client_group_id);
6060
$sysuser_id = (is_array($sysuser) && isset($sysuser['userid']) && $sysuser['userid'] > 0)?$sysuser['userid']:1;
61-
$app->db->query("UPDATE web_domain SET sys_userid = ?, sys_groupid = ?, sys_perm_group = 'riud' WHERE domain_id = ?", $sysuser_id, $client_group_id, $this->id);
61+
$app->db->query("UPDATE web_domain SET sys_userid = ?, sys_groupid = ?, sys_perm_group = 'riud' WHERE domain_id = ?", $sysuser_id, $client_group_id, $page_form->id);
6262
}
6363
}
6464
if($app->auth->has_clients($_SESSION['s']['user']['userid']) && isset($page_form->dataRecord["client_group_id"])) {
@@ -265,7 +265,7 @@ function sites_web_vhost_domain_edit($event_name, $page_form) {
265265
$backup_format_db = $page_form->dataRecord['backup_format_db'];
266266
$records = $app->db->queryAllRecords("SELECT database_id FROM web_database WHERE parent_domain_id = ".$page_form->id);
267267
foreach($records as $rec) {
268-
$app->db->datalogUpdate('web_database', array("backup_interval" => $backup_interval, "backup_copies" => $backup_copies, "backup_format_web" => $backup_format_web, "backup_format_db" => $backup_format_db), 'database_id', $rec['database_id']);
268+
$app->db->datalogUpdate('web_database', array("backup_interval" => $backup_interval, "backup_copies" => $backup_copies), 'database_id', $rec['database_id']);
269269
}
270270
unset($records);
271271
unset($rec);

‎interface/web/sites/web_vhost_domain_edit.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1382,11 +1382,11 @@ function onAfterInsert() {
13821382
// make sure that the record belongs to the client group and not the admin group when admin inserts it
13831383
// also make sure that the user can not delete domain created by a admin if client protection is enabled
13841384
if($_SESSION["s"]["user"]["typ"] == 'admin' && isset($this->dataRecord["client_group_id"])) {
1385-
$client_group_id = $app->functions->intval($this->dataRecord["client_group_id"]);
1386-
$app->uses('getconf');
1387-
$global_config = $app->getconf->get_global_config('sites');
1388-
if($global_config['client_protection'] == 'y') {
1389-
$app->db->query("UPDATE web_domain SET sys_groupid = ?, sys_perm_group = 'ru' WHERE domain_id = ?", $client_group_id, $this->id);
1385+
$client_group_id = $app->functions->intval($this->dataRecord["client_group_id"]);
1386+
$app->uses('getconf');
1387+
$global_config = $app->getconf->get_global_config('sites');
1388+
if($global_config['client_protection'] == 'y') {
1389+
$app->db->query("UPDATE web_domain SET sys_groupid = ?, sys_perm_group = 'ru' WHERE domain_id = ?", $client_group_id, $this->id);
13901390
} else {
13911391
$sysuser = $app->db->queryOneRecord('SELECT userid FROM sys_user WHERE default_group = ?',$client_group_id);
13921392
$sysuser_id = (is_array($sysuser) && isset($sysuser['userid']) && $sysuser['userid'] > 0)?$sysuser['userid']:1;

‎server/conf/apache_apps.vhost.master‎

Lines changed: 55 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
######################################################
32
# This virtual host contains the configuration
43
# for the ISPConfig apps vhost
@@ -15,6 +14,56 @@
1514
SetHandler None
1615
</FilesMatch>
1716

17+
# SSL Configuration
18+
<tmpl_var name="ssl_comment">SSLEngine On
19+
<tmpl_if name='apache_version' op='>=' value='2.3.16' format='version'>
20+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
21+
<tmpl_else>
22+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv2 -SSLv3
23+
</tmpl_if>
24+
<tmpl_var name="ssl_comment">SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
25+
<tmpl_var name="ssl_comment">SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
26+
<tmpl_var name="ssl_bundle_comment">SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle
27+
28+
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
29+
<tmpl_var name="ssl_comment">SSLHonorCipherOrder On
30+
<tmpl_if name='apache_version' op='>=' value='2.4.3' format='version'>
31+
<tmpl_var name="ssl_comment">SSLCompression Off
32+
</tmpl_if>
33+
<tmpl_if name='apache_version' op='>=' value='2.4.11' format='version'>
34+
<tmpl_var name="ssl_comment">SSLSessionTickets Off
35+
</tmpl_if>
36+
37+
<IfModule mod_headers.c>
38+
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
39+
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'"
40+
<tmpl_var name="ssl_comment">Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
41+
Header set X-Content-Type-Options: nosniff
42+
Header set X-Frame-Options: SAMEORIGIN
43+
Header set X-XSS-Protection: "1; mode=block"
44+
Header always edit Set-Cookie (.*) "$1; HTTPOnly"
45+
<tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; Secure"
46+
<IfVersion >= 2.4.7>
47+
Header setifempty Strict-Transport-Security "max-age=15768000"
48+
</IfVersion>
49+
<IfVersion < 2.4.7>
50+
Header set Strict-Transport-Security "max-age=15768000"
51+
</IfVersion>
52+
RequestHeader unset Proxy early
53+
</IfModule>
54+
55+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
56+
<tmpl_var name="ssl_comment">SSLUseStapling On
57+
<tmpl_var name="ssl_comment">SSLStaplingResponderTimeout 5
58+
<tmpl_var name="ssl_comment">SSLStaplingReturnResponderErrors Off
59+
</tmpl_if>
60+
61+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
62+
<IfModule mod_ssl.c>
63+
<tmpl_var name="ssl_comment">SSLStaplingCache shmcb:/var/run/ocsp(128000)
64+
</IfModule>
65+
</tmpl_if>
66+
1867
<IfModule mod_headers.c>
1968
RequestHeader unset Proxy early
2069
</IfModule>
@@ -55,9 +104,9 @@
55104
<Directory {tmpl_var name='apps_vhost_dir'}>
56105
Options +Indexes +FollowSymLinks +MultiViews +ExecCGI
57106
AllowOverride AuthConfig Indexes Limit Options FileInfo
58-
<FilesMatch "\.php$">
59-
SetHandler fcgid-script
60-
</FilesMatch>
107+
<FilesMatch "\.php$">
108+
SetHandler fcgid-script
109+
</FilesMatch>
61110
FCGIWrapper {tmpl_var name='apps_vhost_basedir'}/php-fcgi-scripts/apps/.php-fcgi-starter .php
62111
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
63112
Require all granted
@@ -78,4 +127,6 @@
78127
RewriteRule ^/rspamd/(.*) http://127.0.0.1:11334/$1 [P]
79128
{/tmpl_if}
80129

130+
131+
81132
</VirtualHost>

‎server/conf/nginx_vhost.conf.master‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ server {
3434
server_name <tmpl_var name='domain'> <tmpl_var name='alias'>;
3535

3636
root <tmpl_var name='web_document_root_www'>;
37+
disable_symlinks if_not_owner;
3738

3839
<tmpl_if name='ssl_enabled'>
3940
<tmpl_if name='rewrite_to_https' op='==' value='y'>

0 commit comments

Comments
 (0)