Skip to content

Commit 1d79141

Browse files
author
Marius Burkard
committed
Merge branch 'stable-3.1' into 'stable-3.1'
Stable 3.1 See merge request ispconfig/ispconfig3!704
2 parents 91be9dc + 371590e commit 1d79141

File tree

73 files changed

+297
-233
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

73 files changed

+297
-233
lines changed

‎interface/lib/app.inc.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -298,14 +298,14 @@ public function tpl_defaults() {
298298

299299
$this->tpl->setVar('phpsessid', session_id());
300300

301-
$this->tpl->setVar('theme', $_SESSION['s']['theme']);
301+
$this->tpl->setVar('theme', $_SESSION['s']['theme'], true);
302302
$this->tpl->setVar('html_content_encoding', $this->_conf['html_content_encoding']);
303303

304304
$this->tpl->setVar('delete_confirmation', $this->lng('delete_confirmation'));
305305
//print_r($_SESSION);
306306
if(isset($_SESSION['s']['module']['name'])) {
307-
$this->tpl->setVar('app_module', $_SESSION['s']['module']['name']);
308-
$this->tpl->setVar('session_module', $_SESSION['s']['module']['name']);
307+
$this->tpl->setVar('app_module', $_SESSION['s']['module']['name'], true);
308+
$this->tpl->setVar('session_module', $_SESSION['s']['module']['name'], true);
309309
}
310310
if(isset($_SESSION['s']['user']) && $_SESSION['s']['user']['typ'] == 'admin') {
311311
$this->tpl->setVar('is_admin', 1);
@@ -315,7 +315,7 @@ public function tpl_defaults() {
315315
}
316316
/* Show username */
317317
if(isset($_SESSION['s']['user'])) {
318-
$this->tpl->setVar('cpuser', $_SESSION['s']['user']['username']);
318+
$this->tpl->setVar('cpuser', $_SESSION['s']['user']['username'], true);
319319
$this->tpl->setVar('logout_txt', $this->lng('logout_txt'));
320320
/* Show search field only for normal users, not mail users */
321321
if(stristr($_SESSION['s']['user']['username'], '@')){
@@ -342,7 +342,7 @@ public function tpl_defaults() {
342342
// load and enable PHP Intrusion Detection System (PHPIDS)
343343
$ids_security_config = $app->getconf->get_security_config('ids');
344344

345-
if(is_dir(ISPC_CLASS_PATH.'/IDS') && $ids_security_config['ids_enabled'] == 'yes') {
345+
if(is_dir(ISPC_CLASS_PATH.'/IDS') && ($ids_security_config['ids_anon_enabled'] == 'yes' || $ids_security_config['ids_user_enabled'] == 'yes' || $ids_security_config['ids_admin_enabled'] == 'yes')) {
346346
$app->uses('ids');
347347
$app->ids->start();
348348
}

‎interface/lib/classes/db_mysql.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -472,7 +472,7 @@ private function check_utf8($str) {
472472
public function escape($sString) {
473473
global $app;
474474
if(!is_string($sString) && !is_numeric($sString)) {
475-
$app->log('NON-String given in escape function! (' . gettype($sString) . ')', LOGLEVEL_INFO);
475+
$app->log('NON-String given in escape function! (' . gettype($sString) . ')', LOGLEVEL_DEBUG);
476476
//$sAddMsg = getDebugBacktrace();
477477
$app->log($sAddMsg, LOGLEVEL_DEBUG);
478478
$sString = '';
@@ -481,7 +481,7 @@ public function escape($sString) {
481481
$cur_encoding = mb_detect_encoding($sString);
482482
if($cur_encoding != "UTF-8") {
483483
if($cur_encoding != 'ASCII') {
484-
if(is_object($app) && method_exists($app, 'log')) $app->log('String ' . substr($sString, 0, 25) . '... is ' . $cur_encoding . '.', LOGLEVEL_INFO);
484+
if(is_object($app) && method_exists($app, 'log')) $app->log('String ' . substr($sString, 0, 25) . '... is ' . $cur_encoding . '.', LOGLEVEL_DEBUG);
485485
if($cur_encoding) $sString = mb_convert_encoding($sString, 'UTF-8', $cur_encoding);
486486
else $sString = mb_convert_encoding($sString, 'UTF-8');
487487
}

‎interface/lib/classes/ids.inc.php‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,25 @@ public function start()
118118

119119
$impact = $ids_result->getImpact();
120120

121-
if($impact >= $security_config['ids_log_level']) {
121+
// Choose level from security config
122+
if($app->auth->is_admin()) {
123+
// User is admin
124+
$ids_log_level = $security_config['ids_admin_log_level'];
125+
$ids_warn_level = $security_config['ids_admin_warn_level'];
126+
$ids_block_level = $security_config['ids_admin_block_level'];
127+
} elseif(is_array($_SESSION['s']['user']) && $_SESSION['s']['user']['userid'] > 0) {
128+
// User is Client or Reseller
129+
$ids_log_level = $security_config['ids_user_log_level'];
130+
$ids_warn_level = $security_config['ids_user_warn_level'];
131+
$ids_block_level = $security_config['ids_user_block_level'];
132+
} else {
133+
// Not logged in
134+
$ids_log_level = $security_config['ids_anon_log_level'];
135+
$ids_warn_level = $security_config['ids_anon_warn_level'];
136+
$ids_block_level = $security_config['ids_anon_block_level'];
137+
}
138+
139+
if($impact >= $ids_log_level) {
122140
$ids_log = ISPC_ROOT_PATH.'/temp/ids.log';
123141
if(!is_file($ids_log)) touch($ids_log);
124142

@@ -132,11 +150,11 @@ public function start()
132150

133151
}
134152

135-
if($impact >= $security_config['ids_warn_level']) {
153+
if($impact >= $ids_warn_level) {
136154
$app->log("PHP IDS Alert.".$ids_result, 2);
137155
}
138156

139-
if($impact >= $security_config['ids_block_level']) {
157+
if($impact >= $ids_block_level) {
140158
$app->error("Possible attack detected. This action has been logged.",'', true, 2);
141159
}
142160

‎interface/lib/classes/plugin_listview.inc.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ function onShow() {
5656
// $app->listform->listDef["page_params"] = "&id=".$app->tform_actions->id."&next_tab=".$_SESSION["s"]["form"]["tab"];
5757
$app->listform->listDef["page_params"] = "&id=".$this->form->id."&next_tab=".$_SESSION["s"]["form"]["tab"];
5858
$listTpl->setVar('parent_id', $this->form->id);
59-
$listTpl->setVar('theme', $_SESSION['s']['theme']);
59+
$listTpl->setVar('theme', $_SESSION['s']['theme'], true);
6060

6161
// Generate the SQL for searching
6262
$sql_where = "";
@@ -193,13 +193,13 @@ function onShow() {
193193

194194
$listTpl->setVar('phpsessid', session_id());
195195

196-
$listTpl->setVar('theme', $_SESSION['s']['theme']);
196+
$listTpl->setVar('theme', $_SESSION['s']['theme'], true);
197197
$listTpl->setVar('html_content_encoding', $app->_conf['html_content_encoding']);
198198

199199
$listTpl->setVar('delete_confirmation', $app->lng('delete_confirmation'));
200200
//print_r($_SESSION);
201201
if(isset($_SESSION['s']['module']['name'])) {
202-
$listTpl->setVar('app_module', $_SESSION['s']['module']['name']);
202+
$listTpl->setVar('app_module', $_SESSION['s']['module']['name'], true);
203203
}
204204
if(isset($_SESSION['s']['user']) && $_SESSION['s']['user']['typ'] == 'admin') {
205205
$listTpl->setVar('is_admin', 1);
@@ -209,7 +209,7 @@ function onShow() {
209209
}
210210
/* Show username */
211211
if(isset($_SESSION['s']['user'])) {
212-
$listTpl->setVar('cpuser', $_SESSION['s']['user']['username']);
212+
$listTpl->setVar('cpuser', $_SESSION['s']['user']['username'], true);
213213
$listTpl->setVar('logout_txt', $app->lng('logout_txt'));
214214
/* Show search field only for normal users, not mail users */
215215
if(stristr($_SESSION['s']['user']['username'], '@')){

‎interface/lib/classes/tform.inc.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,11 +115,18 @@ function getNextTab() {
115115
// Show the same tab again in case of an error
116116
$active_tab = $_SESSION["s"]["form"]["tab"];
117117
}
118+
119+
if(!preg_match('/^[a-zA-Z0-9_]{0,50}$/',$active_tab)) {
120+
die('Invalid next tab name.');
121+
}
118122

119123
return $active_tab;
120124
}
121125

122126
function getCurrentTab() {
127+
if(!preg_match('/^[a-zA-Z0-9_]{0,50}$/',$_SESSION["s"]["form"]["tab"])) {
128+
die('Invalid current tab name.');
129+
}
123130
return $_SESSION["s"]["form"]["tab"];
124131
}
125132

‎interface/lib/classes/tform_actions.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -287,7 +287,7 @@ function onError() {
287287
global $app, $conf;
288288

289289
$app->tpl->setVar("error", "<li>".$app->tform->errorMessage."</li>");
290-
$app->tpl->setVar($this->dataRecord);
290+
$app->tpl->setVar($this->dataRecord, null, true);
291291
$this->onShow();
292292
}
293293

‎interface/lib/classes/tform_base.inc.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ protected function _decode($record, $tab = '', $api = false) {
245245
*/
246246
function decode($record, $tab) {
247247
global $conf, $app;
248-
if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab does not exist or the tab is empty (TAB: $tab).");
248+
if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab does not exist or the tab is empty (TAB: ".$app->functions->htmlentities($tab).").");
249249
return $this->_decode($record, $tab, false);
250250
}
251251

@@ -416,7 +416,7 @@ function getHTML($record, $tab, $action = 'NEW') {
416416
$this->action = $action;
417417

418418
if(!is_array($this->formDef)) $app->error("No form definition found.");
419-
if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab).");
419+
if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: ".$app->functions->htmlentities($tab).").");
420420

421421
/* CSRF PROTECTION */
422422
// generate csrf protection id and key
@@ -868,7 +868,7 @@ protected function _encode($record, $tab, $dbencode = true, $api = false) {
868868
function encode($record, $tab, $dbencode = true) {
869869
global $app;
870870

871-
if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab is empty or does not exist (TAB: $tab).");
871+
if(!is_array($this->formDef['tabs'][$tab])) $app->error("Tab is empty or does not exist (TAB: ".$app->functions->htmlentities($tab).").");
872872
return $this->_encode($record, $tab, $dbencode, false);
873873
}
874874

@@ -1437,7 +1437,7 @@ function getSQL($record, $tab, $action = 'INSERT', $primary_id = 0, $sql_ext_whe
14371437
}
14381438

14391439
if(!is_array($this->formDef)) $app->error("Form definition not found.");
1440-
if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: $tab).");
1440+
if(!is_array($this->formDef['tabs'][$tab])) $app->error("The tab is empty or does not exist (TAB: ".$app->functions->htmlentities($tab).").");
14411441

14421442
return $this->_getSQL($record, $tab, $action, $primary_id, $sql_ext_where, false);
14431443
}

‎interface/lib/classes/tpl.inc.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,21 +226,26 @@ public function newTemplate($tmplfile)
226226
* using the keys as variable names and the values as variable values.
227227
* @param mixed $k key to define variable name
228228
* @param mixed $v variable to assign to $k
229+
* @param bool $encode if set to true use htmlentities on values
229230
* @return boolean true/false
230231
* @access public
231232
*/
232-
public function setVar($k, $v = null)
233+
public function setVar($k, $v = null, $encode = false)
233234
{
235+
global $app;
236+
234237
if (is_array($k)) {
235238
foreach($k as $key => $value){
236239
$key = ($this->OPTIONS['CASELESS']) ? strtolower(trim($key)) : trim($key);
237240
if (preg_match('/^[A-Za-z_]+[A-Za-z0-9_]*$/', $key) && $value !== null ) {
241+
if($encode == true) $value = $app->functions->htmlentities($value);
238242
$this->_vars[$key] = $value;
239243
}
240244
}
241245
} else {
242246
if (preg_match('/^[A-Za-z_]+[A-Za-z0-9_]*$/', $k) && $v !== null) {
243247
if ($this->OPTIONS['CASELESS']) $k = strtolower($k);
248+
if($encode == true) $v = $app->functions->htmlentities($v);
244249
$this->_vars[trim($k)] = $v;
245250
} else {
246251
return false;

‎interface/web/admin/directive_snippets_edit.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,9 @@ function onShowEnd() {
7070
if($this->id > 0){
7171
if($this->dataRecord['master_directive_snippets_id'] > 0){
7272
$is_master = true;
73-
$app->tpl->setVar("name", $this->dataRecord['name']);
74-
$app->tpl->setVar("type", $this->dataRecord['type']);
75-
$app->tpl->setVar("snippet", $this->dataRecord['snippet']);
73+
$app->tpl->setVar("name", $this->dataRecord['name'], true);
74+
$app->tpl->setVar("type", $this->dataRecord['type'], true);
75+
$app->tpl->setVar("snippet", $this->dataRecord['snippet'], true);
7676
}
7777
}
7878
$app->tpl->setVar("is_master", $is_master);

‎interface/web/admin/firewall_edit.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ function onShowEnd() {
5757
if($this->id ==0) { //* new record
5858
$server_list = $app->db->queryAllRecords("SELECT server_id, server_name FROM server WHERE server_id NOT IN (SELECT server_id FROM firewall) ORDER BY server_name");
5959
if(is_array($server_list)) {
60-
foreach( $server_list as $server) $server_select .= "<option value='$server[server_id]' >$server[server_name]</option>\r\n";
60+
foreach( $server_list as $server) $server_select .= "<option value='$server[server_id]' >" . $app->functions->htmlentities($server['server_name']) . "</option>\r\n";
6161
}
6262
$app->tpl->setVar('server_id', $server_select);
6363
}

0 commit comments

Comments
 (0)