Skip to content

Commit 33ed536

Browse files
author
Marius Burkard
committed
Merge remote-tracking branch 'ispc3/stable-3.1' into rspamd
Client can create global whitelists and blacklists for email, fixes #5356
2 parents 1eb51aa + 709638f commit 33ed536

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+919
-999
lines changed

‎install/sql/incremental/upd_dev_collection.sql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,8 @@ UPDATE `spamfilter_policy` SET `rspamd_spam_kill_level` = '999.00' WHERE id = 3;
3030
UPDATE `spamfilter_policy` SET `rspamd_spam_kill_level` = '8.00' WHERE id = 6;
3131
UPDATE `spamfilter_policy` SET `rspamd_spam_kill_level` = '20.00' WHERE id = 7;
3232
-- end of rspamd
33+
ALTER TABLE `client` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;
34+
ALTER TABLE `ftp_user` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;
35+
ALTER TABLE `shell_user` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;
36+
ALTER TABLE `sys_user` CHANGE COLUMN `passwort` `passwort` VARCHAR(200) DEFAULT NULL;
37+
ALTER TABLE `webdav_user` CHANGE COLUMN `password` `password` VARCHAR(200) DEFAULT NULL;

‎install/sql/ispconfig3.sql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -243,7 +243,7 @@ CREATE TABLE `client` (
243243
`limit_openvz_vm_template_id` int(11) NOT NULL DEFAULT '0',
244244
`parent_client_id` int(11) unsigned NOT NULL DEFAULT '0',
245245
`username` varchar(64) DEFAULT NULL,
246-
`password` varchar(64) DEFAULT NULL,
246+
`password` varchar(200) DEFAULT NULL,
247247
`language` char(2) NOT NULL DEFAULT 'en',
248248
`usertheme` varchar(32) NOT NULL DEFAULT 'default',
249249
`template_master` int(11) unsigned NOT NULL DEFAULT '0',
@@ -705,7 +705,7 @@ CREATE TABLE `ftp_user` (
705705
`parent_domain_id` int(11) unsigned NOT NULL default '0',
706706
`username` varchar(64) default NULL,
707707
`username_prefix` varchar(50) NOT NULL default '',
708-
`password` varchar(64) default NULL,
708+
`password` varchar(200) default NULL,
709709
`quota_size` bigint(20) NOT NULL default '-1',
710710
`active` enum('n','y') NOT NULL default 'y',
711711
`uid` varchar(64) default NULL,
@@ -1440,7 +1440,7 @@ CREATE TABLE `shell_user` (
14401440
`parent_domain_id` int(11) unsigned NOT NULL default '0',
14411441
`username` varchar(64) default NULL,
14421442
`username_prefix` varchar(50) NOT NULL default '',
1443-
`password` varchar(64) default NULL,
1443+
`password` varchar(200) default NULL,
14441444
`quota_size` bigint(20) NOT NULL default '-1',
14451445
`active` enum('n','y') NOT NULL default 'y',
14461446
`puser` varchar(255) default NULL,
@@ -1869,7 +1869,7 @@ CREATE TABLE `sys_user` (
18691869
`sys_perm_group` varchar(5) NOT NULL default 'riud',
18701870
`sys_perm_other` varchar(5) NOT NULL default '',
18711871
`username` varchar(64) NOT NULL default '',
1872-
`passwort` varchar(64) NOT NULL default '',
1872+
`passwort` varchar(200) NOT NULL default '',
18731873
`modules` varchar(255) NOT NULL default '',
18741874
`startmodule` varchar(255) NOT NULL default '',
18751875
`app_theme` varchar(32) NOT NULL default 'default',
@@ -1904,7 +1904,7 @@ CREATE TABLE `webdav_user` (
19041904
`parent_domain_id` int(11) unsigned NOT NULL DEFAULT '0',
19051905
`username` varchar(64) DEFAULT NULL,
19061906
`username_prefix` varchar(50) NOT NULL default '',
1907-
`password` varchar(64) DEFAULT NULL,
1907+
`password` varchar(200) DEFAULT NULL,
19081908
`active` enum('n','y') NOT NULL DEFAULT 'y',
19091909
`dir` varchar(255) DEFAULT NULL,
19101910
PRIMARY KEY (`webdav_user_id`)

‎interface/lib/app.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ public function __get($prop) {
7878

7979
$this->uses($prop);
8080
if(property_exists($this, $prop)) return $this->{$prop};
81-
else return null;
81+
else trigger_error('Undefined property ' . $name . ' of class app', E_USER_WARNING);
8282
}
8383

8484
public function __destruct() {

‎interface/lib/classes/auth.inc.php‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -231,12 +231,27 @@ public function crypt_password($cleartext_password, $charset = 'UTF-8') {
231231
if($charset != 'UTF-8') {
232232
$cleartext_password = mb_convert_encoding($cleartext_password, $charset, 'UTF-8');
233233
}
234-
$salt="$1$";
235-
$base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
236-
for ($n=0;$n<8;$n++) {
237-
$salt.=$base64_alphabet[mt_rand(0, 63)];
234+
235+
if(defined('CRYPT_SHA512') && CRYPT_SHA512 == 1) {
236+
$salt = '$6$rounds=5000$';
237+
$salt_length = 16;
238+
} elseif(defined('CRYPT_SHA256') && CRYPT_SHA256 == 1) {
239+
$salt = '$5$rounds=5000$';
240+
$salt_length = 16;
241+
} else {
242+
$salt = '$1$';
243+
$salt_length = 12;
244+
}
245+
246+
if(function_exists('openssl_random_pseudo_bytes')) {
247+
$salt .= substr(bin2hex(openssl_random_pseudo_bytes($salt_length)), 0, $salt_length);
248+
} else {
249+
$base64_alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';
250+
for($n = 0; $n < $salt_length; $n++) {
251+
$salt .= $base64_alphabet[mt_rand(0, 63)];
252+
}
238253
}
239-
$salt.="$";
254+
$salt .= "$";
240255
return crypt($cleartext_password, $salt);
241256
}
242257

‎interface/lib/classes/functions.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -451,9 +451,9 @@ public function generate_ssh_key($client_id, $username = ''){
451451
if(file_exists($id_rsa_file)) unset($id_rsa_file);
452452
if(file_exists($id_rsa_pub_file)) unset($id_rsa_pub_file);
453453
if(!file_exists($id_rsa_file) && !file_exists($id_rsa_pub_file)) {
454-
exec('ssh-keygen -t rsa -C '.$username.'-rsa-key-'.time().' -f '.$id_rsa_file.' -N ""');
454+
$app->system->exec_safe('ssh-keygen -t rsa -C ? -f ? -N ""', $username.'-rsa-key-'.time(), $id_rsa_file);
455455
$app->db->query("UPDATE client SET created_at = UNIX_TIMESTAMP(), id_rsa = ?, ssh_rsa = ? WHERE client_id = ?", @file_get_contents($id_rsa_file), @file_get_contents($id_rsa_pub_file), $client_id);
456-
exec('rm -f '.$id_rsa_file.' '.$id_rsa_pub_file);
456+
$app->system->exec_safe('rm -f ? ?', $id_rsa_file, $id_rsa_pub_file);
457457
} else {
458458
$app->log("Failed to create SSH keypair for ".$username, LOGLEVEL_WARN);
459459
}

‎interface/lib/classes/remote.d/client.inc.php‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -604,11 +604,9 @@ public function client_login_get($session_id,$username,$password,$remote_ip = ''
604604
if($user) {
605605
$saved_password = stripslashes($user['password']);
606606

607-
if(substr($saved_password, 0, 3) == '$1$') {
608-
//* The password is crypt-md5 encrypted
609-
$salt = '$1$'.substr($saved_password, 3, 8).'$';
610-
611-
if(crypt(stripslashes($password), $salt) != $saved_password) {
607+
if(preg_match('/^\$[156]\$/', $saved_password)) {
608+
//* The password is crypt encrypted
609+
if(crypt(stripslashes($password), $saved_password) !== $saved_password) {
612610
$user = false;
613611
}
614612
} else {
@@ -636,11 +634,9 @@ public function client_login_get($session_id,$username,$password,$remote_ip = ''
636634
if($user) {
637635
$saved_password = stripslashes($user['passwort']);
638636

639-
if(substr($saved_password, 0, 3) == '$1$') {
637+
if(preg_match('/^\$[156]\$/', $saved_password)) {
640638
//* The password is crypt-md5 encrypted
641-
$salt = '$1$'.substr($saved_password, 3, 8).'$';
642-
643-
if(crypt(stripslashes($password), $salt) != $saved_password) {
639+
if(crypt(stripslashes($password), $saved_password) != $saved_password) {
644640
$user = false;
645641
}
646642
} else {

‎interface/lib/classes/remoting.inc.php‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -99,28 +99,22 @@ public function login($username, $password, $client_login = false)
9999
if($user) {
100100
$saved_password = stripslashes($user['passwort']);
101101

102-
if(substr($saved_password, 0, 3) == '$1$') {
102+
if(preg_match('/^\$[156]\$/', $saved_password)) {
103103
//* The password is crypt-md5 encrypted
104-
$salt = '$1$'.substr($saved_password, 3, 8).'$';
105-
106-
if(crypt(stripslashes($password), $salt) != $saved_password) {
104+
if(crypt(stripslashes($password), $saved_password) != $saved_password) {
107105
throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.');
108-
return false;
109106
}
110107
} else {
111108
//* The password is md5 encrypted
112109
if(md5($password) != $saved_password) {
113110
throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.');
114-
return false;
115111
}
116112
}
117113
} else {
118114
throw new SoapFault('client_login_failed', 'The login failed. Username or password wrong.');
119-
return false;
120115
}
121116
if($user['active'] != 1) {
122117
throw new SoapFault('client_login_failed', 'The login failed. User is blocked.');
123-
return false;
124118
}
125119

126120
// now we need the client data

‎interface/lib/classes/system.inc.php‎

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@
3131
class system {
3232

3333
var $client_service = null;
34+
private $_last_exec_out = null;
35+
private $_last_exec_retcode = null;
3436

3537
public function has_service($userid, $service) {
3638
global $app;
@@ -52,8 +54,47 @@ public function has_service($userid, $service) {
5254
return false;
5355
}
5456
}
55-
} //* End Class
56-
57-
?>
5857

58+
public function last_exec_out() {
59+
return $this->_last_exec_out;
60+
}
61+
62+
public function last_exec_retcode() {
63+
return $this->_last_exec_retcode;
64+
}
65+
66+
public function exec_safe($cmd) {
67+
$arg_count = func_num_args();
68+
if($arg_count != substr_count($cmd, '?') + 1) {
69+
trigger_error('Placeholder count not matching argument list.', E_USER_WARNING);
70+
return false;
71+
}
72+
if($arg_count > 1) {
73+
$args = func_get_args();
5974

75+
$pos = 0;
76+
$a = 0;
77+
foreach($args as $value) {
78+
$a++;
79+
80+
$pos = strpos($cmd, '?', $pos);
81+
if($pos === false) {
82+
break;
83+
}
84+
$value = escapeshellarg($value);
85+
$cmd = substr_replace($cmd, $value, $pos, 1);
86+
$pos += strlen($value);
87+
}
88+
}
89+
90+
$this->_last_exec_out = null;
91+
$this->_last_exec_retcode = null;
92+
return exec($cmd, $this->_last_exec_out, $this->_last_exec_retcode);
93+
}
94+
95+
public function system_safe($cmd) {
96+
call_user_func_array(array($this, 'exec_safe'), func_get_args());
97+
return implode("\n", $this->_last_exec_out);
98+
}
99+
100+
} //* End Class

‎interface/lib/classes/validate_dkim.inc.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,13 @@ function get_error($errmsg) {
4949
* Validator function for private DKIM-Key
5050
*/
5151
function check_private_key($field_name, $field_value, $validator) {
52+
global $app;
53+
5254
$dkim_enabled=$_POST['dkim'];
5355
if ($dkim_enabled == 'y') {
5456
if (empty($field_value)) return $this->get_error($validator['errmsg']);
55-
exec('echo '.escapeshellarg($field_value).'|openssl rsa -check', $output, $result);
57+
$app->system->exec_safe('echo ?|openssl rsa -check', $field_value);
58+
$result = $app->system->last_exec_retcode();
5659
if($result != 0) return $this->get_error($validator['errmsg']);
5760
}
5861
}

‎interface/web/admin/users_edit.php‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,8 @@ function onBeforeUpdate() {
104104
function onAfterUpdate() {
105105
global $app, $conf;
106106

107+
$app->uses('auth');
108+
107109
$client = $app->db->queryOneRecord("SELECT * FROM sys_user WHERE userid = ?", $this->id);
108110
$client_id = $app->functions->intval($client['client_id']);
109111
$username = $this->dataRecord["username"];
@@ -121,13 +123,7 @@ function onAfterUpdate() {
121123
// password changed
122124
if(isset($conf['demo_mode']) && $conf['demo_mode'] != true && isset($this->dataRecord["passwort"]) && $this->dataRecord["passwort"] != '') {
123125
$password = $this->dataRecord["passwort"];
124-
$salt="$1$";
125-
$base64_alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
126-
for ($n=0;$n<8;$n++) {
127-
$salt.=$base64_alphabet[mt_rand(0, 63)];
128-
}
129-
$salt.="$";
130-
$password = crypt(stripslashes($password), $salt);
126+
$password = $app->auth->crypt_password($password);
131127
$sql = "UPDATE client SET password = ? WHERE client_id = ? AND username = ?";
132128
$app->db->query($sql, $password, $client_id, $username);
133129
}

0 commit comments

Comments
 (0)