Skip to content

Commit 4b9329a

Browse files
tbrehmtbrehm
committed
Implemented: FS#2112 - Set u / i attributes on system web folders
This option can be enabled under System > Server config and is named "Web folder protection".
1 parent 7968a13 commit 4b9329a

File tree

9 files changed

+72
-3
lines changed

9 files changed

+72
-3
lines changed

‎install/tpl/server.ini.master‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ set_folder_permissions_on_update=y
7676
add_web_users_to_sshusers_group=y
7777
connect_userid_to_webid=n
7878
connect_userid_to_webid_start=10000
79+
web_folder_protection=n
7980

8081
[dns]
8182
bind_user=root

‎interface/web/admin/form/server_config.tform.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -462,6 +462,12 @@
462462
'default' => 'y',
463463
'value' => array(0 => 'n', 1 => 'y')
464464
),
465+
'web_folder_protection' => array(
466+
'datatype' => 'VARCHAR',
467+
'formtype' => 'CHECKBOX',
468+
'default' => 'y',
469+
'value' => array(0 => 'n', 1 => 'y')
470+
),
465471
'add_web_users_to_sshusers_group' => array(
466472
'datatype' => 'VARCHAR',
467473
'formtype' => 'CHECKBOX',

‎interface/web/admin/lib/lang/en_server_config.lng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,4 +165,5 @@ $wb["awstats_settings_txt"] = 'AWStats Settings';
165165
$wb["firewall_txt"] = 'Firewall';
166166
$wb["mailbox_quota_stats_txt"] = 'Mailbox quota statistics';
167167
$wb["enable_ip_wildcard_txt"] = 'Enable IP wildcard (*)';
168+
$wb["web_folder_protection_txt"] = 'Web folder protection';
168169
?>

‎interface/web/admin/templates/server_config_web_edit.htm‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,12 @@ <h2><tmpl_var name="list_head_txt"></h2>
116116
{tmpl_var name='set_folder_permissions_on_update'}
117117
</div>
118118
</div>
119+
<div class="ctrlHolder">
120+
<p class="label">{tmpl_var name='web_folder_protection_txt'}</p>
121+
<div class="multiField">
122+
{tmpl_var name='web_folder_protection'}
123+
</div>
124+
</div>
119125
<div class="ctrlHolder">
120126
<p class="label">{tmpl_var name='add_web_users_to_sshusers_group_txt'}</p>
121127
<div class="multiField">

‎server/lib/classes/system.inc.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1281,6 +1281,22 @@ function is_installed($appname) {
12811281
return false;
12821282
}
12831283
}
1284+
1285+
function web_folder_protection($document_root,$protect) {
1286+
global $app,$conf;
1287+
1288+
//* load the server configuration options
1289+
$app->uses('getconf');
1290+
$web_config = $app->getconf->get_server_config($conf['server_id'], 'web');
1291+
1292+
if($protect == true && $web_config['web_folder_protection'] == 'y') {
1293+
//* Add protection
1294+
if($document_root != '' && $document_root != '/' && strlen($document_root) > 6 && !stristr($document_root,'..')) exec('chattr +i '.escapeshellcmd($document_root));
1295+
} else {
1296+
//* Remove protection
1297+
if($document_root != '' && $document_root != '/' && strlen($document_root) > 6 && !stristr($document_root,'..')) exec('chattr -i '.escapeshellcmd($document_root));
1298+
}
1299+
}
12841300

12851301
}
12861302
?>

‎server/plugins-available/apache2_plugin.inc.php‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,9 @@ function update($event_name,$data) {
366366
}
367367
}
368368
}
369+
370+
//* Remove protection of old folders
371+
$app->system->web_folder_protection($data['old']['document_root'],false);
369372

370373
//* Move the site data
371374
$tmp_docroot = explode('/',$data['new']['document_root']);
@@ -414,7 +417,7 @@ function update($event_name,$data) {
414417
if(!is_dir($data['new']['document_root'].'/ssl')) exec('mkdir -p '.$data['new']['document_root'].'/ssl');
415418
if(!is_dir($data['new']['document_root'].'/cgi-bin')) exec('mkdir -p '.$data['new']['document_root'].'/cgi-bin');
416419
if(!is_dir($data['new']['document_root'].'/tmp')) exec('mkdir -p '.$data['new']['document_root'].'/tmp');
417-
420+
418421
// Remove the symlink for the site, if site is renamed
419422
if($this->action == 'update' && $data['old']['domain'] != '' && $data['new']['domain'] != $data['old']['domain']) {
420423
if(is_dir('/var/log/ispconfig/httpd/'.$data['old']['domain'])) exec('rm -rf /var/log/ispconfig/httpd/'.$data['old']['domain']);
@@ -593,10 +596,11 @@ function update($event_name,$data) {
593596
}
594597
}
595598

596-
597-
598599
//* If the security level is set to high
599600
if(($this->action == 'insert' && $data['new']['type'] == 'vhost') or ($web_config['set_folder_permissions_on_update'] == 'y' && $data['new']['type'] == 'vhost')) {
601+
602+
$app->system->web_folder_protection($data['new']['document_root'],false);
603+
600604
if($web_config['security_level'] == 20) {
601605

602606
$this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
@@ -673,6 +677,9 @@ function update($event_name,$data) {
673677
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
674678
}
675679
}
680+
681+
//* Protect web folders
682+
$app->system->web_folder_protection($data['new']['document_root'],true);
676683

677684
// Change the ownership of the error log to the owner of the website
678685
if(!@is_file($data['new']['document_root'].'/log/error.log')) exec('touch '.escapeshellcmd($data['new']['document_root']).'/log/error.log');
@@ -1217,7 +1224,9 @@ function update($event_name,$data) {
12171224
if(!is_file($data['new']['document_root'].'/.htpasswd_stats') || $data['new']['stats_password'] != $data['old']['stats_password']) {
12181225
if(trim($data['new']['stats_password']) != '') {
12191226
$htp_file = 'admin:'.trim($data['new']['stats_password']);
1227+
$app->system->web_folder_protection($data['new']['document_root'],false);
12201228
file_put_contents($data['new']['document_root'].'/.htpasswd_stats',$htp_file);
1229+
$app->system->web_folder_protection($data['new']['document_root'],true);
12211230
chmod($data['new']['document_root'].'/.htpasswd_stats',0755);
12221231
unset($htp_file);
12231232
}
@@ -1280,6 +1289,8 @@ function delete($event_name,$data) {
12801289
// load the server configuration options
12811290
$app->uses('getconf');
12821291
$web_config = $app->getconf->get_server_config($conf['server_id'], 'web');
1292+
1293+
$app->system->web_folder_protection($data['new']['document_root'],false);
12831294

12841295
//* Check if this is a chrooted setup
12851296
if($web_config['website_basedir'] != '' && @is_file($web_config['website_basedir'].'/etc/passwd')) {

‎server/plugins-available/cron_jailkit_plugin.inc.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,8 @@ function insert($event_name,$data) {
116116
$this->app = $app;
117117
$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
118118

119+
$app->system->web_folder_protection($parent_domain['document_root'],false);
120+
119121
$this->_update_website_security_level();
120122

121123
$this->_setup_jailkit_chroot();
@@ -126,6 +128,8 @@ function insert($event_name,$data) {
126128
exec($command);
127129

128130
$this->_update_website_security_level();
131+
132+
$app->system->web_folder_protection($parent_domain['document_root'],true);
129133
}
130134

131135
$app->log("Jailkit Plugin (Cron) -> insert username:".$parent_domain['system_user'],LOGLEVEL_DEBUG);
@@ -182,12 +186,14 @@ function update($event_name,$data) {
182186
$this->app = $app;
183187
$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
184188

189+
$app->system->web_folder_protection($parent_domain['document_root'],false);
185190
$this->_update_website_security_level();
186191

187192
$this->_setup_jailkit_chroot();
188193
$this->_add_jailkit_user();
189194

190195
$this->_update_website_security_level();
196+
$app->system->web_folder_protection($parent_domain['document_root'],true);
191197
}
192198

193199
$app->log("Jailkit Plugin (Cron) -> update username:".$parent_domain['system_user'],LOGLEVEL_DEBUG);

‎server/plugins-available/shelluser_base_plugin.inc.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,10 @@ function insert($event_name,$data) {
8080
}
8181

8282
if($app->system->is_user($data['new']['puser'])) {
83+
84+
//* Remove webfolder protection
85+
$app->system->web_folder_protection($web['document_root'],false);
86+
8387
// Get the UID of the parent user
8488
$uid = intval($app->system->getuid($data['new']['puser']));
8589
if($uid > $this->min_uid) {
@@ -114,6 +118,9 @@ function insert($event_name,$data) {
114118
exec($command);
115119
$app->log("Disabling shelluser temporarily: ".$command,LOGLEVEL_DEBUG);
116120
}
121+
122+
//* Add webfolder protection again
123+
$app->system->web_folder_protection($web['document_root'],true);
117124

118125
} else {
119126
$app->log("UID = $uid for shelluser:".$data['new']['username']." not allowed.",LOGLEVEL_ERROR);

‎server/plugins-available/shelluser_jailkit_plugin.inc.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ function insert($event_name,$data) {
7171
global $app, $conf;
7272

7373
$app->uses('system');
74+
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['new']['parent_domain_id']);
7475

7576
if($app->system->is_user($data['new']['username'])) {
7677

@@ -79,6 +80,8 @@ function insert($event_name,$data) {
7980
*/
8081
if ($data['new']['chroot'] == "jailkit")
8182
{
83+
$app->system->web_folder_protection($web['document_root'],false);
84+
8285
// load the server configuration options
8386
$app->uses("getconf");
8487
$this->data = $data;
@@ -98,6 +101,7 @@ function insert($event_name,$data) {
98101
exec($command);
99102

100103
$this->_update_website_security_level();
104+
$app->system->web_folder_protection($web['document_root'],true);
101105
}
102106

103107
$app->log("Jailkit Plugin -> insert username:".$data['new']['username'],LOGLEVEL_DEBUG);
@@ -113,6 +117,7 @@ function update($event_name,$data) {
113117
global $app, $conf;
114118

115119
$app->uses('system');
120+
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['new']['parent_domain_id']);
116121

117122
if($app->system->is_user($data['new']['username'])) {
118123

@@ -121,6 +126,8 @@ function update($event_name,$data) {
121126
*/
122127
if ($data['new']['chroot'] == "jailkit")
123128
{
129+
$app->system->web_folder_protection($web['document_root'],false);
130+
124131
// load the server configuration options
125132
$app->uses("getconf");
126133
$this->data = $data;
@@ -136,6 +143,8 @@ function update($event_name,$data) {
136143
$this->_setup_ssh_rsa();
137144

138145
$this->_update_website_security_level();
146+
147+
$app->system->web_folder_protection($web['document_root'],true);
139148
}
140149

141150
$app->log("Jailkit Plugin -> update username:".$data['new']['username'],LOGLEVEL_DEBUG);
@@ -155,6 +164,8 @@ function delete($event_name,$data) {
155164

156165
$app->uses('system');
157166

167+
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$this->data['old']['parent_domain_id']);
168+
158169
if ($data['old']['chroot'] == "jailkit")
159170
{
160171
$app->uses("getconf");
@@ -165,13 +176,17 @@ function delete($event_name,$data) {
165176
//commented out proved to be dangerous on config errors
166177
//exec('rm -rf '.$data['old']['dir'].$jailkit_chroot_userhome);
167178

179+
$app->system->web_folder_protection($web['document_root'],false);
180+
168181
if(@is_dir($data['old']['dir'].$jailkit_chroot_userhome)) {
169182
$command = 'userdel -f';
170183
$command .= ' '.escapeshellcmd($data['old']['username']);
171184
exec($command);
172185
$app->log("Jailkit Plugin -> delete chroot home:".$data['old']['dir'].$jailkit_chroot_userhome,LOGLEVEL_DEBUG);
173186
}
174187

188+
$app->system->web_folder_protection($web['document_root'],true);
189+
175190
}
176191

177192
$app->log("Jailkit Plugin -> delete username:".$data['old']['username'],LOGLEVEL_DEBUG);

0 commit comments

Comments
 (0)