Merge remote-tracking branch 'origin/develop' into 2558-two-factor-authentication

helmo · helmo · commit 62e64493c5a5 · 2022-03-23T20:10:41.000+01:00
diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,39 @@
-.DS_Store
 .idea
 /nbproject/private/
 .phplint-cache
 *.swp
+
+# macOS-specific things to exclude
+
+# General
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# Icon must end with two \r
+Icon
+
+
+Icon?
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+# Configuration for the Nova editor
+.nova
diff --git a/install/dist/conf/centos52.conf.php b/install/dist/conf/centos52.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos53.conf.php b/install/dist/conf/centos53.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos70.conf.php b/install/dist/conf/centos70.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos72.conf.php b/install/dist/conf/centos72.conf.php
@@ -224,4 +224,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/centos80.conf.php b/install/dist/conf/centos80.conf.php
@@ -224,4 +224,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian100.conf.php b/install/dist/conf/debian100.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian110.conf.php b/install/dist/conf/debian110.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian40.conf.php b/install/dist/conf/debian40.conf.php
@@ -229,4 +229,7 @@
 $conf['openvz']['installed'] = false;
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian60.conf.php b/install/dist/conf/debian60.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debian90.conf.php b/install/dist/conf/debian90.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/debiantesting.conf.php b/install/dist/conf/debiantesting.conf.php
@@ -236,4 +236,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/fedora32.conf.php b/install/dist/conf/fedora32.conf.php
@@ -226,4 +226,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/fedora33.conf.php b/install/dist/conf/fedora33.conf.php
@@ -226,4 +226,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/fedora9.conf.php b/install/dist/conf/fedora9.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/gentoo.conf.php b/install/dist/conf/gentoo.conf.php
@@ -238,4 +238,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/opensuse110.conf.php b/install/dist/conf/opensuse110.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/opensuse112.conf.php b/install/dist/conf/opensuse112.conf.php
@@ -221,4 +221,7 @@
 //* OpenVZ
 $conf['openvz']['installed'] = false;
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu1604.conf.php b/install/dist/conf/ubuntu1604.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu1710.conf.php b/install/dist/conf/ubuntu1710.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu1804.conf.php b/install/dist/conf/ubuntu1804.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/dist/conf/ubuntu2004.conf.php b/install/dist/conf/ubuntu2004.conf.php
@@ -232,4 +232,7 @@
 $conf['xmpp']['init_script'] = 'metronome';
 
 
+// AppArmor
+$conf['apparmor']['installed'] = false;
+
 ?>
diff --git a/install/install.php b/install/install.php
@@ -500,6 +500,12 @@
 	swriteln('Configuring OpenVZ');
 }
 
+// Configure AppArmor
+if($conf['apparmor']['installed']){
+  swriteln('Configuring AppArmor');
+  $inst->configure_apparmor();
+}
+
 if($install_mode == 'standard' || strtolower($inst->simple_query('Configure Firewall Server', array('y', 'n'), 'y','configure_firewall')) == 'y') {
 	//* Check for Firewall
 	if(!$conf['ufw']['installed'] && !$conf['firewall']['installed']) {
diff --git a/install/lib/installer_base.lib.php b/install/lib/installer_base.lib.php
@@ -226,6 +226,7 @@ public function find_installed_apps() {
 		if(is_installed('named') || is_installed('bind') || is_installed('bind9')) $conf['bind']['installed'] = true;
 		if(is_installed('squid')) $conf['squid']['installed'] = true;
 		if(is_installed('nginx')) $conf['nginx']['installed'] = true;
+		if(is_installed('apparmor_status')) $conf['apparmor']['installed'] = true;
 		if(is_installed('iptables') && is_installed('ufw')) {
 			$conf['ufw']['installed'] = true;
 		} elseif(is_installed('iptables')) {
@@ -2478,6 +2479,13 @@ public function configure_squid()
 		exec('chown root:root '.$conf["squid"]["config_dir"].'/'.$configfile);
 	}
 
+	public function configure_apparmor() {
+		$configfile = 'apparmor_usr.sbin.named';
+		if(is_file('/etc/apparmor.d/local/usr.sbin.named')) copy('/etc/apparmor.d/local/usr.sbin.named', '/etc/apparmor.d/local/usr.sbin.named~');
+		$content = rf("tpl/".$configfile.".master");
+		wf('/etc/apparmor.d/local/usr.sbin.named', $content);
+	}
+
 	public function configure_ufw_firewall()
 	{
 		if($this->is_update == false) {
diff --git a/install/sql/incremental/upd_0096.sql b/install/sql/incremental/upd_0096.sql
@@ -0,0 +1,19 @@
+-- create mail_relay_domain and load with current domains from mail_transport table
+CREATE TABLE IF NOT EXISTS `mail_relay_domain` (
+	  `relay_domain_id` bigint(20) NOT NULL AUTO_INCREMENT,
+	  `sys_userid` int(11) NOT NULL DEFAULT '0',
+	  `sys_groupid` int(11) NOT NULL DEFAULT '0',
+	  `sys_perm_user` varchar(5) DEFAULT NULL,
+	  `sys_perm_group` varchar(5) DEFAULT NULL,
+	  `sys_perm_other` varchar(5) DEFAULT NULL,
+	  `server_id` int(11) NOT NULL DEFAULT '0',
+	  `domain` varchar(255) DEFAULT NULL,
+	  `access` varchar(255) NOT NULL DEFAULT 'OK',
+	  `active` varchar(255) NOT NULL DEFAULT 'y',
+	  PRIMARY KEY (`relay_domain_id`),
+	  UNIQUE KEY `domain` (`domain`, `server_id`)
+	) DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+
+INSERT INTO `mail_relay_domain` SELECT NULL, `sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `server_id`, `domain`, 'OK', `active` FROM `mail_transport` WHERE `domain` NOT LIKE '%@%' AND `domain` LIKE '%.%' GROUP BY `domain`, `server_id`;
+
+ALTER TABLE `dns_soa` ADD `rendered_zone` MEDIUMTEXT NULL AFTER `dnssec_info`;
diff --git a/install/sql/incremental/upd_dev_collection.sql b/install/sql/incremental/upd_dev_collection.sql
@@ -1,21 +1 @@
--- create mail_relay_domain and load with current domains from mail_transport table
-CREATE TABLE IF NOT EXISTS `mail_relay_domain` (
-	  `relay_domain_id` bigint(20) NOT NULL AUTO_INCREMENT,
-	  `sys_userid` int(11) NOT NULL DEFAULT '0',
-	  `sys_groupid` int(11) NOT NULL DEFAULT '0',
-	  `sys_perm_user` varchar(5) DEFAULT NULL,
-	  `sys_perm_group` varchar(5) DEFAULT NULL,
-	  `sys_perm_other` varchar(5) DEFAULT NULL,
-	  `server_id` int(11) NOT NULL DEFAULT '0',
-	  `domain` varchar(255) DEFAULT NULL,
-	  `access` varchar(255) NOT NULL DEFAULT 'OK',
-	  `active` varchar(255) NOT NULL DEFAULT 'y',
-	  PRIMARY KEY (`relay_domain_id`),
-	  UNIQUE KEY `domain` (`domain`, `server_id`)
-	) DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
-
-INSERT INTO `mail_relay_domain` SELECT NULL, `sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `server_id`, `domain`, 'OK', `active` FROM `mail_transport` WHERE `domain` NOT LIKE '%@%' AND `domain` LIKE '%.%' GROUP BY `domain`, `server_id`;
-
-ALTER TABLE `dns_soa` ADD `rendered_zone` MEDIUMTEXT NULL AFTER `dnssec_info`;
-
 ALTER TABLE `sys_user` ADD `otp_enabled` SET('n', 'y','v') NOT NULL DEFAULT 'n' COMMENT 'v=waiting for validation of the chosen otp method' AFTER `lost_password_reqtime`, ADD `otp_type` SET('email') NOT NULL DEFAULT 'email' AFTER `otp_enabled`, ADD `otp_data` VARCHAR(255) NULL AFTER `otp_type`, ADD `otp_recovery` VARCHAR(64) NULL AFTER `otp_data`, ADD `otp_attempts` TINYINT NOT NULL DEFAULT '0' AFTER `otp_recovery`;
diff --git a/install/tpl/apparmor_usr.sbin.named.master b/install/tpl/apparmor_usr.sbin.named.master
@@ -0,0 +1,2 @@
+/etc/bind/slave/** lrw,
+/etc/bind/slave/ rw,
diff --git a/install/update.php b/install/update.php
@@ -512,6 +512,12 @@
 	$inst->configure_xmpp('dont-create-certs');
 	}
 
+  // Configure AppArmor
+  if($conf['apparmor']['installed']){
+    swriteln('Configuring AppArmor');
+    $inst->configure_apparmor();
+  }
+
 	if($conf['services']['firewall'] && $inst->reconfigure_app('Firewall', $reconfigure_services_answer)) {
 		if($conf['ufw']['installed'] == true) {
 			//* Configure Ubuntu Firewall
diff --git a/interface/lib/app.inc.php b/interface/lib/app.inc.php
diff --git a/interface/web/admin/lib/remote.conf.php b/interface/web/admin/lib/remote.conf.php
@@ -3,9 +3,11 @@
 $function_list['server_get,server_config_set,get_function_list,client_templates_get_all,server_get_serverid_by_ip,server_ip_get,server_ip_add,server_ip_update,server_ip_delete,system_config_set,system_config_get,config_value_get,config_value_add,config_value_update,config_value_replace,config_value_delete'] = 'Server functions';
 $function_list['admin_record_permissions'] = 'Record permission changes';
 
-# Roundcube: generate list of actual soap methods used with:
-# grep soap-\> /usr/share/roundcube/plugins/ispconfig3_*/ispconfig3_*.php | sed -e 's/^.*soap->//g' -e 's/(.*$//g' | sort -u | xargs | sed -e 's/ /,/g'
-#
+// Roundcube: generate list of actual soap methods used with:
+// grep soap-\> /usr/share/roundcube/plugins/ispconfig3_*/ispconfig3_*.php | sed -e 's/^.*soap->//g' -e 's/(.*$//g' | sort -u | xargs | sed -e 's/ /,/g'
+//
 $function_list['client_get_id,login,logout,mail_alias_get,mail_fetchmail_add,mail_fetchmail_delete,mail_fetchmail_get,mail_fetchmail_update,mail_policy_get,mail_spamfilter_blacklist_add,mail_spamfilter_blacklist_delete,mail_spamfilter_blacklist_get,mail_spamfilter_blacklist_update,mail_spamfilter_user_add,mail_spamfilter_user_get,mail_spamfilter_user_update,mail_spamfilter_whitelist_add,mail_spamfilter_whitelist_delete,mail_spamfilter_whitelist_get,mail_spamfilter_whitelist_update,mail_user_filter_add,mail_user_filter_delete,mail_user_filter_get,mail_user_filter_update,mail_user_get,mail_user_update,server_get,server_get_app_version'] = 'Roundcube plugins functions';
 
-?>
+// functions used by ispc_acmeproxy:  https://git.ispconfig.org/ispconfig/Modules/-/tree/master/ispc_acmeproxy
+//
+$function_list['client_get_by_username,client_get_id,dns_zone_get,dns_zone_get_by_user,dns_zone_update,dns_txt_add,dns_txt_get,dns_txt_delete'] = 'ISPConfig module: acme proxy functions';
diff --git a/interface/web/mail/form/mail_user_filter.tform.php b/interface/web/mail/form/mail_user_filter.tform.php
@@ -121,7 +121,7 @@
 			'datatype' => 'VARCHAR',
 			'formtype' => 'TEXT',
 			'validators' => array (  0 => array ( 'type' => 'REGEX',
-					'regex' => '/^[\p{Latin}0-9\.\-\_\ \&\/]{0,100}$/u',
+					'regex' => '/^[\p{Latin}0-9\.\'\-\_\ \&\/]{0,100}$/u',
 					'errmsg'=> 'target_error_regex'),
 			),
 			'default' => '',
diff --git a/interface/web/mailuser/form/mail_user_filter.tform.php b/interface/web/mailuser/form/mail_user_filter.tform.php
@@ -94,7 +94,6 @@
 			'datatype' => 'VARCHAR',
 			'formtype' => 'SELECT',
 			'default' => '',
-			//'value'  => array('contains'=>'contains_txt','is' => 'Is','begins'=>'Begins with','ends'=>'Ends with')
 			'value'  => array('contains'=>'contains_txt', 'is'=>'is_txt', 'begins'=>'begins_with_txt', 'ends'=>'ends_with_txt', 'regex'=>'regex_txt', 'localpart'=>'localpart_txt', 'domain'=>'domain_txt')
 		),
 		'searchterm' => array (
@@ -122,7 +121,7 @@
 			'datatype' => 'VARCHAR',
 			'formtype' => 'TEXT',
 			'validators' => array (  0 => array ( 'type' => 'REGEX',
-					'regex' => '/^[\p{Latin}0-9\.\-\_\ \&\/]{0,100}$/u',
+					'regex' => '/^[\p{Latin}0-9\.\'\-\_\ \&\/]{0,100}$/u',
 					'errmsg'=> 'target_error_regex'),
 			),
 			'default' => '',
diff --git a/interface/web/themes/default/assets/javascripts/ispconfig.js b/interface/web/themes/default/assets/javascripts/ispconfig.js
@@ -739,7 +739,7 @@ $(document).on("click", "[data-uncheck-fields] > input[type='checkbox']", functi
 	}
 });
 
-$(document).on('ready', function () {
+$(document).ready(function() {
 	$.fn.extend({
 		insertAtCaret: function(myValue){
 			return this.each(function(i) {
diff --git a/server/lib/app.inc.php b/server/lib/app.inc.php
diff --git a/server/lib/classes/letsencrypt.inc.php b/server/lib/classes/letsencrypt.inc.php
