Skip to content

Commit 7b4a869

Browse files
helmohelmo
committed
Merge remote-tracking branch 'origin/develop' into patch-bind-zonefiles-prefix
2 parents 0693ecd + dce4199 commit 7b4a869

File tree

352 files changed

+6614
-549
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

352 files changed

+6614
-549
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
.idea
22
/nbproject/private/
3+
.vscode
34
.phplint-cache
45
*.swp
56

‎docs/autoinstall_samples/autoinstall.conf_sample.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
$autoupdate['ispconfig_postfix_ssl_symlink'] = 'y';
6262
$autoupdate['ispconfig_pureftpd_ssl_symlink'] = 'y';
6363

64-
/* These are for service-detection (defaulting to old behaviour where alle changes were automatically accepted) */
64+
/* These are for service-detection (defaulting to old behaviour where all changes were automatically accepted) */
6565
$autoupdate['svc_detect_change_mail_server'] = 'yes'; // yes (default), no
6666
$autoupdate['svc_detect_change_web_server'] = 'yes'; // yes (default), no
6767
$autoupdate['svc_detect_change_dns_server'] = 'yes'; // yes (default), no

‎docs/autoinstall_samples/autoinstall.ini.sample‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ ignore_hostname_dns=n
6060
ispconfig_postfix_ssl_symlink=y
6161
ispconfig_pureftpd_ssl_symlink=y
6262

63-
; These are for service-detection (defaulting to old behaviour where alle changes were automatically accepted)
63+
; These are for service-detection (defaulting to old behaviour where all changes were automatically accepted)
6464
svc_detect_change_mail_server=yes
6565
svc_detect_change_web_server=yes
6666
svc_detect_change_dns_server=yes

‎install/dist/lib/gentoo.lib.php‎

Lines changed: 500 additions & 195 deletions
Large diffs are not rendered by default.

‎install/dist/tpl/gentoo/apache_ispconfig.vhost.master‎

Lines changed: 98 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,83 @@
44
# for the ISPConfig controlpanel
55
######################################################
66

7-
{vhost_port_listen} Listen {vhost_port}
8-
<tmpl_if name='apache_version' op='<' value='2.4' format='version'>
9-
# NameVirtualHost *:{vhost_port}
10-
</tmpl_if>
7+
<tmpl_var name="vhost_port_listen"> Listen <tmpl_var name="vhost_port">
8+
NameVirtualHost *:<tmpl_var name="vhost_port">
119

12-
<VirtualHost _default_:{vhost_port}>
10+
<VirtualHost _default_:<tmpl_var name="vhost_port">>
1311
ServerAdmin webmaster@localhost
1412

1513
Alias /mail /var/www/ispconfig/mail
1614

15+
<Directory /var/www/ispconfig/>
16+
<FilesMatch "\.ph(p3?|tml)$">
17+
SetHandler None
18+
</FilesMatch>
19+
</Directory>
20+
<Directory /usr/local/ispconfig/interface/web/>
21+
<FilesMatch "\.ph(p3?|tml)$">
22+
SetHandler None
23+
</FilesMatch>
24+
</Directory>
25+
1726
<IfModule mod_fcgid.c>
1827
DocumentRoot /var/www/ispconfig/
1928
SuexecUserGroup ispconfig ispconfig
2029
<Directory /var/www/ispconfig/>
21-
Options +Indexes +FollowSymLinks +MultiViews +ExecCGI
30+
Options -Indexes +FollowSymLinks +MultiViews +ExecCGI
2231
AllowOverride AuthConfig Indexes Limit Options FileInfo
23-
<FilesMatch "\.ph(p[3-5]?|tml)$">
32+
<FilesMatch "\.php$">
2433
SetHandler fcgid-script
2534
</FilesMatch>
2635
FCGIWrapper /var/www/php-fcgi-scripts/ispconfig/.php-fcgi-starter .php
36+
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
37+
Require all granted
38+
<tmpl_else>
2739
Order allow,deny
2840
Allow from all
41+
</tmpl_if>
2942
</Directory>
3043
DirectoryIndex index.php
44+
IPCCommTimeout 7200
45+
MaxRequestLen 15728640
46+
</IfModule>
47+
48+
<IfModule mod_proxy_fcgi.c>
49+
DocumentRoot /usr/local/ispconfig/interface/web
50+
SuexecUserGroup ispconfig ispconfig
51+
DirectoryIndex index.php
52+
53+
<Directory /usr/local/ispconfig/interface/web>
54+
Options -Indexes +FollowSymLinks +MultiViews +ExecCGI
55+
AllowOverride AuthConfig Indexes Limit Options FileInfo
56+
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
57+
Require all granted
58+
<tmpl_else>
59+
Order allow,deny
60+
Allow from all
61+
</tmpl_if>
62+
<FilesMatch \.php$>
63+
#SetHandler "proxy:unix:/var/lib/php5-fpm/ispconfig.sock|fcgi://localhost"
64+
SetHandler "proxy:fcgi://127.0.0.1:9000"
65+
</FilesMatch>
66+
</Directory>
3167
</IfModule>
3268

33-
<IfModule mod_php5.c>
69+
<IfModule mpm_itk_module>
3470
DocumentRoot /usr/local/ispconfig/interface/web/
71+
AssignUserId ispconfig ispconfig
3572
AddType application/x-httpd-php .php
3673
<Directory /usr/local/ispconfig/interface/web>
74+
# php_admin_value open_basedir "/usr/local/ispconfig/interface:/usr/share:/tmp"
3775
Options +FollowSymLinks
3876
AllowOverride None
77+
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
78+
Require all granted
79+
<tmpl_else>
3980
Order allow,deny
4081
Allow from all
41-
php_value magic_quotes_gpc 0
82+
</tmpl_if>
83+
php_value magic_quotes_gpc 0
4284
</Directory>
4385
</IfModule>
4486

@@ -51,20 +93,53 @@
5193
</IfModule>
5294

5395
# SSL Configuration
54-
{ssl_comment}SSLEngine On
55-
{ssl_comment}SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
56-
{ssl_comment}SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
96+
<tmpl_var name="ssl_comment">SSLEngine On
97+
<tmpl_if name='apache_version' op='>=' value='2.3.16' format='version'>
98+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
99+
<tmpl_else>
100+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv2 -SSLv3
101+
</tmpl_if>
102+
<tmpl_var name="ssl_comment">SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
103+
<tmpl_var name="ssl_comment">SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
104+
<tmpl_var name="ssl_bundle_comment">SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle
57105

58-
</VirtualHost>
106+
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
107+
<tmpl_var name="ssl_comment">SSLHonorCipherOrder On
108+
<tmpl_if name='apache_version' op='>=' value='2.4.3' format='version'>
109+
<tmpl_var name="ssl_comment">SSLCompression Off
110+
</tmpl_if>
111+
<tmpl_if name='apache_version' op='>=' value='2.4.11' format='version'>
112+
<tmpl_var name="ssl_comment">SSLSessionTickets Off
113+
</tmpl_if>
59114

60-
<Directory /var/www/php-cgi-scripts>
61-
AllowOverride None
62-
Order Deny,Allow
63-
Deny from all
64-
</Directory>
115+
<IfModule mod_headers.c>
116+
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
117+
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'"
118+
<tmpl_var name="ssl_comment">Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
119+
Header set X-Content-Type-Options: nosniff
120+
Header set X-Frame-Options: SAMEORIGIN
121+
Header set X-XSS-Protection: "1; mode=block"
122+
Header always edit Set-Cookie (.*) "$1; HTTPOnly"
123+
<tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; Secure"
124+
<IfModule mod_version.c>
125+
<IfVersion >= 2.4.7>
126+
Header setifempty Strict-Transport-Security "max-age=15768000"
127+
</IfVersion>
128+
<IfVersion < 2.4.7>
129+
Header set Strict-Transport-Security "max-age=15768000"
130+
</IfVersion>
131+
</IfModule>
132+
RequestHeader unset Proxy early
133+
</IfModule>
134+
135+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
136+
<tmpl_var name="ssl_comment">SSLUseStapling On
137+
<tmpl_var name="ssl_comment">SSLStaplingResponderTimeout 5
138+
<tmpl_var name="ssl_comment">SSLStaplingReturnResponderErrors Off
139+
</tmpl_if>
140+
141+
# Redirect http to https
142+
ErrorDocument 400 "<script>document.location.href='https://'+location.hostname+':'+location.port';</script><h1>Error 400 - trying to redirect</h1>"
143+
144+
</VirtualHost>
65145

66-
<Directory /var/www/php-fcgi-scripts>
67-
AllowOverride None
68-
Order Deny,Allow
69-
Deny from all
70-
</Directory>

‎install/lib/install.lib.php‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -547,16 +547,15 @@ function remove_blank_lines($input, $file = 1){
547547
$content = $input;
548548
}
549549
$lines = explode("\n", $content);
550+
$new_lines = array();
550551
if(!empty($lines)){
551552
foreach($lines as $line){
552553
if(trim($line) != '') $new_lines[] = $line;
553554
}
554555
}
555-
if(is_array($new_lines)){
556-
$content = implode("\n", $new_lines);
557-
} else {
558-
$content = '';
559-
}
556+
557+
$content = implode("\n", $new_lines);
558+
560559
if($file){
561560
wf($input, $content);
562561
}else{

‎install/lib/installer_base.lib.php‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ private function install_acme() {
5252
}
5353

5454
public function update_acme() {
55-
$acme = explode("\n", shell_exec('which acme.sh /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh 2> /dev/null'));
55+
$acme = explode("\n", (string)shell_exec('which acme.sh /usr/local/ispconfig/server/scripts/acme.sh /root/.acme.sh/acme.sh 2> /dev/null'));
5656
$acme = reset($acme);
5757
$val = 0;
5858

@@ -838,9 +838,9 @@ public function process_postfix_config($configfile) {
838838
$addr_cleanup = "'%u'";
839839
foreach (str_split($out[0]) as $delim) {
840840
$recipient_delimiter = $this->db->escape( str_replace('%', '%%', $delim) );
841-
$addr_cleanup = "SUBSTRING_INDEX(${addr_cleanup}, '${recipient_delimiter}', 1)";
841+
$addr_cleanup = "SUBSTRING_INDEX({$addr_cleanup}, '{$recipient_delimiter}', 1)";
842842
}
843-
$no_addr_extension = "CONCAT(${addr_cleanup}, '@%d')";
843+
$no_addr_extension = "CONCAT({$addr_cleanup}, '@%d')";
844844
} else {
845845
$no_addr_extension = "''";
846846
}
@@ -1525,15 +1525,15 @@ public function configure_dovecot() {
15251525
foreach ($options as $value) {
15261526
$value = trim($value);
15271527
if ($value == '') continue;
1528-
if (preg_match("|check_recipient_access\s+proxy:mysql:${quoted_config_dir}/mysql-verify_recipients.cf|", $value)) {
1528+
if (preg_match("|check_recipient_access\s+proxy:mysql:{$quoted_config_dir}/mysql-verify_recipients.cf|", $value)) {
15291529
continue;
15301530
}
15311531
$new_options[] = $value;
15321532
}
15331533
if ($configure_lmtp && (!isset($conf['mail']['content_filter']) || $conf['mail']['content_filter'] === 'amavisd')) {
15341534
for ($i = 0; isset($new_options[$i]); $i++) {
15351535
if ($new_options[$i] == 'reject_unlisted_recipient') {
1536-
array_splice($new_options, $i+1, 0, array("check_recipient_access proxy:mysql:${config_dir}/mysql-verify_recipients.cf"));
1536+
array_splice($new_options, $i+1, 0, array("check_recipient_access proxy:mysql:{$config_dir}/mysql-verify_recipients.cf"));
15371537
break;
15381538
}
15391539
}
@@ -1712,7 +1712,7 @@ public function configure_amavis() {
17121712
// Check for amavisd -> pure webserver with postfix for mailing without antispam
17131713
if ($conf['amavis']['installed']) {
17141714
$content_filter_service = ($configure_lmtp) ? 'lmtp' : 'amavis';
1715-
$postconf_commands[] = "content_filter = ${content_filter_service}:[127.0.0.1]:10024";
1715+
$postconf_commands[] = "content_filter = {$content_filter_service}:[127.0.0.1]:10024";
17161716
$postconf_commands[] = 'receive_override_options = no_address_mappings';
17171717
$postconf_commands[] = 'address_verify_virtual_transport = smtp:[127.0.0.1]:10025';
17181718
$postconf_commands[] = 'address_verify_transport_maps = static:smtp:[127.0.0.1]:10025';
@@ -1723,15 +1723,15 @@ public function configure_amavis() {
17231723
foreach ($options as $value) {
17241724
$value = trim($value);
17251725
if ($value == '') continue;
1726-
if (preg_match("|check_recipient_access\s+proxy:mysql:${quoted_config_dir}/mysql-verify_recipients.cf|", $value)) {
1726+
if (preg_match("|check_recipient_access\s+proxy:mysql:{$quoted_config_dir}/mysql-verify_recipients.cf|", $value)) {
17271727
continue;
17281728
}
17291729
$new_options[] = $value;
17301730
}
17311731
if ($configure_lmtp) {
17321732
for ($i = 0; isset($new_options[$i]); $i++) {
17331733
if ($new_options[$i] == 'reject_unlisted_recipient') {
1734-
array_splice($new_options, $i+1, 0, array("check_recipient_access proxy:mysql:${config_dir}/mysql-verify_recipients.cf"));
1734+
array_splice($new_options, $i+1, 0, array("check_recipient_access proxy:mysql:{$config_dir}/mysql-verify_recipients.cf"));
17351735
break;
17361736
}
17371737
}
@@ -1868,7 +1868,7 @@ public function configure_rspamd() {
18681868
if (preg_match('/check_policy_service\s+inet:127.0.0.1:10023/', $value)) {
18691869
continue;
18701870
}
1871-
if (preg_match("|check_recipient_access\s+proxy:mysql:${quoted_config_dir}/mysql-verify_recipients.cf|", $value)) {
1871+
if (preg_match("|check_recipient_access\s+proxy:mysql:{$quoted_config_dir}/mysql-verify_recipients.cf|", $value)) {
18721872
continue;
18731873
}
18741874
$new_options[] = $value;
@@ -1935,10 +1935,10 @@ public function configure_rspamd() {
19351935
);
19361936
foreach ($local_d as $f) {
19371937
$tpl = new tpl();
1938-
if (file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master")) {
1939-
$tpl->newTemplate($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master");
1938+
if (file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master")) {
1939+
$tpl->newTemplate($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master");
19401940
} else {
1941-
$tpl->newTemplate("rspamd_${f}.master");
1941+
$tpl->newTemplate("rspamd_{$f}.master");
19421942
}
19431943

19441944
$tpl->setVar('dkim_path', $mail_config['dkim_path']);
@@ -1950,7 +1950,7 @@ public function configure_rspamd() {
19501950
$tpl->setLoop('local_addrs', $local_addrs);
19511951
}
19521952

1953-
wf("/etc/rspamd/local.d/${f}", $tpl->grab());
1953+
wf("/etc/rspamd/local.d/{$f}", $tpl->grab());
19541954
}
19551955

19561956

@@ -1967,10 +1967,10 @@ public function configure_rspamd() {
19671967
'arc.conf',
19681968
);
19691969
foreach ($local_d as $f) {
1970-
if(file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master")) {
1971-
exec('cp '.$conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master /etc/rspamd/local.d/${f}");
1970+
if(file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master")) {
1971+
exec('cp '.$conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master /etc/rspamd/local.d/{$f}");
19721972
} else {
1973-
exec("cp tpl/rspamd_${f}.master /etc/rspamd/local.d/${f}");
1973+
exec("cp tpl/rspamd_{$f}.master /etc/rspamd/local.d/{$f}");
19741974
}
19751975
}
19761976

@@ -1980,10 +1980,10 @@ public function configure_rspamd() {
19801980
'surbl_group.conf',
19811981
);
19821982
foreach ($override_d as $f) {
1983-
if(file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master")) {
1984-
exec('cp '.$conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master /etc/rspamd/override.d/${f}");
1983+
if(file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master")) {
1984+
exec('cp '.$conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master /etc/rspamd/override.d/{$f}");
19851985
} else {
1986-
exec("cp tpl/rspamd_${f}.master /etc/rspamd/override.d/${f}");
1986+
exec("cp tpl/rspamd_{$f}.master /etc/rspamd/override.d/{$f}");
19871987
}
19881988
}
19891989

@@ -1995,10 +1995,10 @@ public function configure_rspamd() {
19951995
'spf_whitelist.inc.ispc',
19961996
);
19971997
foreach ($maps_d as $f) {
1998-
if(file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master")) {
1999-
exec('cp '.$conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_${f}.master /etc/rspamd/local.d/maps.d/${f}");
1998+
if(file_exists($conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master")) {
1999+
exec('cp '.$conf['ispconfig_install_dir']."/server/conf-custom/install/rspamd_{$f}.master /etc/rspamd/local.d/maps.d/{$f}");
20002000
} else {
2001-
exec("cp tpl/rspamd_${f}.master /etc/rspamd/local.d/maps.d/${f}");
2001+
exec("cp tpl/rspamd_{$f}.master /etc/rspamd/local.d/maps.d/{$f}");
20022002
}
20032003
}
20042004

@@ -3145,11 +3145,11 @@ public function make_ispconfig_ssl_cert() {
31453145
$out = null;
31463146
$ret = null;
31473147
if($conf['nginx']['installed'] == true || $conf['apache']['installed'] == true) {
3148-
exec("$acme --issue --log $acme_log -w /usr/local/ispconfig/interface/acme -d " . escapeshellarg($hostname) . " $renew_hook", $out, $ret);
3148+
exec("$acme --issue --keylength 4096 --log $acme_log -w /usr/local/ispconfig/interface/acme -d " . escapeshellarg($hostname) . " $renew_hook", $out, $ret);
31493149
}
31503150
// Else, it is not webserver, so we use standalone
31513151
else {
3152-
exec("$acme --issue --log $acme_log --standalone -d " . escapeshellarg($hostname) . " $hook", $out, $ret);
3152+
exec("$acme --issue --keylength 4096 --log $acme_log --standalone -d " . escapeshellarg($hostname) . " $hook", $out, $ret);
31533153
}
31543154

31553155
if($ret == 0 || ($ret == 2 && file_exists($check_acme_file))) {

‎install/tpl/gentoo_postfix.conf.master‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
1+
alias_maps = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
2+
alias_database = hash:/etc/aliases, hash:/var/lib/mailman/data/aliases
13
virtual_alias_domains = proxy:mysql:{config_dir}/mysql-virtual_alias_domains.cf
24
virtual_alias_maps = hash:/var/lib/mailman/data/virtual-mailman, proxy:mysql:{config_dir}/mysql-virtual_forwardings.cf, proxy:mysql:{config_dir}/mysql-virtual_alias_maps.cf, proxy:mysql:{config_dir}/mysql-virtual_email2email.cf
35
virtual_mailbox_domains = proxy:mysql:{config_dir}/mysql-virtual_domains.cf
46
virtual_mailbox_maps = proxy:mysql:{config_dir}/mysql-virtual_mailboxes.cf
57
virtual_mailbox_base = {vmail_mailbox_base}
68
virtual_uid_maps = proxy:mysql:/etc/postfix/mysql-virtual_uids.cf
79
virtual_gid_maps = proxy:mysql:/etc/postfix/mysql-virtual_gids.cf
10+
sender_bcc_maps = proxy:mysql:{config_dir}/mysql-virtual_outgoing_bcc.cf
11+
inet_protocols=all
12+
inet_interfaces = all
813
smtpd_sasl_auth_enable = yes
914
broken_sasl_auth_clients = yes
1015
smtpd_sasl_authenticated_header = yes
@@ -35,7 +40,7 @@ header_checks = regexp:{config_dir}/header_checks
3540
mime_header_checks = regexp:{config_dir}/mime_header_checks
3641
nested_header_checks = regexp:{config_dir}/nested_header_checks
3742
body_checks = regexp:{config_dir}/body_checks
38-
inet_interfaces = all
43+
owner_request_special = no
3944
smtp_tls_security_level = may
4045
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
4146
smtpd_tls_protocols = !SSLv2,!SSLv3

0 commit comments

Comments
 (0)