Skip to content

Commit 8e725d2

Browse files
author
jwarnier
committed
fix some strings quoting and remove some execs
1 parent be76b0b commit 8e725d2

13 files changed

+108
-99
lines changed

‎install/dist/lib/debian60.lib.php‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,11 @@ public function configure_dovecot()
3838

3939
//* Configure master.cf and add a line for deliver
4040
if(is_file($config_dir.'/master.cf')){
41-
copy($config_dir.'/master.cf', $config_dir.'/master.cf~2');
42-
}
41+
copy($config_dir.'/master.cf', $config_dir.'/master.cf~2');
42+
}
4343
if(is_file($config_dir.'/master.cf~')){
44-
exec('chmod 400 '.$config_dir.'/master.cf~2');
45-
}
44+
chmod($config_dir.'/master.cf~2', 0400);
45+
}
4646
$content = rf($conf["postfix"]["config_dir"].'/master.cf');
4747
// Only add the content if we had not addded it before
4848
if(!stristr($content,"dovecot/deliver")) {
@@ -73,29 +73,30 @@ public function configure_dovecot()
7373

7474
//* copy dovecot.conf
7575
$configfile = 'dovecot.conf';
76-
if(is_file("$config_dir/$configfile")){
77-
copy("$config_dir/$configfile", "$config_dir/$configfile~");
78-
}
79-
copy('tpl/debian6_dovecot.conf.master',"$config_dir/$configfile");
76+
if(is_file($config_dir.'/'.$configfile)){
77+
copy($config_dir.'/'.$configfile, $config_dir.'/'.$configfile.'~');
78+
}
79+
copy('tpl/debian6_dovecot.conf.master',$config_dir.'/'.$configfile);
8080

8181
//* dovecot-sql.conf
8282
$configfile = 'dovecot-sql.conf';
83-
if(is_file("$config_dir/$configfile")){
84-
copy("$config_dir/$configfile", "$config_dir/$configfile~");
85-
}
86-
exec("chmod 400 $config_dir/$configfile~");
87-
$content = rf("tpl/debian6_dovecot-sql.conf.master");
83+
if(is_file($config_dir.'/'.$configfile)){
84+
copy($config_dir.'/'.$configfile, $config_dir.'/'.$configfile.'~');
85+
}
86+
chmod($config_dir.'/'.$configfile.'~', 0400);
87+
$content = rf('tpl/debian6_dovecot-sql.conf.master');
8888
$content = str_replace('{mysql_server_ispconfig_user}',$conf['mysql']['ispconfig_user'],$content);
8989
$content = str_replace('{mysql_server_ispconfig_password}',$conf['mysql']['ispconfig_password'], $content);
9090
$content = str_replace('{mysql_server_database}',$conf['mysql']['database'],$content);
9191
$content = str_replace('{mysql_server_host}',$conf['mysql']['host'],$content);
92-
wf("$config_dir/$configfile", $content);
92+
wf($config_dir.'/'.$configfile, $content);
9393

94-
exec("chmod 600 $config_dir/$configfile");
95-
exec("chown root:root $config_dir/$configfile");
94+
chmod($config_dir.'/'.$configfile, 0600);
95+
chown($config_dir.'/'.$configfile, 'root');
96+
chgrp($config_dir.'/'.$configfile, 'root');
9697

9798
}
9899

99100
}
100101

101-
?>
102+
?>

‎install/lib/update.lib.php‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -58,8 +58,9 @@ function prepareDBDump() {
5858
// create a backup copy of the ispconfig database in the root folder
5959
$backup_db_name = '/root/ispconfig_db_backup_'.@date('Y-m-d_h-i').'.sql';
6060
copy('existing_db.sql',$backup_db_name);
61-
exec("chmod 700 $backup_db_name");
62-
exec("chown root:root $backup_db_name");
61+
chmod($backup_db_name, 0700);
62+
chown($backup_db_name, 'root');
63+
chgrp($backup_db_name, 'root');
6364

6465
if ($conf['powerdns']['installed']) {
6566
//** export the current PowerDNS database data
@@ -72,8 +73,9 @@ function prepareDBDump() {
7273
// create a backup copy of the PowerDNS database in the root folder
7374
$backup_db_name = '/root/ispconfig_powerdns_db_backup_'.@date('Y-m-d_h-i').'.sql';
7475
copy('existing_powerdns_db.sql',$backup_db_name);
75-
exec("chmod 700 $backup_db_name");
76-
exec("chown root:root $backup_db_name");
76+
chmod($backup_db_name, 0700);
77+
chown($backup_db_name, 'root');
78+
chgrp($backup_db_name, 'root');
7779
}
7880
}
7981

‎server/cron_daily.php‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ function setConfigVar( $filename, $varName, $varValue ) {
132132
$webalizer_conf = escapeshellcmd($rec["document_root"].'/log/webalizer.conf');
133133

134134
if(!@is_file($webalizer_conf)) {
135-
exec("cp $webalizer_conf_main $webalizer_conf");
135+
copy($webalizer_conf_main,$webalizer_conf);
136136
}
137137

138138
if(@is_file($webalizer_conf)) {
@@ -376,12 +376,12 @@ function setConfigVar( $filename, $varName, $varValue ) {
376376
#######################################################################################################
377377

378378
$server_config = $app->getconf->get_server_config($conf["server_id"], 'server');
379-
$backup_dir = trim($server_config['backup_dir']);
379+
$backup_dir = $server_config['backup_dir'];
380380

381381
if($backup_dir != '') {
382382

383383
if(!is_dir($backup_dir)) {
384-
exec("mkdir -p ".escapeshellarg($backup_dir));
384+
mkdir(escapeshellarg($backup_dir), 0750, true);
385385
}
386386

387387
$sql = "SELECT * FROM web_domain WHERE type = 'vhost'";
@@ -397,24 +397,25 @@ function setConfigVar( $filename, $varName, $varValue ) {
397397
$web_group = $rec['system_group'];
398398
$web_id = $rec['domain_id'];
399399
$web_backup_dir = $backup_dir.'/web'.$web_id;
400-
if(!is_dir($web_backup_dir)) mkdir($web_backup_dir);
400+
if(!is_dir($web_backup_dir)) mkdir($web_backup_dir, 0750);
401401

402-
exec('chown root:root '.$web_backup_dir);
403-
exec('chmod 755 '.$web_backup_dir);
404-
exec("cd ".escapeshellarg($web_path)." && sudo -u ".escapeshellarg($web_user)." find . -group ".escapeshellarg($web_group)." -print | zip -y ".escapeshellarg($web_backup_dir."/web.zip")." -@");
402+
chmod($web_backup_dir, 0755);
403+
chown($web_backup_dir, 'root');
404+
chgrp($web_backup_dir, 'root');
405+
exec('cd '.escapeshellarg($web_path).' && sudo -u '.escapeshellarg($web_user).' find . -group '.escapeshellarg($web_group).' -print | zip -y '.escapeshellarg($web_backup_dir.'/web.zip').' -@');
405406

406407
// Rename or remove old backups
407408
$backup_copies = intval($rec['backup_copies']);
408409

409-
if(is_file($web_backup_dir."/web.".$backup_copies.".zip")) unlink($web_backup_dir."/web.".$backup_copies.".zip");
410+
if(is_file($web_backup_dir.'/web.'.$backup_copies.'.zip')) unlink($web_backup_dir.'/web.'.$backup_copies.'.zip');
410411

411412
for($n = $backup_copies - 1; $n >= 1; $n--) {
412-
if(is_file($web_backup_dir."/web.".$n.".zip")) {
413-
rename($web_backup_dir."/web.".$n.".zip",$web_backup_dir."/web.".($n+1).".zip");
413+
if(is_file($web_backup_dir.'/web.'.$n.'.zip')) {
414+
rename($web_backup_dir.'/web.'.$n.'.zip',$web_backup_dir.'/web.'.($n+1).'.zip');
414415
}
415416
}
416417

417-
if(is_file($web_backup_dir."/web.zip")) rename($web_backup_dir."/web.zip",$web_backup_dir."/web.1.zip");
418+
if(is_file($web_backup_dir.'/web.zip')) rename($web_backup_dir.'/web.zip',$web_backup_dir.'/web.1.zip');
418419

419420
// Create backupdir symlink
420421
if(is_link($web_path.'/backup')) unlink($web_path.'/backup');
@@ -430,7 +431,7 @@ function setConfigVar( $filename, $varName, $varValue ) {
430431
$web_user = $rec['system_user'];
431432
$web_backup_dir = realpath($backup_dir.'/web'.$web_id);
432433
if(is_dir($web_backup_dir)) {
433-
exec("sudo -u ".escapeshellarg($web_user)." rm -f ".escapeshellarg($web_backup_dir.'/*'));
434+
exec('sudo -u '.escapeshellarg($web_user).' rm -f '.escapeshellarg($web_backup_dir.'/*'));
434435
}
435436
}
436437
}
@@ -439,4 +440,4 @@ function setConfigVar( $filename, $varName, $varValue ) {
439440

440441

441442
die("finished.\n");
442-
?>
443+
?>

‎server/plugins-available/bind_plugin.inc.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,8 @@ function soa_update($event_name,$data) {
109109
$filename = escapeshellcmd($dns_config['bind_zonefiles_dir'].'/pri.'.substr($zone['origin'],0,-1));
110110
$app->log("Writing BIND domain file: ".$filename,LOGLEVEL_DEBUG);
111111
file_put_contents($filename,$tpl->grab());
112-
exec('chown '.escapeshellcmd($dns_config['bind_user']).':'.escapeshellcmd($dns_config['bind_group']).' '.$filename);
112+
chown($filename, escapeshellcmd($dns_config['bind_user']));
113+
chgrp($filename, escapeshellcmd($dns_config['bind_group']));
113114
unset($tpl);
114115
unset($records);
115116
unset($records_out);

‎server/plugins-available/cron_jailkit_plugin.inc.php‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -230,20 +230,20 @@ function _setup_jailkit_chroot()
230230
$tpl->setVar('home_dir',$this->_get_home_dir(""));
231231

232232
$bashrc = escapeshellcmd($this->parent_domain['document_root']).'/etc/bash.bashrc';
233-
if(@is_file($bashrc)) exec('rm '.$bashrc);
233+
if(@is_file($bashrc)) unlink($bashrc);
234234

235235
file_put_contents($bashrc,$tpl->grab());
236236
unset($tpl);
237237

238-
$this->app->log("Added bashrc scrpt : ".$bashrc,LOGLEVEL_DEBUG);
238+
$this->app->log('Added bashrc script: '.$bashrc,LOGLEVEL_DEBUG);
239239

240240
$tpl = new tpl();
241-
$tpl->newTemplate("motd.master");
241+
$tpl->newTemplate('motd.master');
242242

243243
$tpl->setVar('domain',$this->parent_domain['domain']);
244244

245245
$motd = escapeshellcmd($this->parent_domain['document_root']).'/var/run/motd';
246-
if(@is_file($motd)) exec('rm '.$motd);
246+
if(@is_file($motd)) unlink($motd);
247247

248248
file_put_contents($motd,$tpl->grab());
249249

@@ -290,7 +290,7 @@ function _add_jailkit_user()
290290

291291
$this->app->log("Added jailkit user to chroot with command: ".$command,LOGLEVEL_DEBUG);
292292

293-
exec("mkdir -p ".escapeshellcmd($this->parent_domain['document_root'].$jailkit_chroot_userhome));
293+
mkdir(escapeshellcmd($this->parent_domain['document_root'].$jailkit_chroot_userhome), 0755, true);
294294
}
295295

296296
function _get_home_dir($username)
@@ -308,16 +308,16 @@ function _update_website_security_level() {
308308

309309
//* If the security level is set to high
310310
if($web_config['security_level'] == 20) {
311-
$this->_exec("chmod 755 ".escapeshellcmd($this->parent_domain['document_root']));
312-
$this->_exec("chown root:root ".escapeshellcmd($this->parent_domain['document_root']));
311+
$this->_exec('chmod 755 '.escapeshellcmd($this->parent_domain['document_root']));
312+
$this->_exec('chown root:root '.escapeshellcmd($this->parent_domain['document_root']));
313313
}
314314

315315
}
316316

317317
//* Wrapper for exec function for easier debugging
318318
private function _exec($command) {
319319
global $app;
320-
$app->log("exec: ".$command,LOGLEVEL_DEBUG);
320+
$app->log('exec: '.$command,LOGLEVEL_DEBUG);
321321
exec($command);
322322
}
323323

‎server/plugins-available/cron_plugin.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ function update($event_name,$data) {
9797
$app->log("Parent domain not found",LOGLEVEL_WARN);
9898
return 0;
9999
} elseif($parent_domain["system_user"] == 'root' or $parent_domain["system_group"] == 'root') {
100-
$app->log("Websites (and Crons) can not be owned by the root user or group.",LOGLEVEL_WARN);
100+
$app->log("Websites (and Crons) cannot be owned by the root user or group.",LOGLEVEL_WARN);
101101
return 0;
102102
}
103103

@@ -134,7 +134,7 @@ function update($event_name,$data) {
134134
}
135135

136136
// make temp directory writable for the apache and website users
137-
exec("chmod 777 ".escapeshellcmd($parent_domain["document_root"]."/tmp"));
137+
chmod(escapeshellcmd($parent_domain["document_root"].'/tmp'), 0777);
138138

139139
/** TODO READ CRON MASTER **/
140140

‎server/plugins-available/getmail_plugin.inc.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,8 @@ function update($event_name,$data) {
129129
// Write the config file.
130130
file_put_contents($config_file_path,$tpl);
131131
$app->log("Writing Getmail config file: $config_file_path",LOGLEVEL_DEBUG);
132-
exec("chmod 400 $config_file_path");
133-
exec("chown getmail $config_file_path");
132+
chmod($config_file_path, 0400);
133+
chown($config_file_path, 'getmail');
134134
unset($tpl);
135135
unset($config_file_path);
136136

@@ -160,4 +160,4 @@ function delete($event_name,$data) {
160160

161161
} // end class
162162

163-
?>
163+
?>

‎server/plugins-available/maildrop_plugin.inc.php‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,8 @@ function update($event_name,$data) {
8282
if(!is_dir($this->mailfilter_config_dir)) {
8383
$app->log("Mailfilter config directory '".$this->mailfilter_config_dir."' does not exist. Creating it now.",LOGLEVEL_WARN);
8484
mkdir($this->mailfilter_config_dir);
85-
exec("chown vmail ".$this->mailfilter_config_dir);
86-
exec("chmod 770 ".$this->mailfilter_config_dir);
85+
chown($this->mailfilter_config_dir, 'vmail');
86+
chmod($this->mailfilter_config_dir, 0770);
8787
}
8888

8989
if(isset($data["new"]["email"])) {
@@ -95,13 +95,13 @@ function update($event_name,$data) {
9595
// make sure that the config directories exist
9696
if(!is_dir($this->mailfilter_config_dir.'/'.$email_parts[1])) {
9797
mkdir($this->mailfilter_config_dir.'/'.$email_parts[1]);
98-
exec("chown vmail ".$this->mailfilter_config_dir.'/'.$email_parts[1]);
99-
exec("chmod 770 ".$this->mailfilter_config_dir.'/'.$email_parts[1]);
98+
chown($this->mailfilter_config_dir.'/'.$email_parts[1], 'vmail');
99+
chmod($this->mailfilter_config_dir.'/'.$email_parts[1], 0770);
100100
}
101101
if(!is_dir($this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0])) {
102102
mkdir($this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0]);
103-
exec("chown vmail ".$this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0]);
104-
exec("chmod 770 ".$this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0]);
103+
chown($this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0], 'vmail');
104+
chmod($this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0], 0770);
105105
}
106106

107107
// Check if something has been changed regarding the autoresponders
@@ -151,16 +151,16 @@ function update($event_name,$data) {
151151
$config_file_path = $this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0].'/.autoresponder';
152152
file_put_contents($config_file_path,$tpl);
153153
$app->log("Writing Autoresponder mailfilter file: $config_file_path",LOGLEVEL_DEBUG);
154-
exec("chmod 770 $config_file_path");
155-
exec("chown vmail $config_file_path");
154+
chmod($config_file_path, 0770);
155+
chown($config_file_path, 'vmail');
156156
unset($tpl);
157157
unset($config_file_path);
158158

159159
// Write the autoresponder message file
160160
$config_file_path = $this->mailfilter_config_dir.'/'.$email_parts[1].'/'.$email_parts[0].'/.vacation.msg';
161161
file_put_contents($config_file_path,$data["new"]["autoresponder_text"]);
162-
exec("chmod 770 $config_file_path");
163-
exec("chown vmail $config_file_path");
162+
chmod($config_file_path, 0770);
163+
chown($config_file_path, 'vmail');
164164
$app->log("Writing Autoresponder message file: $config_file_path",LOGLEVEL_DEBUG);
165165
}
166166
}
@@ -198,8 +198,8 @@ function update($event_name,$data) {
198198

199199
file_put_contents($config_file_path,$mailfilter_content);
200200
$app->log("Writing new custom Mailfiter".$config_file_path,LOGLEVEL_DEBUG);
201-
exec("chmod 770 $config_file_path");
202-
exec("chown vmail $config_file_path");
201+
chmod($config_file_path, 0770);
202+
chown($config_file_path, 'vmail');
203203
unset($config_file_path);
204204
} else {
205205
// Delete the mailfilter recipe
@@ -244,4 +244,4 @@ function delete($event_name,$data) {
244244

245245
} // end class
246246

247-
?>
247+
?>

‎server/plugins-available/pma_symlink_plugin.inc.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -106,16 +106,16 @@ function update($event_name,$data) {
106106
elseif($data["new"]["php"] == "fast-cgi" && $data["new"]["suexec"] == "y") $symlink = false;
107107

108108

109-
if(!is_dir($data["new"]["document_root"]."/web")) exec("mkdir -p ".$data["new"]["document_root"]."/web");
109+
if(!is_dir($data["new"]["document_root"]."/web")) mkdir($data["new"]["document_root"].'/web', 0755, true);
110110
if($symlink == false) {
111-
if(is_link($data["new"]["document_root"]."/web/phpmyadmin")) exec("rm -f ".$data["new"]["document_root"]."/web/phpmyadmin");
111+
if(is_link($data["new"]["document_root"].'/web/phpmyadmin')) unlink($data["new"]["document_root"].'/web/phpmyadmin');
112112
} else {
113-
if(!is_link($data["new"]["document_root"]."/web/phpmyadmin")) exec("ln -s /var/www/phpmyadmin ".$data["new"]["document_root"]."/web/phpmyadmin");
114-
else exec("ln -sf /var/www/phpmyadmin ".$data["new"]["document_root"]."/web/phpmyadmin");
113+
if(!is_link($data["new"]["document_root"].'/web/phpmyadmin')) symlink('/var/www/phpmyadmin',$data["new"]["document_root"].'/web/phpmyadmin');
114+
else symlink('/var/www/phpmyadmin',$data["new"]["document_root"].'/web/phpmyadmin');
115115
}
116116
}
117117

118118

119119
} // end class
120120

121-
?>
121+
?>

0 commit comments

Comments
 (0)