Skip to content

Commit 94e83c1

Browse files
author
Till Brehm
committed
Merge branch '6854-php-jailkit-fixes' into 'develop'
Resolve "PHP Jailkit fixes for PHP 8.3+ compatiblity" Closes #6854 See merge request ispconfig/ispconfig3!2006
2 parents a54517c + 5137b9c commit 94e83c1

File tree

4 files changed

+112
-67
lines changed

4 files changed

+112
-67
lines changed

‎server/lib/classes/system.inc.php‎

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1883,22 +1883,33 @@ public function is_blacklisted_web_path($path) {
18831883
function web_folder_protection($document_root, $protect) {
18841884
global $app, $conf;
18851885

1886-
if($this->checkpath($document_root) == false) {
1886+
// Ensure $document_root is a string and not null
1887+
$document_root = is_string($document_root) ? trim($document_root) : '';
1888+
1889+
// Check if the path is valid
1890+
if ($this->checkpath($document_root) === false) {
18871891
$app->log("Action aborted, target is a symlink: $document_root", LOGLEVEL_DEBUG);
18881892
return false;
18891893
}
18901894

1891-
//* load the server configuration options
1895+
// Load the server configuration options
18921896
$app->uses('getconf');
18931897
$web_config = $app->getconf->get_server_config($conf['server_id'], 'web');
18941898

1895-
if($protect == true && $web_config['web_folder_protection'] == 'y') {
1896-
//* Add protection
1897-
if($document_root != '' && $document_root != '/' && strlen($document_root) > 6 && !stristr($document_root, '..')) $this->exec_safe('chattr +i ?', $document_root);
1899+
// Add or remove protection based on $protect and configuration
1900+
if ($protect === true && isset($web_config['web_folder_protection']) && $web_config['web_folder_protection'] === 'y') {
1901+
// Add protection
1902+
if ($document_root !== '' && $document_root !== '/' && strlen($document_root) > 6 && strpos($document_root, '..') === false) {
1903+
$this->exec_safe('chattr +i ?', $document_root);
1904+
}
18981905
} else {
1899-
//* Remove protection
1900-
if($document_root != '' && $document_root != '/' && strlen($document_root) > 6 && !stristr($document_root, '..')) $this->exec_safe('chattr -i ?', $document_root);
1906+
// Remove protection
1907+
if ($document_root !== '' && $document_root !== '/' && strlen($document_root) > 6 && strpos($document_root, '..') === false) {
1908+
$this->exec_safe('chattr -i ?', $document_root);
1909+
}
19011910
}
1911+
1912+
return true;
19021913
}
19031914

19041915
function usermod($username, $uid = 0, $gid = 0, $home = '', $shell = '', $password = '', $login = '') {

‎server/plugins-available/cron_jailkit_plugin.inc.php‎

Lines changed: 36 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -105,21 +105,21 @@ function insert($event_name, $data) {
105105
*/
106106

107107

108-
if ($data['new']['type'] == "chrooted")
108+
if($data['new']['type'] == "chrooted")
109109
{
110110
// load the server configuration options
111111
$app->uses("getconf");
112112
$this->data = $data;
113113
$this->jailkit_config = $app->getconf->get_server_config($conf["server_id"], 'jailkit');
114-
foreach (array('jailkit_chroot_app_sections', 'jailkit_chroot_app_programs') as $section) {
114+
foreach(array('jailkit_chroot_app_sections', 'jailkit_chroot_app_programs') as $section) {
115115
// Replace and don't inherit the server's Jailkit config
116116
if (isset($parent_domain[$section]) && $parent_domain[$section] != '' ) {
117117
$this->jailkit_config[$section] = $parent_domain[$section];
118118
}
119119
// Add selected PHP version to the jailkit chroot
120-
if ($section == 'jailkit_chroot_app_sections') {
121-
if (isset($parent_domain['php_jk_section']) && $parent_domain['php_jk_section'] != '' ) {
122-
if (is_array($this->jailkit_config['jailkit_chroot_app_sections'])) {
120+
if($section == 'jailkit_chroot_app_sections') {
121+
if(isset($parent_domain['php_jk_section']) && $parent_domain['php_jk_section'] != '' ) {
122+
if(is_array($this->jailkit_config['jailkit_chroot_app_sections'])) {
123123
$this->jailkit_config['jailkit_chroot_app_sections'] = implode(' ', $this->jailkit_config['jailkit_chroot_app_sections']);
124124
}
125125
$this->jailkit_config['jailkit_chroot_app_sections'] = $this->jailkit_config['jailkit_chroot_app_sections'] . ' ' . $parent_domain['php_jk_section'];
@@ -189,7 +189,7 @@ function update($event_name, $data) {
189189
/**
190190
* Setup Jailkit Chroot System If Enabled
191191
*/
192-
if ($data['new']['type'] == "chrooted")
192+
if($data['new']['type'] == "chrooted")
193193
{
194194
$app->log("Jailkit Plugin (Cron) -> setting up jail", LOGLEVEL_DEBUG);
195195
// load the server configuration options
@@ -249,13 +249,13 @@ function delete($event_name, $data) {
249249

250250
$app->uses('system');
251251

252-
if ($data['old']['type'] == "chrooted")
252+
if($data['old']['type'] == "chrooted")
253253
{
254254
$parent_domain = $app->db->queryOneRecord("SELECT * FROM `web_domain` WHERE `domain_id` = ?", $data['old']['parent_domain_id']);
255255

256256
// should copy some _delete_homedir() functionality from shelluser_jailkit_plugin ?
257257
258-
if (isset($parent_domain['delete_unused_jailkit']) && $parent_domain['delete_unused_jailkit'] == 'y') {
258+
if(isset($parent_domain['delete_unused_jailkit']) && $parent_domain['delete_unused_jailkit'] == 'y') {
259259
$app->system->web_folder_protection($parent_domain['document_root'], false);
260260
$this->_delete_jailkit_if_unused($parent_domain['domain_id']);
261261
$app->system->web_folder_protection($parent_domain['document_root'], true);
@@ -268,27 +268,43 @@ function _setup_jailkit_chroot()
268268
global $app, $conf;
269269

270270

271-
if (isset($this->jailkit_config) && isset($this->jailkit_config['jailkit_hardlinks'])) {
272-
if ($this->jailkit_config['jailkit_hardlinks'] == 'yes') {
271+
if(isset($this->jailkit_config) && isset($this->jailkit_config['jailkit_hardlinks'])) {
272+
if($this->jailkit_config['jailkit_hardlinks'] == 'yes') {
273273
$options = array('hardlink');
274-
} elseif ($this->jailkit_config['jailkit_hardlinks'] == 'no') {
274+
} elseif($this->jailkit_config['jailkit_hardlinks'] == 'no') {
275275
$options = array();
276276
}
277277
} else {
278278
$options = array('allow_hardlink');
279279
}
280280

281-
$last_updated = preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_app_sections']
282-
.' '.$this->jailkit_config['jailkit_chroot_app_programs']
283-
.' '.$this->jailkit_config['jailkit_chroot_cron_programs']);
281+
$sections = isset($this->jailkit_config['jailkit_chroot_app_sections'])
282+
? (is_array($this->jailkit_config['jailkit_chroot_app_sections'])
283+
? $this->jailkit_config['jailkit_chroot_app_sections']
284+
: preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_app_sections']))
285+
: [];
286+
287+
$programs = isset($this->jailkit_config['jailkit_chroot_app_programs'])
288+
? (is_array($this->jailkit_config['jailkit_chroot_app_programs'])
289+
? $this->jailkit_config['jailkit_chroot_app_programs']
290+
: preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_app_programs']))
291+
: [];
292+
293+
$cron_programs = isset($this->jailkit_config['jailkit_chroot_cron_programs'])
294+
? (is_array($this->jailkit_config['jailkit_chroot_cron_programs'])
295+
? $this->jailkit_config['jailkit_chroot_cron_programs']
296+
: preg_split('/[\s,]+/', $this->jailkit_config['jailkit_chroot_cron_programs']))
297+
: [];
298+
299+
$last_updated = array_merge($sections, $programs, $cron_programs);
284300
$last_updated = array_unique($last_updated, SORT_REGULAR);
285301
sort($last_updated, SORT_STRING);
286302
$update_hash = hash('md5', implode(' ', $last_updated));
287303

288304
// should move return here if $update_hash == $parent_domain['last_jailkit_hash'] ?
289305
290306
// check if the chroot environment is created yet if not create it with a list of program sections from the config
291-
if (!is_dir($this->parent_domain['document_root'].'/etc/jailkit'))
307+
if(!is_dir($this->parent_domain['document_root'].'/etc/jailkit'))
292308
{
293309

294310
$app->load('tpl');
@@ -314,12 +330,12 @@ function _setup_jailkit_chroot()
314330
$programs = $this->jailkit_config['jailkit_chroot_app_programs'] . ' '
315331
. $this->jailkit_config['jailkit_chroot_cron_programs'];
316332

317-
if ($update_hash == $this->parent_domain['last_jailkit_hash']) {
333+
if($update_hash == $this->parent_domain['last_jailkit_hash']) {
318334
return;
319335
}
320336

321337
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $this->parent_domain['domain_id'], $this->parent_domain['document_root'], $conf['server_id']);
322-
foreach ($records as $record) {
338+
foreach($records as $record) {
323339
$options[] = 'skip='.$record['web_folder'];
324340
}
325341

@@ -400,12 +416,12 @@ private function _delete_jailkit_if_unused($parent_domain_id) {
400416

401417
// get jail directory
402418
$parent_domain = $app->db->queryOneRecord("SELECT * FROM `web_domain` WHERE `domain_id` = ? OR `parent_domain_id` = ? AND `document_root` IS NOT NULL", $parent_domain_id, $parent_domain_id);
403-
if (!is_dir($parent_domain['document_root'])) {
419+
if(!is_dir($parent_domain['document_root'])) {
404420
return;
405421
}
406422

407423
// chroot is used by php-fpm
408-
if (isset($parent_domain['php_fpm_chroot']) && $parent_domain['php_fpm_chroot'] == 'y') {
424+
if(isset($parent_domain['php_fpm_chroot']) && $parent_domain['php_fpm_chroot'] == 'y') {
409425
return;
410426
}
411427

@@ -423,7 +439,7 @@ private function _delete_jailkit_if_unused($parent_domain_id) {
423439

424440
$options = array();
425441
$records = $app->db->queryAllRecords('SELECT web_folder FROM `web_domain` WHERE `parent_domain_id` = ? AND `document_root` = ? AND web_folder != \'\' AND web_folder IS NOT NULL AND `server_id` = ?', $parent_domain_id, $parent_domain['document_root'], $conf['server_id']);
426-
foreach ($records as $record) {
442+
foreach($records as $record) {
427443
$options[] = 'skip='.$record['web_folder'];
428444
}
429445

‎server/plugins-available/shelluser_base_plugin.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -687,7 +687,7 @@ function _setup_shell_php() {
687687
unlink($home_php);
688688
}
689689
symlink($php_binary_path, $home_php);
690-
$app->log("Created symlink from " . $php_binary_path ." to PHP binary: " . $home_php, LOGLEVEL_DEBUG);
690+
$app->log("Created symlink from " . $home_php ." to PHP binary: " . $php_binary_path, LOGLEVEL_DEBUG);
691691
}
692692
}
693693

0 commit comments

Comments
 (0)