Skip to content

Commit a3e2115

Browse files
helmohelmo
committed
Merge branch 'develop' into 'patch-dns-zone-rendering'
# Conflicts: # install/sql/incremental/upd_dev_collection.sql
2 parents 7d7a48f + db69e52 commit a3e2115

File tree

14 files changed

+151
-97
lines changed

14 files changed

+151
-97
lines changed

‎install/dist/lib/fedora.lib.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1227,8 +1227,8 @@ public function install_ispconfig()
12271227
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
12281228

12291229
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1230-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1231-
$this->db->query($sql, $conf['interface_password']);
1230+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
1231+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
12321232
}
12331233

12341234
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -1372,6 +1372,7 @@ public function install_ispconfig()
13721372
//* Create the ispconfig log directory
13731373
if(!is_dir($conf['ispconfig_log_dir'])) mkdir($conf['ispconfig_log_dir']);
13741374
if(!is_file($conf['ispconfig_log_dir'].'/ispconfig.log')) exec('touch '.$conf['ispconfig_log_dir'].'/ispconfig.log');
1375+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
13751376

13761377
if(is_user('getmail')) {
13771378
exec('mv /usr/local/ispconfig/server/scripts/run-getmail.sh /usr/local/bin/run-getmail.sh');

‎install/dist/lib/gentoo.lib.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1115,8 +1115,8 @@ public function install_ispconfig()
11151115
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
11161116

11171117
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1118-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1119-
$this->db->query($sql, $conf['interface_password']);
1118+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
1119+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
11201120
}
11211121

11221122
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -1252,6 +1252,7 @@ public function install_ispconfig()
12521252
if (!is_file($conf['ispconfig_log_dir'].'/ispconfig.log')) {
12531253
touch($conf['ispconfig_log_dir'].'/ispconfig.log');
12541254
}
1255+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
12551256

12561257
//* Create the ispconfig auth log file and set uid/gid
12571258
if(!is_file($conf['ispconfig_log_dir'].'/auth.log')) {

‎install/dist/lib/opensuse.lib.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1215,8 +1215,8 @@ public function install_ispconfig()
12151215
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
12161216

12171217
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1218-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1219-
$this->db->query($sql, $conf['interface_password']);
1218+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
1219+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
12201220
}
12211221

12221222
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -1369,6 +1369,7 @@ public function install_ispconfig()
13691369
//* Create the ispconfig log directory
13701370
if(!is_dir($conf['ispconfig_log_dir'])) mkdir($conf['ispconfig_log_dir']);
13711371
if(!is_file($conf['ispconfig_log_dir'].'/ispconfig.log')) exec('touch '.$conf['ispconfig_log_dir'].'/ispconfig.log');
1372+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
13721373

13731374
if(is_user('getmail')) {
13741375
exec('mv /usr/local/ispconfig/server/scripts/run-getmail.sh /usr/local/bin/run-getmail.sh');

‎install/lib/installer_base.lib.php‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,34 @@ public function get_php_version() {
157157
else return true;
158158
}
159159

160+
public function crypt_password($cleartext_password, $charset = 'UTF-8') {
161+
if($charset != 'UTF-8') {
162+
$cleartext_password = mb_convert_encoding($cleartext_password, $charset, 'UTF-8');
163+
}
164+
165+
if(defined('CRYPT_SHA512') && CRYPT_SHA512 == 1) {
166+
$salt = '$6$rounds=5000$';
167+
$salt_length = 16;
168+
} elseif(defined('CRYPT_SHA256') && CRYPT_SHA256 == 1) {
169+
$salt = '$5$rounds=5000$';
170+
$salt_length = 16;
171+
} else {
172+
$salt = '$1$';
173+
$salt_length = 12;
174+
}
175+
176+
if(function_exists('openssl_random_pseudo_bytes')) {
177+
$salt .= substr(bin2hex(openssl_random_pseudo_bytes($salt_length)), 0, $salt_length);
178+
} else {
179+
$base64_alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';
180+
for($n = 0; $n < $salt_length; $n++) {
181+
$salt .= $base64_alphabet[mt_rand(0, 63)];
182+
}
183+
}
184+
$salt .= "$";
185+
return crypt($cleartext_password, $salt);
186+
}
187+
160188
//** Detect installed applications
161189
public function find_installed_apps() {
162190
global $conf;
@@ -3415,8 +3443,8 @@ public function install_ispconfig() {
34153443
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
34163444

34173445
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
3418-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
3419-
$this->db->query($sql, $conf['interface_password']);
3446+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
3447+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
34203448
}
34213449

34223450
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -3560,6 +3588,7 @@ public function install_ispconfig() {
35603588
if(!is_dir($conf['ispconfig_log_dir'])) mkdir($conf['ispconfig_log_dir'], 0755);
35613589
touch($conf['ispconfig_log_dir'].'/ispconfig.log');
35623590
}
3591+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
35633592

35643593
//* Create the ispconfig auth log file and set uid/gid
35653594
if(!is_file($conf['ispconfig_log_dir'].'/auth.log')) {

‎install/sql/incremental/upd_0092.sql‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-- drop old php column because new installations don't have them (fails in multi-server)
2+
ALTER TABLE `web_domain` DROP COLUMN `fastcgi_php_version`;
3+
4+
-- add php_fpm_socket_dir column to server_php
5+
ALTER TABLE `server_php` ADD `php_fpm_socket_dir` varchar(255) DEFAULT NULL AFTER `php_fpm_pool_dir`;
6+
7+
-- fix #5939
8+
UPDATE `ftp_user` SET `expires` = NULL WHERE `expires` = '0000-00-00 00:00:00';

‎install/sql/incremental/upd_dev_collection.sql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
12
-- drop old php column because new installations don't have them (fails in multi-server)
23
ALTER TABLE `web_domain` DROP COLUMN `fastcgi_php_version`;
34

@@ -8,3 +9,5 @@ ALTER TABLE `server_php` ADD `php_fpm_socket_dir` varchar(255) DEFAULT NULL AFTE
89
UPDATE `ftp_user` SET `expires` = NULL WHERE `expires` = '0000-00-00 00:00:00';
910

1011
ALTER TABLE `dns_soa` ADD `rendered_zone` MEDIUMTEXT NULL AFTER `dnssec_info`;
12+
13+
ALTER TABLE `remote_user` MODIFY `remote_password` VARCHAR(200) NOT NULL DEFAULT '';

‎install/sql/ispconfig3.sql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1326,7 +1326,7 @@ CREATE TABLE `remote_user` (
13261326
`sys_perm_group` varchar(5) default NULL,
13271327
`sys_perm_other` varchar(5) default NULL,
13281328
`remote_username` varchar(64) NOT NULL DEFAULT '',
1329-
`remote_password` varchar(64) NOT NULL DEFAULT '',
1329+
`remote_password` varchar(200) NOT NULL DEFAULT '',
13301330
`remote_access` enum('y','n') NOT NULL DEFAULT 'y',
13311331
`remote_ips` TEXT,
13321332
`remote_functions` text,
@@ -2581,7 +2581,7 @@ INSERT INTO `sys_theme` (`var_id`, `tpl_name`, `username`, `logo_url`) VALUES (N
25812581
-- Dumping data for table `sys_user`
25822582
--
25832583

2584-
INSERT INTO `sys_user` (`userid`, `sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `username`, `passwort`, `modules`, `startmodule`, `app_theme`, `typ`, `active`, `language`, `groups`, `default_group`, `client_id`) VALUES (1, 1, 0, 'riud', 'riud', '', 'admin', '21232f297a57a5a743894a0e4a801fc3', 'dashboard,admin,client,mail,monitor,sites,dns,vm,tools,help', 'dashboard', 'default', 'admin', 1, 'en', '1,2', 1, 0);
2584+
INSERT INTO `sys_user` (`userid`, `sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `username`, `passwort`, `modules`, `startmodule`, `app_theme`, `typ`, `active`, `language`, `groups`, `default_group`, `client_id`) VALUES (1, 1, 0, 'riud', 'riud', '', 'admin', 'xxx', 'dashboard,admin,client,mail,monitor,sites,dns,vm,tools,help', 'dashboard', 'default', 'admin', 1, 'en', '1,2', 1, 0);
25852585

25862586
-- --------------------------------------------------------
25872587

‎interface/lib/classes/db_mysql.inc.php‎

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,10 @@ public function _build_query_string($sQuery = '') {
171171
} elseif(is_null($sValue) || (is_string($sValue) && (strcmp($sValue, '#NULL#') == 0))) {
172172
$sTxt = 'NULL';
173173
} elseif(is_array($sValue)) {
174-
if(isset($sValue['SQL'])) {
175-
$sTxt = $sValue['SQL'];
176-
} else {
177-
$sTxt = '';
178-
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
179-
$sTxt = '(' . substr($sTxt, 1) . ')';
180-
if($sTxt == '()') $sTxt = '(0)';
181-
}
174+
$sTxt = '';
175+
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
176+
$sTxt = '(' . substr($sTxt, 1) . ')';
177+
if($sTxt == '()') $sTxt = '(0)';
182178
} else {
183179
$sTxt = '\'' . $this->escape($sValue) . '\'';
184180
}
@@ -258,7 +254,7 @@ private function securityScan($string) {
258254

259255
private function _query($sQuery = '') {
260256
global $app;
261-
257+
262258
$aArgs = func_get_args();
263259

264260
if ($sQuery == '') {
@@ -354,7 +350,7 @@ public function query($sQuery = '') {
354350
* @return array result row or NULL if none found
355351
*/
356352
public function queryOneRecord($sQuery = '') {
357-
353+
358354
$aArgs = func_get_args();
359355
if(!empty($aArgs)) {
360356
$sQuery = array_shift($aArgs);
@@ -363,7 +359,7 @@ public function queryOneRecord($sQuery = '') {
363359
}
364360
array_unshift($aArgs, $sQuery);
365361
}
366-
362+
367363
$oResult = call_user_func_array([&$this, 'query'], $aArgs);
368364
if(!$oResult) return null;
369365

@@ -750,7 +746,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
750746
foreach($insert_data as $key => $val) {
751747
$key_str .= '??,';
752748
$params[] = $key;
753-
749+
754750
$val_str .= '?,';
755751
$v_params[] = $val;
756752
}
@@ -764,7 +760,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
764760
$this->query("INSERT INTO ?? $insert_data_str", $tablename);
765761
$app->log("deprecated use of passing values to datalogInsert() - table " . $tablename, 1);
766762
}
767-
763+
768764
$old_rec = array();
769765
$index_value = $this->insertID();
770766
if(!$index_value && isset($insert_data[$index_field])) {
@@ -1112,7 +1108,7 @@ public function mapType($metaType, $typeValue) {
11121108
* @access public
11131109
* @return string 'mariadb' or string 'mysql'
11141110
*/
1115-
1111+
11161112
public function getDatabaseType() {
11171113
$tmp = $this->queryOneRecord('SELECT VERSION() as version');
11181114
if(stristr($tmp['version'],'mariadb')) {
@@ -1140,7 +1136,7 @@ public function getDatabaseVersion($major_version_only = false) {
11401136
return $version[0];
11411137
}
11421138
}
1143-
1139+
11441140
/**
11451141
* Get a mysql password hash
11461142
*
@@ -1150,9 +1146,9 @@ public function getDatabaseVersion($major_version_only = false) {
11501146
*/
11511147

11521148
public function getPasswordHash($password) {
1153-
1149+
11541150
$password_type = 'password';
1155-
1151+
11561152
/* Disabled until caching_sha2_password is implemented
11571153
if($this->getDatabaseType() == 'mysql' && $this->getDatabaseVersion(true) >= 8) {
11581154
// we are in MySQL 8 mode
@@ -1162,16 +1158,16 @@ public function getPasswordHash($password) {
11621158
}
11631159
}
11641160
*/
1165-
1161+
11661162
if($password_type == 'caching_sha2_password') {
11671163
/*
1168-
caching_sha2_password hashing needs to be implemented, have not
1164+
caching_sha2_password hashing needs to be implemented, have not
11691165
found valid PHP implementation for the new password hash type.
11701166
*/
11711167
} else {
11721168
$password_hash = '*'.strtoupper(sha1(sha1($password, true)));
11731169
}
1174-
1170+
11751171
return $password_hash;
11761172
}
11771173

‎interface/lib/classes/remoting.inc.php‎

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -128,13 +128,26 @@ public function login($username, $password, $client_login = false)
128128
$app->db->query($sql, $remote_session,$remote_userid,$remote_functions,$tstamp);
129129
return $remote_session;
130130
} else {
131-
$sql = "SELECT * FROM remote_user WHERE remote_username = ? and remote_password = md5(?)";
132-
$remote_user = $app->db->queryOneRecord($sql, $username, $password);
133-
if($remote_user['remote_userid'] > 0) {
131+
$sql = "SELECT * FROM remote_user WHERE remote_username = ?";
132+
$remote_user = $app->db->queryOneRecord($sql, $username);
133+
if($remote_user) {
134+
if(substr($remote_user['remote_password'], 0, 1) === '$') {
135+
if(crypt(stripslashes($password), $remote_user['remote_password']) != $remote_user['remote_password']) {
136+
$remote_user = null;
137+
}
138+
} elseif(md5($password) == $remote_user['remote_password']) {
139+
// update hash algo
140+
$sql = 'UPDATE `remote_user` SET `remote_password` = ? WHERE `remote_username` = ?';
141+
$app->db->query($sql, $app->auth->crypt_password($password), $username);
142+
} else {
143+
$remote_user = null;
144+
}
145+
}
146+
if($remote_user && $remote_user['remote_userid'] > 0) {
134147
if (trim($remote_user['remote_ips']) != '') {
135148
$allowed_ips = explode(',',$remote_user['remote_ips']);
136-
foreach($allowed_ips as $i => $allowed) {
137-
if(!filter_var($allowed, FILTER_VALIDATE_IP)) {
149+
foreach($allowed_ips as $i => $allowed) {
150+
if(!filter_var($allowed, FILTER_VALIDATE_IP)) {
138151
// get the ip for a hostname
139152
unset($allowed_ips[$i]);
140153
$temp=dns_get_record($allowed, DNS_A+DNS_AAAA);
@@ -169,7 +182,7 @@ public function login($username, $password, $client_login = false)
169182
if(!$remote_allowed) {
170183
throw new SoapFault('login_failed', 'The login is not allowed from '.$_SERVER['REMOTE_ADDR']);
171184
return false;
172-
}
185+
}
173186
//* Create a remote user session
174187
//srand ((double)microtime()*1000000);
175188
$remote_session = md5(mt_rand().uniqid('ispco'));
@@ -368,22 +381,22 @@ protected function updateQueryPrepare($formdef_file, $client_id, $primary_id, $p
368381

369382
//* Load the form definition
370383
$app->remoting_lib->loadFormDef($formdef_file);
371-
384+
372385
//* get old record and merge with params, so only new values have to be set in $params
373386
$old_rec = $app->remoting_lib->getDataRecord($primary_id, $client_id);
374-
387+
375388
foreach ($app->remoting_lib->formDef['fields'] as $fieldName => $fieldConf)
376389
{
377390
if ($fieldConf['formtype'] === 'PASSWORD' && empty($params[$fieldName])) {
378391
unset($old_rec[$fieldName]);
379392
}
380393
}
381-
394+
382395
$params = $app->functions->array_merge($old_rec,$params);
383396

384397
//* Get the SQL query
385398
$sql = $app->remoting_lib->getSQL($params, 'UPDATE', $primary_id);
386-
399+
387400
// throw new SoapFault('debug', $sql);
388401
if($app->remoting_lib->errorMessage != '') {
389402
throw new SoapFault('data_processing_error', $app->remoting_lib->errorMessage);
@@ -546,7 +559,7 @@ public function server_get($session_id, $server_id = null, $section ='') {
546559
return false;
547560
}
548561
}
549-
562+
550563
/**
551564
Gets a list of all servers
552565
@param int session_id

‎interface/web/admin/form/remote_user.tform.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@
109109
'errmsg' => 'weak_password_txt'
110110
)
111111
),
112-
'encryption' => 'MD5',
112+
'encryption' => 'CRYPT',
113113
'default' => '',
114114
'value' => '',
115115
'width' => '30',
@@ -124,11 +124,11 @@
124124
'remote_ips' => array (
125125
'datatype' => 'TEXT',
126126
'formtype' => 'TEXT',
127-
'validators' => array (
127+
'validators' => array (
128128
0 => array (
129-
'type' => 'CUSTOM',
130-
'class' => 'validate_remote_user',
131-
'function' => 'valid_remote_ip',
129+
'type' => 'CUSTOM',
130+
'class' => 'validate_remote_user',
131+
'function' => 'valid_remote_ip',
132132
'errmsg' => 'remote_user_error_ips'),
133133
),
134134
'default' => '',

0 commit comments

Comments
 (0)