Merge branch 'develop' of git.ispconfig.org:ispconfig/ispconfig3 into develop

florian030 · florian030 · commit a7382a30bdb5 · 2021-02-09T08:18:18.000+01:00
diff --git a/install/dist/lib/fedora.lib.php b/install/dist/lib/fedora.lib.php
@@ -162,6 +162,7 @@ function configure_postfix($options = '')
 		touch($config_dir.'/mime_header_checks');
 		touch($config_dir.'/nested_header_checks');
 		touch($config_dir.'/body_checks');
+		touch($config_dir.'/sasl_passwd');
 
 		//* Create the mailman files
 		if(!is_dir('/var/lib/mailman/data')) exec('mkdir -p /var/lib/mailman/data');
diff --git a/install/dist/lib/gentoo.lib.php b/install/dist/lib/gentoo.lib.php
@@ -160,6 +160,7 @@ public function configure_postfix($options = '')
 		touch($config_dir.'/mime_header_checks');
 		touch($config_dir.'/nested_header_checks');
 		touch($config_dir.'/body_checks');
+		touch($config_dir.'/sasl_passwd');
 
 		//* Create auxillary postfix conf files
 		$configfile = 'helo_access';
diff --git a/install/dist/lib/opensuse.lib.php b/install/dist/lib/opensuse.lib.php
@@ -176,6 +176,7 @@ function configure_postfix($options = '')
 		touch($config_dir.'/mime_header_checks');
 		touch($config_dir.'/nested_header_checks');
 		touch($config_dir.'/body_checks');
+		touch($config_dir.'/sasl_passwd');
 
 		//* Create the mailman files
 		if(!is_dir('/var/lib/mailman/data')) exec('mkdir -p /var/lib/mailman/data');
diff --git a/install/lib/installer_base.lib.php b/install/lib/installer_base.lib.php
@@ -1193,6 +1193,7 @@ public function configure_postfix($options = '') {
 		touch($config_dir.'/mime_header_checks');
 		touch($config_dir.'/nested_header_checks');
 		touch($config_dir.'/body_checks');
+		touch($config_dir.'/sasl_passwd');
 
 		//* Create the mailman files
 		if(!is_dir('/var/lib/mailman/data')) exec('mkdir -p /var/lib/mailman/data');
diff --git a/install/sql/incremental/upd_dev_collection.sql b/install/sql/incremental/upd_dev_collection.sql
@@ -16,3 +16,6 @@ DROP TABLE 'software_package';
 DROP TABLE 'software_repo';
 DROP TABLE 'software_update';
 DROP TABLE 'software_update_inst';
+
+-- Brexit
+UPDATE `country` SET `eu` = 'n' WHERE `iso` = 'GB';
diff --git a/install/sql/ispconfig3.sql b/install/sql/ispconfig3.sql
@@ -2408,7 +2408,7 @@ INSERT INTO `country` (`iso`, `name`, `printable_name`, `iso3`, `numcode`, `eu`)
 ('UG', 'UGANDA', 'Uganda', 'UGA', 800, 'n'),
 ('UA', 'UKRAINE', 'Ukraine', 'UKR', 804, 'n'),
 ('AE', 'UNITED ARAB EMIRATES', 'United Arab Emirates', 'ARE', 784, 'n'),
-('GB', 'UNITED KINGDOM', 'United Kingdom', 'GBR', 826, 'y'),
+('GB', 'UNITED KINGDOM', 'United Kingdom', 'GBR', 826, 'n'),
 ('US', 'UNITED STATES', 'United States', 'USA', 840, 'n'),
 ('UM', 'UNITED STATES MINOR OUTLYING ISLANDS', 'United States Minor Outlying Islands', NULL, NULL, 'n'),
 ('UY', 'URUGUAY', 'Uruguay', 'URY', 858, 'n'),
diff --git a/install/tpl/apache_ispconfig.conf.master b/install/tpl/apache_ispconfig.conf.master
@@ -3,6 +3,7 @@
 ################################################
 ServerTokens ProductOnly
 ServerSignature Off
+DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.htm standard_index.html
 
 ################################################
 # ISPConfig Logfile configuration for vlogger
diff --git a/install/tpl/debian_postfix.conf.master b/install/tpl/debian_postfix.conf.master
@@ -54,7 +54,7 @@ address_verify_negative_refresh_time=60s
 # needed for postfix < 3.3 when using reject_unverified_recipient (lmtp):
 enable_original_recipient = yes
 sender_dependent_relayhost_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayhost.cf
-smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, hash:{config_dir}/sasl_passwd
+smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, texthash:{config_dir}/sasl_passwd
 smtp_sender_dependent_authentication = yes
 smtp_sasl_auth_enable = yes
 smtp_sasl_security_options = noanonymous, noplaintext
diff --git a/install/tpl/fedora_postfix.conf.master b/install/tpl/fedora_postfix.conf.master
@@ -50,7 +50,7 @@ address_verify_negative_refresh_time=60s
 # needed for postfix < 3.3 when using reject_unverified_recipient (lmtp):
 enable_original_recipient = yes
 sender_dependent_relayhost_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayhost.cf
-smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, hash:{config_dir}/sasl_passwd
+smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, texthash:{config_dir}/sasl_passwd
 smtp_sender_dependent_authentication = yes
 smtp_sasl_auth_enable = yes
 smtp_sasl_security_options = noanonymous, noplaintext
diff --git a/install/tpl/gentoo_postfix.conf.master b/install/tpl/gentoo_postfix.conf.master
@@ -49,7 +49,7 @@ address_verify_negative_refresh_time=60s
 # needed for postfix < 3.3 when using reject_unverified_recipient (lmtp):
 enable_original_recipient = yes
 sender_dependent_relayhost_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayhost.cf
-smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, hash:{config_dir}/sasl_passwd
+smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, texthash:{config_dir}/sasl_passwd
 smtp_sender_dependent_authentication = yes
 smtp_sasl_auth_enable = yes
 smtp_sasl_security_options = noanonymous, noplaintext
diff --git a/install/tpl/jk_init.ini.master b/install/tpl/jk_init.ini.master
@@ -149,8 +149,8 @@ paths_w_setuid = /bin/ping
 #paths = /usr/bin/X11/xterm, /usr/share/terminfo, /etc/terminfo
 #devices = /dev/pts/0, /dev/pts/1, /dev/pts/2, /dev/pts/3, /dev/pts/4, /dev/ptyb4, /dev/ptya4, /dev/tty, /dev/tty0, /dev/tty4
 
-+# coreutils from:
-+# (echo -ne '\n[coreutils]\ncomment = non-sbin progs from coreutils\npaths = '; dpkg --listfiles coreutils | grep -E '^/bin/|/usr/bin/' | xargs -n1 -i@ echo -n "@, " | sed -e 's/, *$/\n/g' -e 's|/usr/bin/||g' -e 's|/bin/||g') >> /etc/jailkit/jk_init.ini
+# coreutils from:
+# (echo -ne '\n[coreutils]\ncomment = non-sbin progs from coreutils\npaths = '; dpkg --listfiles coreutils | grep -E '^/bin/|/usr/bin/' | xargs -n1 -i@ echo -n "@, " | sed -e 's/, *$/\n/g' -e 's|/usr/bin/||g' -e 's|/bin/||g') >> /etc/jailkit/jk_init.ini
 
 [coreutils]
 comment = non-sbin progs from coreutils
@@ -225,3 +225,8 @@ includesections = php_common
 comment = php version 7.4
 paths = /usr/bin/php7.4, /usr/lib/php/7.4/, /usr/lib/php/20190902/, /usr/share/php/7.4/, /etc/php/7.4/cli/, /etc/php/7.4/mods-available/
 includesections = php_common
+
+[php8_0]
+comment = php version 8.0
+paths = /usr/bin/php8.0, /usr/lib/php/8.0/, /usr/lib/php/20200930/, /usr/share/php/8.0/, /etc/php/8.0/cli/, /etc/php/8.0/mods-available/
+includesections = php_common
diff --git a/install/tpl/mysql-virtual_email2email.cf.master b/install/tpl/mysql-virtual_email2email.cf.master
@@ -2,8 +2,8 @@ user = {mysql_server_ispconfig_user}
 password = {mysql_server_ispconfig_password}
 dbname = {mysql_server_database}
 hosts = {mysql_server_ip}
-query = SELECT email FROM mail_user WHERE email = '%s' AND forward_in_lda = 'n' AND disabledeliver = 'n' AND postfix = 'y' AND server_id = {server_id}
+query = SELECT email FROM mail_user WHERE email = '%s' AND forward_in_lda = 'n' AND disabledeliver = 'n' AND disablesmtp = 'n' AND server_id = {server_id}
            AND EXISTS (SELECT domain_id FROM mail_domain WHERE domain = SUBSTRING_INDEX('%s', '@', -1) AND active = 'y' AND server_id = {server_id})
         UNION
-        SELECT cc AS email FROM mail_user WHERE email = '%s' AND cc != '' AND (forward_in_lda = 'n' OR disabledeliver = 'y') AND postfix = 'y' AND server_id = {server_id}
+        SELECT cc AS email FROM mail_user WHERE email = '%s' AND cc != '' AND (forward_in_lda = 'n' OR disabledeliver = 'y') AND disablesmtp = 'n' AND server_id = {server_id}
            AND EXISTS (SELECT domain_id FROM mail_domain WHERE domain = SUBSTRING_INDEX('%s', '@', -1) AND active = 'y' AND server_id = {server_id})
diff --git a/install/tpl/opensuse_postfix.conf.master b/install/tpl/opensuse_postfix.conf.master
@@ -52,7 +52,7 @@ address_verify_negative_refresh_time=60s
 # needed for postfix < 3.3 when using reject_unverified_recipient (lmtp):
 enable_original_recipient = yes
 sender_dependent_relayhost_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayhost.cf
-smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, hash:{config_dir}/sasl_passwd
+smtp_sasl_password_maps = proxy:mysql:{config_dir}/mysql-virtual_sender-relayauth.cf, texthash:{config_dir}/sasl_passwd
 smtp_sender_dependent_authentication = yes
 smtp_sasl_auth_enable = yes
 smtp_sasl_security_options = noanonymous, noplaintext
diff --git a/server/conf/nginx_vhost.conf.master b/server/conf/nginx_vhost.conf.master
@@ -15,7 +15,7 @@ server {
         listen <tmpl_var name='ip_address'>:<tmpl_var name='https_port'> ssl http2;
 <tmpl_if name='use_proxy_protocol' op='==' value='y'>
 <tmpl_if name='proxy_protocol_https' op='>' value='0'>
-        listen <tmpl_var name='ip_address'>:<tmpl_var name='proxy_protocol_https'> ssl proxy_protocol;
+        listen <tmpl_var name='ip_address'>:<tmpl_var name='proxy_protocol_https'> ssl http2 proxy_protocol;
 </tmpl_if>
 </tmpl_if>
 
@@ -79,7 +79,7 @@ server {
 </tmpl_if>
 </tmpl_loop>
 <tmpl_if name='use_proxy' op='!=' value='y'>
-        index index.html index.htm index.php index.cgi index.pl index.xhtml;
+        index index.html index.htm index.php index.cgi index.pl index.xhtml standard_index.html;
 
 <tmpl_if name='ssi' op='==' value='y'>
         location ~ \.shtml$ {
diff --git a/server/lib/classes/cron.d/600-jailkit_maintenance.inc.php b/server/lib/classes/cron.d/600-jailkit_maintenance.inc.php
@@ -114,7 +114,8 @@ public function onRunJob() {
 				if (is_file( $rec['document_root']."/bin/bash" )) {
 					# test that /bin/bash functions in the jail
 print "chroot --userspec ".$rec['system_user'].":".$rec['system_group']." ".$rec['document_root']." /bin/bash -c true 2>/dev/null\n";
-					if (! $app->system->exec_safe("chroot --userspec ?:? ? /bin/bash -c true 2>/dev/null", $rec['system_user'], $rec['system_group'], $rec['document_root'])) {
+					$app->system->exec_safe("chroot --userspec ?:? ? /bin/bash -c true 2>/dev/null", $rec['system_user'], $rec['system_group'], $rec['document_root']);
+					if ($app->system->last_exec_retcode()) {  # return 0 means success
 print "/bin/bash test failed, forcing update\n";
 						$options[] = 'force';
 						# bogus hash will not match, triggering an update
diff --git a/server/lib/classes/system.inc.php b/server/lib/classes/system.inc.php
@@ -2412,6 +2412,7 @@ public function create_jailkit_user($username, $home_dir, $user_home_dir, $shell
 
 	public function create_jailkit_chroot($home_dir, $app_sections = array(), $options = array()) {
 		global $app;
+$app->log("create_jailkit_chroot: called for home_dir $home_dir with options: " . print_r($options, true), LOGLEVEL_DEBUG);
 
 		// Disallow operating on root directory
 		if(realpath($home_dir) == '/') {
@@ -2428,6 +2429,9 @@ public function create_jailkit_chroot($home_dir, $app_sections = array(), $optio
 		} elseif(is_string($app_sections)) {
 			$app_sections = preg_split('/[\s,]+/', $app_sections);
 		}
+		if(! is_array($options)) {
+			$options = (is_string($options) ? preg_split('/[\s,]+/', $options) : array());
+		}
 
 		// Change ownership of the chroot directory to root
 		$this->chown($home_dir, 'root');
@@ -2485,6 +2489,7 @@ public function create_jailkit_chroot($home_dir, $app_sections = array(), $optio
 
 	public function create_jailkit_programs($home_dir, $programs = array(), $options = array()) {
 		global $app;
+$app->log("create_jailkit_programs: called for home_dir $home_dir with options: " . print_r($options, true), LOGLEVEL_DEBUG);
 
 		// Disallow operating on root directory
 		if(realpath($home_dir) == '/') {
@@ -2501,6 +2506,9 @@ public function create_jailkit_programs($home_dir, $programs = array(), $options
 		} elseif(is_string($programs)) {
 			$programs = preg_split('/[\s,]+/', $programs);
 		}
+		if(! is_array($options)) {
+			$options = (is_string($options) ? preg_split('/[\s,]+/', $options) : array());
+		}
 
 		# prohibit ill-advised copying paths known to be sensitive/problematic
 		# (easy to bypass if needed, eg. use /./etc)
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
@@ -788,17 +788,18 @@ function update($event_name, $data) {
 		$last_updated = array_unique($last_updated, SORT_REGULAR);
 		sort($last_updated, SORT_STRING);
 		$update_hash = hash('md5', implode(' ', $last_updated));
+		$check_for_jailkit_updates=false;
 
 		// Create jailkit chroot when enabling php_fpm_chroot
-		if($data['new']['php_fpm_chroot'] == 'y' && $data['old']['php_fpm_chroot'] != 'y') {
+		if($data['new']['php_fpm_chroot'] == 'y' && $data['old']['php_fpm_chroot'] != 'y' && $data['new']['php'] != 'no') {
 			$website = $app->db->queryOneRecord('SELECT * FROM web_domain WHERE domain_id = ?', $data['new']['domain_id']);
 			$this->website = array_merge($website, $data['new'], array('new_jailkit_hash' => $update_hash));
 			$this->jailkit_config = $jailkit_config;
 			$this->_setup_jailkit_chroot();
 			$this->_add_jailkit_user();
-			$check_for_jailkit_updates=false;
 		// else delete if unused
-		} elseif ($data['new']['delete_unused_jailkit'] == 'y' && $data['new']['php_fpm_chroot'] != 'y') {
+		} elseif (($data['new']['delete_unused_jailkit'] == 'y' && $data['new']['php_fpm_chroot'] != 'y') ||
+			($data['new']['delete_unused_jailkit'] == 'y' && $data['new']['php'] == 'no')) {
 			$check_for_jailkit_updates=false;
 			$this->_delete_jailkit_if_unused($data['new']['domain_id']);
 			if(is_dir($data['new']['document_root'].'/etc/jailkit')) {
@@ -953,11 +954,11 @@ function update($event_name, $data) {
 				$app->system->exec_safe('chmod -R a+r ?', $error_page_path);
 			}
 
-			//* Copy the web skeleton files only when there is no index.ph or index.html file yet
-			if(!file_exists($data['new']['document_root'].'/'.$web_folder.'/index.html') && !file_exists($data['new']['document_root'].'/'.$web_folder.'/index.php')) {
+			//* Copy the web skeleton files only when there is no index.php, standard_index.html or index.html file yet
+			if(!file_exists($data['new']['document_root'].'/'.$web_folder.'/index.html') && !file_exists($data['new']['document_root'].'/'.$web_folder.'/index.php') && !file_exists($data['new']['document_root'].'/'.$web_folder.'/standard_index.html')) {
 				if (file_exists($conf['rootpath'] . '/conf-custom/index/standard_index.html_'.substr($conf['language'], 0, 2))) {
-					if(!file_exists($data['new']['document_root'] . '/' . $web_folder . '/index.html')) {
-						$app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf-custom/index/standard_index.html_' . substr($conf['language'], 0, 2), $data['new']['document_root'] . '/' . $web_folder . '/index.html');
+					if(!file_exists($data['new']['document_root'] . '/' . $web_folder . '/standard_index.html')) {
+						$app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf-custom/index/standard_index.html_' . substr($conf['language'], 0, 2), $data['new']['document_root'] . '/' . $web_folder . '/standard_index.html');
 					}
 
 					if(is_file($conf['rootpath'] . '/conf-custom/index/favicon.ico')) {
@@ -968,13 +969,13 @@ function update($event_name, $data) {
 					}
 				} else {
 					if (file_exists($conf['rootpath'] . '/conf-custom/index/standard_index.html')) {
-						if(!file_exists($data['new']['document_root'].'/' . $web_folder . '/index.html')) $app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf-custom/index/standard_index.html', $data['new']['document_root'].'/' . $web_folder . '/index.html');
+						if(!file_exists($data['new']['document_root'].'/' . $web_folder . '/standard_index.html')) $app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf-custom/index/standard_index.html', $data['new']['document_root'].'/' . $web_folder . '/standard_index.html');
 					} else {
-						if(!file_exists($data['new']['document_root'].'/' . $web_folder . '/index.html')) $app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf/index/standard_index.html_'.substr($conf['language'], 0, 2), $data['new']['document_root'].'/' . $web_folder . '/index.html');
-						if(is_file($conf['rootpath'] . '/conf/index/favicon.ico')){
+						if(!file_exists($data['new']['document_root'].'/' . $web_folder . '/standard_index.html')) $app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf/index/standard_index.html_'.substr($conf['language'], 0, 2), $data['new']['document_root'].'/' . $web_folder . '/standard_index.html');
+						if(is_file($conf['rootpath'] . '/conf/index/favicon.ico')) {
 							if(!file_exists($data['new']['document_root'].'/' . $web_folder . '/favicon.ico')) $app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf/index/favicon.ico', $data['new']['document_root'].'/' . $web_folder . '/');
 						}
-						if(is_file($conf['rootpath'] . '/conf/index/robots.txt')){
+						if(is_file($conf['rootpath'] . '/conf/index/robots.txt')) {
 							if(!file_exists($data['new']['document_root'].'/' . $web_folder . '/robots.txt')) $app->system->exec_safe('cp ? ?', $conf['rootpath'] . '/conf/index/robots.txt', $data['new']['document_root'].'/' . $web_folder . '/');
 						}
 					}
@@ -3820,7 +3821,7 @@ private function _delete_jailkit_if_unused($parent_domain_id) {
 		}
 
 		// chroot is used by php-fpm
-		if (isset($parent_domain['php_fpm_chroot']) && $parent_domain['php_fpm_chroot'] == 'y') {
+		if (isset($parent_domain['php_fpm_chroot']) && $parent_domain['php_fpm_chroot'] == 'y' && $parent_domain['php'] != 'no') {
 			return;
 		}
 
diff --git a/server/plugins-available/nginx_plugin.inc.php b/server/plugins-available/nginx_plugin.inc.php
diff --git a/server/plugins-available/openvz_plugin.inc.php b/server/plugins-available/openvz_plugin.inc.php
