Skip to content

Commit b921edd

Browse files
author
Till Brehm
committed
Merge branch 'stable-3.0.5' of git.ispconfig.org:ispconfig/ispconfig3 into stable-3.0.5
2 parents a43eb3b + 64ea561 commit b921edd

File tree

9 files changed

+96
-11
lines changed

9 files changed

+96
-11
lines changed

‎interface/lib/classes/functions.inc.php‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -424,6 +424,24 @@ public function idn_decode($domain) {
424424
return implode("\n", $domains);
425425
}
426426

427+
public function is_allowed_user($username, $restrict_names = false) {
428+
global $app;
429+
430+
if($username == 'root') return false;
431+
if($restrict_names == true && preg_match('/^web\d+$/', $username) == false) return false;
432+
433+
return true;
434+
}
435+
436+
public function is_allowed_group($groupname, $restrict_names = false) {
437+
global $app;
438+
439+
if($groupname == 'root') return false;
440+
if($restrict_names == true && preg_match('/^client\d+$/', $groupname) == false) return false;
441+
442+
return true;
443+
}
444+
427445
}
428446

429447
?>

‎interface/web/sites/web_domain_edit.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -607,9 +607,11 @@ function onSubmit() {
607607
// When the record is updated
608608
if($this->id > 0) {
609609
// restore the server ID if the user is not admin and record is edited
610-
$tmp = $app->db->queryOneRecord("SELECT server_id, `cgi`, `ssi`, `perl`, `ruby`, `python`, `suexec`, `errordocs`, `subdomain`, `ssl` FROM web_domain WHERE domain_id = ".$app->functions->intval($this->id));
610+
$tmp = $app->db->queryOneRecord("SELECT server_id, `system_user`, `system_group`, `cgi`, `ssi`, `perl`, `ruby`, `python`, `suexec`, `errordocs`, `subdomain`, `ssl` FROM web_domain WHERE domain_id = ".$app->functions->intval($this->id));
611611
$this->dataRecord["server_id"] = $tmp["server_id"];
612612

613+
$this->dataRecord['system_user'] = $tmp['system_user'];
614+
$this->dataRecord['system_group'] = $tmp['system_group'];
613615
// set the settings to current if not provided (or cleared due to limits)
614616
if($this->dataRecord['cgi'] == 'n') $this->dataRecord['cgi'] = $tmp['cgi'];
615617
if($this->dataRecord['ssi'] == 'n') $this->dataRecord['ssi'] = $tmp['ssi'];

‎server/lib/classes/system.inc.php‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ class system{
3434
var $server_id;
3535
var $server_conf;
3636
var $data;
37-
37+
var $min_uid = 500;
38+
var $min_gid = 500;
39+
3840
/**
3941
* Construct for this class
4042
*
@@ -1816,6 +1818,28 @@ public function mail($to, $subject, $text, $from, $filepath = '', $filetype = 'a
18161818
return true;
18171819
}
18181820

1821+
public function is_allowed_user($username, $check_id = true, $restrict_names = false) {
1822+
global $app;
1823+
1824+
if($username == 'root') return false;
1825+
if($check_id && intval($this->getuid($username)) < $this->min_uid) return false;
1826+
1827+
if($restrict_names == true && preg_match('/^web\d+$/', $username) == false) return false;
1828+
1829+
return true;
1830+
}
1831+
1832+
public function is_allowed_group($groupname, $restrict_names = false) {
1833+
global $app;
1834+
1835+
if($groupname == 'root') return false;
1836+
if(intval($this->getgid($groupname)) < $this->min_gid) return false;
1837+
1838+
if($restrict_names == true && preg_match('/^client\d+$/', $groupname) == false) return false;
1839+
1840+
return true;
1841+
}
1842+
18191843
}
18201844

18211845
?>

‎server/plugins-available/apache2_plugin.inc.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,8 @@ function update($event_name, $data) {
344344
if($data['new']['type'] == 'vhost' || $data['new']['type'] == 'vhostsubdomain') $app->log('document_root not set', LOGLEVEL_WARN);
345345
return 0;
346346
}
347-
if($data['new']['system_user'] == 'root' or $data['new']['system_group'] == 'root') {
347+
if(!$app->system->is_allowed_user($data['new']['system_user'], false, true)
348+
|| !$app->system->is_allowed_group($data['new']['system_group'], false, true)) {
348349
$app->log('Websites cannot be owned by the root user or group.', LOGLEVEL_WARN);
349350
return 0;
350351
}

‎server/plugins-available/cron_jailkit_plugin.inc.php‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,15 @@ function insert($event_name, $data) {
8080
if(!$parent_domain["domain_id"]) {
8181
$app->log("Parent domain not found", LOGLEVEL_WARN);
8282
return 0;
83-
} elseif($parent_domain["system_user"] == 'root' or $parent_domain["system_group"] == 'root') {
83+
}
84+
85+
if(!$app->system->is_allowed_user($parent_domain['system_user'], true, true)
86+
|| !$app->system->is_allowed_group($parent_domain['system_group'], true, true)) {
8487
$app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
85-
return 0;
88+
return false;
8689
}
8790

91+
8892
$this->parent_domain = $parent_domain;
8993

9094
$app->uses('system');
@@ -155,9 +159,11 @@ function update($event_name, $data) {
155159
if(!$parent_domain["domain_id"]) {
156160
$app->log("Parent domain not found", LOGLEVEL_WARN);
157161
return 0;
158-
} elseif($parent_domain["system_user"] == 'root' or $parent_domain["system_group"] == 'root') {
162+
}
163+
if(!$app->system->is_allowed_user($parent_domain['system_user'], true, true)
164+
|| !$app->system->is_allowed_group($parent_domain['system_group'], true, true)) {
159165
$app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
160-
return 0;
166+
return false;
161167
}
162168

163169
$app->uses('system');

‎server/plugins-available/cron_plugin.inc.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,14 @@ function update($event_name, $data) {
9696
if(!$parent_domain["domain_id"]) {
9797
$app->log("Parent domain not found", LOGLEVEL_WARN);
9898
return 0;
99-
} elseif($parent_domain["system_user"] == 'root' or $parent_domain["system_group"] == 'root') {
100-
$app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
101-
return 0;
10299
}
103100

101+
if(!$app->system->is_allowed_user($parent_domain['system_user'], true, true)
102+
|| !$app->system->is_allowed_group($parent_domain['system_group'], true, true)) {
103+
$app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
104+
return false;
105+
}
106+
104107
// Get the client ID
105108
$client = $app->dbmaster->queryOneRecord("SELECT client_id FROM sys_group WHERE sys_group.groupid = ".intval($data["new"]["sys_groupid"]));
106109
$client_id = intval($client["client_id"]);

‎server/plugins-available/nginx_plugin.inc.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -351,10 +351,13 @@ function update($event_name, $data) {
351351
if($data['new']['type'] == 'vhost' || $data['new']['type'] == 'vhostsubdomain') $app->log('document_root not set', LOGLEVEL_WARN);
352352
return 0;
353353
}
354-
if($data['new']['system_user'] == 'root' or $data['new']['system_group'] == 'root') {
354+
355+
if(!$app->system->is_allowed_user($data['new']['system_user'], false, true)
356+
|| !$app->system->is_allowed_group($data['new']['system_group'], false, true)) {
355357
$app->log('Websites cannot be owned by the root user or group.', LOGLEVEL_WARN);
356358
return 0;
357359
}
360+
358361
if(trim($data['new']['domain']) == '') {
359362
$app->log('domain is empty', LOGLEVEL_WARN);
360363
return 0;

‎server/plugins-available/shelluser_base_plugin.inc.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,13 @@ function insert($event_name, $data) {
8282
$app->log('Directory of the shell user is not valid.',LOGLEVEL_WARN);
8383
return false;
8484
}
85+
86+
if(!$app->system->is_allowed_user($data['new']['username'], false, false)
87+
|| !$app->system->is_allowed_user($data['new']['puser'], true, true)
88+
|| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
89+
$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
90+
return false;
91+
}
8592

8693
if($app->system->is_user($data['new']['puser'])) {
8794

@@ -151,6 +158,13 @@ function update($event_name, $data) {
151158
return false;
152159
}
153160

161+
if(!$app->system->is_allowed_user($data['new']['username'], false, false)
162+
|| !$app->system->is_allowed_user($data['new']['puser'], true, true)
163+
|| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
164+
$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
165+
return false;
166+
}
167+
154168
if($app->system->is_user($data['new']['puser'])) {
155169
// Get the UID of the parent user
156170
$uid = intval($app->system->getuid($data['new']['puser']));

‎server/plugins-available/shelluser_jailkit_plugin.inc.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,13 @@ function insert($event_name, $data) {
7474
$app->uses('system');
7575
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
7676

77+
if(!$app->system->is_allowed_user($data['new']['username'], false, false)
78+
|| !$app->system->is_allowed_user($data['new']['puser'], true, true)
79+
|| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
80+
$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
81+
return false;
82+
}
83+
7784
if($app->system->is_user($data['new']['puser'])) {
7885
// Get the UID of the parent user
7986
$uid = intval($app->system->getuid($data['new']['puser']));
@@ -139,6 +146,13 @@ function update($event_name, $data) {
139146
$app->uses('system');
140147
$web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".$data['new']['parent_domain_id']);
141148

149+
if(!$app->system->is_allowed_user($data['new']['username'], false, false)
150+
|| !$app->system->is_allowed_user($data['new']['puser'], true, true)
151+
|| !$app->system->is_allowed_group($data['new']['pgroup'], true, true)) {
152+
$app->log('Shell user must not be root or in group root.',LOGLEVEL_WARN);
153+
return false;
154+
}
155+
142156
if($app->system->is_user($data['new']['puser'])) {
143157
// Get the UID of the parent user
144158
$uid = intval($app->system->getuid($data['new']['puser']));

0 commit comments

Comments
 (0)