Skip to content

Commit e59dfdc

Browse files
author
Marius Burkard
committed
Merge branch 'stable-3.1'
2 parents 9fdafd1 + 41e1628 commit e59dfdc

File tree

165 files changed

+524
-240
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

165 files changed

+524
-240
lines changed

‎install/dist/lib/fedora.lib.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1076,6 +1076,8 @@ public function install_ispconfig()
10761076
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
10771077
$command = 'chown root:ispconfig '.$install_dir.'/security/apache_directives.blacklist';
10781078
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
1079+
$command = 'chown root:ispconfig '.$install_dir.'/security/nginx_directives.blacklist';
1080+
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
10791081

10801082
//* Make the global language file directory group writable
10811083
exec("chmod -R 770 $install_dir/interface/lib/lang");
@@ -1149,6 +1151,11 @@ public function install_ispconfig()
11491151
$command = "chmod +x $install_dir/server/scripts/*.sh";
11501152
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
11511153

1154+
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1155+
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1156+
$this->db->query($sql, $conf['interface_password']);
1157+
}
1158+
11521159
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
11531160
//* Copy the ISPConfig vhost for the controlpanel
11541161
// TODO: These are missing! should they be "vhost_dist_*_dir" ?

‎install/dist/lib/gentoo.lib.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -996,7 +996,9 @@ public function install_ispconfig()
996996
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
997997
$command = 'chown root:ispconfig '.$install_dir.'/security/apache_directives.blacklist';
998998
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
999-
999+
$command = 'chown root:ispconfig '.$install_dir.'/security/nginx_directives.blacklist';
1000+
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
1001+
10001002
//* Make the global language file directory group writable
10011003
exec("chmod -R 770 $install_dir/interface/lib/lang");
10021004

@@ -1076,6 +1078,11 @@ public function install_ispconfig()
10761078
$command = "chmod +x $install_dir/server/scripts/*.sh";
10771079
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
10781080

1081+
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1082+
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1083+
$this->db->query($sql, $conf['interface_password']);
1084+
}
1085+
10791086
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
10801087
//* Copy the ISPConfig vhost for the controlpanel
10811088
$content = $this->get_template_file("apache_ispconfig.vhost", true);

‎install/dist/lib/opensuse.lib.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1094,7 +1094,9 @@ public function install_ispconfig()
10941094
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
10951095
$command = 'chown root:ispconfig '.$install_dir.'/security/apache_directives.blacklist';
10961096
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
1097-
1097+
$command = 'chown root:ispconfig '.$install_dir.'/security/nginx_directives.blacklist';
1098+
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
1099+
10981100
//* Make the global language file directory group writable
10991101
exec("chmod -R 770 $install_dir/interface/lib/lang");
11001102

@@ -1170,6 +1172,11 @@ public function install_ispconfig()
11701172
$command = "chmod +x $install_dir/server/scripts/*.sh";
11711173
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
11721174

1175+
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1176+
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1177+
$this->db->query($sql, $conf['interface_password']);
1178+
}
1179+
11731180
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
11741181
//* Copy the ISPConfig vhost for the controlpanel
11751182
// TODO: These are missing! should they be "vhost_dist_*_dir" ?

‎install/lib/installer_base.lib.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2499,7 +2499,9 @@ public function install_ispconfig() {
24992499
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
25002500
$command = 'chown root:ispconfig '.$install_dir.'/security/apache_directives.blacklist';
25012501
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
2502-
2502+
$command = 'chown root:ispconfig '.$install_dir.'/security/nginx_directives.blacklist';
2503+
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
2504+
25032505
//* Make the global language file directory group writable
25042506
exec("chmod -R 770 $install_dir/interface/lib/lang");
25052507

‎interface/lib/app.inc.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -299,14 +299,14 @@ public function tpl_defaults() {
299299

300300
$this->tpl->setVar('phpsessid', session_id());
301301

302-
$this->tpl->setVar('theme', $_SESSION['s']['theme']);
302+
$this->tpl->setVar('theme', $_SESSION['s']['theme'], true);
303303
$this->tpl->setVar('html_content_encoding', $this->_conf['html_content_encoding']);
304304

305305
$this->tpl->setVar('delete_confirmation', $this->lng('delete_confirmation'));
306306
//print_r($_SESSION);
307307
if(isset($_SESSION['s']['module']['name'])) {
308-
$this->tpl->setVar('app_module', $_SESSION['s']['module']['name']);
309-
$this->tpl->setVar('session_module', $_SESSION['s']['module']['name']);
308+
$this->tpl->setVar('app_module', $_SESSION['s']['module']['name'], true);
309+
$this->tpl->setVar('session_module', $_SESSION['s']['module']['name'], true);
310310
}
311311
if(isset($_SESSION['s']['user']) && $_SESSION['s']['user']['typ'] == 'admin') {
312312
$this->tpl->setVar('is_admin', 1);
@@ -316,7 +316,7 @@ public function tpl_defaults() {
316316
}
317317
/* Show username */
318318
if(isset($_SESSION['s']['user'])) {
319-
$this->tpl->setVar('cpuser', $_SESSION['s']['user']['username']);
319+
$this->tpl->setVar('cpuser', $_SESSION['s']['user']['username'], true);
320320
$this->tpl->setVar('logout_txt', $this->lng('logout_txt'));
321321
/* Show search field only for normal users, not mail users */
322322
if(stristr($_SESSION['s']['user']['username'], '@')){
@@ -343,7 +343,7 @@ public function tpl_defaults() {
343343
// load and enable PHP Intrusion Detection System (PHPIDS)
344344
$ids_security_config = $app->getconf->get_security_config('ids');
345345

346-
if(is_dir(ISPC_CLASS_PATH.'/IDS') && $ids_security_config['ids_enabled'] == 'yes') {
346+
if(is_dir(ISPC_CLASS_PATH.'/IDS') && !defined('REMOTE_API_CALL') && ($ids_security_config['ids_anon_enabled'] == 'yes' || $ids_security_config['ids_user_enabled'] == 'yes' || $ids_security_config['ids_admin_enabled'] == 'yes')) {
347347
$app->uses('ids');
348348
$app->ids->start();
349349
}

‎interface/lib/classes/db_mysql.inc.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,7 @@ private function check_utf8($str) {
470470
public function escape($sString) {
471471
global $app;
472472
if(!is_string($sString) && !is_numeric($sString)) {
473-
$app->log('NON-String given in escape function! (' . gettype($sString) . ')', LOGLEVEL_INFO);
473+
$app->log('NON-String given in escape function! (' . gettype($sString) . ')', LOGLEVEL_DEBUG);
474474
//$sAddMsg = getDebugBacktrace();
475475
$app->log($sAddMsg, LOGLEVEL_DEBUG);
476476
$sString = '';
@@ -479,7 +479,7 @@ public function escape($sString) {
479479
$cur_encoding = mb_detect_encoding($sString);
480480
if($cur_encoding != "UTF-8") {
481481
if($cur_encoding != 'ASCII') {
482-
if(is_object($app) && method_exists($app, 'log')) $app->log('String ' . substr($sString, 0, 25) . '... is ' . $cur_encoding . '.', LOGLEVEL_INFO);
482+
if(is_object($app) && method_exists($app, 'log')) $app->log('String ' . substr($sString, 0, 25) . '... is ' . $cur_encoding . '.', LOGLEVEL_DEBUG);
483483
if($cur_encoding) $sString = mb_convert_encoding($sString, 'UTF-8', $cur_encoding);
484484
else $sString = mb_convert_encoding($sString, 'UTF-8');
485485
}

‎interface/lib/classes/ids.inc.php‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,25 @@ public function start()
118118

119119
$impact = $ids_result->getImpact();
120120

121-
if($impact >= $security_config['ids_log_level']) {
121+
// Choose level from security config
122+
if($app->auth->is_admin()) {
123+
// User is admin
124+
$ids_log_level = $security_config['ids_admin_log_level'];
125+
$ids_warn_level = $security_config['ids_admin_warn_level'];
126+
$ids_block_level = $security_config['ids_admin_block_level'];
127+
} elseif(is_array($_SESSION['s']['user']) && $_SESSION['s']['user']['userid'] > 0) {
128+
// User is Client or Reseller
129+
$ids_log_level = $security_config['ids_user_log_level'];
130+
$ids_warn_level = $security_config['ids_user_warn_level'];
131+
$ids_block_level = $security_config['ids_user_block_level'];
132+
} else {
133+
// Not logged in
134+
$ids_log_level = $security_config['ids_anon_log_level'];
135+
$ids_warn_level = $security_config['ids_anon_warn_level'];
136+
$ids_block_level = $security_config['ids_anon_block_level'];
137+
}
138+
139+
if($impact >= $ids_log_level) {
122140
$ids_log = ISPC_ROOT_PATH.'/temp/ids.log';
123141
if(!is_file($ids_log)) touch($ids_log);
124142

@@ -132,11 +150,11 @@ public function start()
132150

133151
}
134152

135-
if($impact >= $security_config['ids_warn_level']) {
153+
if($impact >= $ids_warn_level) {
136154
$app->log("PHP IDS Alert.".$ids_result, 2);
137155
}
138156

139-
if($impact >= $security_config['ids_block_level']) {
157+
if($impact >= $ids_block_level) {
140158
$app->error("Possible attack detected. This action has been logged.",'', true, 2);
141159
}
142160

‎interface/lib/classes/plugin_listview.inc.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ function onShow() {
5656
// $app->listform->listDef["page_params"] = "&id=".$app->tform_actions->id."&next_tab=".$_SESSION["s"]["form"]["tab"];
5757
$app->listform->listDef["page_params"] = "&id=".$this->form->id."&next_tab=".$_SESSION["s"]["form"]["tab"];
5858
$listTpl->setVar('parent_id', $this->form->id);
59-
$listTpl->setVar('theme', $_SESSION['s']['theme']);
59+
$listTpl->setVar('theme', $_SESSION['s']['theme'], true);
6060

6161
// Generate the SQL for searching
6262
$sql_where = "";
@@ -193,13 +193,13 @@ function onShow() {
193193

194194
$listTpl->setVar('phpsessid', session_id());
195195

196-
$listTpl->setVar('theme', $_SESSION['s']['theme']);
196+
$listTpl->setVar('theme', $_SESSION['s']['theme'], true);
197197
$listTpl->setVar('html_content_encoding', $app->_conf['html_content_encoding']);
198198

199199
$listTpl->setVar('delete_confirmation', $app->lng('delete_confirmation'));
200200
//print_r($_SESSION);
201201
if(isset($_SESSION['s']['module']['name'])) {
202-
$listTpl->setVar('app_module', $_SESSION['s']['module']['name']);
202+
$listTpl->setVar('app_module', $_SESSION['s']['module']['name'], true);
203203
}
204204
if(isset($_SESSION['s']['user']) && $_SESSION['s']['user']['typ'] == 'admin') {
205205
$listTpl->setVar('is_admin', 1);
@@ -209,7 +209,7 @@ function onShow() {
209209
}
210210
/* Show username */
211211
if(isset($_SESSION['s']['user'])) {
212-
$listTpl->setVar('cpuser', $_SESSION['s']['user']['username']);
212+
$listTpl->setVar('cpuser', $_SESSION['s']['user']['username'], true);
213213
$listTpl->setVar('logout_txt', $app->lng('logout_txt'));
214214
/* Show search field only for normal users, not mail users */
215215
if(stristr($_SESSION['s']['user']['username'], '@')){

‎interface/lib/classes/tform.inc.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,11 +115,18 @@ function getNextTab() {
115115
// Show the same tab again in case of an error
116116
$active_tab = $_SESSION["s"]["form"]["tab"];
117117
}
118+
119+
if(!preg_match('/^[a-zA-Z0-9_]{0,50}$/',$active_tab)) {
120+
die('Invalid next tab name.');
121+
}
118122

119123
return $active_tab;
120124
}
121125

122126
function getCurrentTab() {
127+
if(!preg_match('/^[a-zA-Z0-9_]{0,50}$/',$_SESSION["s"]["form"]["tab"])) {
128+
die('Invalid current tab name.');
129+
}
123130
return $_SESSION["s"]["form"]["tab"];
124131
}
125132

‎interface/lib/classes/tform_actions.inc.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -287,7 +287,7 @@ function onError() {
287287
global $app, $conf;
288288

289289
$app->tpl->setVar("error", "<li>".$app->tform->errorMessage."</li>");
290-
$app->tpl->setVar($this->dataRecord);
290+
$app->tpl->setVar($this->dataRecord, null, true);
291291
$this->onShow();
292292
}
293293

0 commit comments

Comments
 (0)