Skip to content

Commit f2fc77f

Browse files
author
Till Brehm
committed
Improved input validation.
1 parent 4ef653e commit f2fc77f

File tree

8 files changed

+67
-7
lines changed

8 files changed

+67
-7
lines changed

‎interface/lib/classes/functions.inc.php‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -427,7 +427,11 @@ public function idn_decode($domain) {
427427
public function is_allowed_user($username, $restrict_names = false) {
428428
global $app;
429429

430-
if($username == 'root') return false;
430+
$name_blacklist = array('root','ispconfig','vmail','getmail');
431+
if(in_array($username,$name_blacklist)) return false;
432+
433+
if(preg_match('/^[\w\.\-]{0,32}$/', $username) == false) return false;
434+
431435
if($restrict_names == true && preg_match('/^web\d+$/', $username) == false) return false;
432436

433437
return true;
@@ -436,7 +440,11 @@ public function is_allowed_user($username, $restrict_names = false) {
436440
public function is_allowed_group($groupname, $restrict_names = false) {
437441
global $app;
438442

439-
if($groupname == 'root') return false;
443+
$name_blacklist = array('root','ispconfig','vmail','getmail');
444+
if(in_array($groupname,$name_blacklist)) return false;
445+
446+
if(preg_match('/^[\w\.\-]{0,32}$/', $groupname) == false) return false;
447+
440448
if($restrict_names == true && preg_match('/^client\d+$/', $groupname) == false) return false;
441449

442450
return true;

‎interface/web/sites/form/ftp_user.tform.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,10 @@
187187
'datatype' => 'VARCHAR',
188188
'formtype' => 'TEXT',
189189
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
190-
'errmsg'=> 'directory_error_empty'),
190+
'errmsg'=> 'directory_error_empty'),
191+
1 => array ( 'type' => 'REGEX',
192+
'regex' => '/^\/[a-zA-Z0-9\ \.\-\_\/]{10,128}$/',
193+
'errmsg'=> 'directory_error_regex'),
191194
),
192195
'default' => '',
193196
'value' => '',

‎interface/web/sites/form/shell_user.tform.php‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,12 @@
197197
'shell' => array (
198198
'datatype' => 'VARCHAR',
199199
'formtype' => 'TEXT',
200+
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
201+
'errmsg'=> 'shell_error_empty'),
202+
1 => array ( 'type' => 'REGEX',
203+
'regex' => '/^\/[a-zA-Z0-9\/]{5,20}$/',
204+
'errmsg'=> 'shell_error_regex'),
205+
),
200206
'default' => '/bin/bash',
201207
'value' => '',
202208
'width' => '30',
@@ -205,8 +211,11 @@
205211
'dir' => array (
206212
'datatype' => 'VARCHAR',
207213
'formtype' => 'TEXT',
208-
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
209-
'errmsg'=> 'directory_error_empty'),
214+
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
215+
'errmsg'=> 'directory_error_empty'),
216+
1 => array ( 'type' => 'REGEX',
217+
'regex' => '/^\/[a-zA-Z0-9\ \.\-\_\/]{10,128}$/',
218+
'errmsg'=> 'directory_error_regex'),
210219
),
211220
'default' => '',
212221
'value' => '',

‎interface/web/sites/ftp_user_edit.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,11 @@ function onAfterInsert() {
138138
$dir = $app->db->quote($web["document_root"]);
139139
$uid = $app->db->quote($web["system_user"]);
140140
$gid = $app->db->quote($web["system_group"]);
141+
142+
// Check system user and group
143+
if($app->functions->is_allowed_user($uid) == false || $app->functions->is_allowed_group($gid) == false) {
144+
$app->error('Invalid system user or group');
145+
}
141146

142147
// The FTP user shall be owned by the same group then the website
143148
$sys_groupid = $app->functions->intval($web['sys_groupid']);
@@ -148,7 +153,15 @@ function onAfterInsert() {
148153

149154
function onBeforeUpdate() {
150155
global $app, $conf, $interfaceConf;
156+
151157

158+
// Check system user and group
159+
if(isset($this->dataRecord['uid'])) {
160+
if($app->functions->is_allowed_user(strtolower($this->dataRecord['uid']),true) == false || $app->functions->is_allowed_group(strtolower($this->dataRecord['gid']),true) == false) {
161+
$app->tform->errorMessage .= $app->tform->lng('invalid_system_user_or_group_txt');
162+
}
163+
}
164+
152165
/*
153166
* If the names should be restricted -> do it!
154167
*/

‎interface/web/sites/lib/lang/en_ftp_user.lng‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,6 @@ $wb['generate_password_txt'] = 'Generate Password';
3232
$wb['repeat_password_txt'] = 'Repeat Password';
3333
$wb['password_mismatch_txt'] = 'The passwords do not match.';
3434
$wb['password_match_txt'] = 'The passwords do match.';
35+
$wb['invalid_system_user_or_group_txt'] = 'Invalid system user or group';
36+
$wb['directory_error_regex'] = 'Invalid directory';
3537
?>

‎interface/web/sites/lib/lang/en_shell_user.lng‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,7 @@ $wb['password_mismatch_txt'] = 'The passwords do not match.';
2828
$wb['password_match_txt'] = 'The passwords do match.';
2929
$wb['username_must_not_exceed_32_chars_txt'] = 'The username must not exceed 32 characters.';
3030
$wb['username_not_allowed_txt'] = 'The username is not allowed.';
31+
$wb['invalid_system_user_or_group_txt'] = 'Invalid system user or group';
32+
$wb['directory_error_regex'] = 'Invalid directory';
33+
$wb['shell_error_regex'] = 'Invalid shell';
3134
?>

‎interface/web/sites/shell_user_edit.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,8 @@ function onBeforeInsert() {
135135
}
136136
}
137137
unset($blacklist);
138+
139+
if($app->functions->is_allowed_user(trim(strtolower($this->dataRecord['username']))) == false) $app->tform->errorMessage .= $app->tform->lng('username_not_allowed_txt');
138140

139141
/*
140142
* If the names should be restricted -> do it!
@@ -163,6 +165,11 @@ function onAfterInsert() {
163165
$dir = $app->db->quote($web["document_root"]);
164166
$uid = $app->db->quote($web["system_user"]);
165167
$gid = $app->db->quote($web["system_group"]);
168+
169+
// Check system user and group
170+
if($app->functions->is_allowed_user($uid) == false || $app->functions->is_allowed_group($gid) == false) {
171+
$app->error($app->tform->lng('invalid_system_user_or_group_txt'));
172+
}
166173

167174
// The FTP user shall be owned by the same group then the website
168175
$sys_groupid = $app->functions->intval($web['sys_groupid']);
@@ -183,6 +190,13 @@ function onBeforeUpdate() {
183190
}
184191
}
185192
unset($blacklist);
193+
194+
// Check system user and group
195+
if(isset($this->dataRecord['puser'])) {
196+
if($app->functions->is_allowed_user(strtolower($this->dataRecord['puser']),true) == false || $app->functions->is_allowed_group(strtolower($this->dataRecord['pgroup']),true) == false) {
197+
$app->tform->errorMessage .= $app->tform->lng('invalid_system_user_or_group_txt');
198+
}
199+
}
186200

187201
/*
188202
* If the names should be restricted -> do it!

‎server/lib/classes/system.inc.php‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1821,7 +1821,11 @@ public function mail($to, $subject, $text, $from, $filepath = '', $filetype = 'a
18211821
public function is_allowed_user($username, $check_id = true, $restrict_names = false) {
18221822
global $app;
18231823

1824-
if($username == 'root') return false;
1824+
$name_blacklist = array('root','ispconfig','vmail','getmail');
1825+
if(in_array($username,$name_blacklist)) return false;
1826+
1827+
if(preg_match('/^[\w\.\-]{0,32}$/', $username) == false) return false;
1828+
18251829
if($check_id && intval($this->getuid($username)) < $this->min_uid) return false;
18261830

18271831
if($restrict_names == true && preg_match('/^web\d+$/', $username) == false) return false;
@@ -1832,7 +1836,11 @@ public function is_allowed_user($username, $check_id = true, $restrict_names = f
18321836
public function is_allowed_group($groupname, $restrict_names = false) {
18331837
global $app;
18341838

1835-
if($groupname == 'root') return false;
1839+
$name_blacklist = array('root','ispconfig','vmail','getmail');
1840+
if(in_array($groupname,$name_blacklist)) return false;
1841+
1842+
if(preg_match('/^[\w\.\-]{0,32}$/', $groupname) == false) return false;
1843+
18361844
if(intval($this->getgid($groupname)) < $this->min_gid) return false;
18371845

18381846
if($restrict_names == true && preg_match('/^client\d+$/', $groupname) == false) return false;

0 commit comments

Comments
 (0)