Implemented #4872 Extend Apache and Nginx Excludes list

Author: Till Brehm

interface/lib/classes/validate_domain.inc.php

@@ -141,6 +141,44 @@ function web_apache_directives($field_name, $field_value, $validator) {
 		}
 	}
 
+	/* Check nginx directives */
+	function web_nginx_directives($field_name, $field_value, $validator) {
+		global $app;
+		
+		if(trim($field_value) != '') {
+			$security_config = $app->getconf->get_security_config('ids');
+		
+			if($security_config['nginx_directives_scan_enabled'] == 'yes') {
+				
+				// Get blacklist
+				$blacklist_path = '/usr/local/ispconfig/security/nginx_directives.blacklist';
+				if(is_file('/usr/local/ispconfig/security/nginx_directives.blacklist.custom')) $blacklist_path = '/usr/local/ispconfig/security/nginx_directives.blacklist.custom';
+				if(!is_file($blacklist_path)) $blacklist_path = realpath(ISPC_ROOT_PATH.'/../security/nginx_directives.blacklist');
+				
+				$directives = explode("\n",$field_value);
+				$regex = explode("\n",file_get_contents($blacklist_path));
+				$blocked = false;
+				$blocked_line = '';
+				
+				if(is_array($directives) && is_array($regex)) {
+					foreach($directives as $directive) {
+						$directive = trim($directive);
+						foreach($regex as $r) {
+							if(preg_match(trim($r),$directive)) {
+								$blocked = true;
+								$blocked_line .= $directive.'<br />';
+							};
+						}
+					}
+				}
+			}
+		}
+		
+		if($blocked === true) {
+			return $this->get_error('nginx_directive_blocked_error').' '.$blocked_line;
+		}
+	}
+	
 
 	/* internal validator function to match regexp */
 	function _regex_validate($domain_name, $allow_wildcard = false) {

interface/web/sites/form/web_vhost_domain.tform.php

@@ -859,6 +859,13 @@
 			'nginx_directives' => array (
 				'datatype' => 'TEXT',
 				'formtype' => 'TEXT',
+				'validators' => array (  0 => array(
+							'type' => 'CUSTOM',
+							'class' => 'validate_domain',
+							'function' => 'web_nginx_directives',
+							'errmsg' => 'nginx_directive_blockd_error'
+						),
+				),
 				'default' => '',
 				'value'  => '',
 				'width'  => '30',

interface/web/sites/lib/lang/ar_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'HTTP Port';
 $wb['https_port_txt'] = 'HTTPS Port';
 $wb['http_port_error_regex'] = 'HTTP Port invalid.';
 $wb['https_port_error_regex'] = 'HTTPS Port invalid.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>

interface/web/sites/lib/lang/bg_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'HTTP Port';
 $wb['https_port_txt'] = 'HTTPS Port';
 $wb['http_port_error_regex'] = 'HTTP Port invalid.';
 $wb['https_port_error_regex'] = 'HTTPS Port invalid.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>

interface/web/sites/lib/lang/br_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'Porta HTTP';
 $wb['https_port_txt'] = 'Porta HTTPS';
 $wb['http_port_error_regex'] = 'Porta HTTP inválida.';
 $wb['https_port_error_regex'] = 'Porta HTTPS inválida.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>

interface/web/sites/lib/lang/ca_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'HTTP Port';
 $wb['https_port_txt'] = 'HTTPS Port';
 $wb['http_port_error_regex'] = 'HTTP Port invalid.';
 $wb['https_port_error_regex'] = 'HTTPS Port invalid.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>

interface/web/sites/lib/lang/cz_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'HTTP Port';
 $wb['https_port_txt'] = 'HTTPS Port';
 $wb['http_port_error_regex'] = 'HTTP Port invalid.';
 $wb['https_port_error_regex'] = 'HTTPS Port invalid.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>

interface/web/sites/lib/lang/de_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'HTTP Port';
 $wb['https_port_txt'] = 'HTTPS Port';
 $wb['http_port_error_regex'] = 'HTTP Port invalid.';
 $wb['https_port_error_regex'] = 'HTTPS Port invalid.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>

interface/web/sites/lib/lang/dk_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'HTTP Port';
 $wb['https_port_txt'] = 'HTTPS Port';
 $wb['http_port_error_regex'] = 'HTTP Port invalid.';
 $wb['https_port_error_regex'] = 'HTTPS Port invalid.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>

interface/web/sites/lib/lang/el_web_domain.lng

@@ -133,4 +133,5 @@ $wb['http_port_txt'] = 'HTTP Port';
 $wb['https_port_txt'] = 'HTTPS Port';
 $wb['http_port_error_regex'] = 'HTTP Port invalid.';
 $wb['https_port_error_regex'] = 'HTTPS Port invalid.';
+$wb['nginx_directive_blocked_error'] = 'Nginx directive blocked by security settings:';
 ?>