Skip to content

Commit f6a6746

Browse files
florian030florian030
committed
Merge branch 'develop' of git.ispconfig.org:ispconfig/ispconfig3 into develop
2 parents 0df7c5f + 1fa2dfb commit f6a6746

File tree

14 files changed

+199
-129
lines changed

14 files changed

+199
-129
lines changed

‎install/dist/lib/fedora.lib.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1227,8 +1227,8 @@ public function install_ispconfig()
12271227
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
12281228

12291229
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1230-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1231-
$this->db->query($sql, $conf['interface_password']);
1230+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
1231+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
12321232
}
12331233

12341234
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -1372,6 +1372,7 @@ public function install_ispconfig()
13721372
//* Create the ispconfig log directory
13731373
if(!is_dir($conf['ispconfig_log_dir'])) mkdir($conf['ispconfig_log_dir']);
13741374
if(!is_file($conf['ispconfig_log_dir'].'/ispconfig.log')) exec('touch '.$conf['ispconfig_log_dir'].'/ispconfig.log');
1375+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
13751376

13761377
if(is_user('getmail')) {
13771378
exec('mv /usr/local/ispconfig/server/scripts/run-getmail.sh /usr/local/bin/run-getmail.sh');

‎install/dist/lib/gentoo.lib.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1115,8 +1115,8 @@ public function install_ispconfig()
11151115
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
11161116

11171117
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1118-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1119-
$this->db->query($sql, $conf['interface_password']);
1118+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
1119+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
11201120
}
11211121

11221122
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -1252,6 +1252,7 @@ public function install_ispconfig()
12521252
if (!is_file($conf['ispconfig_log_dir'].'/ispconfig.log')) {
12531253
touch($conf['ispconfig_log_dir'].'/ispconfig.log');
12541254
}
1255+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
12551256

12561257
//* Create the ispconfig auth log file and set uid/gid
12571258
if(!is_file($conf['ispconfig_log_dir'].'/auth.log')) {

‎install/dist/lib/opensuse.lib.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1215,8 +1215,8 @@ public function install_ispconfig()
12151215
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
12161216

12171217
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
1218-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
1219-
$this->db->query($sql, $conf['interface_password']);
1218+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
1219+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
12201220
}
12211221

12221222
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -1369,6 +1369,7 @@ public function install_ispconfig()
13691369
//* Create the ispconfig log directory
13701370
if(!is_dir($conf['ispconfig_log_dir'])) mkdir($conf['ispconfig_log_dir']);
13711371
if(!is_file($conf['ispconfig_log_dir'].'/ispconfig.log')) exec('touch '.$conf['ispconfig_log_dir'].'/ispconfig.log');
1372+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
13721373

13731374
if(is_user('getmail')) {
13741375
exec('mv /usr/local/ispconfig/server/scripts/run-getmail.sh /usr/local/bin/run-getmail.sh');

‎install/lib/installer_base.lib.php‎

Lines changed: 81 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,34 @@ public function get_php_version() {
157157
else return true;
158158
}
159159

160+
public function crypt_password($cleartext_password, $charset = 'UTF-8') {
161+
if($charset != 'UTF-8') {
162+
$cleartext_password = mb_convert_encoding($cleartext_password, $charset, 'UTF-8');
163+
}
164+
165+
if(defined('CRYPT_SHA512') && CRYPT_SHA512 == 1) {
166+
$salt = '$6$rounds=5000$';
167+
$salt_length = 16;
168+
} elseif(defined('CRYPT_SHA256') && CRYPT_SHA256 == 1) {
169+
$salt = '$5$rounds=5000$';
170+
$salt_length = 16;
171+
} else {
172+
$salt = '$1$';
173+
$salt_length = 12;
174+
}
175+
176+
if(function_exists('openssl_random_pseudo_bytes')) {
177+
$salt .= substr(bin2hex(openssl_random_pseudo_bytes($salt_length)), 0, $salt_length);
178+
} else {
179+
$base64_alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./';
180+
for($n = 0; $n < $salt_length; $n++) {
181+
$salt .= $base64_alphabet[mt_rand(0, 63)];
182+
}
183+
}
184+
$salt .= "$";
185+
return crypt($cleartext_password, $salt);
186+
}
187+
160188
//** Detect installed applications
161189
public function find_installed_apps() {
162190
global $conf;
@@ -2871,8 +2899,13 @@ public function make_ispconfig_ssl_cert() {
28712899
$ip_address_match = true;
28722900
}
28732901

2902+
// Get subject and issuer of ispserver.crt to check if it is self-signed cert
2903+
if (file_exists($ssl_crt_file)) {
2904+
$crt_subject = exec("openssl x509 -in ".escapeshellarg($ssl_crt_file)." -inform PEM -noout -subject");
2905+
$crt_issuer = exec("openssl x509 -in ".escapeshellarg($ssl_crt_file)." -inform PEM -noout -issuer");
2906+
}
28742907

2875-
if ((!@is_dir($acme_cert_dir) || !@file_exists($check_acme_file) || !@file_exists($ssl_crt_file) || md5_file($check_acme_file) != md5_file($ssl_crt_file)) && $ip_address_match == true) {
2908+
if ((@file_exists($ssl_crt_file) && ($crt_subject == $crt_issuer)) || (!@is_dir($acme_cert_dir) || !@file_exists($check_acme_file) || !@file_exists($ssl_crt_file) || md5_file($check_acme_file) != md5_file($ssl_crt_file)) && $ip_address_match == true) {
28762909

28772910
// This script is needed earlier to check and open http port 80 or standalone might fail
28782911
// Make executable and temporary symlink latest letsencrypt pre, post and renew hook script before install
@@ -2942,6 +2975,14 @@ public function make_ispconfig_ssl_cert() {
29422975

29432976
$issued_successfully = false;
29442977

2978+
// Backup existing ispserver ssl files
2979+
if(file_exists($ssl_crt_file) || is_link($ssl_crt_file))
2980+
rename($ssl_crt_file, $ssl_crt_file.'-temporary.bak');
2981+
if(file_exists($ssl_key_file) || is_link($ssl_key_file))
2982+
rename($ssl_key_file, $ssl_key_file.'-temporary.bak');
2983+
if(file_exists($ssl_pem_file) || is_link($ssl_pem_file))
2984+
rename($ssl_pem_file, $ssl_pem_file.'-temporary.bak');
2985+
29452986
// Attempt to use Neilpang acme.sh first, as it is now the preferred LE client
29462987
if (is_executable($acme)) {
29472988

@@ -2958,18 +2999,6 @@ public function make_ispconfig_ssl_cert() {
29582999
if($ret == 0 || ($ret == 2 && file_exists($check_acme_file))) {
29593000
// acme.sh returns with 2 on issue for already existing certificate
29603001

2961-
2962-
// Backup existing ispserver ssl files
2963-
if(file_exists($ssl_crt_file) || is_link($ssl_crt_file)) {
2964-
rename($ssl_crt_file, $ssl_crt_file . '-' . $date->format('YmdHis') . '.bak');
2965-
}
2966-
if(file_exists($ssl_key_file) || is_link($ssl_key_file)) {
2967-
rename($ssl_key_file, $ssl_key_file . '-' . $date->format('YmdHis') . '.bak');
2968-
}
2969-
if(file_exists($ssl_pem_file) || is_link($ssl_pem_file)) {
2970-
rename($ssl_pem_file, $ssl_pem_file . '-' . $date->format('YmdHis') . '.bak');
2971-
}
2972-
29733002
$check_acme_file = $ssl_crt_file;
29743003

29753004
// Define LE certs name and path, then install them
@@ -2978,8 +3007,26 @@ public function make_ispconfig_ssl_cert() {
29783007
$acme_chain = "--fullchain-file " . escapeshellarg($ssl_crt_file);
29793008
exec("$acme --install-cert -d " . escapeshellarg($hostname) . " $acme_key $acme_chain");
29803009
$issued_successfully = true;
3010+
3011+
// Make temporary backup of self-signed certs permanent
3012+
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3013+
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file.'-'.$date->format('YmdHis').'.bak');
3014+
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3015+
rename($ssl_key_file.'-temporary.bak', $ssl_key_file.'-'.$date->format('YmdHis').'.bak');
3016+
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3017+
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file.'-'.$date->format('YmdHis').'.bak');
3018+
29813019
} else {
29823020
swriteln('Issuing certificate via acme.sh failed. Please check that your hostname can be verified by letsencrypt');
3021+
3022+
// Restore temporary backup of self-signed certs
3023+
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3024+
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file);
3025+
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3026+
rename($ssl_key_file.'-temporary.bak', $ssl_key_file);
3027+
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3028+
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file);
3029+
29833030
}
29843031
// Else, we attempt to use the official LE certbot client certbot
29853032
} else {
@@ -3011,24 +3058,31 @@ public function make_ispconfig_ssl_cert() {
30113058
if($ret == 0) {
30123059
// certbot returns with 0 on issue for already existing certificate
30133060

3014-
// Backup existing ispserver ssl files
3015-
if(file_exists($ssl_crt_file) || is_link($ssl_crt_file)) {
3016-
rename($ssl_crt_file, $ssl_crt_file . '-' . $date->format('YmdHis') . '.bak');
3017-
}
3018-
if(file_exists($ssl_key_file) || is_link($ssl_key_file)) {
3019-
rename($ssl_key_file, $ssl_key_file . '-' . $date->format('YmdHis') . '.bak');
3020-
}
3021-
if(file_exists($ssl_pem_file) || is_link($ssl_pem_file)) {
3022-
rename($ssl_pem_file, $ssl_pem_file . '-' . $date->format('YmdHis') . '.bak');
3023-
}
3024-
30253061
$acme_cert_dir = '/etc/letsencrypt/live/' . $hostname;
30263062
symlink($acme_cert_dir . '/fullchain.pem', $ssl_crt_file);
30273063
symlink($acme_cert_dir . '/privkey.pem', $ssl_key_file);
30283064

30293065
$issued_successfully = true;
3066+
3067+
// Make temporary backup of self-signed certs permanent
3068+
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3069+
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file.'-'.$date->format('YmdHis').'.bak');
3070+
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3071+
rename($ssl_key_file.'-temporary.bak', $ssl_key_file.'-'.$date->format('YmdHis').'.bak');
3072+
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3073+
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file.'-'.$date->format('YmdHis').'.bak');
3074+
30303075
} else {
30313076
swriteln('Issuing certificate via certbot failed. Please check log files and make sure that your hostname can be verified by letsencrypt');
3077+
3078+
// Restore temporary backup of self-signed certs
3079+
if(file_exists($ssl_crt_file.'-temporary.bak') || is_link($ssl_crt_file.'-temporary.bak'))
3080+
rename($ssl_crt_file.'-temporary.bak', $ssl_crt_file);
3081+
if(file_exists($ssl_key_file.'-temporary.bak') || is_link($ssl_key_file.'-temporary.bak'))
3082+
rename($ssl_key_file.'-temporary.bak', $ssl_key_file);
3083+
if(file_exists($ssl_pem_file.'-temporary.bak') || is_link($ssl_pem_file.'-temporary.bak'))
3084+
rename($ssl_pem_file.'-temporary.bak', $ssl_pem_file);
3085+
30323086
}
30333087
} else {
30343088
swriteln('Did not find any valid acme client (acme.sh or certbot)');
@@ -3415,8 +3469,8 @@ public function install_ispconfig() {
34153469
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
34163470

34173471
if ($this->install_ispconfig_interface == true && isset($conf['interface_password']) && $conf['interface_password']!='admin') {
3418-
$sql = "UPDATE sys_user SET passwort = md5(?) WHERE username = 'admin';";
3419-
$this->db->query($sql, $conf['interface_password']);
3472+
$sql = "UPDATE sys_user SET passwort = ? WHERE username = 'admin';";
3473+
$this->db->query($sql, $this->crypt_password($conf['interface_password']));
34203474
}
34213475

34223476
if($conf['apache']['installed'] == true && $this->install_ispconfig_interface == true){
@@ -3560,6 +3614,7 @@ public function install_ispconfig() {
35603614
if(!is_dir($conf['ispconfig_log_dir'])) mkdir($conf['ispconfig_log_dir'], 0755);
35613615
touch($conf['ispconfig_log_dir'].'/ispconfig.log');
35623616
}
3617+
chmod($conf['ispconfig_log_dir'].'/ispconfig.log', 0600);
35633618

35643619
//* Create the ispconfig auth log file and set uid/gid
35653620
if(!is_file($conf['ispconfig_log_dir'].'/auth.log')) {

‎install/sql/incremental/upd_0092.sql‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
-- drop old php column because new installations don't have them (fails in multi-server)
2+
ALTER TABLE `web_domain` DROP COLUMN `fastcgi_php_version`;
3+
4+
-- add php_fpm_socket_dir column to server_php
5+
ALTER TABLE `server_php` ADD `php_fpm_socket_dir` varchar(255) DEFAULT NULL AFTER `php_fpm_pool_dir`;
6+
7+
-- fix #5939
8+
UPDATE `ftp_user` SET `expires` = NULL WHERE `expires` = '0000-00-00 00:00:00';

‎install/sql/incremental/upd_dev_collection.sql‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1 @@
1-
-- drop old php column because new installations don't have them (fails in multi-server)
2-
ALTER TABLE `web_domain` DROP COLUMN `fastcgi_php_version`;
3-
4-
-- add php_fpm_socket_dir column to server_php
5-
ALTER TABLE `server_php` ADD `php_fpm_socket_dir` varchar(255) DEFAULT NULL AFTER `php_fpm_pool_dir`;
6-
7-
-- fix #5939
8-
UPDATE `ftp_user` SET `expires` = NULL WHERE `expires` = '0000-00-00 00:00:00';
1+
ALTER TABLE `remote_user` MODIFY `remote_password` VARCHAR(200) NOT NULL DEFAULT '';

‎install/sql/ispconfig3.sql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1325,7 +1325,7 @@ CREATE TABLE `remote_user` (
13251325
`sys_perm_group` varchar(5) default NULL,
13261326
`sys_perm_other` varchar(5) default NULL,
13271327
`remote_username` varchar(64) NOT NULL DEFAULT '',
1328-
`remote_password` varchar(64) NOT NULL DEFAULT '',
1328+
`remote_password` varchar(200) NOT NULL DEFAULT '',
13291329
`remote_access` enum('y','n') NOT NULL DEFAULT 'y',
13301330
`remote_ips` TEXT,
13311331
`remote_functions` text,
@@ -2580,7 +2580,7 @@ INSERT INTO `sys_theme` (`var_id`, `tpl_name`, `username`, `logo_url`) VALUES (N
25802580
-- Dumping data for table `sys_user`
25812581
--
25822582

2583-
INSERT INTO `sys_user` (`userid`, `sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `username`, `passwort`, `modules`, `startmodule`, `app_theme`, `typ`, `active`, `language`, `groups`, `default_group`, `client_id`) VALUES (1, 1, 0, 'riud', 'riud', '', 'admin', '21232f297a57a5a743894a0e4a801fc3', 'dashboard,admin,client,mail,monitor,sites,dns,vm,tools,help', 'dashboard', 'default', 'admin', 1, 'en', '1,2', 1, 0);
2583+
INSERT INTO `sys_user` (`userid`, `sys_userid`, `sys_groupid`, `sys_perm_user`, `sys_perm_group`, `sys_perm_other`, `username`, `passwort`, `modules`, `startmodule`, `app_theme`, `typ`, `active`, `language`, `groups`, `default_group`, `client_id`) VALUES (1, 1, 0, 'riud', 'riud', '', 'admin', 'xxx', 'dashboard,admin,client,mail,monitor,sites,dns,vm,tools,help', 'dashboard', 'default', 'admin', 1, 'en', '1,2', 1, 0);
25842584

25852585
-- --------------------------------------------------------
25862586

‎interface/lib/classes/db_mysql.inc.php‎

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -171,14 +171,10 @@ public function _build_query_string($sQuery = '') {
171171
} elseif(is_null($sValue) || (is_string($sValue) && (strcmp($sValue, '#NULL#') == 0))) {
172172
$sTxt = 'NULL';
173173
} elseif(is_array($sValue)) {
174-
if(isset($sValue['SQL'])) {
175-
$sTxt = $sValue['SQL'];
176-
} else {
177-
$sTxt = '';
178-
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
179-
$sTxt = '(' . substr($sTxt, 1) . ')';
180-
if($sTxt == '()') $sTxt = '(0)';
181-
}
174+
$sTxt = '';
175+
foreach($sValue as $sVal) $sTxt .= ',\'' . $this->escape($sVal) . '\'';
176+
$sTxt = '(' . substr($sTxt, 1) . ')';
177+
if($sTxt == '()') $sTxt = '(0)';
182178
} else {
183179
$sTxt = '\'' . $this->escape($sValue) . '\'';
184180
}
@@ -258,7 +254,7 @@ private function securityScan($string) {
258254

259255
private function _query($sQuery = '') {
260256
global $app;
261-
257+
262258
$aArgs = func_get_args();
263259

264260
if ($sQuery == '') {
@@ -354,7 +350,7 @@ public function query($sQuery = '') {
354350
* @return array result row or NULL if none found
355351
*/
356352
public function queryOneRecord($sQuery = '') {
357-
353+
358354
$aArgs = func_get_args();
359355
if(!empty($aArgs)) {
360356
$sQuery = array_shift($aArgs);
@@ -363,7 +359,7 @@ public function queryOneRecord($sQuery = '') {
363359
}
364360
array_unshift($aArgs, $sQuery);
365361
}
366-
362+
367363
$oResult = call_user_func_array([&$this, 'query'], $aArgs);
368364
if(!$oResult) return null;
369365

@@ -750,7 +746,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
750746
foreach($insert_data as $key => $val) {
751747
$key_str .= '??,';
752748
$params[] = $key;
753-
749+
754750
$val_str .= '?,';
755751
$v_params[] = $val;
756752
}
@@ -764,7 +760,7 @@ public function datalogInsert($tablename, $insert_data, $index_field) {
764760
$this->query("INSERT INTO ?? $insert_data_str", $tablename);
765761
$app->log("deprecated use of passing values to datalogInsert() - table " . $tablename, 1);
766762
}
767-
763+
768764
$old_rec = array();
769765
$index_value = $this->insertID();
770766
if(!$index_value && isset($insert_data[$index_field])) {
@@ -1112,7 +1108,7 @@ public function mapType($metaType, $typeValue) {
11121108
* @access public
11131109
* @return string 'mariadb' or string 'mysql'
11141110
*/
1115-
1111+
11161112
public function getDatabaseType() {
11171113
$tmp = $this->queryOneRecord('SELECT VERSION() as version');
11181114
if(stristr($tmp['version'],'mariadb')) {
@@ -1140,7 +1136,7 @@ public function getDatabaseVersion($major_version_only = false) {
11401136
return $version[0];
11411137
}
11421138
}
1143-
1139+
11441140
/**
11451141
* Get a mysql password hash
11461142
*
@@ -1150,9 +1146,9 @@ public function getDatabaseVersion($major_version_only = false) {
11501146
*/
11511147

11521148
public function getPasswordHash($password) {
1153-
1149+
11541150
$password_type = 'password';
1155-
1151+
11561152
/* Disabled until caching_sha2_password is implemented
11571153
if($this->getDatabaseType() == 'mysql' && $this->getDatabaseVersion(true) >= 8) {
11581154
// we are in MySQL 8 mode
@@ -1162,16 +1158,16 @@ public function getPasswordHash($password) {
11621158
}
11631159
}
11641160
*/
1165-
1161+
11661162
if($password_type == 'caching_sha2_password') {
11671163
/*
1168-
caching_sha2_password hashing needs to be implemented, have not
1164+
caching_sha2_password hashing needs to be implemented, have not
11691165
found valid PHP implementation for the new password hash type.
11701166
*/
11711167
} else {
11721168
$password_hash = '*'.strtoupper(sha1(sha1($password, true)));
11731169
}
1174-
1170+
11751171
return $password_hash;
11761172
}
11771173

0 commit comments

Comments
 (0)