Skip to content

Commit 00f67ec

Browse files
LupulScIT-Raphael
Lupul
authored and
ScIT-Raphael
committed
Fix custom docroot validation and minor code cleanup
1 parent baa1590 commit 00f67ec

File tree

3 files changed

+39
-36
lines changed

3 files changed

+39
-36
lines changed

‎bin/v-change-web-domain-docroot‎

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -80,21 +80,28 @@ if [ "$target_domain" = "default" ]; then
8080
update_object_value 'web' 'DOMAIN' "$domain" '$CUSTOM_PHPROOT' ""
8181
else
8282
# Check for existence of specified directory under target domain's public_html folder
83+
target_domain_directory="$HOMEDIR/$user/web/$target_domain/"
8384
if [ ! -z "$target_directory" ]; then
84-
if [ ! -e "$HOMEDIR/$user/web/$target_domain/public_html/$target_directory" ]; then
85-
echo "ERROR: Directory $target_directory does not exist under $HOMEDIR/$user/$target_domain/public_html/."
86-
exit 1
85+
86+
# Checking destination path
87+
real_target_directory="$(readlink -e "${target_domain_directory}/public_html/$target_directory/")"
88+
if [ -z "$(echo $real_target_directory | egrep "^$target_domain_directory")" ]; then
89+
check_result $E_FORBIDEN "Error: target dir outside of target domain dir"
90+
fi
91+
92+
if [ ! -e "$real_target_directory" ]; then
93+
check_result $E_NOTEXIST "ERROR: Directory $target_directory does not exist under $HOMEDIR/$user/$target_domain/public_html/."
8794
else
88-
CUSTOM_DOCROOT="$HOMEDIR/$user/web/$target_domain/public_html/$target_directory/"
95+
CUSTOM_DOCROOT="$real_target_directory"
8996
if [ ! -z "$php" ]; then
90-
custom_phproot="$HOMEDIR/$user/web/$target_domain/public_html/"
97+
custom_phproot="${target_domain_directory}/public_html/"
9198
else
92-
custom_phproot="$HOMEDIR/$user/web/$target_domain/public_html/$target_directory/"
99+
custom_phproot="$real_target_directory"
93100
fi
94101
fi
95102
else
96-
CUSTOM_DOCROOT="$HOMEDIR/$user/web/$target_domain/public_html/"
97-
custom_phproot="$HOMEDIR/$user/web/$target_domain/public_html/"
103+
CUSTOM_DOCROOT="${target_domain_directory}/public_html/"
104+
custom_phproot="${target_domain_directory}/public_html/"
98105
fi
99106

100107
add_object_key 'web' 'DOMAIN' "$domain" 'CUSTOM_DOCROOT' 'IP6'

‎web/edit/web/index.php‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -74,13 +74,23 @@
7474
$v_stats_user = $data[$v_domain]['STATS_USER'];
7575
if (!empty($v_stats_user)) $v_stats_password = "";
7676
$v_custom_doc_root_prepath = '/home/'.$v_username.'/web/';
77-
$v_custom_doc_root = $data[$v_domain]['CUSTOM_DOCROOT'];
7877

79-
$m = preg_match('/\/home\/'.$v_username.'\/web\/([[:alnum:]].*)\/public_html\/([[:alnum:]].*)/', $v_custom_doc_root, $matches);
80-
$v_custom_doc_domain = $matches[1];
81-
$v_custom_doc_folder = $matches[2];
82-
if(substr($v_custom_doc_folder, -1) == '/'){
83-
$v_custom_doc_folder = substr($v_custom_doc_folder,0,-1);
78+
if(!empty($data[$v_domain]['CUSTOM_DOCROOT']))
79+
$v_custom_doc_root = realpath($data[$v_domain]['CUSTOM_DOCROOT']) . DIRECTORY_SEPARATOR;
80+
81+
if(!empty($v_custom_doc_root) &&
82+
false !== preg_match('/\/home\/'.$v_username.'\/web\/([[:alnum:]].*)\/public_html\/([[:alnum:]].*)?/', $v_custom_doc_root, $matches) ) {
83+
84+
if(!empty($matches[1]))
85+
$v_custom_doc_domain = $matches[1];
86+
87+
if(!empty($matches[2]))
88+
$v_custom_doc_folder = rtrim($matches[2], '/');
89+
90+
if($v_custom_doc_domain && !in_array($v_custom_doc_domain, $user_domains)) {
91+
$v_custom_doc_domain = '';
92+
$v_custom_doc_folder = '';
93+
}
8494
}
8595

8696

@@ -767,11 +777,7 @@
767777
check_return_code($return_var,$output);
768778
unset($output);
769779
}else{
770-
if(substr($_POST['v-custom-doc-folder'], -1) == '/'){
771-
$v_custom_doc_folder = escapeshellarg(substr($_POST['v-custom-doc-folder'],0,-1));
772-
}else{
773-
$v_custom_doc_folder = escapeshellarg($_POST['v-custom-doc-folder']);
774-
}
780+
$v_custom_doc_folder = escapeshellarg(rtrim($_POST['v-custom-doc-folder'],'/'));
775781
$v_custom_doc_domain = escapeshellarg($_POST['v-custom-doc-domain']);
776782

777783
exec(HESTIA_CMD."v-change-web-domain-docroot ".$v_username." ".escapeshellarg($v_domain)." ".$v_custom_doc_domain." ".$v_custom_doc_folder ." yes", $output, $return_var);

‎web/templates/admin/edit_web.html‎

Lines changed: 7 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -258,24 +258,14 @@
258258
</tr>
259259
<tr>
260260
<td>
261-
<input type="hidden" name="v-custom-doc-root_prepath"" value="<?php echo $v_custom_doc_root_prepath;?>">
261+
<input type="hidden" name="v-custom-doc-root_prepath" value="<?php echo $v_custom_doc_root_prepath;?>">
262262
<select class="vst-list" name="v-custom-doc-domain">
263-
<option value="<?php echo $v_domain;?>"><?php echo $v_domain;?></option>
264-
<?php
265-
foreach ($user_domains as $domain) {
266-
if($domain != $v_domain ){
267-
if($v_custom_doc_domain == $domain){
268-
?>
269-
<option value="<?php echo $domain;?>" selected="selected"><?php echo $domain;?></option>
270-
<?php
271-
}else{
272-
?>
273-
<option value="<?php echo $domain;?>"><?php echo $domain;?></option>
274-
<?php
275-
}
276-
}
277-
}
278-
?>
263+
<?php foreach ($user_domains as $domain): ?>
264+
<option value="<?php echo $domain;?>"
265+
<?=($v_custom_doc_domain === $domain)?' selected="selected" ':''; ?>>
266+
<?php echo $domain;?>
267+
</option>
268+
<?php endforeach; ?>
279269
</select>
280270
</td>
281271
</tr>

0 commit comments

Comments
 (0)