Skip to content

Commit 118158a

Browse files
jaapmarcusjaapmarcus
authored
Fix: DNS cluster expected return code instead of string (hestiacp#3706)
* Improve api * Remove debug thing * Update some points I missed the first time * Allow use of api when ipv6 is enabled * Add log to track what is send over api when Debug is enabled * Don't escape " it shouldn't be needed
1 parent be4d6c0 commit 118158a

File tree

6 files changed

+37
-27
lines changed

6 files changed

+37
-27
lines changed

‎bin/v-add-remote-dns-record‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ if [ "$DNS_CLUSTER_SYSTEM" != "hestia-zone" ]; then
7575
check_result $? "$HOST connection failed (soa sync)" "$E_CONNECT"
7676

7777
# Syncing record
78-
str=$(grep "ID='$id'" $USER_DATA/dns/$domain.conf | sed 's/"/\\"/g')
78+
str=$(grep "ID='$id'" $USER_DATA/dns/$domain.conf)
7979
cluster_cmd v-insert-dns-record $DNS_USER $domain "$str" 'no'
8080
check_result $? "$HOST connection failed (record sync)" "$E_CONNECT"
8181

‎bin/v-check-access-key‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
access_key_id="$(basename "$1")"
1717
secret_access_key=$2
1818
hst_command=$3
19-
ip=${4-127.0.0.1}
19+
ip46=${4-127.0.0.1}
2020
format=${5-shell}
2121

2222
# Includes
@@ -56,11 +56,11 @@ shell_list() {
5656
# Callback to intercept invalid result validation
5757
abort_missmatch() {
5858
echo "Error: $2"
59-
echo "$date $time ${access_key_id:-api} $ip failed to login" >> $HESTIA/log/auth.log
59+
echo "$date $time ${access_key_id:-api} $ip46 failed to login" >> $HESTIA/log/auth.log
6060

6161
# Add a log for user
6262
if [[ "$1" == "$E_PASSWORD" && -n "$user" ]]; then
63-
log_history "[$ip] $access_key_id $2" "Error" "$user" "API"
63+
log_history "[$ip46] $access_key_id $2" "Error" "$user" "API"
6464
fi
6565

6666
if [[ "$1" == "$E_FORBIDEN" ]]; then
@@ -78,7 +78,7 @@ abort_missmatch() {
7878
CHECK_RESULT_CALLBACK="abort_missmatch"
7979

8080
check_args '3' "$#" 'ACCESS_KEY_ID SECRET_ACCESS_KEY COMMAND [IP] [FORMAT]'
81-
is_format_valid 'access_key_id' 'ip' 'command'
81+
is_format_valid 'access_key_id' 'ip46' 'command'
8282
is_object_valid 'key' 'KEY' "$access_key_id"
8383
is_format_valid 'secret_access_key'
8484
check_access_key_secret "$access_key_id" "$secret_access_key" user
@@ -108,7 +108,7 @@ esac
108108
#----------------------------------------------------------#
109109

110110
# Logging
111-
log_history "[$ip] Access key $access_key_id successfully launched with command $hst_command" "Info" "$user" "API"
112-
echo "$date $time $access_key_id $ip $hst_command successfully launched" >> $HESTIA/log/auth.log
111+
log_history "[$ip46] Access key $access_key_id successfully launched with command $hst_command" "Info" "$user" "API"
112+
echo "$date $time $access_key_id $ip46 $hst_command successfully launched" >> $HESTIA/log/auth.log
113113

114114
exit

‎func/remote.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,11 @@ send_api_cmd() {
4747
--data-urlencode "arg8=$9" \
4848
https://$HOST:$PORT/api/)
4949
fi
50+
51+
if [ "$DEBUG_MODE" = "yes" ]; then
52+
# log out going request if wanted for debugging
53+
echo "$1 $2 $3 $4 $5 $6 $7 $8 $9" >> /var/log/hestia/api_out.log
54+
fi
5055
return $answer
5156
}
5257

‎install/upgrade/versions/1.8.0.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ exim_version=$(exim4 --version | head -1 | awk '{print $3}' | cut -f -2 -d .)
201201
# if Exim version > 4.9.4 or greater!
202202
if ! version_ge "4.9.4" "$exim_version"; then
203203
if ! grep -q 'SRS_SECRET' /etc/exim4/exim4.conf.template; then
204-
srs=$(gen_pass)
204+
srs=$(generate_password)
205205
echo $srs > /etc/exim4/srs.conf
206206
chmod 640 /etc/exim4/srs.conf
207207
echo "[ * ] Update exim4.conf.template ..."

‎web/api/index.php‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
* @param string $user
2828
* @return void
2929
*/
30-
function api_error($exit_code, $message, bool $add_log = false, $user = "system") {
30+
function api_error($exit_code, $message, $hst_return, bool $add_log = false, $user = "system") {
3131
$message = trim(is_array($message) ? implode("\n", $message) : $message);
3232

3333
// Add log
@@ -56,32 +56,33 @@ function api_error($exit_code, $message, bool $add_log = false, $user = "system"
5656
* @return void
5757
*/
5858
function api_legacy(array $request_data) {
59+
$hst_return = ($request_data["returncode"] ?? "no") === "yes" ? "code" : "data";
5960
exec(HESTIA_CMD . "v-list-sys-config json", $output, $return_var);
6061
$settings = json_decode(implode("", $output), true);
6162
unset($output);
6263

6364
if ($settings["config"]["API"] != "yes") {
6465
echo "Error: API has been disabled";
65-
api_error(E_DISABLED, "Error: API Disabled");
66+
api_error(E_DISABLED, "Error: API Disabled", $hst_return);
6667
}
6768

6869
if ($settings["config"]["API_ALLOWED_IP"] != "allow-all") {
6970
$ip_list = explode(",", $settings["config"]["API_ALLOWED_IP"]);
7071
$ip_list[] = "";
7172
if (!in_array(get_real_user_ip(), $ip_list)) {
72-
api_error(E_FORBIDDEN, "Error: IP is not allowed to connect with API");
73+
api_error(E_FORBIDDEN, "Error: IP is not allowed to connect with API", $hst_return);
7374
}
7475
}
7576

7677
//This exists, so native JSON can be used without the repeating the code twice, so future code changes are easier and don't need to be replicated twice
7778
// Authentication
7879
if (empty($request_data["hash"])) {
7980
if ($request_data["user"] != "admin") {
80-
api_error(E_FORBIDDEN, "Error: authentication failed");
81+
api_error(E_FORBIDDEN, "Error: authentication failed", $hst_return);
8182
}
8283
$password = $request_data["password"];
8384
if (!isset($password)) {
84-
api_error(E_PASSWORD, "Error: authentication failed");
85+
api_error(E_PASSWORD, "Error: authentication failed", $hst_return);
8586
}
8687
$v_ip = quoteshellarg(get_real_user_ip());
8788
unset($output);
@@ -135,7 +136,7 @@ function api_legacy(array $request_data) {
135136

136137
// Check API answer
137138
if ($return_var > 0) {
138-
api_error(E_PASSWORD, "Error: authentication failed");
139+
api_error(E_PASSWORD, "Error: authentication failed", $hst_return);
139140
}
140141
} else {
141142
$key = "/usr/local/hestia/data/keys/" . basename($request_data["hash"]);
@@ -148,11 +149,10 @@ function api_legacy(array $request_data) {
148149
unset($output);
149150
// Check API answer
150151
if ($return_var > 0) {
151-
api_error(E_PASSWORD, "Error: authentication failed");
152+
api_error(E_PASSWORD, "Error: authentication failed", $hst_return);
152153
}
153154
}
154155

155-
$hst_return = ($request_data["returncode"] ?? "no") === "yes" ? "code" : "data";
156156
$hst_cmd = trim($request_data["cmd"] ?? "");
157157
$hst_cmd_args = [];
158158
for ($i = 1; $i <= 9; $i++) {
@@ -162,9 +162,9 @@ function api_legacy(array $request_data) {
162162
}
163163

164164
if (empty($hst_cmd)) {
165-
api_error(E_INVALID, "Command not provided");
165+
api_error(E_INVALID, "Command not provided", $hst_return);
166166
} elseif (!preg_match('/^[a-zA-Z0-9_-]+$/', $hst_cmd)) {
167-
api_error(E_INVALID, "$hst_cmd command invalid");
167+
api_error(E_INVALID, "$hst_cmd command invalid", $hst_return);
168168
}
169169

170170
// Check command
@@ -207,6 +207,7 @@ function api_legacy(array $request_data) {
207207
* @return void
208208
*/
209209
function api_connection(array $request_data) {
210+
$hst_return = ($request_data["returncode"] ?? "no") === "yes" ? "code" : "data";
210211
$v_real_user_ip = get_real_user_ip();
211212

212213
exec(HESTIA_CMD . "v-list-sys-config json", $output, $return_var);
@@ -220,22 +221,21 @@ function api_connection(array $request_data) {
220221
: 0;
221222
if ($api_status == 0) {
222223
// Check if API is disabled for all users
223-
api_error(E_DISABLED, "API has been disabled");
224+
api_error(E_DISABLED, "API has been disabled", $hst_return);
224225
}
225226

226227
// Check if API access is enabled for the user
227228
if ($settings["config"]["API_ALLOWED_IP"] != "allow-all") {
228229
$ip_list = explode(",", $settings["config"]["API_ALLOWED_IP"]);
229230
$ip_list[] = "";
230231
if (!in_array($v_real_user_ip, $ip_list) && !in_array("0.0.0.0", $ip_list)) {
231-
api_error(E_FORBIDDEN, "IP is not allowed to connect with API");
232+
api_error(E_FORBIDDEN, "IP is not allowed to connect with API", $hst_return);
232233
}
233234
}
234235

235236
// Get POST Params
236237
$hst_access_key_id = trim($request_data["access_key"] ?? "");
237238
$hst_secret_access_key = trim($request_data["secret_key"] ?? "");
238-
$hst_return = ($request_data["returncode"] ?? "no") === "yes" ? "code" : "data";
239239
$hst_cmd = trim($request_data["cmd"] ?? "");
240240
$hst_cmd_args = [];
241241
for ($i = 1; $i <= 9; $i++) {
@@ -245,13 +245,13 @@ function api_connection(array $request_data) {
245245
}
246246

247247
if (empty($hst_cmd)) {
248-
api_error(E_INVALID, "Command not provided");
248+
api_error(E_INVALID, "Command not provided", $hst_return);
249249
} elseif (!preg_match('/^[a-zA-Z0-9_-]+$/', $hst_cmd)) {
250-
api_error(E_INVALID, "$hst_cmd command invalid");
250+
api_error(E_INVALID, "$hst_cmd command invalid", $hst_return);
251251
}
252252

253253
if (empty($hst_access_key_id) || empty($hst_secret_access_key)) {
254-
api_error(E_PASSWORD, "Authentication failed");
254+
api_error(E_PASSWORD, "Authentication failed", $hst_return);
255255
}
256256

257257
// Authenticates the key and checks permission to run the script
@@ -270,8 +270,8 @@ function api_connection(array $request_data) {
270270
$return_var,
271271
);
272272
if ($return_var > 0) {
273-
//api_error($return_var, "Key $hst_access_key_id - authentication failed");
274-
api_error($return_var, $output);
273+
//api_error($return_var, "Key $hst_access_key_id - authentication failed", $hst_return);
274+
api_error($return_var, $output, $hst_return);
275275
}
276276
$key_data = json_decode(implode("", $output), true) ?? [];
277277
unset($output, $return_var);
@@ -284,7 +284,7 @@ function api_connection(array $request_data) {
284284

285285
# Check if API access is enabled for nonadmin users
286286
if ($key_user != "admin" && $api_status < 2) {
287-
api_error(E_API_DISABLED, "API has been disabled");
287+
api_error(E_API_DISABLED, "API has been disabled", $hst_return);
288288
}
289289

290290
// Checks if the value entered in the "user" argument matches the user of the key
@@ -296,6 +296,7 @@ function api_connection(array $request_data) {
296296
api_error(
297297
E_FORBIDDEN,
298298
"Key $hst_access_key_id - the \"user\" argument doesn\'t match the key\'s user",
299+
$hst_return,
299300
);
300301
}
301302

@@ -350,6 +351,7 @@ function api_connection(array $request_data) {
350351
api_error(
351352
405,
352353
"Error: data received is null or invalid, check https://hestiacp.com/docs/server-administration/rest-api.html",
354+
"",
353355
);
354356
}
355357

@@ -376,5 +378,6 @@ function api_connection(array $request_data) {
376378
api_error(
377379
405,
378380
"Error: data received is null or invalid, check https://hestiacp.com/docs/server-administration/rest-api.html",
381+
"",
379382
);
380383
}

‎web/inc/helpers.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
const E_RRD = 18;
2424
const E_UPDATE = 19;
2525
const E_RESTART = 20;
26+
const E_API_DISABLED = 21;
2627

2728
/**
2829
* Looks for a code equivalent to "exit_code" to use in http_code.
@@ -50,6 +51,7 @@ function exit_code_to_http_code(int $exit_code, int $default = 400): int {
5051
case E_UNSUSPENDED:
5152
case E_FORBIDEN:
5253
case E_FORBIDDEN:
54+
case E_API_DISABLED:
5355
return 401;
5456
// return 403;
5557
case E_DISABLED:

0 commit comments

Comments
 (0)