Skip to content

Commit 15aedff

Browse files
ScIT-RaphaelScIT-Raphael
committed
Security fixes - CSRF / Command Injection / XSS, thanks @sergio-nadal!
1 parent e7c11f0 commit 15aedff

File tree

15 files changed

+63
-20
lines changed

15 files changed

+63
-20
lines changed

‎web/add/cron/autoupdate/index.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55
session_start();
66
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
77

8+
// Check token
9+
if ((!isset($_GET['token'])) || ($_SESSION['token'] != $_GET['token'])) {
10+
header('location: /login/');
11+
exit();
12+
}
13+
814
if ($_SESSION['user'] == 'admin') {
915
exec (HESTIA_CMD."v-add-cron-hestia-autoupdate", $output, $return_var);
1016
$_SESSION['error_msg'] = __('Autoupdate has been successfully enabled');

‎web/add/cron/reports/index.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55
session_start();
66
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
77

8+
// Check token
9+
if ((!isset($_GET['token'])) || ($_SESSION['token'] != $_GET['token'])) {
10+
header('location: /login/');
11+
exit();
12+
}
13+
814
exec (HESTIA_CMD."v-add-cron-reports ".$user, $output, $return_var);
915
$_SESSION['error_msg'] = __('Cronjob email reporting has been successfully enabled');
1016
unset($output);

‎web/add/firewall/banlist/index.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@
66
// Main include
77
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
88

9+
// Check token
10+
if ((!isset($_GET['token'])) || ($_SESSION['token'] != $_GET['token'])) {
11+
header('location: /login/');
12+
exit();
13+
}
14+
915
// Check user
1016
if ($_SESSION['user'] != 'admin') {
1117
header("Location: /list/user");

‎web/delete/cron/autoupdate/index.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55
session_start();
66
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
77

8+
// Check token
9+
if ((!isset($_GET['token'])) || ($_SESSION['token'] != $_GET['token'])) {
10+
header('location: /login/');
11+
exit();
12+
}
13+
814
if ($_SESSION['user'] == 'admin') {
915
exec (HESTIA_CMD."v-delete-cron-hestia-autoupdate", $output, $return_var);
1016
$_SESSION['error_msg'] = __('Autoupdate has been successfully disabled');

‎web/delete/cron/reports/index.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55
session_start();
66
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
77

8+
// Check token
9+
if ((!isset($_GET['token'])) || ($_SESSION['token'] != $_GET['token'])) {
10+
header('location: /login/');
11+
exit();
12+
}
13+
814
exec (HESTIA_CMD."v-delete-cron-reports ".$user, $output, $return_var);
915
$_SESSION['error_msg'] = __('Cronjob email reporting has been successfully disabled');
1016
unset($output);

‎web/edit/db/index.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727

2828
// Parse database
2929
$v_username = $user;
30-
$v_database = $_GET['database'];
30+
$v_database = escapeshellarg($_GET['database']);
3131
$v_dbuser = $data[$v_database]['DBUSER'];
3232
$v_password = "";
3333
$v_host = $data[$v_database]['HOST'];

‎web/edit/mail/index.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
unset($output);
2727

2828
// Parse domain
29-
$v_domain = $_GET['domain'];
29+
$v_domain = escapeshellarg($_GET['domain']);
3030
$v_antispam = $data[$v_domain]['ANTISPAM'];
3131
$v_antivirus = $data[$v_domain]['ANTIVIRUS'];
3232
$v_dkim = $data[$v_domain]['DKIM'];
@@ -51,8 +51,8 @@
5151

5252
// Parse mail account
5353
$v_username = $user;
54-
$v_domain = $_GET['domain'];
55-
$v_account = $_GET['account'];
54+
$v_domain = escapeshellarg($_GET['domain']);
55+
$v_account = escapeshellarg($_GET['account']);
5656
$v_password = "";
5757
$v_aliases = str_replace(',', "\n", $data[$v_account]['ALIAS']);
5858
$valiases = explode(",", $data[$v_account]['ALIAS']);
@@ -219,7 +219,7 @@
219219

220220
// Change account aliases
221221
if (empty($_SESSION['error_msg'])) {
222-
$waliases = preg_replace("/\n/", " ", $_POST['v_aliases']);
222+
$waliases = preg_replace("/\n/", " ", escapeshellarg($_POST['v_aliases']));
223223
$waliases = preg_replace("/,/", " ", $waliases);
224224
$waliases = preg_replace('/\s+/', ' ',$waliases);
225225
$waliases = trim($waliases);
@@ -245,7 +245,7 @@
245245

246246
// Change forwarders
247247
if (empty($_SESSION['error_msg'])) {
248-
$wfwd = preg_replace("/\n/", " ", $_POST['v_fwd']);
248+
$wfwd = preg_replace("/\n/", " ", escapeshellarg($_POST['v_fwd']));
249249
$wfwd = preg_replace("/,/", " ", $wfwd);
250250
$wfwd = preg_replace('/\s+/', ' ',$wfwd);
251251
$wfwd = trim($wfwd);

‎web/edit/web/index.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626

2727
// Parse domain
2828
$v_username = $user;
29-
$v_domain = $_GET['domain'];
29+
$v_domain = escapeshellarg($_GET['domain']);
3030
$v_ip = $data[$v_domain]['IP'];
3131
$v_template = $data[$v_domain]['TPL'];
3232
$v_aliases = str_replace(',', "\n", $data[$v_domain]['ALIAS']);
@@ -116,6 +116,7 @@
116116
}
117117

118118
// Change web domain IP
119+
119120
if (($v_ip != $_POST['v_ip']) && (empty($_SESSION['error_msg']))) {
120121
$v_ip = escapeshellarg($_POST['v_ip']);
121122
exec (HESTIA_CMD."v-change-web-domain-ip ".$v_username." ".$v_domain." ".$v_ip." 'no'", $output, $return_var);
@@ -162,7 +163,7 @@
162163

163164
// Change aliases
164165
if (empty($_SESSION['error_msg'])) {
165-
$waliases = preg_replace("/\n/", " ", $_POST['v_aliases']);
166+
$waliases = preg_replace("/\n/", " ", escapeshellarg($_POST['v_aliases']));
166167
$waliases = preg_replace("/,/", " ", $waliases);
167168
$waliases = preg_replace('/\s+/', ' ',$waliases);
168169
$waliases = trim($waliases);
@@ -588,7 +589,7 @@
588589
$subject = __("FTP login credentials");
589590
$hostname = exec('hostname');
590591
$from = __('MAIL_FROM',$hostname);
591-
$mailtext = __('FTP_ACCOUNT_READY',$_GET['domain'],$user,$v_ftp_username,$v_ftp_user_data['v_ftp_password']);
592+
$mailtext = __('FTP_ACCOUNT_READY',escapeshellarg($_GET['domain']),$user,$v_ftp_username,$v_ftp_user_data['v_ftp_password']);
592593
send_email($to, $subject, $mailtext, $from);
593594
unset($v_ftp_email);
594595
}
@@ -662,7 +663,7 @@
662663
$subject = __("FTP login credentials");
663664
$hostname = exec('hostname');
664665
$from = __('MAIL_FROM',$hostname);
665-
$mailtext = __('FTP_ACCOUNT_READY',$_GET['domain'],$user,$v_ftp_username_for_emailing,$v_ftp_user_data['v_ftp_password']);
666+
$mailtext = __('FTP_ACCOUNT_READY',escapeshellarg($_GET['domain']),$user,$v_ftp_username_for_emailing,$v_ftp_user_data['v_ftp_password']);
666667
send_email($to, $subject, $mailtext, $from);
667668
unset($v_ftp_email);
668669
}

‎web/list/directory/index.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@
1818
$panel = json_decode(implode('', $output), true);
1919
}
2020

21-
$path_a = !empty($_REQUEST['dir_a']) ? $_REQUEST['dir_a'] : '';
22-
$path_b = !empty($_REQUEST['dir_b']) ? $_REQUEST['dir_b'] : '';
21+
$path_a = !empty($_REQUEST['dir_a']) ? htmlentities($_REQUEST['dir_a']) : '';
22+
$path_b = !empty($_REQUEST['dir_b']) ? htmlentities($_REQUEST['dir_b']) : '';
2323
$GLOBAL_JS = '<script type="text/javascript">GLOBAL.START_DIR_A = "' . $path_a . '";</script>';
2424
$GLOBAL_JS .= '<script type="text/javascript">GLOBAL.START_DIR_B = "' . $path_b . '";</script>';
2525
$GLOBAL_JS .= '<script type="text/javascript">GLOBAL.ROOT_DIR = "' . $panel[$user]['HOME'] . '";</script>';

‎web/restart/system/index.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55
session_start();
66
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
77

8+
// Check token
9+
if ((!isset($_GET['token'])) || ($_SESSION['token'] != $_GET['token'])) {
10+
header('location: /login/');
11+
exit();
12+
}
13+
814
if ($_SESSION['user'] == 'admin') {
915
if (!empty($_GET['hostname'])) {
1016
exec (HESTIA_CMD."v-restart-system yes", $output, $return_var);

0 commit comments

Comments
 (0)