Skip to content

Commit 1a7612c

Browse files
serghey-rodinserghey-rodin
committed
password transmission via tmp files
1 parent 1021bd4 commit 1a7612c

File tree

14 files changed

+165
-80
lines changed

14 files changed

+165
-80
lines changed

‎web/add/db/index.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@
4343
// Protect input
4444
$v_database = escapeshellarg($_POST['v_database']);
4545
$v_dbuser = escapeshellarg($_POST['v_dbuser']);
46-
$v_password = escapeshellarg($_POST['v_password']);
4746
$v_type = $_POST['v_type'];
4847
$v_charset = $_POST['v_charset'];
4948
$v_host = $_POST['v_host'];
@@ -54,9 +53,15 @@
5453
$v_type = escapeshellarg($_POST['v_type']);
5554
$v_charset = escapeshellarg($_POST['v_charset']);
5655
$v_host = escapeshellarg($_POST['v_host']);
56+
$v_password = tempnam("/tmp","vst");
57+
$fp = fopen($v_password, "w");
58+
fwrite($fp, $_POST['v_password']."\n");
59+
fclose($fp);
5760
exec (VESTA_CMD."v-add-database ".$user." ".$v_database." ".$v_dbuser." ".$v_password." ".$v_type." ".$v_host." ".$v_charset, $output, $return_var);
5861
check_return_code($return_var,$output);
5962
unset($output);
63+
unlink($v_password);
64+
$v_password = escapeshellarg($_POST['v_password']);
6065
$v_type = $_POST['v_type'];
6166
$v_host = $_POST['v_host'];
6267
$v_charset = $_POST['v_charset'];

‎web/add/mail/index.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,6 @@
8787
$v_domain = escapeshellarg($_POST['v_domain']);
8888
$v_domain = strtolower($v_domain);
8989
$v_account = escapeshellarg($_POST['v_account']);
90-
$v_password = escapeshellarg($_POST['v_password']);
9190
$v_quota = escapeshellarg($_POST['v_quota']);
9291
$v_aliases = $_POST['v_aliases'];
9392
$v_fwd = $_POST['v_fwd'];
@@ -96,9 +95,15 @@
9695

9796
// Add Mail Account
9897
if (empty($_SESSION['error_msg'])) {
98+
$v_password = tempnam("/tmp","vst");
99+
$fp = fopen($v_password, "w");
100+
fwrite($fp, $_POST['v_password']."\n");
101+
fclose($fp);
99102
exec (VESTA_CMD."v-add-mail-account ".$user." ".$v_domain." ".$v_account." ".$v_password." ".$v_quota, $output, $return_var);
100103
check_return_code($return_var,$output);
101104
unset($output);
105+
unlink($v_password);
106+
$v_password = escapeshellarg($_POST['v_password']);
102107
}
103108

104109
// Add Aliases

‎web/add/user/index.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@
4747

4848
// Protect input
4949
$v_username = escapeshellarg($_POST['v_username']);
50-
$v_password = escapeshellarg($_POST['v_password']);
5150
$v_email = escapeshellarg($_POST['v_email']);
5251
$v_package = escapeshellarg($_POST['v_package']);
5352
$v_language = escapeshellarg($_POST['v_language']);
@@ -58,9 +57,15 @@
5857

5958
// Add user
6059
if (empty($_SESSION['error_msg'])) {
60+
$v_password = tempnam("/tmp","vst");
61+
$fp = fopen($v_password, "w");
62+
fwrite($fp, $_POST['v_password']."\n");
63+
fclose($fp);
6164
exec (VESTA_CMD."v-add-user ".$v_username." ".$v_password." ".$v_email." ".$v_package." ".$v_fname." ".$v_lname, $output, $return_var);
6265
check_return_code($return_var,$output);
6366
unset($output);
67+
unlink($v_password);
68+
$v_password = escapeshellarg($_POST['v_password']);
6469
}
6570

6671
// Set language

‎web/add/web/index.php‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -196,10 +196,15 @@
196196
// Add web stats password
197197
if ((!empty($_POST['v_stats_user'])) && (empty($_SESSION['error_msg']))) {
198198
$v_stats_user = escapeshellarg($_POST['v_stats_user']);
199-
$v_stats_password = escapeshellarg($_POST['v_stats_password']);
199+
$v_stats_password = tempnam("/tmp","vst");
200+
$fp = fopen($v_stats_password, "w");
201+
fwrite($fp, $_POST['v_stats_password']."\n");
202+
fclose($fp);
200203
exec (VESTA_CMD."v-add-web-domain-stats-user ".$user." ".$v_domain." ".$v_stats_user." ".$v_stats_password, $output, $return_var);
201204
check_return_code($return_var,$output);
202205
unset($output);
206+
unlink($v_stats_password);
207+
$v_stats_password = escapeshellarg($_POST['v_stats_password']);
203208
}
204209

205210
// Restart DNS server
@@ -259,13 +264,16 @@
259264
$v_ftp_username = $v_ftp_user_data['v_ftp_user'];
260265
$v_ftp_username_full = $user . '_' . $v_ftp_user_data['v_ftp_user'];
261266
$v_ftp_user = escapeshellarg($v_ftp_user_data['v_ftp_user']);
262-
$v_ftp_password = escapeshellarg($v_ftp_user_data['v_ftp_password']);
263-
264267
if ($domain_added) {
265268
$v_ftp_path = escapeshellarg(trim($v_ftp_user_data['v_ftp_path']));
269+
$v_ftp_password = tempnam("/tmp","vst");
270+
$fp = fopen($v_ftp_password, "w");
271+
fwrite($fp, $v_ftp_user_data['v_ftp_password']."\n");
272+
fclose($fp);
266273
exec (VESTA_CMD."v-add-web-domain-ftp ".$user." ".$v_domain." ".$v_ftp_username." ".$v_ftp_password . " " . $v_ftp_path, $output, $return_var);
267274
check_return_code($return_var,$output);
268275
unset($output);
276+
unlink($v_ftp_password);
269277
if ((!empty($v_ftp_user_data['v_ftp_email'])) && (empty($_SESSION['error_msg']))) {
270278
$to = $v_ftp_user_data['v_ftp_email'];
271279
$subject = __("FTP login credentials");

‎web/api/index.php‎

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,15 @@
1111
echo 'Error: only admin is allowed to use API';
1212
exit;
1313
}
14-
14+
1515
$v_user = escapeshellarg($_POST['user']);
16-
$v_password = escapeshellarg($_POST['password']);
16+
$v_password = tempnam("/tmp","vst");
17+
$fp = fopen($v_password, "w");
18+
fwrite($fp, $_POST['password']."\n");
19+
fclose($fp);
1720
$v_ip_addr = escapeshellarg($_SERVER["REMOTE_ADDR"]);
1821
exec(VESTA_CMD ."v-check-user-password ".$v_user." ".$v_password." '".$v_ip_addr."'", $output, $auth_code);
22+
unlink($v_password);
1923
} else {
2024
$key = '/usr/local/vesta/data/keys/' . basename($_POST['hash']);
2125
if (file_exists($key) && is_file($key)) {
@@ -27,7 +31,7 @@
2731
echo 'Error: authentication failed';
2832
exit;
2933
}
30-
34+
3135
// Prepare arguments
3236
if (isset($_POST['cmd'])) $cmd = escapeshellarg($_POST['cmd']);
3337
if (isset($_POST['arg1'])) $arg1 = escapeshellarg($_POST['arg1']);
@@ -40,31 +44,30 @@
4044
if (isset($_POST['arg8'])) $arg8 = escapeshellarg($_POST['arg8']);
4145
if (isset($_POST['arg9'])) $arg9 = escapeshellarg($_POST['arg9']);
4246

43-
// Build query
47+
// Build query
4448
$cmdquery = VESTA_CMD.$cmd." ";
45-
46-
if(!empty($arg1)){
47-
$cmdquery = $cmdquery.$arg1." "; }
48-
if(!empty($arg2)){
49-
$cmdquery = $cmdquery.$arg2." "; }
50-
if(!empty($arg3)){
51-
$cmdquery = $cmdquery.$arg3." "; }
52-
if(!empty($arg4)){
53-
$cmdquery = $cmdquery.$arg4." "; }
54-
if(!empty($arg5)){
55-
$cmdquery = $cmdquery.$arg5." "; }
56-
if(!empty($arg6)){
57-
$cmdquery = $cmdquery.$arg6." "; }
58-
if(!empty($arg7)){
59-
$cmdquery = $cmdquery.$arg7." "; }
60-
if(!empty($arg8)){
61-
$cmdquery = $cmdquery.$arg8." "; }
62-
if(!empty($arg9)){
63-
$cmdquery = $cmdquery.$arg9; }
49+
if(!empty($arg1)){
50+
$cmdquery = $cmdquery.$arg1." "; }
51+
if(!empty($arg2)){
52+
$cmdquery = $cmdquery.$arg2." "; }
53+
if(!empty($arg3)){
54+
$cmdquery = $cmdquery.$arg3." "; }
55+
if(!empty($arg4)){
56+
$cmdquery = $cmdquery.$arg4." "; }
57+
if(!empty($arg5)){
58+
$cmdquery = $cmdquery.$arg5." "; }
59+
if(!empty($arg6)){
60+
$cmdquery = $cmdquery.$arg6." "; }
61+
if(!empty($arg7)){
62+
$cmdquery = $cmdquery.$arg7." "; }
63+
if(!empty($arg8)){
64+
$cmdquery = $cmdquery.$arg8." "; }
65+
if(!empty($arg9)){
66+
$cmdquery = $cmdquery.$arg9; }
6467

65-
// Run query
68+
// Run query
6669
exec ($cmdquery, $output, $return_var);
67-
70+
6871
if ((!empty($_POST['returncode'])) && ($_POST['returncode'] == 'yes')) {
6972
echo $return_var;
7073
} else {

‎web/edit/db/index.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,11 +64,15 @@
6464

6565
// Change database password
6666
if (($v_password != $_POST['v_password']) && (empty($_SESSION['error_msg']))) {
67-
$v_password = escapeshellarg($_POST['v_password']);
67+
$v_password = tempnam("/tmp","vst");
68+
$fp = fopen($v_password, "w");
69+
fwrite($fp, $_POST['v_password']."\n");
70+
fclose($fp);
6871
exec (VESTA_CMD."v-change-database-password ".$v_username." ".$v_database." ".$v_password, $output, $return_var);
69-
check_return_code($return_var,$output);
70-
$v_password = "••••••••";
72+
check_return_code($return_var,$output);
7173
unset($output);
74+
unlink($v_password);
75+
$v_password = "••••••••";
7276
}
7377

7478
// Set success message

‎web/edit/mail/index.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,11 +178,15 @@
178178

179179
// Change password
180180
if (($v_password != $_POST['v_password']) && (empty($_SESSION['error_msg']))) {
181-
$v_password = escapeshellarg($_POST['v_password']);
181+
$v_password = tempnam("/tmp","vst");
182+
$fp = fopen($v_password, "w");
183+
fwrite($fp, $_POST['v_password']."\n");
184+
fclose($fp);
182185
exec (VESTA_CMD."v-change-mail-account-password ".$v_username." ".$v_domain." ".$v_account." ".$v_password, $output, $return_var);
183186
check_return_code($return_var,$output);
184-
$v_password = "••••••••";
185187
unset($output);
188+
unlink($v_password);
189+
$v_password = "••••••••";
186190
}
187191

188192
// Change quota

‎web/edit/user/index.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,15 @@
7676

7777
// Change password
7878
if (($v_password != $_POST['v_password']) && (empty($_SESSION['error_msg']))) {
79-
$v_password = escapeshellarg($_POST['v_password']);
79+
$v_password = tempnam("/tmp","vst");
80+
$fp = fopen($v_password, "w");
81+
fwrite($fp, $_POST['v_password']."\n");
82+
fclose($fp);
8083
exec (VESTA_CMD."v-change-user-password ".$v_username." ".$v_password, $output, $return_var);
8184
check_return_code($return_var,$output);
82-
$v_password = "••••••••";
8385
unset($output);
86+
unlink($v_password);
87+
$v_password = "••••••••";
8488
}
8589

8690
// Change package (admin only)

‎web/edit/web/index.php‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -426,10 +426,14 @@
426426
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
427427
} else {
428428
$v_stats_user = escapeshellarg($_POST['v_stats_user']);
429-
$v_stats_password = escapeshellarg($_POST['v_stats_password']);
429+
$v_stats_password = tempnam("/tmp","vst");
430+
$fp = fopen($v_stats_password, "w");
431+
fwrite($fp, $_POST['v_stats_password']."\n");
432+
fclose($fp);
430433
exec (VESTA_CMD."v-add-web-domain-stats-user ".$v_username." ".$v_domain." ".$v_stats_user." ".$v_stats_password, $output, $return_var);
431434
check_return_code($return_var,$output);
432435
unset($output);
436+
unlink($v_stats_password);
433437
$v_stats_password = "••••••••";
434438
}
435439
}
@@ -450,10 +454,14 @@
450454
}
451455
if (($v_stats_user != $_POST['v_stats_user']) || ($_POST['v_stats_password'] != "••••••••" ) && (empty($_SESSION['error_msg']))) {
452456
$v_stats_user = escapeshellarg($_POST['v_stats_user']);
453-
$v_stats_password = escapeshellarg($_POST['v_stats_password']);
457+
$v_stats_password = tempnam("/tmp","vst");
458+
$fp = fopen($v_stats_password, "w");
459+
fwrite($fp, $_POST['v_stats_password']."\n");
460+
fclose($fp);
454461
exec (VESTA_CMD."v-add-web-domain-stats-user ".$v_username." ".$v_domain." ".$v_stats_user." ".$v_stats_password, $output, $return_var);
455462
check_return_code($return_var,$output);
456463
unset($output);
464+
unlink($v_stats_password);
457465
$v_stats_password = "••••••••";
458466
}
459467
}
@@ -484,9 +492,12 @@
484492
$v_ftp_username = $v_ftp_user_data['v_ftp_user'];
485493
$v_ftp_username_full = $user . '_' . $v_ftp_user_data['v_ftp_user'];
486494
$v_ftp_user = escapeshellarg($v_ftp_username);
487-
$v_ftp_password = escapeshellarg($v_ftp_user_data['v_ftp_password']);
488495
$v_ftp_path = escapeshellarg(trim($v_ftp_user_data['v_ftp_path']));
489496
if (empty($_SESSION['error_msg'])) {
497+
$v_ftp_password = tempnam("/tmp","vst");
498+
$fp = fopen($v_ftp_password, "w");
499+
fwrite($fp, $v_ftp_user_data['v_ftp_password']."\n");
500+
fclose($fp);
490501
exec (VESTA_CMD."v-add-web-domain-ftp ".$v_username." ".$v_domain." ".$v_ftp_username." ".$v_ftp_password . " " . $v_ftp_path, $output, $return_var);
491502
check_return_code($return_var,$output);
492503
if ((!empty($v_ftp_user_data['v_ftp_email'])) && (empty($_SESSION['error_msg']))) {
@@ -499,6 +510,8 @@
499510
unset($v_ftp_email);
500511
}
501512
unset($output);
513+
unlink($v_ftp_password);
514+
$v_ftp_password = escapeshellarg($v_ftp_user_data['v_ftp_password']);
502515
}
503516

504517
if ($return_var == 0) {
@@ -552,7 +565,13 @@
552565
$v_ftp_path = escapeshellarg(trim($v_ftp_user_data['v_ftp_path']));
553566
exec (VESTA_CMD."v-change-web-domain-ftp-path ".$v_username." ".$v_domain." ".$v_ftp_username." ".$v_ftp_path, $output, $return_var);
554567
if ($v_ftp_user_data['v_ftp_password'] != "'••••••••'" && $v_ftp_user_data['v_ftp_password'] != "••••••••" && !empty($v_ftp_user_data['v_ftp_password'])) {
568+
$v_ftp_password = tempnam("/tmp","vst");
569+
$fp = fopen($v_ftp_password, "w");
570+
fwrite($fp, $v_ftp_user_data['v_ftp_password']."\n");
571+
fclose($fp);
555572
exec (VESTA_CMD."v-change-web-domain-ftp-password ".$v_username." ".$v_domain." ".$v_ftp_username." ".$v_ftp_user_data['v_ftp_password'], $output, $return_var);
573+
unlink($v_ftp_password);
574+
$v_ftp_user_data['v_ftp_password'] = escapeshellarg(trim($v_ftp_user_data['v_ftp_password']));
556575
$to = $v_ftp_user_data['v_ftp_email'];
557576
$subject = __("FTP login credentials");
558577
$hostname = exec('hostname');

‎web/list/dns/index.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
include($_SERVER['DOCUMENT_ROOT'].'/templates/user/list_dns.html');
2424
}
2525
} else {
26-
exec (VESTA_CMD."v-list-dns-records '".$user."' '".$_GET['domain']."' 'json'", $output, $return_var);
26+
exec (VESTA_CMD."v-list-dns-records '".$user."' '".escapeshellarg($_GET['domain'])."' 'json'", $output, $return_var);
2727
$data = json_decode(implode('', $output), true);
2828
$data = array_reverse($data, true);
2929
unset($output);

0 commit comments

Comments
 (0)