Skip to content

Commit 5787f61

Browse files
jaapmarcusjaapmarcus
authored
Fix multiple small bugs (hestiacp#1877)
* Fix hestiacp#1870 Pass trough the GET user var * Fix hestiacp#1872 Unable to alter template POLICY_USER_EDIT_WEB_TEMPLATES = no still expected the fields to be preset and changed * hestiacp#1874 Allow domain.com for MX record * Fix hestiacp#1835 Set correct branch on update via packages * Fix incorrect example v-add-web-domain * Fix potential XXS issue
1 parent 4340077 commit 5787f61

File tree

10 files changed

+119
-83
lines changed

10 files changed

+119
-83
lines changed

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
# Changelog
22
All notable changes to this project will be documented in this file.
33

4+
## Development
5+
6+
### Bug fix
7+
8+
- # Fixed a issue where users where not able to save / update web domains when POLICY_USER_EDIT_WEB_TEMPLATES is enabled (#1872)
9+
- # Fixed a issue where admin users where not able to add new ssh key for users (#1870)
10+
- # Fixed a issue where domain.com was not affected as a valid domain (#1874)
11+
- # Fixed a issue where "development" icon was not removed on update to release (#1835)
12+
413
## [1.4.1] - Bug fix
514

615
- Fixed bug with 2FA enabled logins

‎bin/v-add-web-domain‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: add web domain
3-
# options: USER DOMAIN [IP] [ALIASES] [PROXY_EXTENSIONS] [RESTART]
3+
# options: USER DOMAIN [IP] [RESTART] [ALIASES] [PROXY_EXTENSIONS]
44
# labels: web
55
#
66
# example: v-add-web-domain admin wonderland.com 192.18.22.43 yes www.wonderland.com

‎func/domain.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -567,7 +567,7 @@ is_dns_fqnd() {
567567
r=$2
568568
fqdn_type=$(echo $t | grep "NS\|CNAME\|MX\|PTR\|SRV")
569569
tree_length=3
570-
if [ $t = 'CNAME' ]; then
570+
if [[ $t = 'CNAME' || $t = 'MX' ]]; then
571571
tree_length=2
572572
fi
573573

‎func/upgrade.sh‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -151,8 +151,16 @@ upgrade_get_version() {
151151

152152
upgrade_set_version() {
153153
# Set new version number in hestia.conf
154-
sed -i "/VERSION/d" $HESTIA/conf/hestia.conf
155-
echo "VERSION='$@'" >> $HESTIA/conf/hestia.conf
154+
$BIN/v-change-sys-config-value "VERSION" "$@"
155+
}
156+
157+
upgrade_set_branch() {
158+
159+
# Set branch in hestia.conf
160+
DISPLAY_VER=$(echo $@ | sed "s|~alpha||g" | sed "s|~beta||g");
161+
if [ "$DISPLAY_VER" = "$@" ]; then
162+
$BIN/v-change-sys-config-value "RELEASE_BRANCH" "release"
163+
fi
156164
}
157165

158166
upgrade_send_notification_to_panel () {

‎src/deb/hestia/postinst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ upgrade_rainloop | tee -a $LOG
7575

7676
# Set new version number in hestia.conf
7777
upgrade_set_version $new_version
78+
upgrade_set_branch $new_version
7879

7980
# Perform upgrade clean-up tasks (rebuild domains and users, restart services, delete temporary files)
8081
upgrade_cleanup_message | tee -a $LOG

‎web/add/key/index.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,15 @@
1717
$_SESSION['error_msg'] = _('Field SSH_KEY can not be blank.');
1818
}
1919

20+
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
21+
$user = $_GET['user'];
22+
}
23+
24+
$user = escapeshellarg($user);
25+
2026
if(!$_SESSION['error_msg']){
2127
if($_POST){
22-
//key if key already exisits
28+
//key if key already exists
2329
exec (HESTIA_CMD . "v-list-user-ssh-key ".$user." json", $output, $return_var);
2430
$data = json_decode(implode('', $output), true);
2531
unset($output);

‎web/edit/web/index.php‎

Lines changed: 80 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -231,14 +231,87 @@
231231
}
232232
}
233233

234-
// Change template
235-
if (($v_template != $_POST['v_template']) && (empty($_SESSION['error_msg']))) {
236-
exec (HESTIA_CMD."v-change-web-domain-tpl ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($_POST['v_template'])." 'no'", $output, $return_var);
237-
check_return_code($return_var,$output);
238-
unset($output);
239-
$restart_web = 'yes';
240-
}
241234

235+
if (($_SESSION['POLICY_USER_EDIT_WEB_TEMPLATES'] == 'yes') || ($_SESSION['userContext'] === "admin")){
236+
// Change template
237+
if (($v_template != $_POST['v_template']) && (empty($_SESSION['error_msg']))) {
238+
exec (HESTIA_CMD."v-change-web-domain-tpl ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($_POST['v_template'])." 'no'", $output, $return_var);
239+
check_return_code($return_var,$output);
240+
unset($output);
241+
$restart_web = 'yes';
242+
}
243+
244+
// Change backend template
245+
if ((!empty($_SESSION['WEB_BACKEND'])) && ( $v_backend_template != $_POST['v_backend_template']) && (empty($_SESSION['error_msg']))) {
246+
$v_backend_template = $_POST['v_backend_template'];
247+
exec (HESTIA_CMD."v-change-web-domain-backend-tpl ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_backend_template), $output, $return_var);
248+
check_return_code($return_var,$output);
249+
unset($output);
250+
}
251+
252+
// Enable/Disable nginx cache
253+
if (($_SESSION['WEB_SYSTEM'] == 'nginx') && ($v_nginx_cache_check != $_POST['v_nginx_cache_check'] ) || ($v_nginx_cache_duration != $_POST['v_nginx_cache_duration'] && $_POST['v_nginx_cache'] = "yes" ) && (empty($_SESSION['error_msg']))) {
254+
if ( $_POST['v_nginx_cache_check'] == 'on' ) {
255+
if (empty ($_POST['v_nginx_cache_duration'])){
256+
echo $_POST['v_nginx_cache_duration'] = "2m";
257+
}
258+
exec (HESTIA_CMD."v-add-fastcgi-cache ".$v_username." ".escapeshellarg($v_domain).' '. escapeshellarg($_POST['v_nginx_cache_duration']) , $output, $return_var);
259+
check_return_code($return_var,$output);
260+
unset($output);
261+
} else {
262+
exec (HESTIA_CMD."v-delete-fastcgi-cache ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);
263+
check_return_code($return_var,$output);
264+
unset($output);
265+
}
266+
$restart_web = 'yes';
267+
}
268+
269+
// Delete proxy support
270+
if ((!empty($_SESSION['PROXY_SYSTEM'])) && (!empty($v_proxy)) && (empty($_POST['v_proxy'])) && (empty($_SESSION['error_msg']))) {
271+
exec (HESTIA_CMD."v-delete-web-domain-proxy ".$v_username." ".escapeshellarg($v_domain)." 'no'", $output, $return_var);
272+
check_return_code($return_var,$output);
273+
unset($output);
274+
unset($v_proxy);
275+
$restart_web = 'yes';
276+
}
277+
278+
// Change proxy template / Update extension list
279+
if ((!empty($_SESSION['PROXY_SYSTEM'])) && (!empty($v_proxy)) && (!empty($_POST['v_proxy'])) && (empty($_SESSION['error_msg'])) ) {
280+
$ext = preg_replace("/\n/", " ", $_POST['v_proxy_ext']);
281+
$ext = preg_replace("/,/", " ", $ext);
282+
$ext = preg_replace('/\s+/', ' ',$ext);
283+
$ext = trim($ext);
284+
$ext = str_replace(' ', ", ", $ext);
285+
if (( $v_proxy_template != $_POST['v_proxy_template']) || ($v_proxy_ext != $ext)) {
286+
$ext = str_replace(', ', ",", $ext);
287+
if (!empty($_POST['v_proxy_template'])) $v_proxy_template = $_POST['v_proxy_template'];
288+
exec (HESTIA_CMD."v-change-web-domain-proxy-tpl ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_proxy_template)." ".escapeshellarg($ext)." 'no'", $output, $return_var);
289+
check_return_code($return_var,$output);
290+
$v_proxy_ext = str_replace(',', ', ', $ext);
291+
unset($output);
292+
$restart_proxy = 'yes';
293+
}
294+
}
295+
296+
// Add proxy support
297+
if ((!empty($_SESSION['PROXY_SYSTEM'])) && (empty($v_proxy)) && (!empty($_POST['v_proxy'])) && (empty($_SESSION['error_msg']))) {
298+
$v_proxy_template = $_POST['v_proxy_template'];
299+
if (!empty($_POST['v_proxy_ext'])) {
300+
$ext = preg_replace("/\n/", " ", $_POST['v_proxy_ext']);
301+
$ext = preg_replace("/,/", " ", $ext);
302+
$ext = preg_replace('/\s+/', ' ',$ext);
303+
$ext = trim($ext);
304+
$ext = str_replace(' ', ",", $ext);
305+
$v_proxy_ext = str_replace(',', ', ', $ext);
306+
}
307+
exec (HESTIA_CMD."v-add-web-domain-proxy ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_proxy_template)." ".escapeshellarg($ext)." 'no'", $output, $return_var);
308+
check_return_code($return_var,$output);
309+
unset($output);
310+
$restart_proxy = 'yes';
311+
}
312+
313+
314+
}
242315
// Change aliases
243316
if (empty($_SESSION['error_msg'])) {
244317
$waliases = preg_replace("/\n/", " ", $_POST['v_aliases']);
@@ -330,75 +403,6 @@
330403
unset($output);
331404
}
332405
}
333-
334-
// Change backend template
335-
if ((!empty($_SESSION['WEB_BACKEND'])) && ( $v_backend_template != $_POST['v_backend_template']) && (empty($_SESSION['error_msg']))) {
336-
$v_backend_template = $_POST['v_backend_template'];
337-
exec (HESTIA_CMD."v-change-web-domain-backend-tpl ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_backend_template), $output, $return_var);
338-
check_return_code($return_var,$output);
339-
unset($output);
340-
}
341-
342-
// Enable/Disable nginx cache
343-
if (($_SESSION['WEB_SYSTEM'] == 'nginx') && ($v_nginx_cache_check != $_POST['v_nginx_cache_check'] ) || ($v_nginx_cache_duration != $_POST['v_nginx_cache_duration'] && $_POST['v_nginx_cache'] = "yes" ) && (empty($_SESSION['error_msg']))) {
344-
if ( $_POST['v_nginx_cache_check'] == 'on' ) {
345-
if (empty ($_POST['v_nginx_cache_duration'])){
346-
echo $_POST['v_nginx_cache_duration'] = "2m";
347-
}
348-
exec (HESTIA_CMD."v-add-fastcgi-cache ".$v_username." ".escapeshellarg($v_domain).' '. escapeshellarg($_POST['v_nginx_cache_duration']) , $output, $return_var);
349-
check_return_code($return_var,$output);
350-
unset($output);
351-
} else {
352-
exec (HESTIA_CMD."v-delete-fastcgi-cache ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);
353-
check_return_code($return_var,$output);
354-
unset($output);
355-
}
356-
$restart_web = 'yes';
357-
}
358-
359-
// Delete proxy support
360-
if ((!empty($_SESSION['PROXY_SYSTEM'])) && (!empty($v_proxy)) && (empty($_POST['v_proxy'])) && (empty($_SESSION['error_msg']))) {
361-
exec (HESTIA_CMD."v-delete-web-domain-proxy ".$v_username." ".escapeshellarg($v_domain)." 'no'", $output, $return_var);
362-
check_return_code($return_var,$output);
363-
unset($output);
364-
unset($v_proxy);
365-
$restart_web = 'yes';
366-
}
367-
368-
// Change proxy template / Update extension list
369-
if ((!empty($_SESSION['PROXY_SYSTEM'])) && (!empty($v_proxy)) && (!empty($_POST['v_proxy'])) && (empty($_SESSION['error_msg'])) ) {
370-
$ext = preg_replace("/\n/", " ", $_POST['v_proxy_ext']);
371-
$ext = preg_replace("/,/", " ", $ext);
372-
$ext = preg_replace('/\s+/', ' ',$ext);
373-
$ext = trim($ext);
374-
$ext = str_replace(' ', ", ", $ext);
375-
if (( $v_proxy_template != $_POST['v_proxy_template']) || ($v_proxy_ext != $ext)) {
376-
$ext = str_replace(', ', ",", $ext);
377-
if (!empty($_POST['v_proxy_template'])) $v_proxy_template = $_POST['v_proxy_template'];
378-
exec (HESTIA_CMD."v-change-web-domain-proxy-tpl ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_proxy_template)." ".escapeshellarg($ext)." 'no'", $output, $return_var);
379-
check_return_code($return_var,$output);
380-
$v_proxy_ext = str_replace(',', ', ', $ext);
381-
unset($output);
382-
$restart_proxy = 'yes';
383-
}
384-
}
385-
386-
// Add proxy support
387-
if ((!empty($_SESSION['PROXY_SYSTEM'])) && (empty($v_proxy)) && (!empty($_POST['v_proxy'])) && (empty($_SESSION['error_msg']))) {
388-
$v_proxy_template = $_POST['v_proxy_template'];
389-
if (!empty($_POST['v_proxy_ext'])) {
390-
$ext = preg_replace("/\n/", " ", $_POST['v_proxy_ext']);
391-
$ext = preg_replace("/,/", " ", $ext);
392-
$ext = preg_replace('/\s+/', ' ',$ext);
393-
$ext = trim($ext);
394-
$ext = str_replace(' ', ",", $ext);
395-
$v_proxy_ext = str_replace(',', ', ', $ext);
396-
}
397-
exec (HESTIA_CMD."v-add-web-domain-proxy ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_proxy_template)." ".escapeshellarg($ext)." 'no'", $output, $return_var);
398-
check_return_code($return_var,$output);
399-
unset($output);
400-
$restart_proxy = 'yes';
401-
}
402406

403407
// Change document root for ssl domain
404408
if (( $v_ssl == 'yes') && (!empty($_POST['v_ssl'])) && (empty($_SESSION['error_msg']))) {

‎web/templates/pages/add_key.html‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,11 @@
22
<div class="l-center edit">
33
<div class="l-sort clearfix">
44
<div class="l-unit-toolbar__buttonstrip">
5-
<a class="ui-button cancel" dir="ltr" id="btn-back" href="/list/key/"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
5+
<?php if (($_SESSION['userContext'] === 'admin') && (isset($_GET['user'])) && ($_GET['user'] !== 'admin')) { ?>
6+
<a class="ui-button cancel" dir="ltr" id="btn-back" href="/list/key/?user=<?=htmlentities($_GET['user']);?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
7+
<?php } else { ?>
8+
<a class="ui-button cancel" dir="ltr" id="btn-back" href="/list/key/"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
9+
<?php } ?>
610
</div>
711
<div class="l-unit-toolbar__buttonstrip float-right">
812
<a href="#" class="ui-button" data-action="submit" data-id="vstobjects"><i class="fas fa-save status-icon purple"></i><?=_('Save');?></a>

‎web/templates/pages/edit_web.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<a class="ui-button cancel" dir="ltr" id="btn-back" href="/list/web/"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
66
</div>
77
<div class="l-unit-toolbar__buttonstrip float-right">
8-
<a href="/delete/web/cache/?domain=<?=$_GET['domain'];?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
8+
<a href="/delete/web/cache/?domain=<?=$v_domain;?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
99
<i class="fas fa-trash status-icon red"></i><?=_('Purge Nginx Cache');?>
1010
</a>
1111
<?php if ($_SESSION['PLUGIN_APP_INSTALLER'] !== 'false') {?>

‎web/templates/pages/list_key.html‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,11 @@
33
<div class="l-sort clearfix noselect">
44
<div class="l-unit-toolbar__buttonstrip">
55
<a class="ui-button cancel" dir="ltr" id="btn-back" href="/edit/user/?user=<?=$user;?>&token=<?=$_SESSION['token']?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
6+
<?php if (($_SESSION['userContext'] === 'admin') && (isset($_GET['user'])) && ($_GET['user'] !== 'admin')) { ?>
7+
<a href="/add/key/?user=<?=htmlentities($_GET['user']);?>" id="btn-create" class="ui-button cancel" dir="ltr"><i class="fas fa-plus-circle status-icon green"></i><?=_('Add SSH Key');?></a>
8+
<?php } else { ?>
69
<a href="/add/key/" id="btn-create" class="ui-button cancel" dir="ltr"><i class="fas fa-plus-circle status-icon green"></i><?=_('Add SSH Key');?></a>
10+
<?php } ?>
711
</div>
812
</div>
913
</div>

0 commit comments

Comments
 (0)