Skip to content

Commit 74b2234

Browse files
jaapmarcusjaapmarcus
authored
Staging/1.5.14 (hestiacp#2572)
* Update changelog with correct CVE number * Add check for adding / changing mx record (hestiacp#2559) * Add check for adding / changing mx record * Fix issue with TXT > 255 chars * Change vars * Add tests for login actions * Update version and changelog * Skip 2 tests that have not been implemented yet
1 parent 787a5d0 commit 74b2234

File tree

13 files changed

+334
-76
lines changed

13 files changed

+334
-76
lines changed

‎CHANGELOG.md‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22
All notable changes to this project will be documented in this file.
33

44

5+
## [1.5.14] - Service release
6+
7+
### Bugfixes
8+
9+
- Fixed an issue with login with ipv6 (#2564)
10+
- Fixed an issue with dns records containing an . (#2559)
11+
512
## [1.5.13] - Service release
613

714
### Bugfixes
@@ -12,7 +19,7 @@ All notable changes to this project will be documented in this file.
1219

1320
### Bugfixes
1421

15-
- Fixed vulnerability with Sed [CVE-2022-XXXX](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-XXXX)
22+
- Fixed vulnerability with Sed [CVE-2022-1509](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1509)
1623
- Remove localhost exception for invalidating sessions [SSD disclosure](https://ssd-disclosure.com/ssd-advisory-vestacp-multiple-vulnerabilities/)
1724

1825
## [1.5.11] - Service release

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
[Hestia Control Panel](https://www.hestiacp.com/)
44
==================================================
5-
**Latest stable release:** Version 1.5.12 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
5+
**Latest stable release:** Version 1.5.14 | [View Changelog](https://github.com/hestiacp/hestiacp/blob/release/CHANGELOG.md) | [![Build Status](https://drone.hestiacp.com/api/badges/hestiacp/hestiacp/status.svg?ref=refs/heads/main)](https://drone.hestiacp.com/hestiacp/hestiacp) <br>
66

77
**Web:** [www.hestiacp.com](https://www.hestiacp.com/)<br>
88
**Documentation:** [docs.hestiacp.com](https://docs.hestiacp.com/)<br>

‎bin/v-change-dns-record‎

Lines changed: 26 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ domain=$2
1616
domain_idn=$2
1717
id=$3
1818
record=$4
19-
type=$5
19+
rtype=$5
2020
dvalue=$(idn -t --quiet -u "$6" )
2121
priority=$7
2222
restart=$8
@@ -42,7 +42,7 @@ format_domain_idn
4242
#----------------------------------------------------------#
4343

4444
check_args '6' "$#" 'USER DOMAIN ID RECORD TYPE VALUE [PRIORITY] [RESTART] [TTL]'
45-
is_format_valid 'user' 'domain' 'id' 'record' 'type' 'dvalue'
45+
is_format_valid 'user' 'domain' 'id' 'record'
4646
is_system_enabled "$DNS_SYSTEM" 'DNS_SYSTEM'
4747
is_object_valid 'user' 'USER' "$user"
4848
is_object_unsuspended 'user' 'USER' "$user"
@@ -66,31 +66,47 @@ unset TTL
6666
line=$(grep "ID='$id'" $USER_DATA/dns/$domain.conf)
6767
parse_object_kv_list "$line"
6868

69-
if [ -z "$type" ]; then
70-
type=$TYPE
69+
if [ -z "$rtype" ]; then
70+
rtype=$TYPE
71+
fi
72+
73+
if [ -z "$priority" ]; then
74+
priority=$PRIORITY
7175
fi
7276

7377
# Null priority for none MX/SRV records
74-
if [ "$type" != 'MX' ] && [ "$TYPE" != 'SRV' ]; then
78+
if [ "$rtype" != 'MX' ] && [ "$rtype" != 'SRV' ]; then
7579
priority=''
7680
fi
7781

7882
# Add trailing dot at the end of NS/CNAME/MX/PTR/SRV record
79-
if [[ $type =~ NS|CNAME|MX|PTR|SRV ]]; then
83+
if [[ $rtype =~ NS|CNAME|MX|PTR|SRV ]]; then
8084
trailing_dot=$(echo "$dvalue" | grep "\.$")
8185
if [ -z "$trailing_dot" ]; then
8286
dvalue="$dvalue."
8387
fi
8488
fi
8589

90+
if [ "$rtype" != "CAA" ]; then
91+
dvalue=${dvalue//\"/}
92+
93+
if [ "$rtype" != 'SRV' ] && [[ "$dvalue" =~ [\;[:space:]] ]]; then
94+
dvalue='"'"$dvalue"'"'
95+
fi
96+
fi
97+
98+
99+
#RTYPE wasn't checked make sure to do it now correctly
100+
is_format_valid 'user' 'domain' 'id' 'record' 'rtype' 'dvalue'
101+
86102
# Additional verifications
87103
is_dns_fqnd "$TYPE" "$dvalue"
88104
is_dns_nameserver_valid "$domain" "$TYPE" "$dvalue"
89105

90-
if [[ "$RECORD" == "$record" ]] && [[ "$TYPE" == "$type" ]] && [[ "$PRIORITY" -eq "$priority" ]] \
106+
if [[ "$RECORD" == "$record" ]] && [[ "$TYPE" == "$rtype" ]] && [[ "$PRIORITY" -eq "$priority" ]] \
91107
&& [[ "$VALUE" == "$dvalue" ]] && [[ "$SUSPENDED" == 'no' ]] && [[ "$TTL" -eq "$ttl" ]]; then
92108
echo "No pending changes in DNS entry."
93-
exit "$E_EXSIST"
109+
exit "$E_EXISTS"
94110
fi
95111

96112
# Generating timestamp
@@ -99,7 +115,7 @@ time=$(echo "$time_n_date" |cut -f 1 -d \ )
99115
date=$(echo "$time_n_date" |cut -f 2 -d \ )
100116

101117
# Adding record
102-
dns_rec="ID='$id' RECORD='$record' TYPE='$type' PRIORITY='$priority'"
118+
dns_rec="ID='$id' RECORD='$record' TYPE='$rtype' PRIORITY='$priority'"
103119
dns_rec="$dns_rec VALUE='$dvalue' SUSPENDED='no' TIME='$time' DATE='$date'"
104120
[ -n "$ttl" ] && dns_rec="$dns_rec TTL='$ttl'"
105121
# Deleting old record
@@ -135,7 +151,7 @@ $BIN/v-restart-dns "$restart"
135151
check_result $? "DNS restart failed" >/dev/null
136152

137153
# Logging
138-
$BIN/v-log-action "$user" "Info" "DNS" "DNS record value changed (Type: $type, Record: $record, Value: $dvalue, Domain: $domain)."
154+
$BIN/v-log-action "$user" "Info" "DNS" "DNS record value changed (Type: $rtype, Record: $record, Value: $dvalue, Domain: $domain)."
139155
log_event "$OK" "$ARGUMENTS"
140156

141157
exit

‎bin/v-check-user-hash‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
# Argument definition
1414
user=$1
1515
hash=$2; HIDE=2
16-
ip=${3-127.0.0.1}
16+
ip46=${3-127.0.0.1}
1717

1818
# Includes
1919
# shellcheck source=/etc/hestiacp/hestia.conf
@@ -32,7 +32,7 @@ date=$(echo "$time_n_date" |cut -f 2 -d \ )
3232
#----------------------------------------------------------#
3333

3434
check_args '2' "$#" 'USER HASH'
35-
is_format_valid 'user'
35+
is_format_valid 'user' 'ip46'
3636

3737
# Checking user
3838
if [ ! -d "$HESTIA/data/users/$user" ] && [ "$user" != 'root' ]; then
@@ -47,7 +47,7 @@ is_hash_valid
4747
# Checking empty hash
4848
if [[ -z "$hash" ]]; then
4949
echo "Error: password missmatch"
50-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
50+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
5151
exit 9
5252
fi
5353

@@ -68,7 +68,7 @@ then
6868
method='sha-512'
6969
else
7070
echo "Error: password missmatch"
71-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
71+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
7272
exit 9
7373
fi
7474
else
@@ -79,14 +79,14 @@ fi
7979
# Checking salt
8080
if [ -z "$salt" ]; then
8181
echo "Error: password missmatch"
82-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
82+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
8383
exit 9
8484
fi
8585

8686
# Comparing hashes
8787
if [[ "$shadow" != "$hash" ]]; then
8888
echo "Error: password missmatch"
89-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
89+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
9090
exit 9
9191
fi
9292

@@ -95,6 +95,6 @@ fi
9595
#----------------------------------------------------------#
9696

9797
# Logging
98-
echo "$date $time $user $ip successfully logged in" >> $HESTIA/log/auth.log
98+
echo "$date $time $user $ip46 successfully logged in" >> $HESTIA/log/auth.log
9999

100100
exit

‎bin/v-check-user-password‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@
1313
# Argument definition
1414
user=$1
1515
password=$2; HIDE=2
16-
ip=${3-127.0.0.1}
16+
ip46=${3-127.0.0.1}
17+
return_hash=${4-no}
1718

1819
# Includes
1920
# shellcheck source=/etc/hestiacp/hestia.conf
@@ -31,23 +32,20 @@ date=$(echo "$time_n_date" |cut -f 2 -d \ )
3132
# Verifications #
3233
#----------------------------------------------------------#
3334

34-
check_args '2' "$#" 'USER PASSWORD'
35-
is_format_valid 'user'
35+
check_args '2' "$#" 'USER PASSWORD [ip] [RETURN_HASH]'
36+
is_format_valid 'user' 'password' 'ip46'
3637

3738
# Checking user
3839
if [ ! -d "$HESTIA/data/users/$user" ] && [ "$user" != 'root' ]; then
3940
echo "Error: password missmatch"
40-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
41+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
4142
exit 9
4243
fi
4344

44-
# Checking user password
45-
is_password_valid
46-
4745
# Checking empty password
4846
if [[ -z "$password" ]]; then
4947
echo "Error: password missmatch"
50-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
48+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
5149
exit 9
5250
fi
5351

@@ -71,7 +69,7 @@ then
7169
method='sha-512'
7270
else
7371
echo "Error: password missmatch"
74-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
72+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
7573
exit 9
7674
fi
7775
else
@@ -81,7 +79,7 @@ fi
8179

8280
if [ -z "$salt" ]; then
8381
echo "Error: password missmatch"
84-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
82+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
8583
exit 9
8684
fi
8785

@@ -98,7 +96,7 @@ fi
9896
result=$(grep "^$user:$hash:" /etc/shadow 2>/dev/null)
9997
if [[ -z "$result" ]]; then
10098
echo "Error: password missmatch"
101-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
99+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
102100
exit 9
103101
fi
104102

@@ -107,6 +105,6 @@ fi
107105
#----------------------------------------------------------#
108106

109107
# Logging
110-
echo "$date $time $user $ip successfully logged in" >> $HESTIA/log/auth.log
108+
echo "$date $time $user $ip46 successfully logged in" >> $HESTIA/log/auth.log
111109

112110
exit

‎bin/v-get-user-salt‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212

1313
# Argument definition
1414
user=$1
15-
ip=${2-127.0.0.1}
15+
ip46=${2-127.0.0.1}
1616
format=${3-shell}
1717

1818
# Includes
@@ -63,13 +63,13 @@ csv_list() {
6363
#----------------------------------------------------------#
6464

6565

66-
check_args '1' "$#" 'USER [IP] [SALT]'
67-
is_format_valid 'user' 'ip'
66+
check_args '1' "$#" 'USER [IP] [FORMAT]'
67+
is_format_valid 'user' 'ip46'
6868

6969
# Checking user
7070
if [ ! -d "$HESTIA/data/users/$user" ]; then
7171
echo "Error: password missmatch"
72-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
72+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
7373
exit 9
7474
fi
7575

@@ -90,12 +90,12 @@ then
9090
method='sha-512'
9191
else
9292
echo "Error: password missmatch"
93-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
93+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
9494
exit 9
9595
fi
9696
elif [[ "$shadow" =~ ! ]]; then
9797
echo "Error: Account has been suspended"
98-
echo "$date $time $user $ip has been suspended" >> $HESTIA/log/auth.log
98+
echo "$date $time $user $ip46 has been suspended" >> $HESTIA/log/auth.log
9999
exit 5
100100
else
101101
salt=${shadow:0:2}
@@ -104,7 +104,7 @@ fi
104104

105105
if [ -z "$salt" ]; then
106106
echo "Error: password missmatch"
107-
echo "$date $time $user $ip failed to login" >> $HESTIA/log/auth.log
107+
echo "$date $time $user $ip46 failed to login" >> $HESTIA/log/auth.log
108108
exit 9
109109
fi
110110

‎func/domain.sh‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -512,9 +512,22 @@ update_domain_zone() {
512512
if [ "$TYPE" = 'CNAME' ] || [ "$TYPE" = 'MX' ]; then
513513
VALUE=$(idn --quiet -a -t "$VALUE")
514514
fi
515-
516-
if [ "$TYPE" = 'TXT' ] && [[ ${VALUE:0:1} != '"' ]]; then
517-
VALUE=$(echo $VALUE | fold -w 255 | xargs -I '$' echo -n '"$"')
515+
516+
if [ "$TYPE" = 'TXT' ]; then
517+
txtlength=${#VALUE}
518+
if [ $txtlength -gt 255 ]; then
519+
already_chunked=0
520+
if [[ $VALUE == *"\" \""* ]] || [[ $VALUE == *"\"\""* ]]; then
521+
already_chunked=1
522+
fi
523+
if [ $already_chunked -eq 0 ]; then
524+
if [[ ${VALUE:0:1} = '"' ]]; then
525+
txtlength=$(( $txtlength - 2 ))
526+
VALUE=${VALUE:1:txtlength}
527+
fi
528+
VALUE=$(echo $VALUE | fold -w 255 | xargs -I '$' echo -n '"$"')
529+
fi
530+
fi
518531
fi
519532

520533
if [ "$SUSPENDED" != 'yes' ]; then

‎func/main.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -876,7 +876,7 @@ is_common_format_valid() {
876876
}
877877

878878
is_no_new_line_format() {
879-
test=$(echo $1 | sed -e 's/\.*$//g' -e 's/^\.*//g');
879+
test=$(echo $1 | head -n1 );
880880
if [[ "$test" != "$1" ]]; then
881881
check_result "$E_INVALID" "invalid value :: $1"
882882
fi

‎install/hst-install-debian.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
3131
VERBOSE='no'
3232

3333
# Define software versions
34-
HESTIA_INSTALL_VER='1.5.13'
34+
HESTIA_INSTALL_VER='1.5.14'
3535
# Dependencies
3636
pma_v='5.1.3'
3737
rc_v="1.5.2"

‎install/hst-install-ubuntu.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ HESTIA_INSTALL_DIR="$HESTIA/install/deb"
3131
VERBOSE='no'
3232

3333
# Define software versions
34-
HESTIA_INSTALL_VER='1.5.13'
34+
HESTIA_INSTALL_VER='1.5.14'
3535
# Dependencies
3636
pma_v='5.1.3'
3737
rc_v="1.5.2"

0 commit comments

Comments
 (0)