Skip to content

Commit 757e065

Browse files
author
Serghey Rodin
committed
security fix / thanks to Christopher Tarquini
1 parent ba14a64 commit 757e065

File tree

636 files changed

+680
-637
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

636 files changed

+680
-637
lines changed

‎bin/v-add-web-domain-stats-user‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: add password protection to web domain statistics
3-
# options: USER DOMAIN STATS_USER STATS_PASSWORD
3+
# options: USER DOMAIN STATS_USER STATS_PASSWORD [RESTART]
44
#
55
# The call is used for securing the web statistics page.
66

@@ -14,6 +14,7 @@ user=$1
1414
domain=$2
1515
stats_user=$3
1616
password=$4; HIDE=4
17+
restart=$5
1718

1819
# Includes
1920
source $VESTA/func/main.sh
@@ -25,7 +26,7 @@ source $VESTA/conf/vesta.conf
2526
# Verifications #
2627
#----------------------------------------------------------#
2728

28-
check_args '4' "$#" 'USER DOMAIN STATS_USER STATS_PASS'
29+
check_args '4' "$#" 'USER DOMAIN STATS_USER STATS_PASS [RESTART]'
2930
is_format_valid 'user' 'domain' 'stats_user'
3031
is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
3132
is_object_valid 'user' 'USER' "$user"
@@ -41,11 +42,12 @@ is_password_valid
4142

4243
# Defining statistic dir
4344
stats_dir="$HOMEDIR/$user/web/$domain/stats"
45+
conf_dir="$HOMEDIR/$user/conf/web"
4446

4547
# Adding htaccess file
4648
if [ "$WEB_SYSTEM" = 'nginx' ]; then
47-
echo "auth_basic \"Web Statistics\";" > $stats_dir/auth.conf
48-
echo "auth_basic_user_file $stats_dir/.htpasswd;" >> $stats_dir/auth.conf
49+
echo "auth_basic \"Web Statistics\";" > $conf_dir/$domain.auth
50+
echo "auth_basic_user_file $stats_dir/.htpasswd;" >> $conf_dir/$domain.auth
4951
else
5052
echo "AuthUserFile $stats_dir/.htpasswd" > $stats_dir/.htaccess
5153
echo "AuthName \"Web Statistics\"" >> $stats_dir/.htaccess
@@ -67,6 +69,12 @@ echo "$stats_user:$stats_pass" > $stats_dir/.htpasswd
6769
update_object_value 'web' 'DOMAIN' "$domain" '$STATS_USER' "$stats_user"
6870
update_object_value 'web' 'DOMAIN' "$domain" '$STATS_CRYPT' "$stats_pass"
6971

72+
# Restarting web server
73+
if [ "$WEB_SYSTEM" = 'nginx' ]; then
74+
$BIN/v-restart-web $restart
75+
check_result $? "Web restart failed" >/dev/null
76+
fi
77+
7078
# Logging
7179
log_history "added password protection for web stats on $domain"
7280
log_event "$OK" "$ARGUMENTS"

‎bin/v-delete-web-domain-stats-user‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: disable webdomain stats authentication support
3-
# options: USER DOMAIN
3+
# options: USER DOMAIN [RESTART]
44
#
55
# The function removes authentication of statistics system. If the script is
66
# called without naming a certain user, all users will be removed. After
@@ -15,6 +15,7 @@
1515
# Argument definition
1616
user=$1
1717
domain=$(idn -t --quiet -u "$2" )
18+
restart=$3
1819

1920
# Includes
2021
source $VESTA/func/main.sh
@@ -26,7 +27,7 @@ source $VESTA/conf/vesta.conf
2627
# Verifications #
2728
#----------------------------------------------------------#
2829

29-
check_args '2' "$#" 'USER DOMAIN'
30+
check_args '2' "$#" 'USER DOMAIN [RESTART]'
3031
is_format_valid 'user' 'domain'
3132
is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
3233
is_object_valid 'user' 'USER' "$user"
@@ -44,6 +45,14 @@ is_object_value_exist 'web' 'DOMAIN' "$domain" '$STATS_USER'
4445
rm -f $HOMEDIR/$user/web/$domain/stats/.htpasswd
4546
rm -f $HOMEDIR/$user/web/$domain/stats/.htaccess
4647

48+
# Deleting nginx auth config
49+
if [ "$WEB_SYSTEM" = 'nginx' ]; then
50+
conf_dir="$HOMEDIR/$user/conf/web"
51+
rm -f $conf_dir/$domain.auth 2>/dev/null
52+
$BIN/v-restart-web $restart
53+
check_result $? "Web restart failed" >/dev/null
54+
fi
55+
4756

4857
#----------------------------------------------------------#
4958
# Vesta #

‎bin/v-rebuild-web-domains‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ fi
6161
for domain in $($BIN/v-list-web-domains $user plain |cut -f 1); do
6262
if [ ! -z "$WEB_BACKEND" ]; then
6363
template=$(get_object_value 'web' 'DOMAIN' "$domain" '$BACKEND')
64-
$BIN/v-add-web-domain-backend $user $domain $template
64+
$BIN/v-add-web-domain-backend $user $domain $template $restart
6565
fi
6666
rebuild_web_domain_conf
6767
done

‎install/debian/7/templates/web/nginx/php5-fpm/cms_made_simple.stpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ server {
4545

4646
location /vstats/ {
4747
alias %home%/%user%/web/%domain%/stats/;
48-
include %home%/%user%/web/%domain%/stats/auth.conf*;
48+
include %home%/%user%/conf/web/%domain%.auth
4949
}
5050

5151
include /etc/nginx/conf.d/phpmyadmin.inc*;

‎install/debian/7/templates/web/nginx/php5-fpm/cms_made_simple.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ server {
4141

4242
location /vstats/ {
4343
alias %home%/%user%/web/%domain%/stats/;
44-
include %home%/%user%/web/%domain%/stats/auth.conf*;
44+
include %home%/%user%/conf/web/%domain%.auth
4545
}
4646

4747
include /etc/nginx/conf.d/phpmyadmin.inc*;

‎install/debian/7/templates/web/nginx/php5-fpm/codeigniter2.stpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ server {
5050

5151
location /vstats/ {
5252
alias %home%/%user%/web/%domain%/stats/;
53-
include %home%/%user%/web/%domain%/stats/auth.conf*;
53+
include %home%/%user%/conf/web/%domain%.auth
5454
}
5555

5656
include /etc/nginx/conf.d/phpmyadmin.inc*;

‎install/debian/7/templates/web/nginx/php5-fpm/codeigniter2.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ server {
4646

4747
location /vstats/ {
4848
alias %home%/%user%/web/%domain%/stats/;
49-
include %home%/%user%/web/%domain%/stats/auth.conf*;
49+
include %home%/%user%/conf/web/%domain%.auth
5050
}
5151

5252
include /etc/nginx/conf.d/phpmyadmin.inc*;

‎install/debian/7/templates/web/nginx/php5-fpm/codeigniter3.stpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ server {
4545

4646
location /vstats/ {
4747
alias %home%/%user%/web/%domain%/stats/;
48-
include %home%/%user%/web/%domain%/stats/auth.conf*;
48+
include %home%/%user%/conf/web/%domain%.auth
4949
}
5050

5151
include /etc/nginx/conf.d/phpmyadmin.inc*;

‎install/debian/7/templates/web/nginx/php5-fpm/codeigniter3.tpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ server {
4141

4242
location /vstats/ {
4343
alias %home%/%user%/web/%domain%/stats/;
44-
include %home%/%user%/web/%domain%/stats/auth.conf*;
44+
include %home%/%user%/conf/web/%domain%.auth
4545
}
4646

4747
include /etc/nginx/conf.d/phpmyadmin.inc*;

‎install/debian/7/templates/web/nginx/php5-fpm/datalife_engine.stpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ server {
116116

117117
location /vstats/ {
118118
alias %home%/%user%/web/%domain%/stats/;
119-
include %home%/%user%/web/%domain%/stats/auth.conf*;
119+
include %home%/%user%/conf/web/%domain%.auth
120120
}
121121

122122
include /etc/nginx/conf.d/phpmyadmin.inc*;

0 commit comments

Comments
 (0)