Skip to content

Commit 9620bfb

Browse files
serghey-rodinserghey-rodin
committed
Merge pull request hestiacp#516 from Flatta/fix-sec-osci
[SECURITY] Fix OS command injection.
2 parents 070a62b + 8e951ac commit 9620bfb

File tree

115 files changed

+1338
-1978
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

115 files changed

+1338
-1978
lines changed

‎web/add/cron/autoupdate/index.php‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,12 @@
33
error_reporting(NULL);
44
ob_start();
55
session_start();
6-
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
6+
include($_SERVER['DOCUMENT_ROOT'].'/inc/main.php');
77

88
if ($_SESSION['user'] == 'admin') {
9-
exec (VESTA_CMD."v-add-cron-vesta-autoupdate", $output, $return_var);
9+
v_exec('v-add-cron-vesta-autoupdate', [], false);
1010
$_SESSION['error_msg'] = __('Autoupdate has been successfully enabled');
11-
unset($output);
1211
}
1312

14-
header("Location: /list/updates/");
13+
header('Location: /list/updates/');
1514
exit;

‎web/add/cron/index.php‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
// Check token
1414
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1515
header('location: /login/');
16-
exit();
16+
exit;
1717
}
1818

1919
// Check empty fields
@@ -35,18 +35,16 @@
3535
}
3636

3737
// Protect input
38-
$v_min = escapeshellarg($_POST['v_min']);
39-
$v_hour = escapeshellarg($_POST['v_hour']);
40-
$v_day = escapeshellarg($_POST['v_day']);
41-
$v_month = escapeshellarg($_POST['v_month']);
42-
$v_wday = escapeshellarg($_POST['v_wday']);
43-
$v_cmd = escapeshellarg($_POST['v_cmd']);
38+
$v_min = $_POST['v_min'];
39+
$v_hour = $_POST['v_hour'];
40+
$v_day = $_POST['v_day'];
41+
$v_month = $_POST['v_month'];
42+
$v_wday = $_POST['v_wday'];
43+
$v_cmd = $_POST['v_cmd'];
4444

4545
// Add cron job
4646
if (empty($_SESSION['error_msg'])) {
47-
exec (VESTA_CMD."v-add-cron-job ".$user." ".$v_min." ".$v_hour." ".$v_day." ".$v_month." ".$v_wday." ".$v_cmd, $output, $return_var);
48-
check_return_code($return_var,$output);
49-
unset($output);
47+
v_exec('v-add-cron-job', [$user, $v_min, $v_hour, $v_day, $v_month, $v_wday, $v_cmd]);
5048
}
5149

5250
// Flush field values on success
@@ -58,7 +56,6 @@
5856
unset($v_month);
5957
unset($v_wday);
6058
unset($v_cmd);
61-
unset($output);
6259
}
6360
}
6461

‎web/add/cron/reports/index.php‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,10 @@
33
error_reporting(NULL);
44
ob_start();
55
session_start();
6-
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
6+
include($_SERVER['DOCUMENT_ROOT'].'/inc/main.php');
77

8-
exec (VESTA_CMD."v-add-cron-reports ".$user, $output, $return_var);
8+
v_exec('v-add-cron-reports', [$user], false);
99
$_SESSION['error_msg'] = __('Cronjob email reporting has been successfully enabled');
10-
unset($output);
1110

12-
header("Location: /list/cron/");
11+
header('Location: /list/cron/');
1312
exit;

‎web/add/db/index.php‎

Lines changed: 21 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
// Check token
1313
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1414
header('location: /login/');
15-
exit();
15+
exit;
1616
}
1717

1818
// Check empty fields
@@ -30,7 +30,7 @@
3030
$error_msg = $error_msg.", ".$error;
3131
}
3232
}
33-
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
33+
$_SESSION['error_msg'] = __('Field "%s" can not be blank.', $error_msg);
3434
}
3535

3636
// Validate email
@@ -43,45 +43,36 @@
4343
// Check password length
4444
if (empty($_SESSION['error_msg'])) {
4545
$pw_len = strlen($_POST['v_password']);
46-
if ($pw_len < 6 ) $_SESSION['error_msg'] = __('Password is too short.',$error_msg);
46+
if ($pw_len < 6) $_SESSION['error_msg'] = __('Password is too short.', $error_msg);
4747
}
4848

49-
// Protect input
50-
$v_database = escapeshellarg($_POST['v_database']);
51-
$v_dbuser = escapeshellarg($_POST['v_dbuser']);
49+
$v_database = $_POST['v_database'];
50+
$v_dbuser = $_POST['v_dbuser'];
5251
$v_type = $_POST['v_type'];
5352
$v_charset = $_POST['v_charset'];
5453
$v_host = $_POST['v_host'];
5554
$v_db_email = $_POST['v_db_email'];
5655

5756
// Add database
5857
if (empty($_SESSION['error_msg'])) {
59-
$v_type = escapeshellarg($_POST['v_type']);
60-
$v_charset = escapeshellarg($_POST['v_charset']);
61-
$v_host = escapeshellarg($_POST['v_host']);
62-
$v_password = tempnam("/tmp","vst");
63-
$fp = fopen($v_password, "w");
58+
$v_password = tempnam('/tmp', 'vst');
59+
$fp = fopen($v_password, 'w');
6460
fwrite($fp, $_POST['v_password']."\n");
6561
fclose($fp);
66-
exec (VESTA_CMD."v-add-database ".$user." ".$v_database." ".$v_dbuser." ".$v_password." ".$v_type." ".$v_host." ".$v_charset, $output, $return_var);
67-
check_return_code($return_var,$output);
68-
unset($output);
62+
v_exec('v-add-database', [$user, $v_database, $v_dbuser, $v_password, $v_type, $v_host, $v_charset]);
6963
unlink($v_password);
70-
$v_password = escapeshellarg($_POST['v_password']);
71-
$v_type = $_POST['v_type'];
72-
$v_host = $_POST['v_host'];
73-
$v_charset = $_POST['v_charset'];
64+
$v_password = $_POST['v_password'];
7465
}
7566

7667
// Get database manager url
7768
if (empty($_SESSION['error_msg'])) {
78-
list($http_host, $port) = explode(':', $_SERVER["HTTP_HOST"] . ":");
69+
list($http_host, $port) = explode(':', $_SERVER['HTTP_HOST'] . ':');
7970
if ($_POST['v_host'] != 'localhost' ) $http_host = $_POST['v_host'];
80-
if ($_POST['v_type'] == 'mysql') $db_admin = "phpMyAdmin";
81-
if ($_POST['v_type'] == 'mysql') $db_admin_link = "http://".$http_host."/phpmyadmin/";
71+
if ($_POST['v_type'] == 'mysql') $db_admin = 'phpMyAdmin';
72+
if ($_POST['v_type'] == 'mysql') $db_admin_link = "http://$http_host/phpmyadmin/";
8273
if (($_POST['v_type'] == 'mysql') && (!empty($_SESSION['DB_PMA_URL']))) $db_admin_link = $_SESSION['DB_PMA_URL'];
83-
if ($_POST['v_type'] == 'pgsql') $db_admin = "phpPgAdmin";
84-
if ($_POST['v_type'] == 'pgsql') $db_admin_link = "http://".$http_host."/phppgadmin/";
74+
if ($_POST['v_type'] == 'pgsql') $db_admin = 'phpPgAdmin';
75+
if ($_POST['v_type'] == 'pgsql') $db_admin_link = "http://$http_host/phppgadmin/";
8576
if (($_POST['v_type'] == 'pgsql') && (!empty($_SESSION['DB_PGA_URL']))) $db_admin_link = $_SESSION['DB_PGA_URL'];
8677
}
8778

@@ -90,15 +81,15 @@
9081
$to = $v_db_email;
9182
$subject = __("Database Credentials");
9283
$hostname = exec('hostname');
93-
$from = __('MAIL_FROM',$hostname);
94-
$mailtext = __('DATABASE_READY',$user."_".$_POST['v_database'],$user."_".$_POST['v_dbuser'],$_POST['v_password'],$db_admin_link);
84+
$from = __('MAIL_FROM', $hostname);
85+
$mailtext = __('DATABASE_READY', $user.'_'.$_POST['v_database'], $user.'_'.$_POST['v_dbuser'], $_POST['v_password'], $db_admin_link);
9586
send_email($to, $subject, $mailtext, $from);
9687
}
9788

9889
// Flush field values on success
9990
if (empty($_SESSION['error_msg'])) {
100-
$_SESSION['ok_msg'] = __('DATABASE_CREATED_OK',htmlentities($user)."_".htmlentities($_POST['v_database']),htmlentities($user)."_".htmlentities($_POST['v_database']));
101-
$_SESSION['ok_msg'] .= " / <a href=".$db_admin_link." target='_blank'>" . __('open %s',$db_admin) . "</a>";
91+
$_SESSION['ok_msg'] = __('DATABASE_CREATED_OK', htmlentities($user.'_'.$_POST['v_database']), htmlentities($user.'_'.$_POST['v_database']));
92+
$_SESSION['ok_msg'] .= " / <a href=$db_admin_link target='_blank'>" . __('open %s', $db_admin) . '</a>';
10293
unset($v_database);
10394
unset($v_dbuser);
10495
unset($v_password);
@@ -117,16 +108,15 @@
117108
$v_db_email = $panel[$user]['CONTACT'];
118109

119110
// List avaiable database types
120-
$db_types = split(",",$_SESSION['DB_SYSTEM']);
111+
$db_types = explode(',', $_SESSION['DB_SYSTEM']);
121112

122113
// List available database servers
123114
$db_hosts = array();
124115
foreach ($db_types as $db_type ) {
125-
exec (VESTA_CMD."v-list-database-hosts ".$db_type." 'json'", $output, $return_var);
126-
$db_hosts_tmp = json_decode(implode('', $output), true);
116+
v_exec('v-list-database-hosts', [$db_type, 'json'], false, $output);
117+
$db_hosts_tmp = json_decode($output, true);
127118
$db_hosts = array_merge($db_hosts, $db_hosts_tmp);
128119
unset($db_hosts_tmp);
129-
unset($output);
130120
}
131121

132122
// Display body

‎web/add/dns/index.php‎

Lines changed: 26 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
// Check token
1414
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1515
header('location: /login/');
16-
exit();
16+
exit;
1717
}
1818

1919
// Check empty fields
@@ -32,56 +32,47 @@
3232

3333
// Protect input
3434
$v_domain = preg_replace("/^www./i", "", $_POST['v_domain']);
35-
$v_domain = escapeshellarg($v_domain);
3635
$v_domain = strtolower($v_domain);
37-
$v_ip = escapeshellarg($_POST['v_ip']);
38-
if (!empty($_POST['v_ns1'])) $v_ns1 = escapeshellarg($_POST['v_ns1']);
39-
if (!empty($_POST['v_ns2'])) $v_ns2 = escapeshellarg($_POST['v_ns2']);
40-
if (!empty($_POST['v_ns3'])) $v_ns3 = escapeshellarg($_POST['v_ns3']);
41-
if (!empty($_POST['v_ns4'])) $v_ns4 = escapeshellarg($_POST['v_ns4']);
42-
if (!empty($_POST['v_ns5'])) $v_ns5 = escapeshellarg($_POST['v_ns5']);
43-
if (!empty($_POST['v_ns6'])) $v_ns6 = escapeshellarg($_POST['v_ns6']);
44-
if (!empty($_POST['v_ns7'])) $v_ns7 = escapeshellarg($_POST['v_ns7']);
45-
if (!empty($_POST['v_ns8'])) $v_ns8 = escapeshellarg($_POST['v_ns8']);
36+
$v_ip = $_POST['v_ip'];
37+
if (!empty($_POST['v_ns1'])) $v_ns1 = $_POST['v_ns1'];
38+
if (!empty($_POST['v_ns2'])) $v_ns2 = $_POST['v_ns2'];
39+
if (!empty($_POST['v_ns3'])) $v_ns3 = $_POST['v_ns3'];
40+
if (!empty($_POST['v_ns4'])) $v_ns4 = $_POST['v_ns4'];
41+
if (!empty($_POST['v_ns5'])) $v_ns5 = $_POST['v_ns5'];
42+
if (!empty($_POST['v_ns6'])) $v_ns6 = $_POST['v_ns6'];
43+
if (!empty($_POST['v_ns7'])) $v_ns7 = $_POST['v_ns7'];
44+
if (!empty($_POST['v_ns8'])) $v_ns8 = $_POST['v_ns8'];
4645

4746
// Add dns domain
4847
if (empty($_SESSION['error_msg'])) {
49-
exec (VESTA_CMD."v-add-dns-domain ".$user." ".$v_domain." ".$v_ip." ".$v_ns1." ".$v_ns2." ".$v_ns3." ".$v_ns4." ".$v_ns5." ".$v_ns6." ".$v_ns7." ".$v_ns8." no", $output, $return_var);
50-
check_return_code($return_var,$output);
51-
unset($output);
48+
v_exec('v-add-dns-domain', [$user, $v_domain, $v_ip, $v_ns1, $v_ns2, $v_ns3, $v_ns4, $v_ns5, $v_ns6, $v_ns7, $v_ns8, 'no']);
5249
}
5350

5451

5552
// Set expiriation date
5653
if (empty($_SESSION['error_msg'])) {
5754
if ((!empty($_POST['v_exp'])) && ($_POST['v_exp'] != date('Y-m-d', strtotime('+1 year')))) {
58-
$v_exp = escapeshellarg($_POST['v_exp']);
59-
exec (VESTA_CMD."v-change-dns-domain-exp ".$user." ".$v_domain." ".$v_exp." no", $output, $return_var);
60-
check_return_code($return_var,$output);
61-
unset($output);
55+
$v_exp = $_POST['v_exp'];
56+
v_exec('v-change-dns-domain-exp', [$user, $v_domain, $v_exp, 'no']);
6257
}
6358
}
6459

6560
// Set ttl
6661
if (empty($_SESSION['error_msg'])) {
6762
if ((!empty($_POST['v_ttl'])) && ($_POST['v_ttl'] != '14400') && (empty($_SESSION['error_msg']))) {
68-
$v_ttl = escapeshellarg($_POST['v_ttl']);
69-
exec (VESTA_CMD."v-change-dns-domain-ttl ".$user." ".$v_domain." ".$v_ttl." no", $output, $return_var);
70-
check_return_code($return_var,$output);
71-
unset($output);
63+
$v_ttl = $_POST['v_ttl'];
64+
v_exec('v-change-dns-domain-ttl', [$user, $v_domain, $v_ttl, 'no']);
7265
}
7366
}
7467

7568
// Restart dns server
7669
if (empty($_SESSION['error_msg'])) {
77-
exec (VESTA_CMD."v-restart-dns", $output, $return_var);
78-
check_return_code($return_var,$output);
79-
unset($output);
70+
v_exec('v-restart-dns');
8071
}
8172

8273
// Flush field values on success
8374
if (empty($_SESSION['error_msg'])) {
84-
$_SESSION['ok_msg'] = __('DNS_DOMAIN_CREATED_OK',htmlentities($_POST[v_domain]),htmlentities($_POST[v_domain]));
75+
$_SESSION['ok_msg'] = __('DNS_DOMAIN_CREATED_OK', htmlentities($_POST[v_domain]), htmlentities($_POST[v_domain]));
8576
unset($v_domain);
8677
}
8778
}
@@ -93,7 +84,7 @@
9384
// Check token
9485
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
9586
header('location: /login/');
96-
exit();
87+
exit;
9788
}
9889

9990
// Check empty fields
@@ -113,18 +104,15 @@
113104
}
114105

115106
// Protect input
116-
$v_domain = escapeshellarg($_POST['v_domain']);
117-
$v_rec = escapeshellarg($_POST['v_rec']);
118-
$v_type = escapeshellarg($_POST['v_type']);
119-
$v_val = escapeshellarg($_POST['v_val']);
120-
$v_priority = escapeshellarg($_POST['v_priority']);
107+
$v_domain = $_POST['v_domain'];
108+
$v_rec = $_POST['v_rec'];
109+
$v_type = $_POST['v_type'];
110+
$v_val = $_POST['v_val'];
111+
$v_priority = $_POST['v_priority'];
121112

122113
// Add dns record
123114
if (empty($_SESSION['error_msg'])) {
124-
exec (VESTA_CMD."v-add-dns-record ".$user." ".$v_domain." ".$v_rec." ".$v_type." ".$v_val." ".$v_priority, $output, $return_var);
125-
check_return_code($return_var,$output);
126-
unset($output);
127-
$v_type = $_POST['v_type'];
115+
v_exec('v-add-dns-record', [$user, $v_domain, $v_rec, $v_type, $v_val, $v_priority]);
128116
}
129117

130118
// Flush field values on success
@@ -159,8 +147,8 @@
159147
if (empty($v_ttl)) $v_ttl = 14400;
160148
if (empty($v_exp)) $v_exp = date('Y-m-d', strtotime('+1 year'));
161149
if (empty($v_ns1)) {
162-
exec (VESTA_CMD."v-list-user-ns ".$user." json", $output, $return_var);
163-
$nameservers = json_decode(implode('', $output), true);
150+
v_exec('v-list-user-ns', [$user, 'json'], false, $output);
151+
$nameservers = json_decode($output, true);
164152
$v_ns1 = str_replace("'", "", $nameservers[0]);
165153
$v_ns2 = str_replace("'", "", $nameservers[1]);
166154
$v_ns3 = str_replace("'", "", $nameservers[2]);
@@ -169,7 +157,6 @@
169157
$v_ns6 = str_replace("'", "", $nameservers[5]);
170158
$v_ns7 = str_replace("'", "", $nameservers[6]);
171159
$v_ns8 = str_replace("'", "", $nameservers[7]);
172-
unset($output);
173160
}
174161
include($_SERVER['DOCUMENT_ROOT'].'/templates/admin/add_dns.html');
175162
}

‎web/add/favorite/index.php‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,13 @@
99
// Check token
1010
// if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1111
// header('location: /login/');
12-
// exit();
12+
// exit;
1313
// }
1414

15-
// Protect input
16-
$v_section = escapeshellarg($_REQUEST['v_section']);
17-
$v_unit_id = escapeshellarg($_REQUEST['v_unit_id']);
15+
$v_section = $_REQUEST['v_section'];
16+
$v_unit_id = $_REQUEST['v_unit_id'];
1817

19-
$_SESSION['favourites'][strtoupper($_REQUEST['v_section'])][$_REQUEST['v_unit_id']] = 1;
18+
$_SESSION['favourites'][strtoupper((string)$v_section)][(string)$v_unit_id] = 1;
2019

21-
exec (VESTA_CMD."v-add-user-favourites ".$_SESSION['user']." ".$v_section." ".$v_unit_id, $output, $return_var);
22-
// check_return_code($return_var,$output);
20+
v_exec('v-add-user-favourites', [$_SESSION['user'], $v_section, $v_unit_id], false/*true*/);
2321
?>

‎web/add/firewall/banlist/index.php‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,12 @@
3131
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
3232
}
3333

34-
// Protect input
35-
$v_chain = escapeshellarg($_POST['v_chain']);
36-
$v_ip = escapeshellarg($_POST['v_ip']);
34+
$v_chain = $_POST['v_chain'];
35+
$v_ip = $_POST['v_ip'];
3736

3837
// Add firewall ban
3938
if (empty($_SESSION['error_msg'])) {
40-
exec (VESTA_CMD."v-add-firewall-ban ".$v_ip." ".$v_chain, $output, $return_var);
41-
check_return_code($return_var,$output);
42-
unset($output);
39+
v_exec('v-add-firewall-ban', [$v_ip, $v_chain]);
4340
}
4441

4542
// Flush field values on success

0 commit comments

Comments
 (0)