Skip to content

Commit a3d2ae4

Browse files
author
Kristan Kenney
committed
Fix domain CLI argument parsing
- escaping global variables led to double single quotes and overidden parsed domain state - moved shell argument escaping on command execution thanks @Lupul hestiacp#261
1 parent deb4e33 commit a3d2ae4

File tree

2 files changed

+136
-105
lines changed

2 files changed

+136
-105
lines changed

‎web/edit/mail/index.php‎

Lines changed: 57 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,26 @@
1818
}
1919
$v_username = $user;
2020

21+
// Get all user domains
22+
exec (HESTIA_CMD."v-list-mail-domains ".escapeshellarg($user)." json", $output, $return_var);
23+
$user_domains = json_decode(implode('', $output), true);
24+
$user_domains = array_keys($user_domains);
25+
unset($output);
26+
2127
// List mail domain
22-
if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
23-
$v_domain = escapeshellarg($_GET['domain']);
24-
exec (HESTIA_CMD."v-list-mail-domain ".$user." ".$v_domain." json", $output, $return_var);
28+
if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
29+
30+
$v_domain = $_GET['domain'];
31+
if(!in_array($v_domain, $user_domains)) {
32+
header("Location: /list/mail/");
33+
exit;
34+
}
35+
36+
exec (HESTIA_CMD."v-list-mail-domain ".$user." ".escapeshellarg($v_domain)." json", $output, $return_var);
2537
$data = json_decode(implode('', $output), true);
2638
unset($output);
2739

2840
// Parse domain
29-
$v_domain = escapeshellarg($_GET['domain']);
3041
$v_antispam = $data[$v_domain]['ANTISPAM'];
3142
$v_antivirus = $data[$v_domain]['ANTIVIRUS'];
3243
$v_dkim = $data[$v_domain]['DKIM'];
@@ -42,17 +53,21 @@
4253
}
4354

4455
// List mail account
45-
if ((!empty($_GET['domain'])) && (!empty($_GET['account']))) {
46-
$v_domain = escapeshellarg($_GET['domain']);
47-
$v_account = escapeshellarg($_GET['account']);
48-
exec (HESTIA_CMD."v-list-mail-account ".$user." ".$v_domain." ".$v_account." 'json'", $output, $return_var);
56+
if ((!empty($_GET['domain'])) && (!empty($_GET['account']))) {
57+
58+
$v_domain = $_GET['domain'];
59+
if(!in_array($v_domain, $user_domains)) {
60+
header("Location: /list/mail/");
61+
exit;
62+
}
63+
64+
$v_account = $_GET['account'];
65+
exec (HESTIA_CMD."v-list-mail-account ".$user." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." 'json'", $output, $return_var);
4966
$data = json_decode(implode('', $output), true);
5067
unset($output);
5168

5269
// Parse mail account
5370
$v_username = $user;
54-
$v_domain = escapeshellarg($_GET['domain']);
55-
$v_account = escapeshellarg($_GET['account']);
5671
$v_password = "";
5772
$v_aliases = str_replace(',', "\n", $data[$v_account]['ALIAS']);
5873
$valiases = explode(",", $data[$v_account]['ALIAS']);
@@ -72,7 +87,7 @@
7287

7388
// Parse autoreply
7489
if ( $v_autoreply == 'yes' ) {
75-
exec (HESTIA_CMD."v-list-mail-account-autoreply ".$user." '".$v_domain."' '".$v_account."' json", $output, $return_var);
90+
exec (HESTIA_CMD."v-list-mail-account-autoreply ".$user." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." json", $output, $return_var);
7691
$autoreply_str = json_decode(implode('', $output), true);
7792
unset($output);
7893
$v_autoreply_message = $autoreply_str[$v_account]['MSG'];
@@ -83,7 +98,10 @@
8398

8499
// Check POST request for mail domain
85100
if ((!empty($_POST['save'])) && (!empty($_GET['domain'])) && (empty($_GET['account']))) {
86-
$v_domain = escapeshellarg($_POST['v_domain']);
101+
$v_domain = $_POST['v_domain'];
102+
if(!in_array($v_domain, $user_domains)) {
103+
check_return_code(3, ["Unknown domain"]);
104+
}
87105

88106
// Check token
89107
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
@@ -93,55 +111,55 @@
93111

94112
// Delete antispam
95113
if (($v_antispam == 'yes') && (empty($_POST['v_antispam'])) && (empty($_SESSION['error_msg']))) {
96-
exec (HESTIA_CMD."v-delete-mail-domain-antispam ".$v_username." ".$v_domain, $output, $return_var);
114+
exec (HESTIA_CMD."v-delete-mail-domain-antispam ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);
97115
check_return_code($return_var,$output);
98116
$v_antispam = 'no';
99117
unset($output);
100118
}
101119

102120
// Add antispam
103121
if (($v_antispam == 'no') && (!empty($_POST['v_antispam'])) && (empty($_SESSION['error_msg']))) {
104-
exec (HESTIA_CMD."v-add-mail-domain-antispam ".$v_username." ".$v_domain, $output, $return_var);
122+
exec (HESTIA_CMD."v-add-mail-domain-antispam ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);
105123
check_return_code($return_var,$output);
106124
$v_antispam = 'yes';
107125
unset($output);
108126
}
109127

110128
// Delete antivirus
111129
if (($v_antivirus == 'yes') && (empty($_POST['v_antivirus'])) && (empty($_SESSION['error_msg']))) {
112-
exec (HESTIA_CMD."v-delete-mail-domain-antivirus ".$v_username." ".$v_domain, $output, $return_var);
130+
exec (HESTIA_CMD."v-delete-mail-domain-antivirus ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);
113131
check_return_code($return_var,$output);
114132
$v_antivirus = 'no';
115133
unset($output);
116134
}
117135

118136
// Add antivirs
119137
if (($v_antivirus == 'no') && (!empty($_POST['v_antivirus'])) && (empty($_SESSION['error_msg']))) {
120-
exec (HESTIA_CMD."v-add-mail-domain-antivirus ".$v_username." ".$v_domain, $output, $return_var);
138+
exec (HESTIA_CMD."v-add-mail-domain-antivirus ".$v_username." ".$escapeshellarg($v_domain), $output, $return_var);
121139
check_return_code($return_var,$output);
122140
$v_antivirus = 'yes';
123141
unset($output);
124142
}
125143

126144
// Delete DKIM
127145
if (($v_dkim == 'yes') && (empty($_POST['v_dkim'])) && (empty($_SESSION['error_msg']))) {
128-
exec (HESTIA_CMD."v-delete-mail-domain-dkim ".$v_username." ".$v_domain, $output, $return_var);
146+
exec (HESTIA_CMD."v-delete-mail-domain-dkim ".$v_username." ".$escapeshellarg($v_domain), $output, $return_var);
129147
check_return_code($return_var,$output);
130148
$v_dkim = 'no';
131149
unset($output);
132150
}
133151

134152
// Add DKIM
135153
if (($v_dkim == 'no') && (!empty($_POST['v_dkim'])) && (empty($_SESSION['error_msg']))) {
136-
exec (HESTIA_CMD."v-add-mail-domain-dkim ".$v_username." ".$v_domain, $output, $return_var);
154+
exec (HESTIA_CMD."v-add-mail-domain-dkim ".$v_username." ".$escapeshellarg($v_domain), $output, $return_var);
137155
check_return_code($return_var,$output);
138156
$v_dkim = 'yes';
139157
unset($output);
140158
}
141159

142160
// Delete catchall
143161
if ((!empty($v_catchall)) && (empty($_POST['v_catchall'])) && (empty($_SESSION['error_msg']))) {
144-
exec (HESTIA_CMD."v-delete-mail-domain-catchall ".$v_username." ".$v_domain, $output, $return_var);
162+
exec (HESTIA_CMD."v-delete-mail-domain-catchall ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);
145163
check_return_code($return_var,$output);
146164
$v_catchall = '';
147165
unset($output);
@@ -151,7 +169,7 @@
151169
if ((!empty($v_catchall)) && (!empty($_POST['v_catchall'])) && (empty($_SESSION['error_msg']))) {
152170
if ($v_catchall != $_POST['v_catchall']) {
153171
$v_catchall = escapeshellarg($_POST['v_catchall']);
154-
exec (HESTIA_CMD."v-change-mail-domain-catchall ".$v_username." ".$v_domain." ".$v_catchall, $output, $return_var);
172+
exec (HESTIA_CMD."v-change-mail-domain-catchall ".$v_username." ".escapeshellarg($v_domain)." ".$v_catchall, $output, $return_var);
155173
check_return_code($return_var,$output);
156174
unset($output);
157175
}
@@ -160,7 +178,7 @@
160178
// Add catchall
161179
if ((empty($v_catchall)) && (!empty($_POST['v_catchall'])) && (empty($_SESSION['error_msg']))) {
162180
$v_catchall = escapeshellarg($_POST['v_catchall']);
163-
exec (HESTIA_CMD."v-add-mail-domain-catchall ".$v_username." ".$v_domain." ".$v_catchall, $output, $return_var);
181+
exec (HESTIA_CMD."v-add-mail-domain-catchall ".$v_username." ".escapeshellarg($v_domain)." ".$v_catchall, $output, $return_var);
164182
check_return_code($return_var,$output);
165183
unset($output);
166184
}
@@ -187,8 +205,12 @@
187205
}
188206
}
189207

190-
$v_domain = escapeshellarg($_POST['v_domain']);
191-
$v_account = escapeshellarg($_POST['v_account']);
208+
$v_domain = $_POST['v_domain'];
209+
if(!in_array($v_domain, $user_domains)) {
210+
check_return_code(3, ["Unknown domain"]);
211+
}
212+
213+
$v_account = $_POST['v_account'];
192214
$v_send_email = $_POST['v_send_email'];
193215
$v_credentials = $_POST['v_credentials'];
194216

@@ -198,7 +220,7 @@
198220
$fp = fopen($v_password, "w");
199221
fwrite($fp, $_POST['v_password']."\n");
200222
fclose($fp);
201-
exec (HESTIA_CMD."v-change-mail-account-password ".$v_username." ".$v_domain." ".$v_account." ".$v_password, $output, $return_var);
223+
exec (HESTIA_CMD."v-change-mail-account-password ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".$v_password, $output, $return_var);
202224
check_return_code($return_var,$output);
203225
unset($output);
204226
unlink($v_password);
@@ -212,14 +234,14 @@
212234
} else {
213235
$v_quota = escapeshellarg($_POST['v_quota']);
214236
}
215-
exec (HESTIA_CMD."v-change-mail-account-quota ".$v_username." ".$v_domain." ".$v_account." ".$v_quota, $output, $return_var);
237+
exec (HESTIA_CMD."v-change-mail-account-quota ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".$v_quota, $output, $return_var);
216238
check_return_code($return_var,$output);
217239
unset($output);
218240
}
219241

220242
// Change account aliases
221243
if (empty($_SESSION['error_msg'])) {
222-
$waliases = preg_replace("/\n/", " ", escapeshellarg($_POST['v_aliases']));
244+
$waliases = preg_replace("/\n/", " ", $_POST['v_aliases']);
223245
$waliases = preg_replace("/,/", " ", $waliases);
224246
$waliases = preg_replace('/\s+/', ' ',$waliases);
225247
$waliases = trim($waliases);
@@ -228,15 +250,15 @@
228250
$result = array_diff($valiases, $aliases);
229251
foreach ($result as $alias) {
230252
if ((empty($_SESSION['error_msg'])) && (!empty($alias))) {
231-
exec (HESTIA_CMD."v-delete-mail-account-alias ".$v_username." ".$v_domain." ".$v_account." '".$alias."'", $output, $return_var);
253+
exec (HESTIA_CMD."v-delete-mail-account-alias ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".escapeshellarg($alias), $output, $return_var);
232254
check_return_code($return_var,$output);
233255
unset($output);
234256
}
235257
}
236258
$result = array_diff($aliases, $valiases);
237259
foreach ($result as $alias) {
238260
if ((empty($_SESSION['error_msg'])) && (!empty($alias))) {
239-
exec (HESTIA_CMD."v-add-mail-account-alias ".$v_username." ".$v_domain." ".$v_account." ".escapeshellarg($alias), $output, $return_var);
261+
exec (HESTIA_CMD."v-add-mail-account-alias ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".escapeshellarg($alias), $output, $return_var);
240262
check_return_code($return_var,$output);
241263
unset($output);
242264
}
@@ -245,7 +267,7 @@
245267

246268
// Change forwarders
247269
if (empty($_SESSION['error_msg'])) {
248-
$wfwd = preg_replace("/\n/", " ", escapeshellarg($_POST['v_fwd']));
270+
$wfwd = preg_replace("/\n/", " ", $_POST['v_fwd']);
249271
$wfwd = preg_replace("/,/", " ", $wfwd);
250272
$wfwd = preg_replace('/\s+/', ' ',$wfwd);
251273
$wfwd = trim($wfwd);
@@ -254,15 +276,15 @@
254276
$result = array_diff($vfwd, $fwd);
255277
foreach ($result as $forward) {
256278
if ((empty($_SESSION['error_msg'])) && (!empty($forward))) {
257-
exec (HESTIA_CMD."v-delete-mail-account-forward ".$v_username." ".$v_domain." ".$v_account." '".$forward."'", $output, $return_var);
279+
exec (HESTIA_CMD."v-delete-mail-account-forward ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".escapeshellarg($forward), $output, $return_var);
258280
check_return_code($return_var,$output);
259281
unset($output);
260282
}
261283
}
262284
$result = array_diff($fwd, $vfwd);
263285
foreach ($result as $forward) {
264286
if ((empty($_SESSION['error_msg'])) && (!empty($forward))) {
265-
exec (HESTIA_CMD."v-add-mail-account-forward ".$v_username." ".$v_domain." ".$v_account." ".escapeshellarg($forward), $output, $return_var);
287+
exec (HESTIA_CMD."v-add-mail-account-forward ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".escapeshellarg($forward), $output, $return_var);
266288
check_return_code($return_var,$output);
267289
unset($output);
268290
}
@@ -271,23 +293,23 @@
271293

272294
// Delete FWD_ONLY flag
273295
if (($v_fwd_only == 'yes') && (empty($_POST['v_fwd_only'])) && (empty($_SESSION['error_msg']))) {
274-
exec (HESTIA_CMD."v-delete-mail-account-fwd-only ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
296+
exec (HESTIA_CMD."v-delete-mail-account-fwd-only ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account), $output, $return_var);
275297
check_return_code($return_var,$output);
276298
unset($output);
277299
$v_fwd_only = '';
278300
}
279301

280302
// Add FWD_ONLY flag
281303
if (($v_fwd_only != 'yes') && (!empty($_POST['v_fwd_only'])) && (empty($_SESSION['error_msg']))) {
282-
exec (HESTIA_CMD."v-add-mail-account-fwd-only ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
304+
exec (HESTIA_CMD."v-add-mail-account-fwd-only ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account), $output, $return_var);
283305
check_return_code($return_var,$output);
284306
unset($output);
285307
$v_fwd_only = 'yes';
286308
}
287309

288310
// Delete autoreply
289311
if (($v_autoreply == 'yes') && (empty($_POST['v_autoreply'])) && (empty($_SESSION['error_msg']))) {
290-
exec (HESTIA_CMD."v-delete-mail-account-autoreply ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
312+
exec (HESTIA_CMD."v-delete-mail-account-autoreply ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account), $output, $return_var);
291313
check_return_code($return_var,$output);
292314
unset($output);
293315
$v_autoreply = 'no';
@@ -299,7 +321,7 @@
299321
if ( $v_autoreply_message != str_replace("\r\n", "\n", $_POST['v_autoreply_message'])) {
300322
$v_autoreply_message = str_replace("\r\n", "\n", $_POST['v_autoreply_message']);
301323
$v_autoreply_message = escapeshellarg($v_autoreply_message);
302-
exec (HESTIA_CMD."v-add-mail-account-autoreply ".$v_username." ".$v_domain." ".$v_account." ".$v_autoreply_message, $output, $return_var);
324+
exec (HESTIA_CMD."v-add-mail-account-autoreply ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($v_account)." ".$v_autoreply_message, $output, $return_var);
303325
check_return_code($return_var,$output);
304326
unset($output);
305327
$v_autoreply = 'yes';

0 commit comments

Comments
 (0)