Skip to content

Commit ab87b1f

Browse files
ScIT-RaphaelKristan Kenney
ScIT-Raphael
authored and
Kristan Kenney
committed
Improve HSTS backend and add UI checkbox
1 parent 6036316 commit ab87b1f

File tree

5 files changed

+108
-19
lines changed

5 files changed

+108
-19
lines changed

bin/v-change-web-domain-hsts renamed to bin/v-add-web-domain-ssl-hsts

Lines changed: 16 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
#!/bin/bash
2-
# info: add/remove HSTS support from a domain
3-
# options: USER DOMAIN STATUS
2+
# info: Adding hsts to a domain
3+
# options: USER DOMAIN
44
#
5-
# This function will enable or disable HSTS (HTTP Strict Transport Security)
6-
# for a web domain.
5+
# The function enables HSTS for the requested domain.
76

87

98
#----------------------------------------------------------#
@@ -13,14 +12,12 @@
1312
# Argument definition
1413
user=$1
1514
domain=$2
16-
domain_idn=$2
17-
status=$3
1815

1916
# Includes
2017
source $HESTIA/func/main.sh
21-
source $HESTIA/func/domain.sh
2218
source $HESTIA/conf/hestia.conf
2319

20+
2421
#----------------------------------------------------------#
2522
# Verifications #
2623
#----------------------------------------------------------#
@@ -32,6 +29,7 @@ is_object_unsuspended 'user' 'USER' "$user"
3229
is_object_valid 'web' 'DOMAIN' "$domain"
3330
is_object_unsuspended 'web' 'DOMAIN' "$domain"
3431

32+
3533
#----------------------------------------------------------#
3634
# Action #
3735
#----------------------------------------------------------#
@@ -52,18 +50,9 @@ else
5250
hstsconf="$HOMEDIR/$user/conf/web/$domain/$PROXY_SYSTEM.hsts.conf"
5351
fi
5452

55-
if [ "$status" = "on" ]; then
56-
echo 'add_header Strict-Transport-Security "max-age=15768000;" always;' > $hstsconf
57-
nginx -s reload
58-
echo "HTTP Strict Transport Security (HSTS) turned on for $domain."
59-
elif [ "$status" = "off" ]; then
60-
rm -f $hstsconf
61-
nginx -s reload
62-
echo "HTTP Strict Transport Security (HSTS) turned off for $domain."
63-
else
64-
echo "Error: Invalid mode specified."
65-
echo "Usage: v-change-web-domain-hsts USER DOMAIN [ON / OFF]"
66-
fi
53+
echo 'add_header Strict-Transport-Security "max-age=15768000;" always;' > $hstsconf
54+
echo "HTTP Strict Transport Security (HSTS) turned on for $domain."
55+
6756

6857
#----------------------------------------------------------#
6958
# Hestia #
@@ -73,4 +62,12 @@ fi
7362
log_history "Turned HTTP Strict Transport Security $status for $domain."
7463
log_event "$OK" "$ARGUMENTS"
7564

65+
# Restart web server
66+
$BIN/v-restart-web
67+
check_result $? "Web restart failed" > /dev/null
68+
69+
# Restart proxy
70+
$BIN/v-restart-proxy
71+
check_result $? "Proxy restart failed" > /dev/null
72+
7673
exit

‎bin/v-delete-web-domain-ssl-hsts‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/bash
2+
# info: remove ssl force from domain
3+
# options: USER DOMAIN [RESTART]
4+
#
5+
# The function removes force SSL configurations.
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument definition
13+
user=$1
14+
domain=$2
15+
restart=$3
16+
17+
# Includes
18+
source $HESTIA/func/main.sh
19+
source $HESTIA/conf/hestia.conf
20+
21+
#----------------------------------------------------------#
22+
# Verifications #
23+
#----------------------------------------------------------#
24+
25+
check_args '2' "$#" 'USER DOMAIN'
26+
is_format_valid 'user' 'domain'
27+
is_object_valid 'user' 'USER' "$user"
28+
is_object_unsuspended 'user' 'USER' "$user"
29+
is_object_valid 'web' 'DOMAIN' "$domain"
30+
is_object_unsuspended 'web' 'DOMAIN' "$domain"
31+
is_object_valid 'web' 'DOMAIN' "$domain" "$SSL_FORCE"
32+
33+
#----------------------------------------------------------#
34+
# Action #
35+
#----------------------------------------------------------#
36+
37+
# Load domain data
38+
eval $(grep "DOMAIN='$domain'" $USER_DATA/web.conf)
39+
40+
# Check for Apache/Nginx or Nginx/PHP-FPM configuration
41+
if [ -z $PROXY_SYSTEM ]; then
42+
hstsconf="$HOMEDIR/$user/conf/web/$domain/$WEB_SYSTEM.hsts.conf"
43+
else
44+
hstsconf="$HOMEDIR/$user/conf/web/$domain/$PROXY_SYSTEM.hsts.conf"
45+
fi
46+
47+
rm -f $hstsconf
48+
echo "HTTP Strict Transport Security (HSTS) turned off for $domain."
49+
50+
51+
#----------------------------------------------------------#
52+
# Hestia #
53+
#----------------------------------------------------------#
54+
55+
# Restart services if requested
56+
if [ ! -z "$restart" ]; then
57+
$BIN/v-restart-web
58+
check_result $? "Web restart failed" >/dev/null
59+
60+
$BIN/v-restart-proxy
61+
check_result $? "Proxy restart failed" >/dev/null
62+
fi
63+
64+
exit

‎web/edit/web/index.php‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@
6161
$v_ssl_pub_key = $ssl_str[$v_domain]['PUB_KEY'];
6262
$v_ssl_issuer = $ssl_str[$v_domain]['ISSUER'];
6363
$v_ssl_forcessl = $data[$v_domain]['SSL_FORCE'];
64+
$v_ssl_hsts = $data[$v_domain]['SSL_HSTS'];
6465
}
6566
$v_letsencrypt = $data[$v_domain]['LETSENCRYPT'];
6667
if (empty($v_letsencrypt)) $v_letsencrypt = 'no';
@@ -372,6 +373,7 @@
372373
$v_ssl_ca = '';
373374
$v_ssl = 'no';
374375
$v_ssl_forcessl = 'no';
376+
$v_ssl_hsts = 'no';
375377
$restart_web = 'yes';
376378
$restart_proxy = 'yes';
377379
}
@@ -463,6 +465,14 @@
463465
unset($output);
464466
$v_ssl_forcessl = 'yes';
465467
}
468+
469+
// Add SSL HSTS
470+
if ((!empty($_POST['v_ssl_hsts'])) && (!empty($_POST['v_ssl'])) && (empty($_SESSION['error_msg']))) {
471+
exec (HESTIA_CMD."v-add-web-domain-ssl-hsts ".$user." ".escapeshellarg($v_domain), $output, $return_var);
472+
check_return_code($return_var,$output);
473+
unset($output);
474+
$v_ssl_hsts = 'yes';
475+
}
466476

467477
// Delete Force SSL
468478
if (( $v_ssl_forcessl == 'yes' ) && (empty($_POST['v_ssl_forcessl'])) && (empty($_SESSION['error_msg']))) {
@@ -472,6 +482,14 @@
472482
$v_ssl_forcessl = 'no';
473483
}
474484

485+
// Delete SSL HSTS
486+
if (( $v_ssl_hsts == 'yes' ) && (empty($_POST['v_ssl_hsts'])) && (empty($_SESSION['error_msg']))) {
487+
exec (HESTIA_CMD."v-delete-web-domain-ssl-hsts ".$user." ".escapeshellarg($v_domain)." yes", $output, $return_var);
488+
check_return_code($return_var,$output);
489+
unset($output);
490+
$v_ssl_hsts = 'no';
491+
}
492+
475493
// Delete web stats
476494
if ((!empty($v_stats)) && ($_POST['v_stats'] == 'none') && (empty($_SESSION['error_msg']))) {
477495
exec (HESTIA_CMD."v-delete-web-domain-stats ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);

‎web/templates/admin/edit_web.html‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,11 @@
251251
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_ssl_forcessl" <?php if($v_ssl_forcessl == 'yes') echo "checked=yes" ?> onclick="App.Actions.WEB.toggle_forcessl(this)"> <?php print __('Force SSL/HTTPS');?></label>
252252
</td>
253253
</tr>
254+
<tr>
255+
<td class="input-label vst-text">
256+
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_ssl_hsts" <?php if($v_ssl_hsts == 'yes') echo "checked=yes" ?> onclick="App.Actions.WEB.toggle_hsts(this)"> <?php print __('Enable SSL HSTS');?></label>
257+
</td>
258+
</tr>
254259
<tr>
255260
<td class="input-label vst-text">
256261
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_letsencrypt" <?php if($v_letsencrypt == 'yes' || $v_letencrypt == 'on') echo "checked=yes" ?> onclick="App.Actions.WEB.toggle_letsencrypt(this)"> <?php print __('Lets Encrypt Support');?></label>

‎web/templates/user/edit_web.html‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,11 @@
251251
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_ssl_forcessl" <?php if($v_ssl_forcessl == 'yes') echo "checked=yes" ?> onclick="App.Actions.WEB.toggle_forcessl(this)"> <?php print __('Force SSL/HTTPS');?></label>
252252
</td>
253253
</tr>
254+
<tr>
255+
<td class="input-label vst-text">
256+
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_ssl_hsts" <?php if($v_ssl_hsts == 'yes') echo "checked=yes" ?> onclick="App.Actions.WEB.toggle_hsts(this)"> <?php print __('Enable SSL HSTS');?></label>
257+
</td>
258+
</tr>
254259
<tr>
255260
<td class="input-label vst-text">
256261
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_letsencrypt" <?php if($v_letsencrypt == 'yes' || $v_letencrypt == 'on') echo "checked=yes" ?> onclick="App.Actions.WEB.toggle_letsencrypt(this)"> <?php print __('Lets Encrypt Support');?></label>

0 commit comments

Comments
 (0)