Skip to content

Commit c16ec40

Browse files
jaapmarcusjaapmarcus
authored
Fix issues with unauthorised adding subdomain to user account (hestiacp#1642)
* Don’t allow xxx.domain.tld to be created to different user if domain.tld exists * $HESTIA/data/extensions is missing * Enable Domain in use for other types ALLOW_USERS var to allow domain to be used by user for sub domain. * Set / change flag allow_users via bash command * Fix 2 minor bugs * Update automated tests * Issue with v-add-web-domian-alias * Improved testing the limitation for domains to user * Fix issue with IDN domains * Missing clossing “ on test * Fix spelling
1 parent 090608a commit c16ec40

File tree

8 files changed

+320
-2
lines changed

8 files changed

+320
-2
lines changed

‎bin/v-add-dns-domain‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ is_package_full 'DNS_DOMAINS'
5353
template=$(get_user_value '$DNS_TEMPLATE')
5454
is_dns_template_valid $template
5555

56+
is_base_domain_owner "$domain"
57+
5658
if [ ! -z "$ns1" ]; then
5759
ns1=$(echo $4 |sed -e 's/\.*$//g' -e 's/^\.*//g')
5860
is_format_valid 'ns1'

‎bin/v-add-mail-domain‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ is_domain_new 'mail' "$domain"
5151
is_package_full 'MAIL_DOMAINS'
5252
is_dir_symlink $HOMEDIR/$user/mail
5353

54+
is_base_domain_owner "$domain"
55+
5456
# Perform verification if read-only mode is enabled
5557
check_hestia_demo_mode
5658

‎bin/v-add-web-domain‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@ is_package_full 'WEB_DOMAINS' 'WEB_ALIASES'
5151
is_domain_new 'web' "$domain,$aliases"
5252
is_dir_symlink "$HOMEDIR/$user/web"
5353
is_dir_symlink "$HOMEDIR/$user/web/$domain"
54+
55+
is_base_domain_owner "$domain,$aliases"
56+
5457
if [ ! -z "$ip" ]; then
5558
is_ip_valid "$ip" "$user"
5659
else

‎bin/v-add-web-domain-alias‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,8 @@ is_object_unsuspended 'web' 'DOMAIN' "$domain"
5151
is_domain_new 'web' "$aliases"
5252
is_package_full 'WEB_ALIASES'
5353

54+
is_base_domain_owner "$aliases"
55+
5456
# Perform verification if read-only mode is enabled
5557
check_hestia_demo_mode
5658

‎bin/v-add-web-domain-allow-users‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/bin/bash
2+
# info: disables other users create subdomains
3+
# options: USER DOMAIN
4+
# labels: web hestia
5+
#
6+
# example: v-delete-web-domain-allow-users
7+
#
8+
# Disallow other users to create a new subdomain.
9+
# eg: admin adds admin.com
10+
# user can't create user.admin.com
11+
12+
13+
#----------------------------------------------------------#
14+
# Variable&Function #
15+
#----------------------------------------------------------#
16+
17+
# Argument definition
18+
user=$1
19+
domain=$2
20+
domain_idn=$2
21+
22+
# Includes
23+
source $HESTIA/func/main.sh
24+
source $HESTIA/func/domain.sh
25+
source $HESTIA/func/ip.sh
26+
source $HESTIA/conf/hestia.conf
27+
28+
# Additional argument formatting
29+
format_domain
30+
31+
32+
#----------------------------------------------------------#
33+
# Verifications #
34+
#----------------------------------------------------------#
35+
36+
check_args '2' "$#" 'USER DOMAIN'
37+
is_format_valid 'user' 'domain'
38+
is_object_valid 'user' 'USER' "$user"
39+
is_object_unsuspended 'user' 'USER' "$user"
40+
is_object_valid 'web' 'DOMAIN' "$domain"
41+
is_object_unsuspended 'web' 'DOMAIN' "$domain"
42+
43+
# Perform verification if read-only mode is enabled
44+
check_hestia_demo_mode
45+
46+
#----------------------------------------------------------#
47+
# Action #
48+
#----------------------------------------------------------#
49+
50+
# Load domain data
51+
parse_object_kv_list $(grep "DOMAIN='$domain'" $USER_DATA/web.conf)
52+
53+
#----------------------------------------------------------#
54+
# Hestia #
55+
#----------------------------------------------------------#
56+
57+
if [ -z "$ALLOW_USERS" ]; then
58+
add_object_key "web" 'DOMAIN' "$domain" 'ALLOW_USERS' 'TIME'
59+
fi
60+
61+
# Adding new alias
62+
update_object_value 'web' 'DOMAIN' "$domain" '$ALLOW_USERS' "yes"
63+
64+
log_history "Allow users create subdomain for $domain"
65+
log_event "$OK" "$ARGUMENTS"
66+
67+
exit

‎bin/v-delete-web-domain-allow-users‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/bin/bash
2+
# info: disables other users create subdomains
3+
# options: USER DOMAIN
4+
# labels: web hestia
5+
#
6+
# example: v-delete-web-domain-allow-users
7+
#
8+
# Disallow other users to create a new subdomain.
9+
# eg: admin adds admin.com
10+
# user can't create user.admin.com
11+
12+
13+
#----------------------------------------------------------#
14+
# Variable&Function #
15+
#----------------------------------------------------------#
16+
17+
# Argument definition
18+
user=$1
19+
domain=$2
20+
domain_idn=$2
21+
22+
# Includes
23+
source $HESTIA/func/main.sh
24+
source $HESTIA/func/domain.sh
25+
source $HESTIA/func/ip.sh
26+
source $HESTIA/conf/hestia.conf
27+
28+
# Additional argument formatting
29+
format_domain
30+
31+
32+
#----------------------------------------------------------#
33+
# Verifications #
34+
#----------------------------------------------------------#
35+
36+
check_args '2' "$#" 'USER DOMAIN'
37+
is_format_valid 'user' 'domain'
38+
is_object_valid 'user' 'USER' "$user"
39+
is_object_unsuspended 'user' 'USER' "$user"
40+
is_object_valid 'web' 'DOMAIN' "$domain"
41+
is_object_unsuspended 'web' 'DOMAIN' "$domain"
42+
43+
# Perform verification if read-only mode is enabled
44+
check_hestia_demo_mode
45+
46+
#----------------------------------------------------------#
47+
# Action #
48+
#----------------------------------------------------------#
49+
50+
51+
# Load domain data
52+
parse_object_kv_list $(grep "DOMAIN='$domain'" $USER_DATA/web.conf)
53+
54+
#----------------------------------------------------------#
55+
# Hestia #
56+
#----------------------------------------------------------#
57+
58+
if [ -z "$ALLOW_USERS" ]; then
59+
add_object_key "web" 'DOMAIN' "$domain" 'ALLOW_USERS' 'TIME'
60+
fi
61+
62+
# Adding new alias
63+
update_object_value 'web' 'DOMAIN' "$domain" '$ALLOW_USERS' "no"
64+
65+
log_history "Allow users create subdomain for $domain"
66+
log_event "$OK" "$ARGUMENTS"
67+
68+
exit

‎func/domain.sh‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -867,3 +867,67 @@ is_domain_new() {
867867
get_domain_values() {
868868
parse_object_kv_list $(grep "DOMAIN='$domain'" $USER_DATA/$1.conf)
869869
}
870+
871+
#----------------------------------------------------------#
872+
# 2 Char domain name detection #
873+
#----------------------------------------------------------#
874+
875+
is_valid_extension() {
876+
if [ ! -e "$HESTIA/data/extensions/public_suffix_list.dat" ]; then
877+
mkdir $HESTIA/data/extensions/
878+
chmod 750 $HESTIA/data/extensions/
879+
/usr/bin/wget --tries=3 --timeout=15 --read-timeout=15 --waitretry=3 --no-dns-cache --quiet -O $HESTIA/data/extensions/public_suffix_list.dat https://raw.githubusercontent.com/publicsuffix/list/master/public_suffix_list.dat
880+
fi
881+
test_domain=$(idn -t --quiet -u "$1" )
882+
extension=$( /bin/echo "${test_domain}" | /usr/bin/rev | /usr/bin/cut -d "." --output-delimiter="." -f 1 | /usr/bin/rev );
883+
exten=$(grep "^$extension\$" $HESTIA/data/extensions/public_suffix_list.dat);
884+
if [ $? -ne 0 ]; then
885+
check_result 2 ".$extension is not valid"
886+
fi
887+
}
888+
889+
is_valid_2_part_extension() {
890+
if [ ! -e "$HESTIA/data/extensions/public_suffix_list.dat" ]; then
891+
mkdir $HESTIA/data/extensions/
892+
chmod 750 $HESTIA/data/extensions/
893+
/usr/bin/wget --tries=3 --timeout=15 --read-timeout=15 --waitretry=3 --no-dns-cache --quiet -O $HESTIA/data/extensions/public_suffix_list.dat https://raw.githubusercontent.com/publicsuffix/list/master/public_suffix_list.dat
894+
fi
895+
test_domain=$(idn -t --quiet -u "$1" )
896+
extension=$( /bin/echo "${test_domain}" | /usr/bin/rev | /usr/bin/cut -d "." --output-delimiter="." -f 1-2 | /usr/bin/rev );
897+
exten=$(grep "^$extension\$" $HESTIA/data/extensions/public_suffix_list.dat);
898+
}
899+
900+
get_base_domain() {
901+
test_domain=$1
902+
is_valid_extension "$test_domain"
903+
if [ $? -ne 0 ]; then
904+
basedomain=""
905+
else
906+
is_valid_2_part_extension "$test_domain"
907+
if [ $? -ne 0 ]; then
908+
basedomain=$( /bin/echo "${test_domain}" | /usr/bin/rev | /usr/bin/cut -d "." --output-delimiter="." -f 1-2 | /usr/bin/rev );
909+
else
910+
extension=$( /bin/echo "${test_domain}" | /usr/bin/rev | /usr/bin/cut -d "." --output-delimiter="." -f 1-2 | /usr/bin/rev );
911+
partdomain=$( /bin/echo "${test_domain}" | /usr/bin/rev | /usr/bin/cut -d "." --output-delimiter="." -f 3 | /usr/bin/rev );
912+
basedomain="$partdomain.$extension"
913+
fi
914+
fi
915+
}
916+
917+
is_base_domain_owner(){
918+
for object in ${1//,/ }; do
919+
if [ "$object" != "none" ]; then
920+
get_base_domain $object
921+
web=$(grep -F -H -h "DOMAIN='$basedomain'" $HESTIA/data/users/*/web.conf);
922+
if [ ! -z "$web" ]; then
923+
parse_object_kv_list "$web"
924+
if [ -z "$ALLOW_USERS" ] || [ "$ALLOW_USERS" != "yes" ]; then
925+
# Don't care if $basedomain all ready exists only if the owner is of the base domain is the current user
926+
is_domain_new "" $basedomain
927+
fi
928+
else
929+
is_domain_new "" $basedomain
930+
fi
931+
fi
932+
done
933+
}

‎test/test.bats‎

Lines changed: 112 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,14 @@ function setup() {
1313
# echo "# Setup_file" > &3
1414
if [ $BATS_TEST_NUMBER = 1 ]; then
1515
echo 'user=test-5285' > /tmp/hestia-test-env.sh
16+
echo 'user2=test-5286' >> /tmp/hestia-test-env.sh
1617
echo 'userbk=testbk-5285' >> /tmp/hestia-test-env.sh
1718
echo 'userpass1=test-5285' >> /tmp/hestia-test-env.sh
1819
echo 'userpass2=t3st-p4ssw0rd' >> /tmp/hestia-test-env.sh
1920
echo 'HESTIA=/usr/local/hestia' >> /tmp/hestia-test-env.sh
2021
echo 'domain=test-5285.hestiacp.com' >> /tmp/hestia-test-env.sh
22+
echo 'rootdomain=testhestiacp.com' >> /tmp/hestia-test-env.sh
23+
echo 'subdomain=cdn.testhestiacp.com' >> /tmp/hestia-test-env.sh
2124
echo 'database=test-5285_database' >> /tmp/hestia-test-env.sh
2225
echo 'dbuser=test-5285_dbuser' >> /tmp/hestia-test-env.sh
2326
fi
@@ -552,8 +555,7 @@ function validate_database(){
552555
assert_success
553556
refute_output
554557
}
555-
556-
558+
557559
#----------------------------------------------------------#
558560
# MULTIPHP #
559561
#----------------------------------------------------------#
@@ -941,6 +943,114 @@ function validate_database(){
941943
assert_failure $E_NOTEXIST
942944
}
943945

946+
#----------------------------------------------------------#
947+
# Limit possibilities adding different owner domain #
948+
#----------------------------------------------------------#
949+
950+
@test "Allow Users: User can't add user.user2.com " {
951+
# Case: admin company.ltd
952+
# users should not be allowed to add user.company.ltd
953+
run v-add-user $user2 $user2 $user@hestiacp.com default "Super Test"
954+
assert_success
955+
refute_output
956+
957+
run v-add-web-domain $user2 $rootdomain
958+
assert_success
959+
refute_output
960+
961+
run v-add-web-domain $user $subdomain
962+
assert_failure $E_EXISTS
963+
}
964+
965+
@test "Allow Users: User can't add user.user2.com as alias" {
966+
run v-add-web-domain-alias $user $domain $subdomain
967+
assert_failure $E_EXISTS
968+
}
969+
970+
@test "Allow Users: User can't add user.user2.com as mail domain" {
971+
run v-add-mail-domain $user $subdomain
972+
assert_failure $E_EXISTS
973+
}
974+
975+
@test "Allow Users: User can't add user.user2.com as dns domain" {
976+
run v-add-dns-domain $user $subdomain 198.18.0.125
977+
assert_failure $E_EXISTS
978+
}
979+
980+
@test "Allow Users: Set Allow users" {
981+
# Allow user to yes allows
982+
# Case: admin company.ltd
983+
# users are allowed to add user.company.ltd
984+
run v-add-web-domain-allow-users $user2 $rootdomain
985+
assert_success
986+
refute_output
987+
}
988+
989+
@test "Allow Users: User can add user.user2.com" {
990+
run v-add-web-domain $user $subdomain
991+
assert_success
992+
refute_output
993+
}
994+
995+
@test "Allow Users: User can add user.user2.com as alias" {
996+
run v-delete-web-domain $user $subdomain
997+
assert_success
998+
refute_output
999+
1000+
run v-add-web-domain-alias $user $domain $subdomain
1001+
assert_success
1002+
refute_output
1003+
}
1004+
1005+
@test "Allow Users: User can add user.user2.com as mail domain" {
1006+
run v-add-mail-domain $user $subdomain
1007+
assert_success
1008+
refute_output
1009+
}
1010+
1011+
@test "Allow Users: User can add user.user2.com as dns domain" {
1012+
run v-add-dns-domain $user $subdomain 198.18.0.125
1013+
assert_success
1014+
refute_output
1015+
}
1016+
1017+
@test "Allow Users: Cleanup tests" {
1018+
run v-delete-dns-domain $user $subdomain
1019+
assert_success
1020+
refute_output
1021+
1022+
run v-delete-mail-domain $user $subdomain
1023+
assert_success
1024+
refute_output
1025+
}
1026+
1027+
1028+
@test "Allow Users: Set Allow users no" {
1029+
run v-delete-web-domain-alias $user $domain $subdomain
1030+
assert_success
1031+
refute_output
1032+
1033+
run v-delete-web-domain-allow-users $user2 $rootdomain
1034+
assert_success
1035+
refute_output
1036+
}
1037+
1038+
@test "Allow Users: User can't add user.user2.com again" {
1039+
run v-add-web-domain $user $subdomain
1040+
assert_failure $E_EXISTS
1041+
}
1042+
1043+
@test "Allow Users: user2 can add user.user2.com again" {
1044+
run v-add-web-domain $user2 $subdomain
1045+
assert_success
1046+
refute_output
1047+
1048+
run v-delete-user $user2
1049+
assert_success
1050+
refute_output
1051+
}
1052+
1053+
9441054

9451055
#----------------------------------------------------------#
9461056
# DB #

0 commit comments

Comments
 (0)