Skip to content

Commit c682ace

Browse files
jaapmarcusjaapmarcus
committed
Fix web ui + Imporve security by blocking html + Allow for the use of idn domains
1 parent 193ff2f commit c682ace

File tree

6 files changed

+144
-14
lines changed

6 files changed

+144
-14
lines changed

‎bin/v-add-web-domain-redirect‎

Lines changed: 33 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,23 @@ is_object_unsuspended 'user' 'USER' "$user"
4040
is_object_valid 'web' 'DOMAIN' "$domain"
4141
is_object_unsuspended 'web' 'DOMAIN' "$domain"
4242

43+
44+
scheme=0
45+
if [[ "$3" =~ http://|https:// ]]; then
46+
scheme=1
47+
regex='(https?|ftp|file)://[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]'
48+
if ! [[ "$3" =~ $regex ]]; then
49+
echo "Invalid redirect"
50+
exit 2;
51+
fi
52+
else
53+
regex='[-A-Za-z0-9\+&@#/%?=~_|!:,.;]*[-A-Za-z0-9\+&@#/%=~_|]'
54+
if ! [[ "$3" =~ $regex ]]; then
55+
echo "Invalid redirect"
56+
exit 2;
57+
fi
58+
fi
59+
4360
# Perform verification if read-only mode is enabled
4461
check_hestia_demo_mode
4562

@@ -55,12 +72,19 @@ if [ "$WEB_SYSTEM" = 'nginx' ] || [ "$PROXY_SYSTEM" = 'nginx' ]; then
5572
fi
5673
# Insert redirect commands
5774
if [ ! -z "$PROXY_SYSTEM" ] || [ "$WEB_SYSTEM" = 'nginx' ]; then
58-
echo "if (\$host != \"$redirect\") {" > $conf
59-
echo " return $code \$scheme://$redirect\$request_uri;" >> $conf
60-
echo "}" >> $conf
61-
62-
if [ ! -e "$sconf" ]; then
63-
ln -s "$conf" "$sconf"
75+
if [ "$scheme" = 1 ]; then
76+
echo " return $code $redirect\$request_uri;" > $conf
77+
if [ ! -e "$sconf" ]; then
78+
ln -s "$conf" "$sconf"
79+
fi
80+
else
81+
echo "if (\$host != \"$redirect\") {" > $conf
82+
echo " return $code \$scheme://$redirect\$request_uri;" >> $conf
83+
echo "}" >> $conf
84+
85+
if [ ! -e "$sconf" ]; then
86+
ln -s "$conf" "$sconf"
87+
fi
6488
fi
6589
else
6690
echo "Non supported please use .htaccess instead"
@@ -72,12 +96,12 @@ fi
7296
#----------------------------------------------------------#
7397

7498
if [ -z "$REDIRECT" ]; then
75-
add_object_key "web" 'DOMAIN' "$domain" 'REDIRECT' 'STATS_CRYPT'
76-
add_object_key "web" 'DOMAIN' "$domain" 'REDIRECT_CODE' 'STATS_CRYPT'
99+
add_object_key "web" 'DOMAIN' "$domain" 'REDIRECT' 'U_DISK'
100+
add_object_key "web" 'DOMAIN' "$domain" 'REDIRECT_CODE' 'U_DISK'
77101
fi
78102

79103
update_object_value 'web' 'DOMAIN' "$domain" '$REDIRECT' "$redirect"
80-
104+
update_object_value 'web' 'DOMAIN' "$domain" '$REDIRECT_CODE' "$code"
81105
# Restart web server
82106
$BIN/v-restart-web
83107
check_result $? "Web restart failed" > /dev/null

‎bin/v-delete-web-domain-redirect‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: Delete force redirect to domain
3-
# options: USER DOMAIN REDIRECT [CUSTOM]
3+
# options: USER DOMAIN
44
# labels: hestia web
55
#
66
# example: v-add-web-domain-redirect user domain.tld
@@ -27,7 +27,7 @@ source $HESTIA/conf/hestia.conf
2727
# Verifications #
2828
#----------------------------------------------------------#
2929

30-
check_args '3' "$#" 'USER DOMAIN REDIRECT'
30+
check_args '2' "$#" 'USER DOMAIN'
3131
is_format_valid 'user' 'domain'
3232
is_object_valid 'user' 'USER' "$user"
3333
is_object_unsuspended 'user' 'USER' "$user"
@@ -58,7 +58,7 @@ fi
5858
#----------------------------------------------------------#
5959

6060
update_object_value 'web' 'DOMAIN' "$domain" '$REDIRECT' ""
61-
61+
update_object_value 'web' 'DOMAIN' "$domain" '$REDIRECT_CODE' ""
6262
# Restart web server
6363
$BIN/v-restart-web
6464
check_result $? "Web restart failed" > /dev/null

‎bin/v-list-web-domain‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ json_list() {
4545
"PROXY": "'$PROXY'",
4646
"PROXY_EXT": "'$PROXY_EXT'",
4747
"FASTCGI_CACHE": "'$FASTCGI_CACHE'",
48+
"REDIRECT": "'$REDIRECT'",
49+
"REDIRECT_CODE": "'$REDIRECT_CODE'",
4850
"CUSTOM_DOCROOT": "'$CUSTOM_DOCROOT'",
4951
"SUSPENDED": "'$SUSPENDED'",
5052
"TIME": "'$TIME'",

‎web/edit/web/index.php‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,12 @@
9494
}
9595
}
9696

97+
$redirect_code_options = array(301,302);
98+
$v_redirect = $data[$v_domain]['REDIRECT'];
99+
$v_redirect_code = $data[$v_domain]['REDIRECT_CODE'];
100+
if ( !in_array($v_redirect, array('www.'.$v_domain, $v_domain))){
101+
$v_redirect_custom = $v_redirect;
102+
}
97103

98104
$v_ftp_user = $data[$v_domain]['FTP_USER'];
99105
$v_ftp_path = $data[$v_domain]['FTP_PATH'];
@@ -835,7 +841,38 @@
835841
}else{
836842
unset($v_custom_doc_root);
837843
}
844+
845+
if ( !empty($v_redirect) && empty($_POST['v-redirect-checkbox']) ) {
846+
exec(HESTIA_CMD."v-delete-web-domain-redirect ".$v_username." ".escapeshellarg($v_domain), $output, $return_var);
847+
check_return_code($return_var,$output);
848+
unset($output);
849+
unset($_POST['v-redirect']);
850+
}
851+
852+
if (!empty($_POST['v-redirect']) && !empty($_POST['v-redirect-checkbox']) ){
853+
if (empty($v_redirect)){
854+
if ($_POST['v-redirect'] == 'custom' && empty($_POST['v-redirect-custom'])){
855+
}else{
856+
if($_POST['v-redirect'] == 'custom'){
857+
$_POST['v-redirect'] = $_POST['v-redirect-custom'];
858+
}
859+
exec(HESTIA_CMD."v-add-web-domain-redirect ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($_POST['v-redirect'])." ".escapeshellarg($_POST['v-redirect-code']), $output, $return_var);
860+
check_return_code($return_var,$output);
861+
unset($output);
862+
863+
}
838864

865+
}else {
866+
if ($_POST['v-redirect'] == 'custom') {
867+
$_POST['v-redirect'] = $_POST['v-redirect-custom'];
868+
}
869+
if ( $_POST['v-redirect'] != $v_redirect || $_POST['v-redirect-code'] != $v_redirect_code ) {
870+
exec(HESTIA_CMD."v-add-web-domain-redirect ".$v_username." ".escapeshellarg($v_domain)." ".escapeshellarg($_POST['v-redirect'])." ".escapeshellarg($_POST['v-redirect-code']), $output, $return_var);
871+
check_return_code($return_var,$output);
872+
unset($output);
873+
}
874+
}
875+
}
839876
// Restart web server
840877
if (!empty($restart_web) && (empty($_SESSION['error_msg']))) {
841878
exec (HESTIA_CMD."v-restart-web", $output, $return_var);

‎web/js/pages/edit_web.js‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ App.Actions.WEB.update_custom_doc_root = function(elm, hint) {
22
var prepath = $('input[name="v-custom-doc-root_prepath"]').val();
33
var domain = $('select[name="v-custom-doc-domain"]').val();
44
var folder = $('input[name="v-custom-doc-folder"]').val();
5-
console.log(domain, folder);
5+
66
$('.custom_docroot_hint').html(prepath+domain+'/public_html/'+folder);
77
}
88
App.Listeners.DB.keypress_custom_folder = function() {
@@ -294,3 +294,12 @@ function elementHideShow(elementToHideOrShow){
294294
var el = document.getElementById(elementToHideOrShow);
295295
el.style.display = el.style.display === 'none' ? 'block' : 'none';
296296
}
297+
298+
$('#v-redirect-custom-value').change( function(){
299+
console.log($('#v-redirect-custom-value').is(":checked"));
300+
if($('#v-redirect-custom-value').is(":checked")){
301+
$('#custom_redirect').show();
302+
}else{
303+
$('#custom_redirect').hide();
304+
}
305+
})

‎web/templates/admin/edit_web.html‎

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,65 @@
316316
</table>
317317
</td>
318318
</tr>
319-
319+
<tr>
320+
<td class="vst-text step-top">
321+
<label><input type="checkbox" size="20" class="vst-checkbox" name="v-redirect-checkbox" <?php if (!empty($v_redirect)) echo "checked=yes" ?> onclick="javascript:elementHideShow('v_redirect');"> <?php print _('Redirect');?></label>
322+
</td>
323+
</tr>
324+
<tr>
325+
<td class="step-left">
326+
<table style="display:<?php if (empty($v_redirect)) { echo 'none';} else {echo 'block';}?> ;" id="v_redirect">
327+
<tr>
328+
<td class="vst-text input-label">
329+
<?php $v_redirect;?>
330+
<?=_('Redirect');?>
331+
</td>
332+
</tr>
333+
<tr>
334+
<td>
335+
<input type="radio" name="v-redirect" value="<?php echo 'www.'.$domain;?>" <?php if ($v_redirect == "www.".$domain) echo "checked"; ?>/> <?=sprintf(_('Always redirect to %s'),"www.".$domain);?><br />
336+
<input type="radio" name="v-redirect" value="<?php echo $domain;?>" <?php if( $v_redirect == $domain) echo "checked";?>/> <?=sprintf(_('Always redirect to %s'),$domain);?><br />
337+
<input type="radio" name="v-redirect" value="custom" <?php if( !empty($v_redirect_custom)) echo "checked";?> id="v-redirect-custom-value"/> <?=_("Redirect to custom URL or domain");?>
338+
</td>
339+
</tr>
340+
<tr>
341+
<td>
342+
<table id="custom_redirect" style="display:<?php if (empty($v_redirect_custom)) { echo 'none';} else {echo 'block';}?> ;">
343+
<tr>
344+
<td class="vst-text input-label">
345+
<?=_('Address');?>
346+
</td>
347+
</tr>
348+
<tr>
349+
<td class="vst-text input-label">
350+
<input type="text" name="v-redirect-custom" class="vst-input" value="<?=$v_redirect_custom;?>" />
351+
</td>
352+
</tr>
353+
</table>
354+
</td>
355+
</tr>
356+
<tr>
357+
<td class="vst-text input-label">
358+
<?=_('Status code');?>
359+
</td>
360+
</tr>
361+
<tr>
362+
<td class="vst-text input-label">
363+
<select class="vst-list" name="v-redirect-code">
364+
<?php foreach ($redirect_code_options as $status_code): ?>
365+
<option value="<?php echo $status_code;?>"
366+
<?=($v_redirect_code === $status_code || (empty($v_redirect_code) && $status_code === $v_redirect_code))?' selected="selected" ':''; ?>>
367+
<?php echo $status_code;?>
368+
</option>
369+
<?php endforeach; ?>
370+
</select>
371+
</td>
372+
</tr>
373+
<tr>
374+
</tr>
375+
</table>
376+
</td>
377+
</tr>
320378
<tr>
321379
<td class="vst-text step-top">
322380
<label><input type="checkbox" size="20" class="vst-checkbox" name="v_ssl" <?php if ($v_ssl == 'yes') echo "checked=yes" ?> onclick="javascript:App.Actions.WEB.toggle_ssl(this);"> <?php print _('SSL Support');?></label>

0 commit comments

Comments
 (0)