Skip to content

Commit ee10e22

Browse files
jaapmarcusjaapmarcus
authored
Fix XXS issues (hestiacp#2432)
* XSS patches * Reslove XSS vulnrebilty * Resolve XSS vulnrebility * Prevent showing edit form from non exsiting records * Improve error handling message Create a function * Make sure $user from $_SESSION is escapeshellarg Prevent double escapeshellarg in Edit/web/index * Enable translateable errors in /inc/main.php Fix "White" screen issue when trying to loginas non existing user * Prevent double escapeshellarg() * Do not remove unset($output) * Resolve linting errors
1 parent 4e0c670 commit ee10e22

File tree

89 files changed

+233
-697
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+233
-697
lines changed

‎install/deb/phpmyadmin/hestia-sso.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,11 @@ function session_invalid()
147147
$user = $_GET['user'];
148148
$host = 'localhost';
149149
$token = $_GET['hestia_token'];
150-
$time = $_GET['exp'];
150+
if(is_numeric($_GET['exp'])){
151+
$time = $_GET['exp'];
152+
}else{
153+
$time = 0;
154+
}
151155

152156
if ($time + 60 > time()) {
153157
//note: Possible issues with cloudflare due to ip obfuscation

‎web/delete/backup/exclusion/index.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,15 @@
44
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
55

66
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
7-
$user=$_GET['user'];
7+
$user=escapeshellarg($_GET['user']);
88
}
99

1010
// Check token
1111
verify_csrf($_GET);
1212

1313
if (!empty($_GET['system'])) {
14-
$v_username = escapeshellarg($user);
1514
$v_system = escapeshellarg($_GET['system']);
16-
exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$v_username." ".$v_system, $output, $return_var);
15+
exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$user." ".$v_system, $output, $return_var);
1716
}
1817
check_return_code($return_var, $output);
1918
unset($output);

‎web/delete/backup/index.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,15 @@
44
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
55

66
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
7-
$user=$_GET['user'];
7+
$user=escapeshellarg($_GET['user']);
88
}
99

1010
// Check token
1111
verify_csrf($_GET);
1212

1313
if (!empty($_GET['backup'])) {
14-
$v_username = escapeshellarg($user);
1514
$v_backup = escapeshellarg($_GET['backup']);
16-
exec(HESTIA_CMD."v-delete-user-backup ".$v_username." ".$v_backup, $output, $return_var);
15+
exec(HESTIA_CMD."v-delete-user-backup ".$user." ".$v_backup, $output, $return_var);
1716
}
1817
check_return_code($return_var, $output);
1918
unset($output);

‎web/delete/cron/index.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
55

66
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
7-
$user=$_GET['user'];
7+
$user=escapeshellarg($_GET['user']);
88
}
99

1010
// Check token
@@ -13,7 +13,7 @@
1313
if (!empty($_GET['job'])) {
1414
$v_username = escapeshellarg($user);
1515
$v_job = escapeshellarg($_GET['job']);
16-
exec(HESTIA_CMD."v-delete-cron-job ".$v_username." ".$v_job, $output, $return_var);
16+
exec(HESTIA_CMD."v-delete-cron-job ".$user." ".$v_job, $output, $return_var);
1717
}
1818
check_return_code($return_var, $output);
1919
unset($output);

‎web/delete/db/index.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,15 @@
44
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
55

66
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
7-
$user=$_GET['user'];
7+
$user=escapeshellarg($_GET['user']);
88
}
99

1010
// Check token
1111
verify_csrf($_GET);
1212

1313
if (!empty($_GET['database'])) {
14-
$v_username = escapeshellarg($user);
1514
$v_database = escapeshellarg($_GET['database']);
16-
exec(HESTIA_CMD."v-delete-database ".$v_username." ".$v_database, $output, $return_var);
15+
exec(HESTIA_CMD."v-delete-database ".$user." ".$v_database, $output, $return_var);
1716
}
1817
check_return_code($return_var, $output);
1918
unset($output);

‎web/delete/dns/index.php‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,16 @@
55

66
// Delete as someone else?
77
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
8-
$user=$_GET['user'];
8+
$user=escapeshellarg($_GET['user']);
99
}
1010

1111
// Check token
1212
verify_csrf($_GET);
1313

1414
// DNS domain
1515
if ((!empty($_GET['domain'])) && (empty($_GET['record_id']))) {
16-
$v_username = escapeshellarg($user);
1716
$v_domain = escapeshellarg($_GET['domain']);
18-
exec(HESTIA_CMD."v-delete-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
17+
exec(HESTIA_CMD."v-delete-dns-domain ".$user." ".$v_domain, $output, $return_var);
1918
check_return_code($return_var, $output);
2019
unset($output);
2120

@@ -41,8 +40,14 @@
4140
header("Location: ".$back);
4241
exit;
4342
}
44-
header("Location: /list/dns/?domain=".$_GET['domain']);
45-
exit;
43+
if($return_var > 0){
44+
header("Location: /list/dns/");
45+
exit;
46+
}else{
47+
header("Location: /list/dns/?domain=".$_GET['domain']);
48+
exit;
49+
}
50+
4651
}
4752

4853
$back = $_SESSION['back'];

‎web/delete/key/index.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,12 @@
77
verify_csrf($_GET);
88

99
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
10-
$user = $_GET['user'];
10+
$user=escapeshellarg($_GET['user']);
1111
}
1212

1313
if (!empty($_GET['key'])) {
1414
$v_key = escapeshellarg(trim($_GET['key']));
15-
$v_user = escapeshellarg(trim($user));
16-
exec(HESTIA_CMD."v-delete-user-ssh-key ".$v_user." ".$v_key);
15+
exec(HESTIA_CMD."v-delete-user-ssh-key ".$user." ".$v_key);
1716
check_return_code($return_var, $output);
1817
}
1918

‎web/delete/log/auth/index.php‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,12 @@
77

88
// Check if administrator is viewing system log (currently 'admin' user)
99
if (($_SESSION['userContext'] === "admin") && (isset($_GET['user']))) {
10-
$user=$_GET['user'];
10+
$user=escapeshellarg($_GET['user']);
1111
$token=$_SESSION['token'];
1212
}
1313

1414
// Clear log
15-
$v_username = escapeshellarg($user);
16-
exec(HESTIA_CMD."v-delete-user-auth-log ".$v_username, $output, $return_var);
15+
exec(HESTIA_CMD."v-delete-user-auth-log ".$user, $output, $return_var);
1716
check_return_code($return_var, $output);
1817
unset($output);
1918

@@ -32,7 +31,7 @@
3231

3332
// Add current user session back to log unless impersonating another user
3433
if (!isset($_SESSION['look'])) {
35-
exec(HESTIA_CMD."v-log-user-login ".$v_username." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
34+
exec(HESTIA_CMD."v-log-user-login ".$user." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
3635
}
3736

3837
// Flush session messages

‎web/delete/log/index.php‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,27 @@
77

88
// Check if administrator is viewing system log (currently 'admin' user)
99
if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
10-
$user=$_GET['user'];
10+
$user=escapeshellarg($_GET['user']);
1111
$token=$_SESSION['token'];
1212
}
1313

14-
// Set correct page reload target
15-
if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
16-
header("Location: /list/log/?user=$user&token=$token");
17-
} else {
18-
header("Location: /list/log/");
19-
}
20-
2114
// Clear log
22-
$v_username = escapeshellarg($user);
23-
exec(HESTIA_CMD."v-delete-user-log ".$v_username." ".$output, $return_var);
15+
exec(HESTIA_CMD."v-delete-user-log ".$user." ".$output, $return_var);
2416
check_return_code($return_var, $output);
2517
unset($output);
2618
unset($token);
2719

20+
if($return_var > 0){
21+
header("Location: /list/log/");
22+
}else{
23+
// Set correct page reload target
24+
if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
25+
header("Location: /list/log/?user=$user&token=$token");
26+
} else {
27+
header("Location: /list/log/");
28+
}
29+
}
30+
2831
// Render page
2932
render_page($user, $TAB, 'list_log');
3033

‎web/delete/mail/index.php‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
// Delete as someone else?
77
if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
8-
$user=$_GET['user'];
8+
$user=scapeshellarg($user);
99
}
1010

1111
// Check token
@@ -15,10 +15,13 @@
1515
if ((!empty($_GET['domain'])) && (empty($_GET['account']))) {
1616
$v_username = escapeshellarg($user);
1717
$v_domain = escapeshellarg($_GET['domain']);
18-
exec(HESTIA_CMD."v-delete-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
18+
exec(HESTIA_CMD."v-delete-mail-domain ".$user." ".$v_domain, $output, $return_var);
1919
check_return_code($return_var, $output);
2020
unset($output);
2121
$back = $_SESSION['back'];
22+
if($return_var > 0){
23+
header("Location: /list/mail/");
24+
}
2225
if (!empty($back)) {
2326
header("Location: ".$back);
2427
exit;
@@ -29,19 +32,22 @@
2932

3033
// Mail account
3134
if ((!empty($_GET['domain'])) && (!empty($_GET['account']))) {
32-
$v_username = escapeshellarg($user);
3335
$v_domain = escapeshellarg($_GET['domain']);
3436
$v_account = escapeshellarg($_GET['account']);
35-
exec(HESTIA_CMD."v-delete-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
37+
exec(HESTIA_CMD."v-delete-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
3638
check_return_code($return_var, $output);
3739
unset($output);
40+
if($return_var > 0){
41+
header("Location: /list/mail/");
42+
}else{
3843
$back = $_SESSION['back'];
3944
if (!empty($back)) {
4045
header("Location: ".$back);
4146
exit;
4247
}
4348
header("Location: /list/mail/?domain=".$_GET['domain']);
4449
exit;
50+
}
4551
}
4652

4753
$back = $_SESSION['back'];

0 commit comments

Comments
 (0)