Skip to content

Commit f8b39ec

Browse files
serghey-rodinserghey-rodin
committed
Merge pull request hestiacp#534 from serghey-rodin/revert-516-fix-sec-osci
Revert "[SECURITY] Fix OS command injection."
2 parents 9620bfb + 39e9b63 commit f8b39ec

File tree

115 files changed

+1978
-1338
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

115 files changed

+1978
-1338
lines changed

‎web/add/cron/autoupdate/index.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,13 @@
33
error_reporting(NULL);
44
ob_start();
55
session_start();
6-
include($_SERVER['DOCUMENT_ROOT'].'/inc/main.php');
6+
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
77

88
if ($_SESSION['user'] == 'admin') {
9-
v_exec('v-add-cron-vesta-autoupdate', [], false);
9+
exec (VESTA_CMD."v-add-cron-vesta-autoupdate", $output, $return_var);
1010
$_SESSION['error_msg'] = __('Autoupdate has been successfully enabled');
11+
unset($output);
1112
}
1213

13-
header('Location: /list/updates/');
14+
header("Location: /list/updates/");
1415
exit;

‎web/add/cron/index.php‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
// Check token
1414
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1515
header('location: /login/');
16-
exit;
16+
exit();
1717
}
1818

1919
// Check empty fields
@@ -35,16 +35,18 @@
3535
}
3636

3737
// Protect input
38-
$v_min = $_POST['v_min'];
39-
$v_hour = $_POST['v_hour'];
40-
$v_day = $_POST['v_day'];
41-
$v_month = $_POST['v_month'];
42-
$v_wday = $_POST['v_wday'];
43-
$v_cmd = $_POST['v_cmd'];
38+
$v_min = escapeshellarg($_POST['v_min']);
39+
$v_hour = escapeshellarg($_POST['v_hour']);
40+
$v_day = escapeshellarg($_POST['v_day']);
41+
$v_month = escapeshellarg($_POST['v_month']);
42+
$v_wday = escapeshellarg($_POST['v_wday']);
43+
$v_cmd = escapeshellarg($_POST['v_cmd']);
4444

4545
// Add cron job
4646
if (empty($_SESSION['error_msg'])) {
47-
v_exec('v-add-cron-job', [$user, $v_min, $v_hour, $v_day, $v_month, $v_wday, $v_cmd]);
47+
exec (VESTA_CMD."v-add-cron-job ".$user." ".$v_min." ".$v_hour." ".$v_day." ".$v_month." ".$v_wday." ".$v_cmd, $output, $return_var);
48+
check_return_code($return_var,$output);
49+
unset($output);
4850
}
4951

5052
// Flush field values on success
@@ -56,6 +58,7 @@
5658
unset($v_month);
5759
unset($v_wday);
5860
unset($v_cmd);
61+
unset($output);
5962
}
6063
}
6164

‎web/add/cron/reports/index.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,11 @@
33
error_reporting(NULL);
44
ob_start();
55
session_start();
6-
include($_SERVER['DOCUMENT_ROOT'].'/inc/main.php');
6+
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
77

8-
v_exec('v-add-cron-reports', [$user], false);
8+
exec (VESTA_CMD."v-add-cron-reports ".$user, $output, $return_var);
99
$_SESSION['error_msg'] = __('Cronjob email reporting has been successfully enabled');
10+
unset($output);
1011

11-
header('Location: /list/cron/');
12+
header("Location: /list/cron/");
1213
exit;

‎web/add/db/index.php‎

Lines changed: 31 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
// Check token
1313
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1414
header('location: /login/');
15-
exit;
15+
exit();
1616
}
1717

1818
// Check empty fields
@@ -30,7 +30,7 @@
3030
$error_msg = $error_msg.", ".$error;
3131
}
3232
}
33-
$_SESSION['error_msg'] = __('Field "%s" can not be blank.', $error_msg);
33+
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
3434
}
3535

3636
// Validate email
@@ -43,36 +43,45 @@
4343
// Check password length
4444
if (empty($_SESSION['error_msg'])) {
4545
$pw_len = strlen($_POST['v_password']);
46-
if ($pw_len < 6) $_SESSION['error_msg'] = __('Password is too short.', $error_msg);
46+
if ($pw_len < 6 ) $_SESSION['error_msg'] = __('Password is too short.',$error_msg);
4747
}
4848

49-
$v_database = $_POST['v_database'];
50-
$v_dbuser = $_POST['v_dbuser'];
49+
// Protect input
50+
$v_database = escapeshellarg($_POST['v_database']);
51+
$v_dbuser = escapeshellarg($_POST['v_dbuser']);
5152
$v_type = $_POST['v_type'];
5253
$v_charset = $_POST['v_charset'];
5354
$v_host = $_POST['v_host'];
5455
$v_db_email = $_POST['v_db_email'];
5556

5657
// Add database
5758
if (empty($_SESSION['error_msg'])) {
58-
$v_password = tempnam('/tmp', 'vst');
59-
$fp = fopen($v_password, 'w');
59+
$v_type = escapeshellarg($_POST['v_type']);
60+
$v_charset = escapeshellarg($_POST['v_charset']);
61+
$v_host = escapeshellarg($_POST['v_host']);
62+
$v_password = tempnam("/tmp","vst");
63+
$fp = fopen($v_password, "w");
6064
fwrite($fp, $_POST['v_password']."\n");
6165
fclose($fp);
62-
v_exec('v-add-database', [$user, $v_database, $v_dbuser, $v_password, $v_type, $v_host, $v_charset]);
66+
exec (VESTA_CMD."v-add-database ".$user." ".$v_database." ".$v_dbuser." ".$v_password." ".$v_type." ".$v_host." ".$v_charset, $output, $return_var);
67+
check_return_code($return_var,$output);
68+
unset($output);
6369
unlink($v_password);
64-
$v_password = $_POST['v_password'];
70+
$v_password = escapeshellarg($_POST['v_password']);
71+
$v_type = $_POST['v_type'];
72+
$v_host = $_POST['v_host'];
73+
$v_charset = $_POST['v_charset'];
6574
}
6675

6776
// Get database manager url
6877
if (empty($_SESSION['error_msg'])) {
69-
list($http_host, $port) = explode(':', $_SERVER['HTTP_HOST'] . ':');
78+
list($http_host, $port) = explode(':', $_SERVER["HTTP_HOST"] . ":");
7079
if ($_POST['v_host'] != 'localhost' ) $http_host = $_POST['v_host'];
71-
if ($_POST['v_type'] == 'mysql') $db_admin = 'phpMyAdmin';
72-
if ($_POST['v_type'] == 'mysql') $db_admin_link = "http://$http_host/phpmyadmin/";
80+
if ($_POST['v_type'] == 'mysql') $db_admin = "phpMyAdmin";
81+
if ($_POST['v_type'] == 'mysql') $db_admin_link = "http://".$http_host."/phpmyadmin/";
7382
if (($_POST['v_type'] == 'mysql') && (!empty($_SESSION['DB_PMA_URL']))) $db_admin_link = $_SESSION['DB_PMA_URL'];
74-
if ($_POST['v_type'] == 'pgsql') $db_admin = 'phpPgAdmin';
75-
if ($_POST['v_type'] == 'pgsql') $db_admin_link = "http://$http_host/phppgadmin/";
83+
if ($_POST['v_type'] == 'pgsql') $db_admin = "phpPgAdmin";
84+
if ($_POST['v_type'] == 'pgsql') $db_admin_link = "http://".$http_host."/phppgadmin/";
7685
if (($_POST['v_type'] == 'pgsql') && (!empty($_SESSION['DB_PGA_URL']))) $db_admin_link = $_SESSION['DB_PGA_URL'];
7786
}
7887

@@ -81,15 +90,15 @@
8190
$to = $v_db_email;
8291
$subject = __("Database Credentials");
8392
$hostname = exec('hostname');
84-
$from = __('MAIL_FROM', $hostname);
85-
$mailtext = __('DATABASE_READY', $user.'_'.$_POST['v_database'], $user.'_'.$_POST['v_dbuser'], $_POST['v_password'], $db_admin_link);
93+
$from = __('MAIL_FROM',$hostname);
94+
$mailtext = __('DATABASE_READY',$user."_".$_POST['v_database'],$user."_".$_POST['v_dbuser'],$_POST['v_password'],$db_admin_link);
8695
send_email($to, $subject, $mailtext, $from);
8796
}
8897

8998
// Flush field values on success
9099
if (empty($_SESSION['error_msg'])) {
91-
$_SESSION['ok_msg'] = __('DATABASE_CREATED_OK', htmlentities($user.'_'.$_POST['v_database']), htmlentities($user.'_'.$_POST['v_database']));
92-
$_SESSION['ok_msg'] .= " / <a href=$db_admin_link target='_blank'>" . __('open %s', $db_admin) . '</a>';
100+
$_SESSION['ok_msg'] = __('DATABASE_CREATED_OK',htmlentities($user)."_".htmlentities($_POST['v_database']),htmlentities($user)."_".htmlentities($_POST['v_database']));
101+
$_SESSION['ok_msg'] .= " / <a href=".$db_admin_link." target='_blank'>" . __('open %s',$db_admin) . "</a>";
93102
unset($v_database);
94103
unset($v_dbuser);
95104
unset($v_password);
@@ -108,15 +117,16 @@
108117
$v_db_email = $panel[$user]['CONTACT'];
109118

110119
// List avaiable database types
111-
$db_types = explode(',', $_SESSION['DB_SYSTEM']);
120+
$db_types = split(",",$_SESSION['DB_SYSTEM']);
112121

113122
// List available database servers
114123
$db_hosts = array();
115124
foreach ($db_types as $db_type ) {
116-
v_exec('v-list-database-hosts', [$db_type, 'json'], false, $output);
117-
$db_hosts_tmp = json_decode($output, true);
125+
exec (VESTA_CMD."v-list-database-hosts ".$db_type." 'json'", $output, $return_var);
126+
$db_hosts_tmp = json_decode(implode('', $output), true);
118127
$db_hosts = array_merge($db_hosts, $db_hosts_tmp);
119128
unset($db_hosts_tmp);
129+
unset($output);
120130
}
121131

122132
// Display body

‎web/add/dns/index.php‎

Lines changed: 39 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
// Check token
1414
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1515
header('location: /login/');
16-
exit;
16+
exit();
1717
}
1818

1919
// Check empty fields
@@ -32,47 +32,56 @@
3232

3333
// Protect input
3434
$v_domain = preg_replace("/^www./i", "", $_POST['v_domain']);
35+
$v_domain = escapeshellarg($v_domain);
3536
$v_domain = strtolower($v_domain);
36-
$v_ip = $_POST['v_ip'];
37-
if (!empty($_POST['v_ns1'])) $v_ns1 = $_POST['v_ns1'];
38-
if (!empty($_POST['v_ns2'])) $v_ns2 = $_POST['v_ns2'];
39-
if (!empty($_POST['v_ns3'])) $v_ns3 = $_POST['v_ns3'];
40-
if (!empty($_POST['v_ns4'])) $v_ns4 = $_POST['v_ns4'];
41-
if (!empty($_POST['v_ns5'])) $v_ns5 = $_POST['v_ns5'];
42-
if (!empty($_POST['v_ns6'])) $v_ns6 = $_POST['v_ns6'];
43-
if (!empty($_POST['v_ns7'])) $v_ns7 = $_POST['v_ns7'];
44-
if (!empty($_POST['v_ns8'])) $v_ns8 = $_POST['v_ns8'];
37+
$v_ip = escapeshellarg($_POST['v_ip']);
38+
if (!empty($_POST['v_ns1'])) $v_ns1 = escapeshellarg($_POST['v_ns1']);
39+
if (!empty($_POST['v_ns2'])) $v_ns2 = escapeshellarg($_POST['v_ns2']);
40+
if (!empty($_POST['v_ns3'])) $v_ns3 = escapeshellarg($_POST['v_ns3']);
41+
if (!empty($_POST['v_ns4'])) $v_ns4 = escapeshellarg($_POST['v_ns4']);
42+
if (!empty($_POST['v_ns5'])) $v_ns5 = escapeshellarg($_POST['v_ns5']);
43+
if (!empty($_POST['v_ns6'])) $v_ns6 = escapeshellarg($_POST['v_ns6']);
44+
if (!empty($_POST['v_ns7'])) $v_ns7 = escapeshellarg($_POST['v_ns7']);
45+
if (!empty($_POST['v_ns8'])) $v_ns8 = escapeshellarg($_POST['v_ns8']);
4546

4647
// Add dns domain
4748
if (empty($_SESSION['error_msg'])) {
48-
v_exec('v-add-dns-domain', [$user, $v_domain, $v_ip, $v_ns1, $v_ns2, $v_ns3, $v_ns4, $v_ns5, $v_ns6, $v_ns7, $v_ns8, 'no']);
49+
exec (VESTA_CMD."v-add-dns-domain ".$user." ".$v_domain." ".$v_ip." ".$v_ns1." ".$v_ns2." ".$v_ns3." ".$v_ns4." ".$v_ns5." ".$v_ns6." ".$v_ns7." ".$v_ns8." no", $output, $return_var);
50+
check_return_code($return_var,$output);
51+
unset($output);
4952
}
5053

5154

5255
// Set expiriation date
5356
if (empty($_SESSION['error_msg'])) {
5457
if ((!empty($_POST['v_exp'])) && ($_POST['v_exp'] != date('Y-m-d', strtotime('+1 year')))) {
55-
$v_exp = $_POST['v_exp'];
56-
v_exec('v-change-dns-domain-exp', [$user, $v_domain, $v_exp, 'no']);
58+
$v_exp = escapeshellarg($_POST['v_exp']);
59+
exec (VESTA_CMD."v-change-dns-domain-exp ".$user." ".$v_domain." ".$v_exp." no", $output, $return_var);
60+
check_return_code($return_var,$output);
61+
unset($output);
5762
}
5863
}
5964

6065
// Set ttl
6166
if (empty($_SESSION['error_msg'])) {
6267
if ((!empty($_POST['v_ttl'])) && ($_POST['v_ttl'] != '14400') && (empty($_SESSION['error_msg']))) {
63-
$v_ttl = $_POST['v_ttl'];
64-
v_exec('v-change-dns-domain-ttl', [$user, $v_domain, $v_ttl, 'no']);
68+
$v_ttl = escapeshellarg($_POST['v_ttl']);
69+
exec (VESTA_CMD."v-change-dns-domain-ttl ".$user." ".$v_domain." ".$v_ttl." no", $output, $return_var);
70+
check_return_code($return_var,$output);
71+
unset($output);
6572
}
6673
}
6774

6875
// Restart dns server
6976
if (empty($_SESSION['error_msg'])) {
70-
v_exec('v-restart-dns');
77+
exec (VESTA_CMD."v-restart-dns", $output, $return_var);
78+
check_return_code($return_var,$output);
79+
unset($output);
7180
}
7281

7382
// Flush field values on success
7483
if (empty($_SESSION['error_msg'])) {
75-
$_SESSION['ok_msg'] = __('DNS_DOMAIN_CREATED_OK', htmlentities($_POST[v_domain]), htmlentities($_POST[v_domain]));
84+
$_SESSION['ok_msg'] = __('DNS_DOMAIN_CREATED_OK',htmlentities($_POST[v_domain]),htmlentities($_POST[v_domain]));
7685
unset($v_domain);
7786
}
7887
}
@@ -84,7 +93,7 @@
8493
// Check token
8594
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
8695
header('location: /login/');
87-
exit;
96+
exit();
8897
}
8998

9099
// Check empty fields
@@ -104,15 +113,18 @@
104113
}
105114

106115
// Protect input
107-
$v_domain = $_POST['v_domain'];
108-
$v_rec = $_POST['v_rec'];
109-
$v_type = $_POST['v_type'];
110-
$v_val = $_POST['v_val'];
111-
$v_priority = $_POST['v_priority'];
116+
$v_domain = escapeshellarg($_POST['v_domain']);
117+
$v_rec = escapeshellarg($_POST['v_rec']);
118+
$v_type = escapeshellarg($_POST['v_type']);
119+
$v_val = escapeshellarg($_POST['v_val']);
120+
$v_priority = escapeshellarg($_POST['v_priority']);
112121

113122
// Add dns record
114123
if (empty($_SESSION['error_msg'])) {
115-
v_exec('v-add-dns-record', [$user, $v_domain, $v_rec, $v_type, $v_val, $v_priority]);
124+
exec (VESTA_CMD."v-add-dns-record ".$user." ".$v_domain." ".$v_rec." ".$v_type." ".$v_val." ".$v_priority, $output, $return_var);
125+
check_return_code($return_var,$output);
126+
unset($output);
127+
$v_type = $_POST['v_type'];
116128
}
117129

118130
// Flush field values on success
@@ -147,8 +159,8 @@
147159
if (empty($v_ttl)) $v_ttl = 14400;
148160
if (empty($v_exp)) $v_exp = date('Y-m-d', strtotime('+1 year'));
149161
if (empty($v_ns1)) {
150-
v_exec('v-list-user-ns', [$user, 'json'], false, $output);
151-
$nameservers = json_decode($output, true);
162+
exec (VESTA_CMD."v-list-user-ns ".$user." json", $output, $return_var);
163+
$nameservers = json_decode(implode('', $output), true);
152164
$v_ns1 = str_replace("'", "", $nameservers[0]);
153165
$v_ns2 = str_replace("'", "", $nameservers[1]);
154166
$v_ns3 = str_replace("'", "", $nameservers[2]);
@@ -157,6 +169,7 @@
157169
$v_ns6 = str_replace("'", "", $nameservers[5]);
158170
$v_ns7 = str_replace("'", "", $nameservers[6]);
159171
$v_ns8 = str_replace("'", "", $nameservers[7]);
172+
unset($output);
160173
}
161174
include($_SERVER['DOCUMENT_ROOT'].'/templates/admin/add_dns.html');
162175
}

‎web/add/favorite/index.php‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,15 @@
99
// Check token
1010
// if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
1111
// header('location: /login/');
12-
// exit;
12+
// exit();
1313
// }
1414

15-
$v_section = $_REQUEST['v_section'];
16-
$v_unit_id = $_REQUEST['v_unit_id'];
15+
// Protect input
16+
$v_section = escapeshellarg($_REQUEST['v_section']);
17+
$v_unit_id = escapeshellarg($_REQUEST['v_unit_id']);
1718

18-
$_SESSION['favourites'][strtoupper((string)$v_section)][(string)$v_unit_id] = 1;
19+
$_SESSION['favourites'][strtoupper($_REQUEST['v_section'])][$_REQUEST['v_unit_id']] = 1;
1920

20-
v_exec('v-add-user-favourites', [$_SESSION['user'], $v_section, $v_unit_id], false/*true*/);
21+
exec (VESTA_CMD."v-add-user-favourites ".$_SESSION['user']." ".$v_section." ".$v_unit_id, $output, $return_var);
22+
// check_return_code($return_var,$output);
2123
?>

‎web/add/firewall/banlist/index.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,15 @@
3131
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
3232
}
3333

34-
$v_chain = $_POST['v_chain'];
35-
$v_ip = $_POST['v_ip'];
34+
// Protect input
35+
$v_chain = escapeshellarg($_POST['v_chain']);
36+
$v_ip = escapeshellarg($_POST['v_ip']);
3637

3738
// Add firewall ban
3839
if (empty($_SESSION['error_msg'])) {
39-
v_exec('v-add-firewall-ban', [$v_ip, $v_chain]);
40+
exec (VESTA_CMD."v-add-firewall-ban ".$v_ip." ".$v_chain, $output, $return_var);
41+
check_return_code($return_var,$output);
42+
unset($output);
4043
}
4144

4245
// Flush field values on success

0 commit comments

Comments
 (0)