Improved input validation

Marius Cramer

2014-07-29 64ea56164ad8f0f2cee5676f84d2d8f064e986e1

 server/plugins-available/nginx_plugin.inc.php

@@ -351,10 +351,13 @@
         if($data['new']['type'] == 'vhost' || $data['new']['type'] == 'vhostsubdomain') $app->log('document_root not set', LOGLEVEL_WARN);
         return 0;
      }
      if($data['new']['system_user'] == 'root' or $data['new']['system_group'] == 'root') {

      if(!$app->system->is_allowed_user($data['new']['system_user'], false, true)
         || !$app->system->is_allowed_group($data['new']['system_group'], false, true)) {
         $app->log('Websites cannot be owned by the root user or group.', LOGLEVEL_WARN);
         return 0;
      }

      if(trim($data['new']['domain']) == '') {
         $app->log('domain is empty', LOGLEVEL_WARN);
         return 0;
@@ -362,13 +365,26 @@

      $web_folder = 'web';
      $log_folder = 'log';
      $old_web_folder = 'web';
      $old_log_folder = 'log';
      if($data['new']['type'] == 'vhostsubdomain') {
         // new one
         $tmp = $app->db->queryOneRecord('SELECT `domain` FROM web_domain WHERE domain_id = '.intval($data['new']['parent_domain_id']));
         $subdomain_host = preg_replace('/^(.*)\.' . preg_quote($tmp['domain'], '/') . '$/', '$1', $data['new']['domain']);
         if($subdomain_host == '') $subdomain_host = 'web'.$data['new']['domain_id'];
         $web_folder = $data['new']['web_folder'];
         $log_folder .= '/' . $subdomain_host;
         unset($tmp);
			
         if(isset($data['old']['parent_domain_id'])) {
            // old one
            $tmp = $app->db->queryOneRecord('SELECT `domain` FROM web_domain WHERE domain_id = '.intval($data['old']['parent_domain_id']));
            $subdomain_host = preg_replace('/^(.*)\.' . preg_quote($tmp['domain'], '/') . '$/', '$1', $data['old']['domain']);
            if($subdomain_host == '') $subdomain_host = 'web'.$data['old']['domain_id'];
            $old_web_folder = $data['old']['web_folder'];
            $old_log_folder .= '/' . $subdomain_host;
            unset($tmp);
         }
      }

      // Create group and user, if not exist
@@ -452,6 +468,9 @@
               $app->system->rename($data['new']['document_root'], $data['new']['document_root'].'_bak_'.date('Y_m_d_H_i_s'));
               $app->log('Renaming existing directory in new docroot location. mv '.$data['new']['document_root'].' '.$data['new']['document_root'].'_bak_'.date('Y_m_d_H_i_s'), LOGLEVEL_DEBUG);
            }
				
            //* Unmount the old log directory bfore we move the log dir
            exec('umount '.escapeshellcmd($old_dir.'/log'));

            //* Create new base directory, if it does not exist yet
            if(!is_dir($new_dir)) $app->system->mkdirpath($new_dir);
@@ -477,10 +496,14 @@
         if($nginx_chrooted) $this->_exec('chroot '.escapeshellcmd($web_config['website_basedir']).' '.$command);

         //* Change the log mount
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['old']['domain'].' '.$data['old']['document_root'].'/'.$log_folder.'    none    bind';
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['old']['domain'].' '.$data['old']['document_root'].'/'.$old_log_folder.'    none    bind';
         $app->system->removeLine('/etc/fstab', $fstab_line);
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['new']['domain'].' '.$data['new']['document_root'].'/'.$log_folder.'    none    bind,nobootwait    0 0';
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['old']['domain'].' '.$data['old']['document_root'].'/'.$old_log_folder.'    none    bind,nobootwait';
         $app->system->removeLine('/etc/fstab', $fstab_line);
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['new']['domain'].' '.$data['new']['document_root'].'/'.$log_folder.'    none    bind,nobootwait,_netdev    0 0';
         $app->system->replaceLine('/etc/fstab', $fstab_line, $fstab_line, 1, 1);
			
         exec('mount --bind '.escapeshellarg('/var/log/ispconfig/httpd/'.$data['new']['domain']).' '.escapeshellarg($data['new']['document_root'].'/'.$log_folder));

      }

@@ -509,14 +532,14 @@
      // Remove the symlink for the site, if site is renamed
      if($this->action == 'update' && $data['old']['domain'] != '' && $data['new']['domain'] != $data['old']['domain']) {
         if(is_dir('/var/log/ispconfig/httpd/'.$data['old']['domain'])) exec('rm -rf /var/log/ispconfig/httpd/'.$data['old']['domain']);
         if(is_link($data['old']['document_root'].'/'.$log_folder)) $app->system->unlink($data['old']['document_root'].'/'.$log_folder);
         if(is_link($data['old']['document_root'].'/'.$old_log_folder)) $app->system->unlink($data['old']['document_root'].'/'.$old_log_folder);

         //* remove old log mount
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['old']['domain'].' '.$data['old']['document_root'].'/'.$log_folder.'    none    bind';
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['old']['domain'].' '.$data['old']['document_root'].'/'.$old_log_folder.'    none    bind';
         $app->system->removeLine('/etc/fstab', $fstab_line);

         //* Unmount log directory
         exec('umount '.escapeshellarg($data['old']['document_root'].'/'.$log_folder));
         exec('umount '.escapeshellarg($data['old']['document_root'].'/'.$old_log_folder));
      }

      //* Create the log dir if nescessary and mount it
@@ -529,7 +552,7 @@
         $app->system->chmod($data['new']['document_root'].'/'.$log_folder, 0755);
         exec('mount --bind '.escapeshellarg('/var/log/ispconfig/httpd/'.$data['new']['domain']).' '.escapeshellarg($data['new']['document_root'].'/'.$log_folder));
         //* add mountpoint to fstab
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['new']['domain'].' '.$data['new']['document_root'].'/'.$log_folder.'    none    bind,nobootwait    0 0';
         $fstab_line = '/var/log/ispconfig/httpd/'.$data['new']['domain'].' '.$data['new']['document_root'].'/'.$log_folder.'    none    bind,nobootwait,_netdev    0 0';
         $app->system->replaceLine('/etc/fstab', $fstab_line, $fstab_line, 1, 1);
      }

@@ -693,13 +716,13 @@
         if($web_config['security_level'] == 20) {

            $app->system->chmod($data['new']['document_root'], 0755);
            $app->system->chmod($data['new']['document_root'].'/web', 0711);
            $app->system->chmod($data['new']['document_root'].'/web', 0751);
            //$app->system->chmod($data['new']['document_root'].'/webdav',0710);
            $app->system->chmod($data['new']['document_root'].'/private', 0710);
            $app->system->chmod($data['new']['document_root'].'/ssl', 0755);

            // make tmp directory writable for nginx and the website users
            $app->system->chmod($data['new']['document_root'].'/tmp', 0777);
            $app->system->chmod($data['new']['document_root'].'/tmp', 0770);

            // Set Log directory to 755 to make the logs accessible by the FTP user
            if(realpath($data['new']['document_root'].'/'.$log_folder . '/error.log') == '/var/log/ispconfig/httpd/'.$data['new']['domain'].'/error.log') {
@@ -759,7 +782,7 @@
            $app->system->chmod($data['new']['document_root'].'/cgi-bin', 0755);

            // make temp directory writable for nginx and the website users
            $app->system->chmod($data['new']['document_root'].'/tmp', 0777);
            $app->system->chmod($data['new']['document_root'].'/tmp', 0770);

            // Set Log directory to 755 to make the logs accessible by the FTP user
            if(realpath($data['new']['document_root'].'/'.$log_folder . '/error.log') == '/var/log/ispconfig/httpd/'.$data['new']['domain'].'/error.log') {
@@ -981,6 +1004,18 @@
               }
               // rewrite
               if(preg_match('@^\s*rewrite\s+(^/)?\S+(\$)?\s+\S+(\s+(last|break|redirect|permanent|))?\s*;\s*$@', $custom_rewrite_rule_line)){
                  $final_rewrite_rules[] = array('rewrite_rule' => $custom_rewrite_rule_line);
                  continue;
               }
               if(preg_match('@^\s*rewrite\s+(^/)?(\'[^\']+\'|"[^"]+")+(\$)?\s+(\'[^\']+\'|"[^"]+")+(\s+(last|break|redirect|permanent|))?\s*;\s*$@', $custom_rewrite_rule_line)){
                  $final_rewrite_rules[] = array('rewrite_rule' => $custom_rewrite_rule_line);
                  continue;
               }
               if(preg_match('@^\s*rewrite\s+(^/)?(\'[^\']+\'|"[^"]+")+(\$)?\s+\S+(\s+(last|break|redirect|permanent|))?\s*;\s*$@', $custom_rewrite_rule_line)){
                  $final_rewrite_rules[] = array('rewrite_rule' => $custom_rewrite_rule_line);
                  continue;
               }
               if(preg_match('@^\s*rewrite\s+(^/)?\S+(\$)?\s+(\'[^\']+\'|"[^"]+")+(\s+(last|break|redirect|permanent|))?\s*;\s*$@', $custom_rewrite_rule_line)){
                  $final_rewrite_rules[] = array('rewrite_rule' => $custom_rewrite_rule_line);
                  continue;
               }
@@ -2330,6 +2365,7 @@

      $fpm_socket = $socket_dir.$pool_name.'.sock';
      $tpl->setVar('fpm_socket', $fpm_socket);
      $tpl->setVar('fpm_listen_mode', '0660');

      $tpl->setVar('fpm_pool', $pool_name);
      $tpl->setVar('fpm_port', $web_config['php_fpm_start_port'] + $data['new']['domain_id'] - 1);
@@ -2344,6 +2380,7 @@
      $tpl->setVar('pm_max_requests', $data['new']['pm_max_requests']);
      $tpl->setVar('document_root', $data['new']['document_root']);
      $tpl->setVar('security_level', $web_config['security_level']);
      $tpl->setVar('domain', $data['new']['domain']);
      $php_open_basedir = ($data['new']['php_open_basedir'] == '')?escapeshellcmd($data['new']['document_root']):escapeshellcmd($data['new']['php_open_basedir']);
      $tpl->setVar('php_open_basedir', $php_open_basedir);
      if($php_open_basedir != ''){
@@ -2366,9 +2403,9 @@
               if(substr($ini_setting, 0, 1) == ';') continue;
               if(substr($ini_setting, 0, 1) == '#') continue;
               if(substr($ini_setting, 0, 2) == '//') continue;
               list($key, $value) = explode('=', $ini_setting);
               if($value){
                  $value = trim($value);
               list($key, $value) = explode('=', $ini_setting, 2);
               $value = trim($value);
               if($value != ''){
                  $key = trim($key);
                  switch (strtolower($value)) {
                  case '0':