- Fixed FS#2936 - Please check and limit username input length.

ftimme

2013-06-08 fe9a23f542bc56c1c0b6dc30257418e38ff7bd3a

 interface/web/sites/web_vhost_subdomain_edit.php

@@ -45,7 +45,7 @@
$app->auth->check_module_permissions('sites');

// Loading classes
$app->uses('tpl,tform,tform_actions');
$app->uses('tpl,tform,tform_actions,tools_sites');
$app->load('tform_actions');

class page_action extends tform_actions {
@@ -277,16 +277,7 @@
         /*
          * The domain-module is in use.
         */
         $client_group_id = $_SESSION["s"]["user"]["default_group"];
         /*
          * The admin can select ALL domains, the user only the domains assigned to him
          */
         $sql = "SELECT domain_id, domain FROM domain ";
         if ($_SESSION["s"]["user"]["typ"] != 'admin') {
            $sql .= "WHERE sys_groupid =" . $client_group_id;
         }
         $sql .= " ORDER BY domain";
         $domains = $app->db->queryAllRecords($sql);
            $domains = $app->tools_sites->getDomainModuleDomains();
         $domain_select = '';
            $selected_domain = '';
         if(is_array($domains) && sizeof($domains) > 0) {
@@ -350,18 +341,12 @@
            $app->uses('ini_parser,getconf');
            $settings = $app->getconf->get_global_config('domains');
            if ($settings['use_domain_module'] == 'y') {
                $client_group_id = $app->functions->intval($_SESSION["s"]["user"]["default_group"]);
                
                $sql = "SELECT domain_id, domain FROM domain WHERE domain_id = " . $app->functions->intval($this->dataRecord['sel_domain']);
                if ($_SESSION["s"]["user"]["typ"] != 'admin') {
                    $sql .= " AND sys_groupid =" . $client_group_id;
                }
                $domain_check = $app->db->queryOneRecord($sql);
                $domain_check = $app->tools_sites->checkDomainModuleDomain($this->dataRecord['sel_domain']);
                if(!$domain_check) {
                    // invalid domain selected
                    $app->tform->errorMessage .= $app->tform->lng("domain_error_empty")."<br />";
                } else {
                    $this->dataRecord['domain'] = $this->dataRecord['domain'] . '.' . $domain_check['domain'];
                    $this->dataRecord['domain'] = $this->dataRecord['domain'] . '.' . $domain_check;
                }
            } else {
                $this->dataRecord["domain"] = $this->dataRecord["domain"].'.'.$parent_domain["domain"];
@@ -369,15 +354,26 @@
            
            
            $this->dataRecord['web_folder'] = strtolower($this->dataRecord['web_folder']);
            $forbidden_folders = array('', 'cgi-bin', 'web', 'log', 'private', 'ssl', 'tmp', 'webdav');
            if(in_array($this->dataRecord['web_folder'], $forbidden_folders)) {
         if(substr($this->dataRecord['web_folder'], 0, 1) === '/') $this->dataRecord['web_folder'] = substr($this->dataRecord['web_folder'], 1);
         if(substr($this->dataRecord['web_folder'], -1) === '/') $this->dataRecord['web_folder'] = substr($this->dataRecord['web_folder'], 0, -1);
            $forbidden_folders = array('', 'cgi-bin', 'log', 'private', 'ssl', 'tmp', 'webdav');
            $check_folder = strtolower($this->dataRecord['web_folder']);
            if(substr($check_folder, 0, 1) === '/') $check_folder = substr($check_folder, 1); // strip / at beginning to check against forbidden entries
            if(strpos($check_folder, '/') !== false) $check_folder = substr($check_folder, 0, strpos($check_folder, '/')); // get the first part of the path to check it
            if(in_array($check_folder, $forbidden_folders)) {
                $app->tform->errorMessage .= $app->tform->lng("web_folder_invalid_txt")."<br>";
            }
			
         // vhostsubdomains do not have a quota of their own
         $this->dataRecord["hd_quota"] = 0;
			
            // check for duplicate folder usage
         /*
            $check = $app->db->queryOneRecord("SELECT COUNT(*) as `cnt` FROM `web_domain` WHERE `type` = 'vhostsubdomain' AND `parent_domain_id` = '" . $app->functions->intval($this->dataRecord['parent_domain_id']) . "' AND `web_folder` = '" . $app->db->quote($this->dataRecord['web_folder']) . "' AND `domain_id` != '" . $app->functions->intval($this->id) . "'");
            if($check && $check['cnt'] > 0) {
                $app->tform->errorMessage .= $app->tform->lng("web_folder_unique_txt")."<br>";
            }
         */
        } else {
            $this->dataRecord["domain"] = $this->dataRecord["domain"].'.'.$parent_domain["domain"];
        }
@@ -392,26 +388,10 @@
            if($client['limit_perl'] != 'y') $this->dataRecord['perl'] = '-';
            if($client['limit_ruby'] != 'y') $this->dataRecord['ruby'] = '-';
            if($client['limit_python'] != 'y') $this->dataRecord['python'] = '-';
            if($client['force_suexec'] != 'n') $this->dataRecord['suexec'] = '-';
            if($client['force_suexec'] != 'n') $this->dataRecord['suexec'] = 'y';
            if($client['limit_hterror'] != 'y') $this->dataRecord['errordocs'] = '-';
            if($client['limit_wildcard'] != 'y' && $this->dataRecord['subdomain'] == '*') $this->dataRecord['subdomain'] = '-';
            if($client['limit_ssl'] != 'y') $this->dataRecord['ssl'] = '-';
            
         //* Check the website quota of the client
         if(isset($_POST["hd_quota"]) && $client["limit_web_quota"] >= 0) {
            $tmp = $app->db->queryOneRecord("SELECT sum(hd_quota) as webquota FROM web_domain WHERE domain_id != ".$app->functions->intval($this->id)." AND ".$app->tform->getAuthSQL('u'));
            $webquota = $tmp["webquota"];
            $new_web_quota = $app->functions->intval($this->dataRecord["hd_quota"]);
            if(($webquota + $new_web_quota > $client["limit_web_quota"]) || ($new_web_quota < 0 && $client["limit_web_quota"] >= 0)) {
               $max_free_quota = floor($client["limit_web_quota"] - $webquota);
               if($max_free_quota < 0) $max_free_quota = 0;
               $app->tform->errorMessage .= $app->tform->lng("limit_web_quota_free_txt").": ".$max_free_quota." MB<br>";
               // Set the quota field to the max free space
               $this->dataRecord["hd_quota"] = $max_free_quota;
            }
            unset($tmp);
            unset($tmp_quota);
         }

         //* Check the traffic quota of the client
         if(isset($_POST["traffic_quota"]) && $client["limit_traffic_quota"] > 0) {
@@ -432,22 +412,6 @@
         if($client['parent_client_id'] > 0) {
            // Get the limits of the reseller
            $reseller = $app->db->queryOneRecord("SELECT limit_traffic_quota, limit_web_subdomain, default_webserver, limit_web_quota FROM client WHERE client_id = ".$client['parent_client_id']);

            //* Check the website quota of the client
            if(isset($_POST["hd_quota"]) && $reseller["limit_web_quota"] >= 0) {
               $tmp = $app->db->queryOneRecord("SELECT sum(hd_quota) as webquota FROM web_domain WHERE domain_id != ".$app->functions->intval($this->id)." AND ".$app->tform->getAuthSQL('u'));
               $webquota = $tmp["webquota"];
               $new_web_quota = $app->functions->intval($this->dataRecord["hd_quota"]);
               if(($webquota + $new_web_quota > $reseller["limit_web_quota"]) || ($new_web_quota < 0 && $reseller["limit_web_quota"] >= 0)) {
                  $max_free_quota = floor($reseller["limit_web_quota"] - $webquota);
                  if($max_free_quota < 0) $max_free_quota = 0;
                  $app->tform->errorMessage .= $app->tform->lng("limit_web_quota_free_txt").": ".$max_free_quota." MB<br>";
                  // Set the quota field to the max free space
                  $this->dataRecord["hd_quota"] = $max_free_quota;
               }
               unset($tmp);
               unset($tmp_quota);
            }

            //* Check the traffic quota of the client
            if(isset($_POST["traffic_quota"]) && $reseller["limit_traffic_quota"] > 0) {