From 08cc7f673c377bf88897743e340097e93f1e95f4 Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Wed, 16 Jan 2013 09:30:05 -0500
Subject: [PATCH] - Changed regex for redirect path (Web sites, subdomains, vhost subdomains, alias domains) and web folder (vhost subdomains) so that ".." is not allowed (in order to prevent path traversals). - nginx: don't allow folders for proxy redirects (subdomains and alias domains); URL is required. - nginx: modified rewriting.
---
interface/web/dns/dns_alias_edit.php | 15 ++++++++++-----
1 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/interface/web/dns/dns_alias_edit.php b/interface/web/dns/dns_alias_edit.php
index ffcf133..86a6dcd 100644
--- a/interface/web/dns/dns_alias_edit.php
+++ b/interface/web/dns/dns_alias_edit.php
@@ -76,7 +76,7 @@
global $app, $conf;
// Get the parent soa record of the domain
- $soa = $app->db->queryOneRecord("SELECT * FROM dns_soa WHERE id = '".intval($_POST["zone"])."' AND ".$app->tform->getAuthSQL('r'));
+ $soa = $app->db->queryOneRecord("SELECT * FROM dns_soa WHERE id = '".$app->functions->intval($_POST["zone"])."' AND ".$app->tform->getAuthSQL('r'));
// Check if Domain belongs to user
if($soa["id"] != $_POST["zone"]) $app->tform->errorMessage .= $app->tform->wordbook["no_zone_perm"];
@@ -100,6 +100,11 @@
// Set the server ID of the rr record to the same server ID as the parent record.
$this->dataRecord["server_id"] = $soa["server_id"];
+ // Update the serial number and timestamp of the RR record
+ $soa = $app->db->queryOneRecord("SELECT serial FROM dns_rr WHERE id = ".$this->id);
+ $this->dataRecord["serial"] = $app->validate_dns->increase_serial($soa["serial"]);
+ $this->dataRecord["stamp"] = date('Y-m-d H:i:s');
+
parent::onSubmit();
}
@@ -107,11 +112,11 @@
global $app, $conf;
//* Set the sys_groupid of the rr record to be the same then the sys_groupid of the soa record
- $soa = $app->db->queryOneRecord("SELECT sys_groupid,serial FROM dns_soa WHERE id = '".intval($this->dataRecord["zone"])."' AND ".$app->tform->getAuthSQL('r'));
+ $soa = $app->db->queryOneRecord("SELECT sys_groupid,serial FROM dns_soa WHERE id = '".$app->functions->intval($this->dataRecord["zone"])."' AND ".$app->tform->getAuthSQL('r'));
$app->db->datalogUpdate('dns_rr', "sys_groupid = ".$soa['sys_groupid'], 'id', $this->id);
//* Update the serial number of the SOA record
- $soa_id = intval($_POST["zone"]);
+ $soa_id = $app->functions->intval($_POST["zone"]);
$serial = $app->validate_dns->increase_serial($soa["serial"]);
$app->db->datalogUpdate('dns_soa', "serial = $serial", 'id', $soa_id);
}
@@ -120,8 +125,8 @@
global $app, $conf;
//* Update the serial number of the SOA record
- $soa = $app->db->queryOneRecord("SELECT serial FROM dns_soa WHERE id = '".intval($this->dataRecord["zone"])."' AND ".$app->tform->getAuthSQL('r'));
- $soa_id = intval($_POST["zone"]);
+ $soa = $app->db->queryOneRecord("SELECT serial FROM dns_soa WHERE id = '".$app->functions->intval($this->dataRecord["zone"])."' AND ".$app->tform->getAuthSQL('r'));
+ $soa_id = $app->functions->intval($_POST["zone"]);
$serial = $app->validate_dns->increase_serial($soa["serial"]);
$app->db->datalogUpdate('dns_soa', "serial = $serial", 'id', $soa_id);
}
--
Gitblit v1.9.1