From 1c40af89512efe74f2a5dbb56a523ee2a7c3f64b Mon Sep 17 00:00:00 2001
From: tbrehm <t.brehm@ispconfig.org>
Date: Mon, 24 Aug 2009 11:37:53 -0400
Subject: [PATCH] Added a fix to adjust website permissions in high security level.
---
server/plugins-available/apache2_plugin.inc.php | 80 +++++++++++++++++++++++++++++++++++-----
1 files changed, 70 insertions(+), 10 deletions(-)
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index 18e0a75..087b5c4 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -261,7 +261,7 @@
// Remove trailing slash
if(substr($tmp_symlink, -1, 1) == '/') $tmp_symlink = substr($tmp_symlink, 0, -1);
// create the symlinks, if not exist
- if(!is_link($tmp_symlink)) {
+ if(is_link($tmp_symlink)) {
exec("rm -f ".escapeshellcmd($tmp_symlink));
$app->log("Removed Symlink: rm -f ".$tmp_symlink,LOGLEVEL_DEBUG);
}
@@ -443,7 +443,7 @@
$username = escapeshellcmd($data["new"]["system_user"]);
if($data["new"]["system_user"] != '' && !$app->system->is_user($data["new"]["system_user"])) {
- exec("useradd -d ".escapeshellcmd($data["new"]["document_root"])." -g $groupname $username -s /bin/false");
+ exec("useradd -d ".escapeshellcmd($data["new"]["document_root"])." -g $groupname -G sshusers $username -s /bin/false");
$app->log("Adding the user: $username",LOGLEVEL_DEBUG);
}
@@ -459,17 +459,62 @@
exec("setquota -T -u $username 604800 604800 -a &> /dev/null");
}
-
if($this->action == 'insert') {
// Chown and chmod the directories below the document root
- exec("chown -R $username:$groupname ".escapeshellcmd($data["new"]["document_root"]));
-
- // The document root itself has to be owned by root
- exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]));
+ $this->_exec("chown -R $username:$groupname ".escapeshellcmd($data["new"]["document_root"]));
+ // The document root itself has to be owned by root in normal level and by the web owner in security level 20
+ if($web_config['security_level'] == 20) {
+ $this->_exec("chown $username:$groupname ".escapeshellcmd($data["new"]["document_root"]));
+ } else {
+ $this->_exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]));
+ }
}
- // make temp direcory writable for the apache user and the website user
- exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
+
+
+ //* If the security level is set to high
+ if($web_config['security_level'] == 20) {
+
+ $this->_exec("chmod 751 ".escapeshellcmd($data["new"]["document_root"]."/"));
+ $this->_exec("chmod 751 ".escapeshellcmd($data["new"]["document_root"])."/*");
+ $this->_exec("chmod 710 ".escapeshellcmd($data["new"]["document_root"]."/web"));
+
+ // make temp direcory writable for the apache user and the website user
+ $this->_exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
+
+ $command = 'usermod';
+ $command .= ' --groups sshusers';
+ $command .= ' '.escapeshellcmd($data["new"]["system_user"]);
+ $this->_exec($command);
+
+ //* add the apache user to the client group
+ $app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
+
+ $this->_exec("chown $username:$groupname ".escapeshellcmd($data["new"]["document_root"]));
+
+ /*
+ * Workaround for jailkit: If jailkit is enabled for the site, the
+ * website root has to be owned by the root user and we have to chmod it to 755 then
+ */
+
+ //* Check if there is a jailkit user for this site
+ $tmp = $app->db->queryOneRecord("SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = ".$data["new"]["domain_id"]." AND chroot = 'jailkit'");
+ if($tmp['number'] > 0) {
+ $this->_exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/"));
+ $this->_exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]."/"));
+ }
+ unset($tmp);
+
+ // If the security Level is set to medium
+ } else {
+
+ $this->_exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/"));
+ $this->_exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/*"));
+ $this->_exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]."/"));
+
+ // make temp direcory writable for the apache user and the website user
+ $this->_exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
+ }
// Create the vhost config file
@@ -482,6 +527,7 @@
$vhost_data["web_document_root"] = $data["new"]["document_root"]."/web";
$vhost_data["web_document_root_www"] = $web_config["website_basedir"]."/".$data["new"]["domain"]."/web";
$vhost_data["web_basedir"] = $web_config["website_basedir"];
+ $vhost_data["security_level"] = $web_config["security_level"];
// Check if a SSL cert exists
$ssl_dir = $data["new"]["document_root"]."/ssl";
@@ -506,6 +552,7 @@
// Rewrite rules
$rewrite_rules = array();
if($data["new"]["redirect_type"] != '') {
+ if(substr($data["new"]["redirect_path"],-1) != '/') $data["new"]["redirect_path"] .= '/';
$rewrite_rules[] = array( 'rewrite_domain' => $data["new"]["domain"],
'rewrite_type' => ($data["new"]["redirect_type"] == 'no')?'':'['.$data["new"]["redirect_type"].']',
'rewrite_target' => $data["new"]["redirect_path"]);
@@ -552,6 +599,7 @@
$app->log("Add server alias: $alias[domain]",LOGLEVEL_DEBUG);
// Rewriting
if($alias["redirect_type"] != '') {
+ if(substr($data["new"]["redirect_path"],-1) != '/') $data["new"]["redirect_path"] .= '/';
$rewrite_rules[] = array( 'rewrite_domain' => $alias["domain"],
'rewrite_type' => ($alias["redirect_type"] == 'no')?'':'['.$alias["redirect_type"].']',
'rewrite_target' => $alias["redirect_path"]);
@@ -629,6 +677,7 @@
$fcgi_tpl->setVar('php_fcgi_children',$fastcgi_config["fastcgi_children"]);
$fcgi_tpl->setVar('php_fcgi_max_requests',$fastcgi_config["fastcgi_max_requests"]);
$fcgi_tpl->setVar('php_fcgi_bin',$fastcgi_config["fastcgi_bin"]);
+ $fcgi_tpl->setVar('security_level',$web_config["security_level"]);
$fcgi_starter_script = escapeshellcmd($fastcgi_starter_path.$fastcgi_config["fastcgi_starter_script"]);
file_put_contents($fcgi_starter_script,$fcgi_tpl->grab());
@@ -680,6 +729,7 @@
// This will NOT work!
//$cgi_tpl->setVar('open_basedir', "/var/www/" . $data["new"]["domain"]);
$cgi_tpl->setVar('php_cgi_bin',$cgi_config["cgi_bin"]);
+ $cgi_tpl->setVar('security_level',$web_config["security_level"]);
$cgi_starter_script = escapeshellcmd($cgi_starter_path.$cgi_config["cgi_starter_script"]);
file_put_contents($cgi_starter_script,$cgi_tpl->grab());
@@ -725,7 +775,7 @@
}
//* Create .htaccess and .htpasswd file for website statistics
- if(!is_file($data["new"]["document_root"].'/web/stats/.htaccess')) {
+ if(!is_file($data["new"]["document_root"].'/web/stats/.htaccess') or $data["old"]["document_root"] != $data["new"]["document_root"]) {
if(!is_dir($data["new"]["document_root"].'/web/stats')) mkdir($data["new"]["document_root"].'/web/stats');
$ht_file = "AuthType Basic\nAuthName \"Members Only\"\nAuthUserFile ".$data["new"]["document_root"]."/.htpasswd_stats\n<limit GET PUT POST>\nrequire valid-user\n</limit>";
file_put_contents($data["new"]["document_root"].'/web/stats/.htaccess',$ht_file);
@@ -746,6 +796,9 @@
// request a httpd reload when all records have been processed
$app->services->restartServiceDelayed('httpd','reload');
+
+ //* Unset action to clean it for next processed vhost.
+ $this->action = '';
}
@@ -864,6 +917,13 @@
}
+ //* Wrapper for exec function for easier debugging
+ private function _exec($command) {
+ global $app;
+ $app->log("exec: ".$command,LOGLEVEL_DEBUG);
+ exec($command);
+ }
+
} // end class
--
Gitblit v1.9.1