From 64ea56164ad8f0f2cee5676f84d2d8f064e986e1 Mon Sep 17 00:00:00 2001
From: Marius Cramer <m.cramer@pixcept.de>
Date: Tue, 29 Jul 2014 11:55:13 -0400
Subject: [PATCH] Improved input validation
---
server/plugins-available/apache2_plugin.inc.php | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index addcd13..b1411c9 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -344,7 +344,8 @@
if($data['new']['type'] == 'vhost' || $data['new']['type'] == 'vhostsubdomain') $app->log('document_root not set', LOGLEVEL_WARN);
return 0;
}
- if($data['new']['system_user'] == 'root' or $data['new']['system_group'] == 'root') {
+ if(!$app->system->is_allowed_user($data['new']['system_user'], false, true)
+ || !$app->system->is_allowed_group($data['new']['system_group'], false, true)) {
$app->log('Websites cannot be owned by the root user or group.', LOGLEVEL_WARN);
return 0;
}
--
Gitblit v1.9.1