From 64ea56164ad8f0f2cee5676f84d2d8f064e986e1 Mon Sep 17 00:00:00 2001
From: Marius Cramer <m.cramer@pixcept.de>
Date: Tue, 29 Jul 2014 11:55:13 -0400
Subject: [PATCH] Improved input validation
---
server/plugins-available/cron_jailkit_plugin.inc.php | 16 +++++++++++-----
1 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/server/plugins-available/cron_jailkit_plugin.inc.php b/server/plugins-available/cron_jailkit_plugin.inc.php
index c3bd5b7..4c95b83 100644
--- a/server/plugins-available/cron_jailkit_plugin.inc.php
+++ b/server/plugins-available/cron_jailkit_plugin.inc.php
@@ -80,10 +80,14 @@
if(!$parent_domain["domain_id"]) {
$app->log("Parent domain not found", LOGLEVEL_WARN);
return 0;
- } elseif($parent_domain["system_user"] == 'root' or $parent_domain["system_group"] == 'root') {
- $app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
- return 0;
}
+
+ if(!$app->system->is_allowed_user($parent_domain['system_user'], true, true)
+ || !$app->system->is_allowed_group($parent_domain['system_group'], true, true)) {
+ $app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
+ return false;
+ }
+
$this->parent_domain = $parent_domain;
@@ -155,9 +159,11 @@
if(!$parent_domain["domain_id"]) {
$app->log("Parent domain not found", LOGLEVEL_WARN);
return 0;
- } elseif($parent_domain["system_user"] == 'root' or $parent_domain["system_group"] == 'root') {
+ }
+ if(!$app->system->is_allowed_user($parent_domain['system_user'], true, true)
+ || !$app->system->is_allowed_group($parent_domain['system_group'], true, true)) {
$app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
- return 0;
+ return false;
}
$app->uses('system');
--
Gitblit v1.9.1