From 64ea56164ad8f0f2cee5676f84d2d8f064e986e1 Mon Sep 17 00:00:00 2001
From: Marius Cramer <m.cramer@pixcept.de>
Date: Tue, 29 Jul 2014 11:55:13 -0400
Subject: [PATCH] Improved input validation
---
server/plugins-available/cron_plugin.inc.php | 9 ++++++---
1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/server/plugins-available/cron_plugin.inc.php b/server/plugins-available/cron_plugin.inc.php
index fe00713..7f8070d 100644
--- a/server/plugins-available/cron_plugin.inc.php
+++ b/server/plugins-available/cron_plugin.inc.php
@@ -96,11 +96,14 @@
if(!$parent_domain["domain_id"]) {
$app->log("Parent domain not found", LOGLEVEL_WARN);
return 0;
- } elseif($parent_domain["system_user"] == 'root' or $parent_domain["system_group"] == 'root') {
- $app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
- return 0;
}
+ if(!$app->system->is_allowed_user($parent_domain['system_user'], true, true)
+ || !$app->system->is_allowed_group($parent_domain['system_group'], true, true)) {
+ $app->log("Websites (and Crons) cannot be owned by the root user or group.", LOGLEVEL_WARN);
+ return false;
+ }
+
// Get the client ID
$client = $app->dbmaster->queryOneRecord("SELECT client_id FROM sys_group WHERE sys_group.groupid = ".intval($data["new"]["sys_groupid"]));
$client_id = intval($client["client_id"]);
--
Gitblit v1.9.1