From 8db8f3ae53eedaee838e6eb8da17a40340122807 Mon Sep 17 00:00:00 2001
From: tbrehm <t.brehm@ispconfig.org>
Date: Mon, 24 Aug 2009 10:52:53 -0400
Subject: [PATCH] Fix for jailkit permissions in high security website mode.
---
server/plugins-available/apache2_plugin.inc.php | 40 +++++++++++++++++++++++++++++++++-------
1 files changed, 33 insertions(+), 7 deletions(-)
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index 9e1c948..1749acd 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -261,7 +261,7 @@
// Remove trailing slash
if(substr($tmp_symlink, -1, 1) == '/') $tmp_symlink = substr($tmp_symlink, 0, -1);
// create the symlinks, if not exist
- if(!is_link($tmp_symlink)) {
+ if(is_link($tmp_symlink)) {
exec("rm -f ".escapeshellcmd($tmp_symlink));
$app->log("Removed Symlink: rm -f ".$tmp_symlink,LOGLEVEL_DEBUG);
}
@@ -463,27 +463,53 @@
// Chown and chmod the directories below the document root
exec("chown -R $username:$groupname ".escapeshellcmd($data["new"]["document_root"]));
- // The document root itself has to be owned by root
- exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]));
+ // The document root itself has to be owned by root in normal level and by the web owner in security level 20
+ if($web_config['security_level'] == 20) {
+ exec("chown $username:$groupname ".escapeshellcmd($data["new"]["document_root"]));
+ } else {
+ exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]));
+ }
}
- // If the security level is set to high
+ //* If the security level is set to high
if($web_config['security_level'] == 20) {
- exec("chmod 711 ".escapeshellcmd($data["new"]["document_root"]."/"));
- exec("chmod 711 ".escapeshellcmd($data["new"]["document_root"])."/*");
+ exec("chmod 751 ".escapeshellcmd($data["new"]["document_root"]."/"));
+ exec("chmod 751 ".escapeshellcmd($data["new"]["document_root"])."/*");
exec("chmod 710 ".escapeshellcmd($data["new"]["document_root"]."/web"));
+
+ // make temp direcory writable for the apache user and the website user
+ exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
+
+ $command = 'usermod';
+ $command .= ' --groups sshusers';
+ $command .= ' '.escapeshellcmd($data["new"]["system_user"]);
+ exec($command);
//* add the apache user to the client group
$app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
+
+ /*
+ * Workaround for jailkit: If jailkit is enabled for the site, the
+ * website root has to be owned by the root user and we have to chmod it to 755 then
+ */
+
+ //* Check if there is a jailkit user for this site
+ $tmp = $app->db->queryOneRecord("SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = ".$data["new"]["domain_id"]." AND chroot = 'jailkit'");
+ if($tmp['number'] > 0) {
+ exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/"));
+ exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]."/"));
+ }
+ unset($tmp);
// If the security Level is set to medium
} else {
exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/"));
exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/*"));
+ exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]."/"));
// make temp direcory writable for the apache user and the website user
exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
@@ -748,7 +774,7 @@
}
//* Create .htaccess and .htpasswd file for website statistics
- if(!is_file($data["new"]["document_root"].'/web/stats/.htaccess')) {
+ if(!is_file($data["new"]["document_root"].'/web/stats/.htaccess') or $data["old"]["document_root"] != $data["new"]["document_root"]) {
if(!is_dir($data["new"]["document_root"].'/web/stats')) mkdir($data["new"]["document_root"].'/web/stats');
$ht_file = "AuthType Basic\nAuthName \"Members Only\"\nAuthUserFile ".$data["new"]["document_root"]."/.htpasswd_stats\n<limit GET PUT POST>\nrequire valid-user\n</limit>";
file_put_contents($data["new"]["document_root"].'/web/stats/.htaccess',$ht_file);
--
Gitblit v1.9.1