From e68cd24e02b242a53c179dcfacc59ff3c18ec7f3 Mon Sep 17 00:00:00 2001
From: ftimme <ft@falkotimme.com>
Date: Thu, 14 Jun 2012 07:41:30 -0400
Subject: [PATCH] - Changed try_files for PHP files.
---
server/plugins-available/apache2_plugin.inc.php | 124 +++++++++++++++++++++++++++++++++--------
1 files changed, 99 insertions(+), 25 deletions(-)
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index e048b5f..c441a6a 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -85,6 +85,8 @@
$app->plugins->registerEvent('web_folder_update',$this->plugin_name,'web_folder_update');
$app->plugins->registerEvent('web_folder_delete',$this->plugin_name,'web_folder_delete');
+ $app->plugins->registerEvent('ftp_user_delete',$this->plugin_name,'ftp_user_delete');
+
}
// Handle the creation of SSL certificates
@@ -110,6 +112,13 @@
//* Create a SSL Certificate
if($data['new']['ssl_action'] == 'create') {
+
+ //* Rename files if they exist
+ if(file_exists($key_file)) rename($key_file,$key_file.'.bak');
+ if(file_exists($key_file2)) rename($key_file2,$key_file2.'.bak');
+ if(file_exists($csr_file)) rename($csr_file,$csr_file.'.bak');
+ if(file_exists($crt_file)) rename($crt_file,$crt_file.'.bak');
+
$rand_file = $ssl_dir.'/random_file';
$rand_data = md5(uniqid(microtime(),1));
for($i=0; $i<1000; $i++) {
@@ -133,11 +142,11 @@
output_password = $ssl_password
[ req_distinguished_name ]
- C = ".$data['new']['ssl_country']."
- ST = ".$data['new']['ssl_state']."
- L = ".$data['new']['ssl_locality']."
- O = ".$data['new']['ssl_organisation']."
- OU = ".$data['new']['ssl_organisation_unit']."
+ C = ".trim($data['new']['ssl_country'])."
+ ST = ".trim($data['new']['ssl_state'])."
+ L = ".trim($data['new']['ssl_locality'])."
+ O = ".trim($data['new']['ssl_organisation'])."
+ OU = ".trim($data['new']['ssl_organisation_unit'])."
CN = $domain
emailAddress = webmaster@".$data['new']['domain']."
@@ -288,6 +297,10 @@
$app->log('Websites cannot be owned by the root user or group.',LOGLEVEL_WARN);
return 0;
}
+ if(trim($data['new']['domain']) == '') {
+ $app->log('domain is empty',LOGLEVEL_WARN);
+ return 0;
+ }
// Create group and user, if not exist
$app->uses('system');
@@ -353,6 +366,9 @@
}
}
}
+
+ //* Remove protection of old folders
+ $app->system->web_folder_protection($data['old']['document_root'],false);
//* Move the site data
$tmp_docroot = explode('/',$data['new']['document_root']);
@@ -401,7 +417,7 @@
if(!is_dir($data['new']['document_root'].'/ssl')) exec('mkdir -p '.$data['new']['document_root'].'/ssl');
if(!is_dir($data['new']['document_root'].'/cgi-bin')) exec('mkdir -p '.$data['new']['document_root'].'/cgi-bin');
if(!is_dir($data['new']['document_root'].'/tmp')) exec('mkdir -p '.$data['new']['document_root'].'/tmp');
-
+
// Remove the symlink for the site, if site is renamed
if($this->action == 'update' && $data['old']['domain'] != '' && $data['new']['domain'] != $data['old']['domain']) {
if(is_dir('/var/log/ispconfig/httpd/'.$data['old']['domain'])) exec('rm -rf /var/log/ispconfig/httpd/'.$data['old']['domain']);
@@ -580,10 +596,11 @@
}
}
-
-
//* If the security level is set to high
if(($this->action == 'insert' && $data['new']['type'] == 'vhost') or ($web_config['set_folder_permissions_on_update'] == 'y' && $data['new']['type'] == 'vhost')) {
+
+ $app->system->web_folder_protection($data['new']['document_root'],false);
+
if($web_config['security_level'] == 20) {
$this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
@@ -631,9 +648,10 @@
* website root has to be owned by the root user and we have to chmod it to 755 then
*/
- //* Check if there is a jailkit user for this site
+ //* Check if there is a jailkit user or cronjob for this site
$tmp = $app->db->queryOneRecord('SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = '.$data['new']['domain_id']." AND chroot = 'jailkit'");
- if($tmp['number'] > 0) {
+ $tmp2 = $app->db->queryOneRecord('SELECT count(id) as number FROM cron WHERE parent_domain_id = '.$data['new']['domain_id']." AND `type` = 'chrooted'");
+ if($tmp['number'] > 0 || $tmp2['number'] > 0) {
$this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
$this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
}
@@ -659,15 +677,24 @@
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
}
}
+
+ //* Protect web folders
+ $app->system->web_folder_protection($data['new']['document_root'],true);
// Change the ownership of the error log to the owner of the website
if(!@is_file($data['new']['document_root'].'/log/error.log')) exec('touch '.escapeshellcmd($data['new']['document_root']).'/log/error.log');
$this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']).'/log/error.log');
- //* Write the custom php.ini file, if custom_php_ini filed is not empty
+ //* Write the custom php.ini file, if custom_php_ini fieled is not empty
$custom_php_ini_dir = $web_config['website_basedir'].'/conf/'.$data['new']['system_user'];
if(!is_dir($web_config['website_basedir'].'/conf')) mkdir($web_config['website_basedir'].'/conf');
+
+ //* add open_basedir restriction to custom php.ini content, required for suphp only
+ if(!stristr($data['new']['custom_php_ini'],'open_basedir') && $data['new']['php'] == 'suphp') {
+ $data['new']['custom_php_ini'] .= "\nopen_basedir = '".$data['new']['php_open_basedir']."'\n";
+ }
+ //* Create custom php.ini
if(trim($data['new']['custom_php_ini']) != '') {
$has_custom_php_ini = true;
if(!is_dir($custom_php_ini_dir)) mkdir($custom_php_ini_dir);
@@ -960,18 +987,38 @@
$tpl->setVar('fastcgi_starter_script',$fastcgi_config['fastcgi_starter_script']);
$tpl->setVar('fastcgi_config_syntax',$fastcgi_config['fastcgi_config_syntax']);
+ } else {
+ //remove the php fastgi starter script if available
+ if ($data['old']['php'] == 'fast-cgi') {
+ $fastcgi_config = $app->getconf->get_server_config($conf['server_id'], 'fastcgi');
+ $fastcgi_starter_path = str_replace('[system_user]',$data['old']['system_user'],$fastcgi_config['fastcgi_starter_path']);
+ $fastcgi_starter_path = str_replace('[client_id]',$client_id,$fastcgi_starter_path);
+ if (is_dir($fastcgi_starter_path)) {
+ exec('rm -rf '.$fastcgi_starter_path);
+ }
+ }
}
/**
* PHP-FPM
*/
// Support for multiple PHP versions
- if(trim($data['new']['fastcgi_php_version']) != ''){
- $default_php_fpm = false;
- list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
- if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
+ if($data['new']['php'] == 'php-fpm'){
+ if(trim($data['new']['fastcgi_php_version']) != ''){
+ $default_php_fpm = false;
+ list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
+ if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
+ } else {
+ $default_php_fpm = true;
+ }
} else {
- $default_php_fpm = true;
+ if(trim($data['old']['fastcgi_php_version']) != '' && $data['old']['php'] == 'php-fpm'){
+ $default_php_fpm = false;
+ list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['old']['fastcgi_php_version']));
+ if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
+ } else {
+ $default_php_fpm = true;
+ }
}
if($default_php_fpm){
@@ -1177,7 +1224,9 @@
if(!is_file($data['new']['document_root'].'/.htpasswd_stats') || $data['new']['stats_password'] != $data['old']['stats_password']) {
if(trim($data['new']['stats_password']) != '') {
$htp_file = 'admin:'.trim($data['new']['stats_password']);
+ $app->system->web_folder_protection($data['new']['document_root'],false);
file_put_contents($data['new']['document_root'].'/.htpasswd_stats',$htp_file);
+ $app->system->web_folder_protection($data['new']['document_root'],true);
chmod($data['new']['document_root'].'/.htpasswd_stats',0755);
unset($htp_file);
}
@@ -1240,6 +1289,8 @@
// load the server configuration options
$app->uses('getconf');
$web_config = $app->getconf->get_server_config($conf['server_id'], 'web');
+
+ $app->system->web_folder_protection($data['new']['document_root'],false);
//* Check if this is a chrooted setup
if($web_config['website_basedir'] != '' && @is_file($web_config['website_basedir'].'/etc/passwd')) {
@@ -1613,6 +1664,16 @@
}
+
+ public function ftp_user_delete($event_name,$data) {
+ global $app, $conf;
+
+ $ftpquota_file = $data['old']['dir'].'/.ftpquota';
+ if(file_exists($ftpquota_file)) unlink($ftpquota_file);
+
+ }
+
+
/**
* This function is called when a Webdav-User is inserted, updated or deleted.
@@ -1926,12 +1987,22 @@
global $app, $conf;
//$reload = false;
- if(trim($data['new']['fastcgi_php_version']) != ''){
- $default_php_fpm = false;
- list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
- if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
+ if($data['new']['php'] == 'php-fpm'){
+ if(trim($data['new']['fastcgi_php_version']) != ''){
+ $default_php_fpm = false;
+ list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
+ if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
+ } else {
+ $default_php_fpm = true;
+ }
} else {
- $default_php_fpm = true;
+ if(trim($data['old']['fastcgi_php_version']) != '' && $data['old']['php'] == 'php-fpm'){
+ $default_php_fpm = false;
+ list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['old']['fastcgi_php_version']));
+ if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
+ } else {
+ $default_php_fpm = true;
+ }
}
$app->uses("getconf");
@@ -1975,10 +2046,13 @@
$tpl->setVar('fpm_port', $web_config['php_fpm_start_port'] + $data['new']['domain_id'] - 1);
$tpl->setVar('fpm_user', $data['new']['system_user']);
$tpl->setVar('fpm_group', $data['new']['system_group']);
+ $tpl->setVar('pm', $data['new']['pm']);
$tpl->setVar('pm_max_children', $data['new']['pm_max_children']);
$tpl->setVar('pm_start_servers', $data['new']['pm_start_servers']);
$tpl->setVar('pm_min_spare_servers', $data['new']['pm_min_spare_servers']);
$tpl->setVar('pm_max_spare_servers', $data['new']['pm_max_spare_servers']);
+ $tpl->setVar('pm_process_idle_timeout', $data['new']['pm_process_idle_timeout']);
+ $tpl->setVar('pm_max_requests', $data['new']['pm_max_requests']);
$tpl->setVar('document_root', $data['new']['document_root']);
$tpl->setVar('security_level',$web_config['security_level']);
$php_open_basedir = ($data['new']['php_open_basedir'] == '')?escapeshellcmd($data['new']['document_root']):escapeshellcmd($data['new']['php_open_basedir']);
@@ -2004,12 +2078,12 @@
$value = escapeshellcmd(trim($value));
$key = escapeshellcmd(trim($key));
switch (strtolower($value)) {
- case 'on':
- case 'off':
- case '1':
case '0':
// PHP-FPM might complain about invalid boolean value if you use 0
$value = 'off';
+ case '1':
+ case 'on':
+ case 'off':
case 'true':
case 'false':
case 'yes':
@@ -2070,7 +2144,7 @@
private function php_fpm_pool_delete ($data,$web_config) {
global $app, $conf;
- if(trim($data['old']['fastcgi_php_version']) != ''){
+ if(trim($data['old']['fastcgi_php_version']) != '' && $data['old']['php'] == 'php-fpm'){
$default_php_fpm = false;
list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['old']['fastcgi_php_version']));
if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
--
Gitblit v1.9.1