From e94a9fb5e4b6a2bc07e0bb4cf8ea35fc70c4bbf0 Mon Sep 17 00:00:00 2001
From: tbrehm <t.brehm@ispconfig.org>
Date: Thu, 10 May 2012 12:31:27 -0400
Subject: [PATCH] Merged revisions 3049-3051,3053-3054,3058,3070,3074-3077,3082,3086-3088,3091-3092,3094-3095 from stable branch.
---
server/plugins-available/shelluser_base_plugin.inc.php | 70 +++++++++++++++++++++++++----------
1 files changed, 50 insertions(+), 20 deletions(-)
diff --git a/server/plugins-available/shelluser_base_plugin.inc.php b/server/plugins-available/shelluser_base_plugin.inc.php
index 7677778..5c41863 100755
--- a/server/plugins-available/shelluser_base_plugin.inc.php
+++ b/server/plugins-available/shelluser_base_plugin.inc.php
@@ -72,6 +72,13 @@
$app->uses('system');
+ //* Check if the resulting path is inside the docroot
+ $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".intval($data['new']['parent_domain_id']));
+ if(substr(realpath($data['new']['dir']),0,strlen($web['document_root'])) != $web['document_root']) {
+ $app->log('Directory of the shell user is outside of website docroot.',LOGLEVEL_WARN);
+ return false;
+ }
+
if($app->system->is_user($data['new']['puser'])) {
// Get the UID of the parent user
$uid = intval($app->system->getuid($data['new']['puser']));
@@ -120,6 +127,13 @@
global $app, $conf;
$app->uses('system');
+
+ //* Check if the resulting path is inside the docroot
+ $web = $app->db->queryOneRecord("SELECT * FROM web_domain WHERE domain_id = ".intval($data['new']['parent_domain_id']));
+ if(substr(realpath($data['new']['dir']),0,strlen($web['document_root'])) != $web['document_root']) {
+ $app->log('Directory of the shell user is outside of website docroot.',LOGLEVEL_WARN);
+ return false;
+ }
if($app->system->is_user($data['new']['puser'])) {
// Get the UID of the parent user
@@ -234,13 +248,13 @@
if (!file_exists($sshkeys)){
// add root's key
- $app->file->mkdirs($sshdir, '0755');
+ $app->file->mkdirs($sshdir, '0700');
if(is_file('/root/.ssh/authorized_keys')) file_put_contents($sshkeys, file_get_contents('/root/.ssh/authorized_keys'));
// Remove duplicate keys
- $existing_keys = file($sshkeys);
+ $existing_keys = @file($sshkeys);
$new_keys = explode("\n", $userkey);
- $final_keys_arr = array_merge($existing_keys, $new_keys);
+ $final_keys_arr = @array_merge($existing_keys, $new_keys);
$new_final_keys_arr = array();
if(is_array($final_keys_arr) && !empty($final_keys_arr)){
foreach($final_keys_arr as $key => $val){
@@ -254,26 +268,42 @@
$app->file->remove_blank_lines($sshkeys);
$this->app->log("ssh-rsa authorisation keyfile created in ".$sshkeys,LOGLEVEL_DEBUG);
}
- if ($sshrsa != ''){
- // Remove duplicate keys
- $existing_keys = file($sshkeys);
- $new_keys = explode("\n", $sshrsa);
- $final_keys_arr = array_merge($existing_keys, $new_keys);
- $new_final_keys_arr = array();
- if(is_array($final_keys_arr) && !empty($final_keys_arr)){
- foreach($final_keys_arr as $key => $val){
- $new_final_keys_arr[$key] = trim($val);
- }
- }
- $final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
- // add the custom key
- file_put_contents($sshkeys, $final_keys);
- $app->file->remove_blank_lines($sshkeys);
- $this->app->log("ssh-rsa key updated in ".$sshkeys,LOGLEVEL_DEBUG);
+ //* Get the keys
+ $existing_keys = file($sshkeys);
+ $new_keys = explode("\n", $sshrsa);
+ $old_keys = explode("\n",$this->data['old']['ssh_rsa']);
+
+ //* Remove all old keys
+ if(is_array($old_keys)) {
+ foreach($old_keys as $key => $val) {
+ $k = array_search(trim($val),$existing_keys);
+ unset($existing_keys[$k]);
+ }
}
+
+ //* merge the remaining keys and the ones fom the ispconfig database.
+ if(is_array($new_keys)) {
+ $final_keys_arr = array_merge($existing_keys, $new_keys);
+ } else {
+ $final_keys_arr = $existing_keys;
+ }
+
+ $new_final_keys_arr = array();
+ if(is_array($final_keys_arr) && !empty($final_keys_arr)){
+ foreach($final_keys_arr as $key => $val){
+ $new_final_keys_arr[$key] = trim($val);
+ }
+ }
+ $final_keys = implode("\n", array_flip(array_flip($new_final_keys_arr)));
+
+ // add the custom key
+ file_put_contents($sshkeys, $final_keys);
+ $app->file->remove_blank_lines($sshkeys);
+ $this->app->log("ssh-rsa key updated in ".$sshkeys,LOGLEVEL_DEBUG);
+
// set proper file permissions
- // exec("chown -R ".escapeshellcmd($this->data['new']['puser']).":".escapeshellcmd($this->data['new']['pgroup'])." ".$usrdir);
+ exec("chown -R ".escapeshellcmd($this->data['new']['puser']).":".escapeshellcmd($this->data['new']['pgroup'])." ".$sshdir);
exec("chmod 600 '$sshkeys'");
}
--
Gitblit v1.9.1