Skip to content

Commit c1408fc

Browse files
boonkerzboonkerz
authored
Merge branch 'Froxlor:main' into main
2 parents 8634a29 + d8b86fc commit c1408fc

File tree

10 files changed

+58
-30
lines changed

10 files changed

+58
-30
lines changed

‎.github/workflows/build-mariadb.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
mariadb-version: [ 10.11, 10.5 ]
1313
steps:
1414
- name: Checkout
15-
uses: actions/checkout@v3
15+
uses: actions/checkout@v4
1616

1717
- name: Setup PHP, with composer and extensions
1818
uses: shivammathur/setup-php@v2
@@ -57,7 +57,7 @@ jobs:
5757

5858
steps:
5959
- name: Checkout
60-
uses: actions/checkout@v3
60+
uses: actions/checkout@v4
6161

6262
- name: Setup PHP with PECL extension
6363
uses: shivammathur/setup-php@v2
@@ -70,7 +70,7 @@ jobs:
7070
run: composer install --no-dev
7171

7272
- name: Install Node.js
73-
uses: actions/setup-node@v3
73+
uses: actions/setup-node@v4
7474
with:
7575
node-version: '20.x'
7676

@@ -119,7 +119,7 @@ jobs:
119119
mv froxlor-nightly.${{steps.vars.outputs.sha_short}}.zip.sha256 dist/
120120
121121
- name: Deploy nightly to server
122-
uses: easingthemes/ssh-deploy@v3.4.3
122+
uses: easingthemes/ssh-deploy@main
123123
env:
124124
ARGS: "-rltDzvO --chown=${{ secrets.WEB_USER }}:${{ secrets.WEB_USER }}"
125125
SOURCE: "dist/"

‎.github/workflows/build-mysql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
mysql-version: [8.0, 5.7]
1313
steps:
1414
- name: Checkout
15-
uses: actions/checkout@v3
15+
uses: actions/checkout@v4
1616

1717
- name: Setup PHP, with composer and extensions
1818
uses: shivammathur/setup-php@v2

‎actions/admin/settings/120.system.php‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -180,18 +180,6 @@
180180
'default' => true,
181181
'save_method' => 'storeSettingField'
182182
],
183-
'system_httpuser' => [
184-
'settinggroup' => 'system',
185-
'varname' => 'httpuser',
186-
'type' => 'hidden',
187-
'default' => 'www-data'
188-
],
189-
'system_httpgroup' => [
190-
'settinggroup' => 'system',
191-
'varname' => 'httpgroup',
192-
'type' => 'hidden',
193-
'default' => 'www-data'
194-
],
195183
'system_report_enable' => [
196184
'label' => lng('serversettings.report.report'),
197185
'settinggroup' => 'system',

‎lib/Froxlor/Api/Commands/Customers.php‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,28 @@ public function add()
460460
if (function_exists('posix_getpwnam') && !in_array("posix_getpwnam", explode(",", ini_get('disable_functions'))) && posix_getpwnam($loginname)) {
461461
Response::standardError('loginnameissystemaccount', $loginname, true);
462462
}
463+
464+
// blacklist some system-internal names that might lead to issues
465+
Database::needSqlData();
466+
$sqldata = Database::getSqlData();
467+
Database::needRoot(true);
468+
Database::needSqlData();
469+
$sqlrdata = Database::getSqlData();
470+
$login_blacklist = [
471+
'root',
472+
'admin',
473+
'froxroot',
474+
'froxlor',
475+
$sqldata['user'],
476+
$sqldata['db'],
477+
$sqlrdata['user'],
478+
];
479+
unset($sqldata);
480+
unset($sqlrdata);
481+
$login_blacklist = array_unique($login_blacklist);
482+
if (in_array($loginname, $login_blacklist)) {
483+
Response::standardError('loginnameisreservedname', $loginname, true);
484+
}
463485
} else {
464486
$accountnumber = intval(Settings::Get('system.lastaccountnumber')) + 1;
465487
$loginname = Settings::Get('customer.accountprefix') . $accountnumber;
@@ -748,9 +770,10 @@ public function add()
748770
$dbm = new DbManager($this->logger());
749771
// give permission to the user on every access-host we have
750772
foreach (array_map('trim', explode(',', Settings::Get('system.mysql_access_host'))) as $mysql_access_host) {
751-
$dbm->getManager()->grantPrivilegesTo($loginname, $password, $mysql_access_host, false, false);
773+
$dbm->getManager()->grantPrivilegesTo($loginname, $password, $mysql_access_host, false, false, true);
752774
}
753775
$dbm->getManager()->flushPrivileges();
776+
Database::needRoot(false);
754777
}
755778
}
756779

@@ -1320,7 +1343,8 @@ public function update()
13201343
]);
13211344

13221345
// enable/disable global mysql-user (loginname)
1323-
foreach ($result['allowed_mysqlserver'] as $dbserver) {
1346+
$current_allowed_mysqlserver = isset($result['allowed_mysqlserver']) && !empty($result['allowed_mysqlserver']) ? json_decode($result['allowed_mysqlserver'], true) : [];
1347+
foreach ($current_allowed_mysqlserver as $dbserver) {
13241348
// require privileged access for target db-server
13251349
Database::needRoot(true, $dbserver, false);
13261350
// get DbManager
@@ -1336,6 +1360,7 @@ public function update()
13361360
}
13371361
}
13381362
$dbm->getManager()->flushPrivileges();
1363+
Database::needRoot(false);
13391364
}
13401365

13411366
// Retrieve customer's databases
@@ -1650,7 +1675,8 @@ public function delete()
16501675
$id = $result['customerid'];
16511676

16521677
// remove global mysql-user (loginname)
1653-
foreach ($result['allowed_mysqlserver'] as $dbserver) {
1678+
$current_allowed_mysqlserver = isset($result['allowed_mysqlserver']) && !empty($result['allowed_mysqlserver']) ? json_decode($result['allowed_mysqlserver'], true) : [];
1679+
foreach ($current_allowed_mysqlserver as $dbserver) {
16541680
// require privileged access for target db-server
16551681
Database::needRoot(true, $dbserver, false);
16561682
// get DbManager
@@ -1659,6 +1685,7 @@ public function delete()
16591685
$dbm->getManager()->deleteUser($result['loginname'], $mysql_access_host);
16601686
}
16611687
$dbm->getManager()->flushPrivileges();
1688+
Database::needRoot(false);
16621689
}
16631690

16641691
// remove all databases

‎lib/Froxlor/Api/Commands/Domains.php‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1528,13 +1528,12 @@ public function update()
15281528
// enabled ssl for the domain but no ssl ip/port is selected
15291529
Response::standardError('nosslippportgiven', '', true);
15301530
}
1531-
if (Settings::Get('system.use_ssl') == "0" || empty($ssl_ipandports)) {
1531+
if (Settings::Get('system.use_ssl') == "0" || empty($ssl_ipandports) || !$sslenabled) {
15321532
$ssl_redirect = 0;
15331533
$letsencrypt = 0;
15341534
$http2 = 0;
1535-
// we need this for the json_encode
1536-
// if ssl is disabled or no ssl-ip/port exists
1537-
$ssl_ipandports[] = -1;
1535+
// act like $remove_ssl_ipandport
1536+
$ssl_ipandports = [];
15381537

15391538
// HSTS
15401539
$hsts_maxage = 0;

‎lib/Froxlor/Cron/Http/Apache.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
namespace Froxlor\Cron\Http;
2727

2828
use Froxlor\Cron\Http\Php\PhpInterface;
29+
use Froxlor\Cron\TaskId;
2930
use Froxlor\Customer\Customer;
3031
use Froxlor\Database\Database;
3132
use Froxlor\Domain\Domain;
@@ -36,6 +37,7 @@
3637
use Froxlor\Http\Statistics;
3738
use Froxlor\PhpHelper;
3839
use Froxlor\Settings;
40+
use Froxlor\System\Cronjob;
3941
use Froxlor\System\Crypt;
4042
use Froxlor\Validate\Validate;
4143
use PDO;
@@ -133,6 +135,7 @@ public function createIpPort()
133135
if (Settings::Get('system.le_froxlor_enabled') && ($this->froxlorVhostHasLetsEncryptCert() == false || $this->froxlorVhostLetsEncryptNeedsRenew())) {
134136
$this->virtualhosts_data[$vhosts_filename] .= '# temp. disabled ssl-redirect due to Let\'s Encrypt certificate generation.' . PHP_EOL;
135137
$is_redirect = false;
138+
Cronjob::inserttask(TaskId::REBUILD_VHOST);
136139
} else {
137140
$_sslport = $this->checkAlternativeSslPort();
138141

‎lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -525,6 +525,8 @@ private static function runIssueFor($certrows = [])
525525
self::runAcmeSh($certrow, $domains, $cronlog, $do_force, $certrow['domainid'] == 0);
526526
} else {
527527
$cronlog->logAction(FroxlorLogger::CRON_ACTION, LOG_WARNING, "Skipping Let's Encrypt generation for " . $certrow['domain'] . " due to an enabled ssl_redirect");
528+
// we need another reconfigure in order to get the certificate
529+
Cronjob::inserttask(TaskId::REBUILD_VHOST);
528530
}
529531
}
530532
}

‎lib/Froxlor/PhpHelper.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,6 +416,7 @@ public static function cleanGlobal(array &$global, AntiXSS &$antiXss)
416416
'mysql_unprivileged_pass',
417417
'admin_pass',
418418
'admin_pass_confirm',
419+
'panel_password_special_char',
419420
];
420421
if (!empty($global)) {
421422
$tmp = $global;

‎lng/de.lng.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -408,7 +408,10 @@
408408
'description' => 'Hier kann ein eigenes RSS-Feed angegeben werden, welches den Kunden auf dem Dashboard angezeigt wird.<br /><small>Leerlassen um das offizielle Froxlor Newsfeed (https://inside.froxlor.org/news/) zu verwenden.</small>',
409409
],
410410
'movetoadmin' => 'Kunde verschieben',
411-
'movecustomertoadmin' => 'Verschiebe den Kunden zum angegebenen Admin/Reseller<br /><small>Leerlassen für keine Änderung.<br />Wird der gewünschte Admin/Reseller hier nicht aufgelistet, hat er sein Kunden-Kontigent erreicht.</small>',
411+
'movecustomertoadmin' => [
412+
'title' => 'Verschiebe den Kunden zum angegebenen Admin/Reseller',
413+
'description' => 'Leerlassen für keine Änderung.<br />Wird der gewünschte Admin/Reseller hier nicht aufgelistet, hat er sein Kunden-Kontigent erreicht.',
414+
],
412415
'note' => 'Hinweis',
413416
'mod_fcgid_umask' => [
414417
'title' => 'Umask (Standard: 022)',
@@ -432,8 +435,8 @@
432435
'description' => 'Die optionale "includeSubDomains" Direktive, wenn vorhanden, signalisiert dem UA, dass die HSTS Regel für diese Domain und auch jede Subdomain dieser gilt.',
433436
],
434437
'domain_hsts_preload' => [
435-
'title' => 'Füge Domain in die <a href="https://hstspreload.org/" target="_blank">HSTS preload Liste</a> hinzu',
436-
'description' => 'Wenn die Domain in die HSTS preload Liste, verwaltet von Chrome (und genutzt von Firefox und Safari), hinzugefügt werden soll, dann aktivieren Sie diese Einstellung.<br>Die preload-Direktive zu senden kann PERMANTENTE KONSEQUENZEN haben und dazu führen, dass Benutzer auf diese Domain und auch Subdomains nicht zugreifen können.<br>Beachten Sie die Details unter <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> bevor ein Header mit "preload" gesendet wird.',
438+
'title' => 'Füge Domain in die HSTS preload Liste hinzu',
439+
'description' => 'Wenn die Domain in die <a href="https://hstspreload.org/" target="_blank">HSTS preload Liste</a>, verwaltet von Chrome (und genutzt von Firefox und Safari), hinzugefügt werden soll, dann aktivieren Sie diese Einstellung.<br>Die preload-Direktive zu senden kann PERMANTENTE KONSEQUENZEN haben und dazu führen, dass Benutzer auf diese Domain und auch Subdomains nicht zugreifen können.<br>Beachten Sie die Details unter <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> bevor ein Header mit "preload" gesendet wird.',
437440
],
438441
'domain_ocsp_stapling' => [
439442
'title' => 'OCSP stapling',
@@ -810,6 +813,7 @@
810813
'stringformaterror' => 'Der Wert des Feldes "%s" hat nicht das erwartete Format.',
811814
'loginnameisusingprefix' => 'Sie können keinen Account anlegen, der mit "%s" beginnt, da dieser Prefix für die automatische Namensvergabe eingestellt ist. Bitte wählen Sie einen anderen Accountnamen.',
812815
'loginnameissystemaccount' => 'Der Account "%s" existiert bereits auf dem System und kann daher nicht verwendet werden. Bitte wählen Sie einen anderen Accountnamen.',
816+
'loginnameisreservedname' => 'Der Account-Name "%s" ist systemseitig reserviert und kann nicht verwenden werden.',
813817
'youcantdeleteyourself' => 'Aus Sicherheitsgründen können Sie sich nicht selbst löschen.',
814818
'youcanteditallfieldsofyourself' => 'Hinweis: Aus Sicherheitsgründen können Sie nicht alle Felder Ihres eigenen Accounts bearbeiten.',
815819
'documentrootexists' => 'Es existiert noch ein Verzeichnis "%s" für diesen Kunden. Bitte löschen Sie dieses vorher.',

‎lng/en.lng.php‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -413,7 +413,10 @@
413413
'description' => 'Specify a custom RSS-feed that will be shown to your customers on their dashboard.<br /><small>Leave this empty to use the official froxlor newsfeed (https://inside.froxlor.org/news/).</small>',
414414
],
415415
'movetoadmin' => 'Move customer',
416-
'movecustomertoadmin' => 'Move customer to the selected admin/reseller<br /><small>Leave this empty for no change.<br />If the desired admin does not show up in the list, his customer-limit has been reached.</small>',
416+
'movecustomertoadmin' => [
417+
'title' => 'Move customer to the selected admin/reseller',
418+
'description' => 'Leave this empty for no change.<br />If the desired admin does not show up in the list, his customer-limit has been reached.',
419+
],
417420
'note' => 'Note',
418421
'mod_fcgid_umask' => [
419422
'title' => 'Umask (default: 022)',
@@ -440,8 +443,8 @@
440443
'description' => 'The optional "includeSubDomains" directive, if present, signals the UA that the HSTS Policy applies to this HSTS Host as well as any subdomains of the host\'s domain name.',
441444
],
442445
'domain_hsts_preload' => [
443-
'title' => 'Include domain in <a href="https://hstspreload.org/" target="_blank">HSTS preload list</a>',
444-
'description' => 'If you would like this domain to be included in the HSTS preload list maintained by Chrome (and used by Firefox and Safari), then use activate this.<br>Sending the preload directive from your site can have PERMANENT CONSEQUENCES and prevent users from accessing your site and any of its subdomains.<br>Please read the details at <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> before sending the header with "preload".',
446+
'title' => 'Include domain in HSTS preload list',
447+
'description' => 'If you would like this domain to be included in the <a href="https://hstspreload.org/" target="_blank">HSTS preload list</a> maintained by Chrome (and used by Firefox and Safari), then use activate this.<br>Sending the preload directive from your site can have PERMANENT CONSEQUENCES and prevent users from accessing your site and any of its subdomains.<br>Please read the details at <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> before sending the header with "preload".',
445448
],
446449
'domain_ocsp_stapling' => [
447450
'title' => 'OCSP stapling',
@@ -882,6 +885,7 @@
882885
'stringformaterror' => 'The value for the field "%s" is not in the expected format.',
883886
'loginnameisusingprefix' => 'You cannot create accounts that begin with "%s", as this prefix is set to be used for the automatic account-naming. Please enter another account name.',
884887
'loginnameissystemaccount' => 'The account "%s" already exists on the system and cannot be used. Please enter another account name.',
888+
'loginnameisreservedname' => 'The account-name "%s" is reserved for system internals and cannot be used.',
885889
'youcantdeleteyourself' => 'You cannot delete yourself for security reasons.',
886890
'youcanteditallfieldsofyourself' => 'Note: You cannot edit all fields of your own account for security reasons.',
887891
'documentrootexists' => 'The directory "%s" already exists for this customer. Please remove this before adding the customer again.',

0 commit comments

Comments
 (0)