github/vesta
1
0
Fork 0
mirror of https://github.com/serghey-rodin/vesta.git synced 2025-08-14 10:37:39 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Revert "[SECURITY] Fix OS command injection."

Browse source
This commit is contained in:
Serghey Rodin 2015-12-11 21:14:49 +02:00
commit 39e9b6397b
115 changed files with 1980 additions and 1340 deletions
Download patch file Download diff file Expand all files Collapse all files

7
web/add/cron/autoupdate/index.php
View file

@ -3,12 +3,13 @@
error_reporting(NULL);
ob_start();
session_start();
include($_SERVER['DOCUMENT_ROOT'].'/inc/main.php');
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
if ($_SESSION['user'] == 'admin') {
v_exec('v-add-cron-vesta-autoupdate', [], false);
exec (VESTA_CMD."v-add-cron-vesta-autoupdate", $output, $return_var);
$_SESSION['error_msg'] = __('Autoupdate has been successfully enabled');
unset($output);
}
header('Location: /list/updates/');
header("Location: /list/updates/");
exit;

19
web/add/cron/index.php
View file

@ -13,7 +13,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -35,16 +35,18 @@ if (!empty($_POST['ok'])) {
}
// Protect input
$v_min = $_POST['v_min'];
$v_hour = $_POST['v_hour'];
$v_day = $_POST['v_day'];
$v_month = $_POST['v_month'];
$v_wday = $_POST['v_wday'];
$v_cmd = $_POST['v_cmd'];
$v_min = escapeshellarg($_POST['v_min']);
$v_hour = escapeshellarg($_POST['v_hour']);
$v_day = escapeshellarg($_POST['v_day']);
$v_month = escapeshellarg($_POST['v_month']);
$v_wday = escapeshellarg($_POST['v_wday']);
$v_cmd = escapeshellarg($_POST['v_cmd']);
// Add cron job
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-cron-job', [$user, $v_min, $v_hour, $v_day, $v_month, $v_wday, $v_cmd]);
exec (VESTA_CMD."v-add-cron-job ".$user." ".$v_min." ".$v_hour." ".$v_day." ".$v_month." ".$v_wday." ".$v_cmd, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Flush field values on success
@ -56,6 +58,7 @@ if (!empty($_POST['ok'])) {
unset($v_month);
unset($v_wday);
unset($v_cmd);
unset($output);
}
}

7
web/add/cron/reports/index.php
View file

@ -3,10 +3,11 @@
error_reporting(NULL);
ob_start();
session_start();
include($_SERVER['DOCUMENT_ROOT'].'/inc/main.php');
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
v_exec('v-add-cron-reports', [$user], false);
exec (VESTA_CMD."v-add-cron-reports ".$user, $output, $return_var);
$_SESSION['error_msg'] = __('Cronjob email reporting has been successfully enabled');
unset($output);
header('Location: /list/cron/');
header("Location: /list/cron/");
exit;

52
web/add/db/index.php
View file

@ -12,7 +12,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -30,7 +30,7 @@ if (!empty($_POST['ok'])) {
$error_msg = $error_msg.", ".$error;
}
}
$_SESSION['error_msg'] = __('Field "%s" can not be blank.', $error_msg);
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
}
// Validate email
@ -43,11 +43,12 @@ if (!empty($_POST['ok'])) {
// Check password length
if (empty($_SESSION['error_msg'])) {
$pw_len = strlen($_POST['v_password']);
if ($pw_len < 6) $_SESSION['error_msg'] = __('Password is too short.', $error_msg);
if ($pw_len < 6 ) $_SESSION['error_msg'] = __('Password is too short.',$error_msg);
}
$v_database = $_POST['v_database'];
$v_dbuser = $_POST['v_dbuser'];
// Protect input
$v_database = escapeshellarg($_POST['v_database']);
$v_dbuser = escapeshellarg($_POST['v_dbuser']);
$v_type = $_POST['v_type'];
$v_charset = $_POST['v_charset'];
$v_host = $_POST['v_host'];
@ -55,24 +56,32 @@ if (!empty($_POST['ok'])) {
// Add database
if (empty($_SESSION['error_msg'])) {
$v_password = tempnam('/tmp', 'vst');
$fp = fopen($v_password, 'w');
$v_type = escapeshellarg($_POST['v_type']);
$v_charset = escapeshellarg($_POST['v_charset']);
$v_host = escapeshellarg($_POST['v_host']);
$v_password = tempnam("/tmp","vst");
$fp = fopen($v_password, "w");
fwrite($fp, $_POST['v_password']."\n");
fclose($fp);
v_exec('v-add-database', [$user, $v_database, $v_dbuser, $v_password, $v_type, $v_host, $v_charset]);
exec (VESTA_CMD."v-add-database ".$user." ".$v_database." ".$v_dbuser." ".$v_password." ".$v_type." ".$v_host." ".$v_charset, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
unlink($v_password);
$v_password = $_POST['v_password'];
$v_password = escapeshellarg($_POST['v_password']);
$v_type = $_POST['v_type'];
$v_host = $_POST['v_host'];
$v_charset = $_POST['v_charset'];
}
// Get database manager url
if (empty($_SESSION['error_msg'])) {
list($http_host, $port) = explode(':', $_SERVER['HTTP_HOST'] . ':');
list($http_host, $port) = explode(':', $_SERVER["HTTP_HOST"] . ":");
if ($_POST['v_host'] != 'localhost' ) $http_host = $_POST['v_host'];
if ($_POST['v_type'] == 'mysql') $db_admin = 'phpMyAdmin';
if ($_POST['v_type'] == 'mysql') $db_admin_link = "http://$http_host/phpmyadmin/";
if ($_POST['v_type'] == 'mysql') $db_admin = "phpMyAdmin";
if ($_POST['v_type'] == 'mysql') $db_admin_link = "http://".$http_host."/phpmyadmin/";
if (($_POST['v_type'] == 'mysql') && (!empty($_SESSION['DB_PMA_URL']))) $db_admin_link = $_SESSION['DB_PMA_URL'];
if ($_POST['v_type'] == 'pgsql') $db_admin = 'phpPgAdmin';
if ($_POST['v_type'] == 'pgsql') $db_admin_link = "http://$http_host/phppgadmin/";
if ($_POST['v_type'] == 'pgsql') $db_admin = "phpPgAdmin";
if ($_POST['v_type'] == 'pgsql') $db_admin_link = "http://".$http_host."/phppgadmin/";
if (($_POST['v_type'] == 'pgsql') && (!empty($_SESSION['DB_PGA_URL']))) $db_admin_link = $_SESSION['DB_PGA_URL'];
}
@ -81,15 +90,15 @@ if (!empty($_POST['ok'])) {
$to = $v_db_email;
$subject = __("Database Credentials");
$hostname = exec('hostname');
$from = __('MAIL_FROM', $hostname);
$mailtext = __('DATABASE_READY', $user.'_'.$_POST['v_database'], $user.'_'.$_POST['v_dbuser'], $_POST['v_password'], $db_admin_link);
$from = __('MAIL_FROM',$hostname);
$mailtext = __('DATABASE_READY',$user."_".$_POST['v_database'],$user."_".$_POST['v_dbuser'],$_POST['v_password'],$db_admin_link);
send_email($to, $subject, $mailtext, $from);
}
// Flush field values on success
if (empty($_SESSION['error_msg'])) {
$_SESSION['ok_msg'] = __('DATABASE_CREATED_OK', htmlentities($user.'_'.$_POST['v_database']), htmlentities($user.'_'.$_POST['v_database']));
$_SESSION['ok_msg'] .= " / <a href=$db_admin_link target='_blank'>" . __('open %s', $db_admin) . '</a>';
$_SESSION['ok_msg'] = __('DATABASE_CREATED_OK',htmlentities($user)."_".htmlentities($_POST['v_database']),htmlentities($user)."_".htmlentities($_POST['v_database']));
$_SESSION['ok_msg'] .= " / <a href=".$db_admin_link." target='_blank'>" . __('open %s',$db_admin) . "</a>";
unset($v_database);
unset($v_dbuser);
unset($v_password);
@ -108,15 +117,16 @@ top_panel($user,$TAB);
$v_db_email = $panel[$user]['CONTACT'];
// List avaiable database types
$db_types = explode(',', $_SESSION['DB_SYSTEM']);
$db_types = split(",",$_SESSION['DB_SYSTEM']);
// List available database servers
$db_hosts = array();
foreach ($db_types as $db_type ) {
v_exec('v-list-database-hosts', [$db_type, 'json'], false, $output);
$db_hosts_tmp = json_decode($output, true);
exec (VESTA_CMD."v-list-database-hosts ".$db_type." 'json'", $output, $return_var);
$db_hosts_tmp = json_decode(implode('', $output), true);
$db_hosts = array_merge($db_hosts, $db_hosts_tmp);
unset($db_hosts_tmp);
unset($output);
}
// Display body

65
web/add/dns/index.php
View file

@ -13,7 +13,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -32,47 +32,56 @@ if (!empty($_POST['ok'])) {
// Protect input
$v_domain = preg_replace("/^www./i", "", $_POST['v_domain']);
$v_domain = escapeshellarg($v_domain);
$v_domain = strtolower($v_domain);
$v_ip = $_POST['v_ip'];
if (!empty($_POST['v_ns1'])) $v_ns1 = $_POST['v_ns1'];
if (!empty($_POST['v_ns2'])) $v_ns2 = $_POST['v_ns2'];
if (!empty($_POST['v_ns3'])) $v_ns3 = $_POST['v_ns3'];
if (!empty($_POST['v_ns4'])) $v_ns4 = $_POST['v_ns4'];
if (!empty($_POST['v_ns5'])) $v_ns5 = $_POST['v_ns5'];
if (!empty($_POST['v_ns6'])) $v_ns6 = $_POST['v_ns6'];
if (!empty($_POST['v_ns7'])) $v_ns7 = $_POST['v_ns7'];
if (!empty($_POST['v_ns8'])) $v_ns8 = $_POST['v_ns8'];
$v_ip = escapeshellarg($_POST['v_ip']);
if (!empty($_POST['v_ns1'])) $v_ns1 = escapeshellarg($_POST['v_ns1']);
if (!empty($_POST['v_ns2'])) $v_ns2 = escapeshellarg($_POST['v_ns2']);
if (!empty($_POST['v_ns3'])) $v_ns3 = escapeshellarg($_POST['v_ns3']);
if (!empty($_POST['v_ns4'])) $v_ns4 = escapeshellarg($_POST['v_ns4']);
if (!empty($_POST['v_ns5'])) $v_ns5 = escapeshellarg($_POST['v_ns5']);
if (!empty($_POST['v_ns6'])) $v_ns6 = escapeshellarg($_POST['v_ns6']);
if (!empty($_POST['v_ns7'])) $v_ns7 = escapeshellarg($_POST['v_ns7']);
if (!empty($_POST['v_ns8'])) $v_ns8 = escapeshellarg($_POST['v_ns8']);
// Add dns domain
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-dns-domain', [$user, $v_domain, $v_ip, $v_ns1, $v_ns2, $v_ns3, $v_ns4, $v_ns5, $v_ns6, $v_ns7, $v_ns8, 'no']);
exec (VESTA_CMD."v-add-dns-domain ".$user." ".$v_domain." ".$v_ip." ".$v_ns1." ".$v_ns2." ".$v_ns3." ".$v_ns4." ".$v_ns5." ".$v_ns6." ".$v_ns7." ".$v_ns8." no", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Set expiriation date
if (empty($_SESSION['error_msg'])) {
if ((!empty($_POST['v_exp'])) && ($_POST['v_exp'] != date('Y-m-d', strtotime('+1 year')))) {
$v_exp = $_POST['v_exp'];
v_exec('v-change-dns-domain-exp', [$user, $v_domain, $v_exp, 'no']);
$v_exp = escapeshellarg($_POST['v_exp']);
exec (VESTA_CMD."v-change-dns-domain-exp ".$user." ".$v_domain." ".$v_exp." no", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
}
// Set ttl
if (empty($_SESSION['error_msg'])) {
if ((!empty($_POST['v_ttl'])) && ($_POST['v_ttl'] != '14400') && (empty($_SESSION['error_msg']))) {
$v_ttl = $_POST['v_ttl'];
v_exec('v-change-dns-domain-ttl', [$user, $v_domain, $v_ttl, 'no']);
$v_ttl = escapeshellarg($_POST['v_ttl']);
exec (VESTA_CMD."v-change-dns-domain-ttl ".$user." ".$v_domain." ".$v_ttl." no", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
}
// Restart dns server
if (empty($_SESSION['error_msg'])) {
v_exec('v-restart-dns');
exec (VESTA_CMD."v-restart-dns", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Flush field values on success
if (empty($_SESSION['error_msg'])) {
$_SESSION['ok_msg'] = __('DNS_DOMAIN_CREATED_OK', htmlentities($_POST[v_domain]), htmlentities($_POST[v_domain]));
$_SESSION['ok_msg'] = __('DNS_DOMAIN_CREATED_OK',htmlentities($_POST[v_domain]),htmlentities($_POST[v_domain]));
unset($v_domain);
}
}
@ -84,7 +93,7 @@ if (!empty($_POST['ok_rec'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -104,15 +113,18 @@ if (!empty($_POST['ok_rec'])) {
}
// Protect input
$v_domain = $_POST['v_domain'];
$v_rec = $_POST['v_rec'];
$v_type = $_POST['v_type'];
$v_val = $_POST['v_val'];
$v_priority = $_POST['v_priority'];
$v_domain = escapeshellarg($_POST['v_domain']);
$v_rec = escapeshellarg($_POST['v_rec']);
$v_type = escapeshellarg($_POST['v_type']);
$v_val = escapeshellarg($_POST['v_val']);
$v_priority = escapeshellarg($_POST['v_priority']);
// Add dns record
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-dns-record', [$user, $v_domain, $v_rec, $v_type, $v_val, $v_priority]);
exec (VESTA_CMD."v-add-dns-record ".$user." ".$v_domain." ".$v_rec." ".$v_type." ".$v_val." ".$v_priority, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
$v_type = $_POST['v_type'];
}
// Flush field values on success
@ -147,8 +159,8 @@ if (empty($_GET['domain'])) {
if (empty($v_ttl)) $v_ttl = 14400;
if (empty($v_exp)) $v_exp = date('Y-m-d', strtotime('+1 year'));
if (empty($v_ns1)) {
v_exec('v-list-user-ns', [$user, 'json'], false, $output);
$nameservers = json_decode($output, true);
exec (VESTA_CMD."v-list-user-ns ".$user." json", $output, $return_var);
$nameservers = json_decode(implode('', $output), true);
$v_ns1 = str_replace("'", "", $nameservers[0]);
$v_ns2 = str_replace("'", "", $nameservers[1]);
$v_ns3 = str_replace("'", "", $nameservers[2]);
@ -157,6 +169,7 @@ if (empty($_GET['domain'])) {
$v_ns6 = str_replace("'", "", $nameservers[5]);
$v_ns7 = str_replace("'", "", $nameservers[6]);
$v_ns8 = str_replace("'", "", $nameservers[7]);
unset($output);
}
include($_SERVER['DOCUMENT_ROOT'].'/templates/admin/add_dns.html');
}

12
web/add/favorite/index.php
View file

@ -9,13 +9,15 @@ include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
// Check token
// if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
// header('location: /login/');
// exit;
// exit();
// }
$v_section = $_REQUEST['v_section'];
$v_unit_id = $_REQUEST['v_unit_id'];
// Protect input
$v_section = escapeshellarg($_REQUEST['v_section']);
$v_unit_id = escapeshellarg($_REQUEST['v_unit_id']);
$_SESSION['favourites'][strtoupper((string)$v_section)][(string)$v_unit_id] = 1;
$_SESSION['favourites'][strtoupper($_REQUEST['v_section'])][$_REQUEST['v_unit_id']] = 1;
v_exec('v-add-user-favourites', [$_SESSION['user'], $v_section, $v_unit_id], false/*true*/);
exec (VESTA_CMD."v-add-user-favourites ".$_SESSION['user']." ".$v_section." ".$v_unit_id, $output, $return_var);
// check_return_code($return_var,$output);
?>

9
web/add/firewall/banlist/index.php
View file

@ -31,12 +31,15 @@ if (!empty($_POST['ok'])) {
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
}
$v_chain = $_POST['v_chain'];
$v_ip = $_POST['v_ip'];
// Protect input
$v_chain = escapeshellarg($_POST['v_chain']);
$v_ip = escapeshellarg($_POST['v_ip']);
// Add firewall ban
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-firewall-ban', [$v_ip, $v_chain]);
exec (VESTA_CMD."v-add-firewall-ban ".$v_ip." ".$v_chain, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Flush field values on success

20
web/add/firewall/index.php
View file

@ -20,7 +20,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -39,17 +39,21 @@ if (!empty($_POST['ok'])) {
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
}
$v_action = $_POST['v_action'];
$v_protocol = $_POST['v_protocol'];
$v_port = str_replace(' ', ',', $_POST['v_port']);
// Protect input
$v_action = escapeshellarg($_POST['v_action']);
$v_protocol = escapeshellarg($_POST['v_protocol']);
$v_port = str_replace(" ",",", $_POST['v_port']);
$v_port = preg_replace('/\,+/', ',', $v_port);
$v_port = trim($v_port, ',');
$v_ip = $_POST['v_ip'];
$v_comment = $_POST['v_comment'];
$v_port = trim($v_port, ",");
$v_port = escapeshellarg($v_port);
$v_ip = escapeshellarg($_POST['v_ip']);
$v_comment = escapeshellarg($_POST['v_comment']);
// Add firewall rule
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-firewall-rule', [$v_action, $v_ip, $v_port, $v_protocol, $v_comment]);
exec (VESTA_CMD."v-add-firewall-rule ".$v_action." ".$v_ip." ".$v_port." ".$v_protocol." ".$v_comment, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Flush field values on success

32
web/add/ip/index.php
View file

@ -19,7 +19,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -38,12 +38,13 @@ if (!empty($_POST['ok'])) {
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
}
$v_ip = $_POST['v_ip'];
$v_netmask = $_POST['v_netmask'];
$v_name = $_POST['v_name'];
$v_nat = $_POST['v_nat'];
$v_interface = $_POST['v_interface'];
$v_owner = $_POST['v_owner'];
// Protect input
$v_ip = escapeshellarg($_POST['v_ip']);
$v_netmask = escapeshellarg($_POST['v_netmask']);
$v_name = escapeshellarg($_POST['v_name']);
$v_nat = escapeshellarg($_POST['v_nat']);
$v_interface = escapeshellarg($_POST['v_interface']);
$v_owner = escapeshellarg($_POST['v_owner']);
$v_shared = $_POST['v_shared'];
// Check shared checkmark
@ -52,11 +53,16 @@ if (!empty($_POST['ok'])) {
} else {
$ip_status = 'dedicated';
$v_dedicated = 'yes';
}
// Add IP
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-sys-ip', [$v_ip, $v_netmask, $v_interface, $v_owner, $ip_status, $v_name, $v_nat]);
exec (VESTA_CMD."v-add-sys-ip ".$v_ip." ".$v_netmask." ".$v_interface." ".$v_owner." '".$ip_status."' ".$v_name." ".$v_nat, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
$v_owner = $_POST['v_owner'];
$v_interface = $_POST['v_interface'];
}
// Flush field values on success
@ -76,12 +82,14 @@ include($_SERVER['DOCUMENT_ROOT'].'/templates/header.html');
top_panel($user,$TAB);
// List network interfaces
v_exec('v-list-sys-interfaces', ['json'], false, $output);
$interfaces = json_decode($output, true);
exec (VESTA_CMD."v-list-sys-interfaces 'json'", $output, $return_var);
$interfaces = json_decode(implode('', $output), true);
unset($output);
// List users
v_exec('v-list-sys-users', ['json'], false, $output);
$users = json_decode($output, true);
exec (VESTA_CMD."v-list-sys-users 'json'", $output, $return_var);
$users = json_decode(implode('', $output), true);
unset($output);
// Display body
include($_SERVER['DOCUMENT_ROOT'].'/templates/admin/add_ip.html');

62
web/add/mail/index.php
View file

@ -14,7 +14,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -53,16 +53,19 @@ if (!empty($_POST['ok'])) {
// Set domain name to lowercase and remove www prefix
$v_domain = preg_replace("/^www./i", "", $_POST['v_domain']);
$v_domain = escapeshellarg($v_domain);
$v_domain = strtolower($v_domain);
// Add mail domain
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-mail-domain', [$user, $v_domain, $v_antispam, $v_antivirus, $v_dkim]);
exec (VESTA_CMD."v-add-mail-domain ".$user." ".$v_domain." ".$v_antispam." ".$v_antivirus." ".$v_dkim, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Flush field values on success
if (empty($_SESSION['error_msg'])) {
$_SESSION['ok_msg'] = __('MAIL_DOMAIN_CREATED_OK', htmlentities($_POST['v_domain']), htmlentities($_POST['v_domain']));
$_SESSION['ok_msg'] = __('MAIL_DOMAIN_CREATED_OK',htmlentities($_POST['v_domain']),htmlentities($_POST['v_domain']));
unset($v_domain);
}
}
@ -74,7 +77,7 @@ if (!empty($_POST['ok_acc'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -89,16 +92,17 @@ if (!empty($_POST['ok_acc'])) {
$error_msg = $error_msg.", ".$error;
}
}
$_SESSION['error_msg'] = __('Field "%s" can not be blank.', $error_msg);
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
}
// Protect input
$v_domain = strtolower($_POST['v_domain']);
$v_account = $_POST['v_account'];
$v_quota = $_POST['v_quota'];
$v_domain = escapeshellarg($_POST['v_domain']);
$v_domain = strtolower($v_domain);
$v_account = escapeshellarg($_POST['v_account']);
$v_quota = escapeshellarg($_POST['v_quota']);
$v_aliases = $_POST['v_aliases'];
$v_fwd = $_POST['v_fwd'];
if (empty($_POST['v_quota'])) $v_quota = '0';
if (empty($_POST['v_quota'])) $v_quota = 0;
if ((!empty($_POST['v_quota'])) || (!empty($_POST['v_aliases'])) || (!empty($_POST['v_fwd'])) ) $v_adv = 'yes';
// Add Mail Account
@ -107,55 +111,65 @@ if (!empty($_POST['ok_acc'])) {
$fp = fopen($v_password, "w");
fwrite($fp, $_POST['v_password']."\n");
fclose($fp);
v_exec('v-add-mail-account', [$user, $v_domain, $v_account, $v_password, $v_quota]);
exec (VESTA_CMD."v-add-mail-account ".$user." ".$v_domain." ".$v_account." ".$v_password." ".$v_quota, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
unlink($v_password);
$v_password = $_POST['v_password'];
$v_password = escapeshellarg($_POST['v_password']);
}
// Add Aliases
if ((!empty($_POST['v_aliases'])) && (empty($_SESSION['error_msg']))) {
$valiases = preg_replace('/\n/', ' ', $_POST['v_aliases']);
$valiases = preg_replace('/,/', ' ', $valiases);
$valiases = preg_replace("/\n/", " ", $_POST['v_aliases']);
$valiases = preg_replace("/,/", " ", $valiases);
$valiases = preg_replace('/\s+/', ' ',$valiases);
$valiases = trim($valiases);
$aliases = explode(' ', $valiases);
$aliases = explode(" ", $valiases);
foreach ($aliases as $alias) {
$alias = escapeshellarg($alias);
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-mail-account-alias', [$user, $v_domain, $v_account, $alias]);
exec (VESTA_CMD."v-add-mail-account-alias ".$user." ".$v_domain." ".$v_account." ".$alias, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
}
}
// Add Forwarders
if ((!empty($_POST['v_fwd'])) && (empty($_SESSION['error_msg']))) {
$vfwd = preg_replace('/\n/', ' ', $_POST['v_fwd']);
$vfwd = preg_replace('/,/', ' ', $vfwd);
$vfwd = preg_replace("/\n/", " ", $_POST['v_fwd']);
$vfwd = preg_replace("/,/", " ", $vfwd);
$vfwd = preg_replace('/\s+/', ' ',$vfwd);
$vfwd = trim($vfwd);
$fwd = explode(' ', $vfwd);
$fwd = explode(" ", $vfwd);
foreach ($fwd as $forward) {
$forward = escapeshellarg($forward);
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-mail-account-forward', [$user, $v_domain, $v_account, $forward]);
exec (VESTA_CMD."v-add-mail-account-forward ".$user." ".$v_domain." ".$v_account." ".$forward, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
}
}
// Add fwd_only flag
if ((!empty($_POST['v_fwd_only'])) && (empty($_SESSION['error_msg']))) {
v_exec('v-add-mail-account-fwd-only', [$user, $v_domain, $v_account]);
exec (VESTA_CMD."v-add-mail-account-fwd-only ".$user." ".$v_domain." ".$v_account, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Get webmail url
if (empty($_SESSION['error_msg'])) {
list($http_host, $port) = explode(':', $_SERVER['HTTP_HOST'].':');
$webmail = "http://$http_host/webmail/";
list($http_host, $port) = explode(':', $_SERVER["HTTP_HOST"].":");
$webmail = "http://".$http_host."/webmail/";
if (!empty($_SESSION['MAIL_URL'])) $webmail = $_SESSION['MAIL_URL'];
}
// Flush field values on success
if (empty($_SESSION['error_msg'])) {
$_SESSION['ok_msg'] = __('MAIL_ACCOUNT_CREATED_OK', htmlentities(strtolower($_POST['v_account'])), htmlentities($_POST['v_domain']), htmlentities(strtolower($_POST['v_account'])), htmlentities($_POST['v_domain']));
$_SESSION['ok_msg'] .= " / <a href=$webmail target='_blank'>" . __('open webmail') . '</a>';
$_SESSION['ok_msg'] = __('MAIL_ACCOUNT_CREATED_OK',htmlentities(strtolower($_POST['v_account'])),htmlentities($_POST[v_domain]),htmlentities(strtolower($_POST['v_account'])),htmlentities($_POST[v_domain]));
$_SESSION['ok_msg'] .= " / <a href=".$webmail." target='_blank'>" . __('open webmail') . "</a>";
unset($v_account);
unset($v_password);
unset($v_password);

152
web/add/package/index.php
View file

@ -19,7 +19,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -57,23 +57,24 @@ if (!empty($_POST['ok'])) {
$_SESSION['error_msg'] = __('Field "%s" can not be blank.',$error_msg);
}
$v_package = $_POST['v_package'];
$v_web_template = $_POST['v_web_template'];
$v_backend_template = $_POST['v_backend_template'];
$v_proxy_template = $_POST['v_proxy_template'];
$v_dns_template = $_POST['v_dns_template'];
$v_shell = $_POST['v_shell'];
$v_web_domains = $_POST['v_web_domains'];
$v_web_aliases = $_POST['v_web_aliases'];
$v_dns_domains = $_POST['v_dns_domains'];
$v_dns_records = $_POST['v_dns_records'];
$v_mail_domains = $_POST['v_mail_domains'];
$v_mail_accounts = $_POST['v_mail_accounts'];
$v_databases = $_POST['v_databases'];
$v_cron_jobs = $_POST['v_cron_jobs'];
$v_backups = $_POST['v_backups'];
$v_disk_quota = $_POST['v_disk_quota'];
$v_bandwidth = $_POST['v_bandwidth'];
// Protect input
$v_package = escapeshellarg($_POST['v_package']);
$v_web_template = escapeshellarg($_POST['v_web_template']);
$v_backend_template = escapeshellarg($_POST['v_backend_template']);
$v_proxy_template = escapeshellarg($_POST['v_proxy_template']);
$v_dns_template = escapeshellarg($_POST['v_dns_template']);
$v_shell = escapeshellarg($_POST['v_shell']);
$v_web_domains = escapeshellarg($_POST['v_web_domains']);
$v_web_aliases = escapeshellarg($_POST['v_web_aliases']);
$v_dns_domains = escapeshellarg($_POST['v_dns_domains']);
$v_dns_records = escapeshellarg($_POST['v_dns_records']);
$v_mail_domains = escapeshellarg($_POST['v_mail_domains']);
$v_mail_accounts = escapeshellarg($_POST['v_mail_accounts']);
$v_databases = escapeshellarg($_POST['v_databases']);
$v_cron_jobs = escapeshellarg($_POST['v_cron_jobs']);
$v_backups = escapeshellarg($_POST['v_backups']);
$v_disk_quota = escapeshellarg($_POST['v_disk_quota']);
$v_bandwidth = escapeshellarg($_POST['v_bandwidth']);
$v_ns1 = trim($_POST['v_ns1'], '.');
$v_ns2 = trim($_POST['v_ns2'], '.');
$v_ns3 = trim($_POST['v_ns3'], '.');
@ -89,46 +90,43 @@ if (!empty($_POST['ok'])) {
if (!empty($v_ns6)) $v_ns .= ",".$v_ns6;
if (!empty($v_ns7)) $v_ns .= ",".$v_ns7;
if (!empty($v_ns8)) $v_ns .= ",".$v_ns8;
$v_time = date('H:i:s');
$v_date = date('Y-m-d');
$v_ns = escapeshellarg($v_ns);
$v_time = escapeshellarg(date('H:i:s'));
$v_date = escapeshellarg(date('Y-m-d'));
// Create temporary dir
if (empty($_SESSION['error_msg'])) {
exec('mktemp -d', $output, $return_var);
exec ('mktemp -d', $output, $return_var);
$tmpdir = $output[0];
check_return_code($return_var, $output);
check_return_code($return_var,$output);
unset($output);
}
// Create package file
if (empty($_SESSION['error_msg'])) {
$a_pkg = [
'WEB_TEMPLATE' => $v_web_template,
'BACKEND_TEMPLATE' => !empty($_SESSION['WEB_BACKEND']) ? $v_backend_template : null,
'PROXY_TEMPLATE' => !empty($_SESSION['PROXY_SYSTEM']) ? $v_proxy_template : null,
'DNS_TEMPLATE' => $v_dns_template,
'WEB_DOMAINS' => $v_web_domains,
'WEB_ALIASES' => $v_web_aliases,
'DNS_DOMAINS' => $v_dns_domains,
'DNS_RECORDS' => $v_dns_records,
'MAIL_DOMAINS' => $v_mail_domains,
'MAIL_ACCOUNTS' => $v_mail_accounts,
'DATABASES' => $v_databases,
'CRON_JOBS' => $v_cron_jobs,
'DISK_QUOTA' => $v_disk_quota,
'BANDWIDTH' => $v_bandwidth,
'NS' => $v_ns,
'SHELL' => $v_shell,
'BACKUPS' => $v_backups,
'TIME' => $v_time,
'DATE' => $v_date,
];
$pkg = '';
foreach ($a_pkg as $key => $value) {
if (is_null($value)) continue;
$pkg .= $key . '=' . escapeshellarg($value) . "\n";
$pkg = "WEB_TEMPLATE=".$v_web_template."\n";
if (!empty($_SESSION['WEB_BACKEND'])) {
$pkg .= "BACKEND_TEMPLATE=".$v_backend_template."\n";
}
if (!empty($_SESSION['PROXY_SYSTEM'])) {
$pkg .= "PROXY_TEMPLATE=".$v_proxy_template."\n";
}
$pkg .= "DNS_TEMPLATE=".$v_dns_template."\n";
$pkg .= "WEB_DOMAINS=".$v_web_domains."\n";
$pkg .= "WEB_ALIASES=".$v_web_aliases."\n";
$pkg .= "DNS_DOMAINS=".$v_dns_domains."\n";
$pkg .= "DNS_RECORDS=".$v_dns_records."\n";
$pkg .= "MAIL_DOMAINS=".$v_mail_domains."\n";
$pkg .= "MAIL_ACCOUNTS=".$v_mail_accounts."\n";
$pkg .= "DATABASES=".$v_databases."\n";
$pkg .= "CRON_JOBS=".$v_cron_jobs."\n";
$pkg .= "DISK_QUOTA=".$v_disk_quota."\n";
$pkg .= "BANDWIDTH=".$v_bandwidth."\n";
$pkg .= "NS=".$v_ns."\n";
$pkg .= "SHELL=".$v_shell."\n";
$pkg .= "BACKUPS=".$v_backups."\n";
$pkg .= "TIME=".$v_time."\n";
$pkg .= "DATE=".$v_date."\n";
$fp = fopen($tmpdir."/".$_POST['v_package'].".pkg", 'w');
fwrite($fp, $pkg);
@ -137,15 +135,18 @@ if (!empty($_POST['ok'])) {
// Add new package
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-user-package', [$tmpdir, $v_package]);
exec (VESTA_CMD."v-add-user-package ".$tmpdir." ".$v_package, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Remove tmpdir
safe_exec('rm', ['-rf', $tmpdir]);
// Remove tmpdir
exec ('rm -rf '.$tmpdir, $output, $return_var);
unset($output);
// Flush field values on success
if (empty($_SESSION['error_msg'])) {
$_SESSION['ok_msg'] = __('PACKAGE_CREATED_OK', htmlentities($_POST['v_package']), htmlentities($_POST['v_package']));
$_SESSION['ok_msg'] = __('PACKAGE_CREATED_OK',htmlentities($_POST['v_package']),htmlentities($_POST['v_package']));
unset($v_package);
}
@ -159,28 +160,33 @@ include($_SERVER['DOCUMENT_ROOT'].'/templates/header.html');
top_panel($user,$TAB);
// List web temmplates
v_exec('v-list-web-templates', ['json'], false, $output);
$web_templates = json_decode($output, true);
exec (VESTA_CMD."v-list-web-templates json", $output, $return_var);
$web_templates = json_decode(implode('', $output), true);
unset($output);
// List web templates for backend
if (!empty($_SESSION['WEB_BACKEND'])) {
v_exec('v-list-web-templates-backend', ['json'], false, $output);
$backend_templates = json_decode($output, true);
exec (VESTA_CMD."v-list-web-templates-backend json", $output, $return_var);
$backend_templates = json_decode(implode('', $output), true);
unset($output);
}
// List web templates for proxy
if (!empty($_SESSION['PROXY_SYSTEM'])) {
v_exec('v-list-web-templates-proxy', ['json'], false, $output);
$proxy_templates = json_decode($output, true);
exec (VESTA_CMD."v-list-web-templates-proxy json", $output, $return_var);
$proxy_templates = json_decode(implode('', $output), true);
unset($output);
}
// List DNS templates
v_exec('v-list-dns-templates', ['json'], false, $output);
$dns_templates = json_decode($output, true);
exec (VESTA_CMD."v-list-dns-templates json", $output, $return_var);
$dns_templates = json_decode(implode('', $output), true);
unset($output);
// List system shells
v_exec('v-list-sys-shells', ['json'], false, $output);
$shells = json_decode($output, true);
exec (VESTA_CMD."v-list-sys-shells json", $output, $return_var);
$shells = json_decode(implode('', $output), true);
unset($output);
// Set default values
if (empty($v_web_template)) $v_web_template = 'default';
@ -188,17 +194,17 @@ if (empty($v_backend_template)) $v_backend_template = 'default';
if (empty($v_proxy_template)) $v_proxy_template = 'default';
if (empty($v_dns_template)) $v_dns_template = 'default';
if (empty($v_shell)) $v_shell = 'nologin';
if (empty($v_web_domains)) $v_web_domains = '1';
if (empty($v_web_aliases)) $v_web_aliases = '1';
if (empty($v_dns_domains)) $v_dns_domains = '1';
if (empty($v_dns_records)) $v_dns_records = '1';
if (empty($v_mail_domains)) $v_mail_domains = '1';
if (empty($v_mail_accounts)) $v_mail_accounts = '1';
if (empty($v_databases)) $v_databases = '1';
if (empty($v_cron_jobs)) $v_cron_jobs = '1';
if (empty($v_backups)) $v_backups = '1';
if (empty($v_disk_quota)) $v_disk_quota = '1000';
if (empty($v_bandwidth)) $v_bandwidth = '1000';
if (empty($v_web_domains)) $v_web_domains = "'1'";
if (empty($v_web_aliases)) $v_web_aliases = "'1'";
if (empty($v_dns_domains)) $v_dns_domains = "'1'";
if (empty($v_dns_records)) $v_dns_records = "'1'";
if (empty($v_mail_domains)) $v_mail_domains = "'1'";
if (empty($v_mail_accounts)) $v_mail_accounts = "'1'";
if (empty($v_databases)) $v_databases = "'1'";
if (empty($v_cron_jobs)) $v_cron_jobs = "'1'";
if (empty($v_backups)) $v_backups = "'1'";
if (empty($v_disk_quota)) $v_disk_quota = "'1000'";
if (empty($v_bandwidth)) $v_bandwidth = "'1000'";
if (empty($v_ns1)) $v_ns1 = 'ns1.example.ltd';
if (empty($v_ns2)) $v_ns2 = 'ns2.example.ltd';

38
web/add/user/index.php
View file

@ -19,7 +19,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check empty fields
@ -48,15 +48,16 @@ if (!empty($_POST['ok'])) {
// Check password length
if (empty($_SESSION['error_msg'])) {
$pw_len = strlen($_POST['v_password']);
if ($pw_len < 6) $_SESSION['error_msg'] = __('Password is too short.', $error_msg);
if ($pw_len < 6 ) $_SESSION['error_msg'] = __('Password is too short.',$error_msg);
}
$v_username = $_POST['v_username'];
$v_email = $_POST['v_email'];
$v_package = $_POST['v_package'];
$v_language = $_POST['v_language'];
$v_fname = $_POST['v_fname'];
$v_lname = $_POST['v_lname'];
// Protect input
$v_username = escapeshellarg($_POST['v_username']);
$v_email = escapeshellarg($_POST['v_email']);
$v_package = escapeshellarg($_POST['v_package']);
$v_language = escapeshellarg($_POST['v_language']);
$v_fname = escapeshellarg($_POST['v_fname']);
$v_lname = escapeshellarg($_POST['v_lname']);
$v_notify = $_POST['v_notify'];
@ -66,14 +67,18 @@ if (!empty($_POST['ok'])) {
$fp = fopen($v_password, "w");
fwrite($fp, $_POST['v_password']."\n");
fclose($fp);
v_exec('v-add-user', [$v_username, $v_password, $v_email, $v_package, $v_fname, $v_lname]);
exec (VESTA_CMD."v-add-user ".$v_username." ".$v_password." ".$v_email." ".$v_package." ".$v_fname." ".$v_lname, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
unlink($v_password);
$v_password = $_POST['v_password'];
$v_password = escapeshellarg($_POST['v_password']);
}
// Set language
if (empty($_SESSION['error_msg'])) {
v_exec('v-change-user-language', [$v_username, $v_language]);
exec (VESTA_CMD."v-change-user-language ".$v_username." ".$v_language, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Send email to the new user
@ -81,6 +86,7 @@ if (!empty($_POST['ok'])) {
$to = $_POST['v_notify'];
$subject = _translate($_POST['v_language'],"Welcome to Vesta Control Panel");
$hostname = exec('hostname');
unset($output);
$from = _translate($_POST['v_language'],'MAIL_FROM',$hostname);
if (!empty($_POST['v_fname'])) {
$mailtext = _translate($_POST['v_language'],'GREETINGS_GORDON_FREEMAN',$_POST['v_fname'],$_POST['v_lname']);
@ -112,13 +118,15 @@ include($_SERVER['DOCUMENT_ROOT'].'/templates/header.html');
top_panel($user,$TAB);
// List hosting packages
$return_var = v_exec('v-list-user-packages', ['json'], false, $output);
exec (VESTA_CMD."v-list-user-packages json", $output, $return_var);
check_error($return_var);
$data = json_decode($output, true);
$data = json_decode(implode('', $output), true);
unset($output);
// List languages
v_exec('v-list-sys-languages', ['json'], false, $output);
$languages = json_decode($output, true);
exec (VESTA_CMD."v-list-sys-languages json", $output, $return_var);
$languages = json_decode(implode('', $output), true);
unset($output);
// Display body
include($_SERVER['DOCUMENT_ROOT'].'/templates/admin/add_user.html');

108
web/add/web/index.php
View file

@ -13,7 +13,7 @@ if (!empty($_POST['ok'])) {
// Check token
if ((!isset($_POST['token'])) || ($_SESSION['token'] != $_POST['token'])) {
header('location: /login/');
exit;
exit();
}
// Check for empty fields
@ -42,10 +42,11 @@ if (!empty($_POST['ok'])) {
// Set domain to lowercase and remove www prefix
$v_domain = preg_replace("/^www\./i", "", $_POST['v_domain']);
$v_domain = escapeshellarg($v_domain);
$v_domain = strtolower($v_domain);
// Define domain ip address
$v_ip = $_POST['v_ip'];
$v_ip = escapeshellarg($_POST['v_ip']);
// Define domain aliases
$v_aliases = $_POST['v_aliases'];
@ -53,10 +54,11 @@ if (!empty($_POST['ok'])) {
$aliases = preg_replace("/\r/", ",", $aliases);
$aliases = preg_replace("/\t/", ",", $aliases);
$aliases = preg_replace("/ /", ",", $aliases);
$aliases_arr = explode(',', $aliases);
$aliases_arr = explode(",", $aliases);
$aliases_arr = array_unique($aliases_arr);
$aliases_arr = array_filter($aliases_arr);
$aliases = implode(',', $aliases_arr);
$aliases = implode(",",$aliases_arr);
$aliases = escapeshellarg($aliases);
// Define proxy extentions
$v_proxy_ext = $_POST['v_proxy_ext'];
@ -64,10 +66,11 @@ if (!empty($_POST['ok'])) {
$proxy_ext = preg_replace("/\r/", ",", $proxy_ext);
$proxy_ext = preg_replace("/\t/", ",", $proxy_ext);
$proxy_ext = preg_replace("/ /", ",", $proxy_ext);
$proxy_ext_arr = explode(',', $proxy_ext);
$proxy_ext_arr = explode(",", $proxy_ext);
$proxy_ext_arr = array_unique($proxy_ext_arr);
$proxy_ext_arr = array_filter($proxy_ext_arr);
$proxy_ext = implode(',', $proxy_ext_arr);
$proxy_ext = implode(",",$proxy_ext_arr);
$proxy_ext = escapeshellarg($proxy_ext);
// Define other options
$v_elog = $_POST['v_elog'];
@ -76,7 +79,7 @@ if (!empty($_POST['ok'])) {
$v_ssl_key = $_POST['v_ssl_key'];
$v_ssl_ca = $_POST['v_ssl_ca'];
$v_ssl_home = $data[$v_domain]['SSL_HOME'];
$v_stats = $_POST['v_stats'];
$v_stats = escapeshellarg($_POST['v_stats']);
$v_stats_user = $data[$v_domain]['STATS_USER'];
$v_stats_password = $data[$v_domain]['STATS_PASSWORD'];
$v_ftp = $_POST['v_ftp'];
@ -101,32 +104,44 @@ if (!empty($_POST['ok'])) {
// Add web domain
if (empty($_SESSION['error_msg'])) {
v_exec('v-add-web-domain', [$user, $v_domain, $v_ip, 'no', $aliases, $proxy_ext]);
exec (VESTA_CMD."v-add-web-domain ".$user." ".$v_domain." ".$v_ip." 'no' ".$aliases." ".$proxy_ext, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
$domain_added = empty($_SESSION['error_msg']);
}
// Add DNS domain
if (($_POST['v_dns'] == 'on') && (empty($_SESSION['error_msg']))) {
v_exec('v-add-dns-domain', [$user, $v_domain, $v_ip]);
exec (VESTA_CMD."v-add-dns-domain ".$user." ".$v_domain." ".$v_ip, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Add DNS for domain aliases
if (($_POST['v_dns'] == 'on') && (empty($_SESSION['error_msg']))) {
foreach ($aliases_arr as $alias) {
if ($alias != 'www.' . $_POST['v_domain']) {
v_exec('v-add-dns-on-web-alias', [$user, $alias, $v_ip, 'no']);
if ($alias != "www.".$_POST['v_domain']) {
$alias = escapeshellarg($alias);
exec (VESTA_CMD."v-add-dns-on-web-alias ".$user." ".$alias." ".$v_ip." 'no'", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
}
}
// Add mail domain
if (($_POST['v_mail'] == 'on') && (empty($_SESSION['error_msg']))) {
v_exec('v-add-mail-domain', [$user, $v_domain]);
exec (VESTA_CMD."v-add-mail-domain ".$user." ".$v_domain, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Delete proxy support
if ((!empty($_SESSION['PROXY_SYSTEM'])) && ($_POST['v_proxy'] == 'off') && (empty($_SESSION['error_msg']))) {
v_exec('v-delete-web-domain-proxy', [$user, $v_domain, 'no']);
$ext = escapeshellarg($ext);
exec (VESTA_CMD."v-delete-web-domain-proxy ".$user." ".$v_domain." 'no'", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Add SSL certificates
@ -159,46 +174,60 @@ if (!empty($_POST['ok'])) {
fclose($fp);
}
$v_ssl_home = $_POST['v_ssl_home'];
v_exec('v-add-web-domain-ssl', [$user, $v_domain, $tmpdir, $v_ssl_home, 'no']);
$v_ssl_home = escapeshellarg($_POST['v_ssl_home']);
exec (VESTA_CMD."v-add-web-domain-ssl ".$user." ".$v_domain." ".$tmpdir." ".$v_ssl_home." 'no'", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Add web stats
if ((!empty($_POST['v_stats'])) && ($_POST['v_stats'] != 'none' ) && (empty($_SESSION['error_msg']))) {
$v_stats = $_POST['v_stats'];
v_exec('v-add-web-domain-stats', [$user, $v_domain, $v_stats]);
$v_stats = escapeshellarg($_POST['v_stats']);
exec (VESTA_CMD."v-add-web-domain-stats ".$user." ".$v_domain." ".$v_stats, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Add web stats password
if ((!empty($_POST['v_stats_user'])) && (empty($_SESSION['error_msg']))) {
$v_stats_user = $_POST['v_stats_user'];
$v_stats_user = escapeshellarg($_POST['v_stats_user']);
$v_stats_password = tempnam("/tmp","vst");
$fp = fopen($v_stats_password, "w");
fwrite($fp, $_POST['v_stats_password']."\n");
fclose($fp);
v_exec('v-add-web-domain-stats-user', [$user, $v_domain, $v_stats_user, $v_stats_password]);
exec (VESTA_CMD."v-add-web-domain-stats-user ".$user." ".$v_domain." ".$v_stats_user." ".$v_stats_password, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
unlink($v_stats_password);
$v_stats_password = $_POST['v_stats_password'];
$v_stats_password = escapeshellarg($_POST['v_stats_password']);
}
// Restart DNS server
if (($_POST['v_dns'] == 'on') && (empty($_SESSION['error_msg']))) {
v_exec('v-restart-dns');
exec (VESTA_CMD."v-restart-dns", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Restart web server
if (empty($_SESSION['error_msg'])) {
v_exec('v-restart-web');
exec (VESTA_CMD."v-restart-web", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Restart backend server
//if ((!empty($_SESSION['WEB_BACKEND'])) && (empty($_SESSION['error_msg']))) {
// v_exec('v-restart-backend');
// exec (VESTA_CMD."v-restart-web-backend", $output, $return_var);
// check_return_code($return_var,$output);
// unset($output);
//}
// Restart proxy server
if ((!empty($_SESSION['PROXY_SYSTEM'])) && ($_POST['v_proxy'] == 'on') && (empty($_SESSION['error_msg']))) {
v_exec('v-restart-proxy');
exec (VESTA_CMD."v-restart-proxy", $output, $return_var);
check_return_code($return_var,$output);
unset($output);
}
// Add FTP
@ -236,19 +265,22 @@ if (!empty($_POST['ok'])) {
$v_ftp_user_data['v_ftp_user'] = preg_replace("/^".$user."_/i", "", $v_ftp_user_data['v_ftp_user']);
$v_ftp_username = $v_ftp_user_data['v_ftp_user'];
$v_ftp_username_full = $user . '_' . $v_ftp_user_data['v_ftp_user'];
$v_ftp_user = escapeshellarg($v_ftp_user_data['v_ftp_user']);
if ($domain_added) {
$v_ftp_path = trim($v_ftp_user_data['v_ftp_path']);
$v_ftp_path = escapeshellarg(trim($v_ftp_user_data['v_ftp_path']));
$v_ftp_password = tempnam("/tmp","vst");
$fp = fopen($v_ftp_password, "w");
fwrite($fp, $v_ftp_user_data['v_ftp_password']."\n");
fclose($fp);
v_exec('v-add-web-domain-ftp', [$user, $v_domain, $v_ftp_username, $v_ftp_password, $v_ftp_path]);
exec (VESTA_CMD."v-add-web-domain-ftp ".$user." ".$v_domain." ".$v_ftp_username." ".$v_ftp_password . " " . $v_ftp_path, $output, $return_var);
check_return_code($return_var,$output);
unset($output);
unlink($v_ftp_password);
if ((!empty($v_ftp_user_data['v_ftp_email'])) && (empty($_SESSION['error_msg']))) {
$to = $v_ftp_user_data['v_ftp_email'];
$subject = __('FTP login credentials');
$from = __('MAIL_FROM', $_POST['v_domain']);
$mailtext = __('FTP_ACCOUNT_READY', $_POST['v_domain'], $user, $v_ftp_username, $v_ftp_user_data['v_ftp_password']);
$subject = __("FTP login credentials");
$from = __('MAIL_FROM',$_POST['v_domain']);
$mailtext = __('FTP_ACCOUNT_READY',$_POST['v_domain'],$user,$v_ftp_user_data['v_ftp_user'],$v_ftp_user_data['v_ftp_password']);
send_email($to, $subject, $mailtext, $from);
unset($v_ftp_email);
}
@ -257,13 +289,13 @@ if (!empty($_POST['ok'])) {
}
if ($return_var == 0) {
$v_ftp_password = '••••••••';
$v_ftp_password = "••••••••";
$v_ftp_user_data['is_new'] = 0;
} else {
$v_ftp_user_data['is_new'] = 1;
}
$v_ftp_username = preg_replace("/^{$user}_/", '', $v_ftp_user_data['v_ftp_user']);
$v_ftp_username = preg_replace("/^".$user."_/", "", $v_ftp_user_data['v_ftp_user']);
$v_ftp_users_updated[] = array(
'is_new' => $v_ftp_user_data['is_new'],
'v_ftp_user' => $return_var == 0 ? $v_ftp_username_full : $v_ftp_username,
@ -279,8 +311,8 @@ if (!empty($_POST['ok'])) {
if (!empty($_SESSION['error_msg']) && $domain_added) {
$_SESSION['ok_msg'] = __('WEB_DOMAIN_CREATED_OK',htmlentities($_POST[v_domain]),htmlentities($_POST[v_domain]));
$_SESSION['flash_error_msg'] = $_SESSION['error_msg'];
$url = '/edit/web/?domain=' . strtolower(preg_replace('/^www\./i', '', $_POST['v_domain']));
header("Location: $url");
$url = '/edit/web/?domain='.strtolower(preg_replace("/^www\./i", "", $_POST['v_domain']));
header('Location: ' . $url);
exit;
}
}
@ -312,12 +344,14 @@ $v_ftp_user_prepath = $panel[$user]['HOME'] . "/web";
$v_ftp_email = $panel[$user]['CONTACT'];
// List IP addresses
v_exec('v-list-user-ips', [$user, 'json'], false, $output);
$ips = json_decode($output, true);
exec (VESTA_CMD."v-list-user-ips ".$user." json", $output, $return_var);
$ips = json_decode(implode('', $output), true);
unset($output);
// List web stat engines
v_exec('v-list-web-stats', ['json'], false, $output);
$stats = json_decode($output, true);
exec (VESTA_CMD."v-list-web-stats json", $output, $return_var);
$stats = json_decode(implode('', $output), true);
unset($output);
// Display body
include($_SERVER['DOCUMENT_ROOT'].'/templates/admin/add_web.html');