Skip to content

Commit

Permalink
remove unused hidden-settings; correct setting-language-strings-layou…
Browse files Browse the repository at this point in the history 
…t; add blacklist for usernames when creating a Customer which may lead to internal issues

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>
  • Loading branch information
@d00p
d00p committed Mar 3, 2024
1 parent 70b3e61 commit d86da23
Show file tree
Hide file tree
Showing 5 changed files with 37 additions and 18 deletions.
12 changes: 0 additions & 12 deletions actions/admin/settings/120.system.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -180,18 +180,6 @@
'default' => true,
'save_method' => 'storeSettingField'
],
'system_httpuser' => [
'settinggroup' => 'system',
'varname' => 'httpuser',
'type' => 'hidden',
'default' => 'www-data'
],
'system_httpgroup' => [
'settinggroup' => 'system',
'varname' => 'httpgroup',
'type' => 'hidden',
'default' => 'www-data'
],
'system_report_enable' => [
'label' => lng('serversettings.report.report'),
'settinggroup' => 'system',
Expand Down
22 changes: 22 additions & 0 deletions lib/Froxlor/Api/Commands/Customers.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -460,6 +460,28 @@ public function add()
if (function_exists('posix_getpwnam') && !in_array("posix_getpwnam", explode(",", ini_get('disable_functions'))) && posix_getpwnam($loginname)) {
Response::standardError('loginnameissystemaccount', $loginname, true);
}

// blacklist some system-internal names that might lead to issues
Database::needSqlData();
$sqldata = Database::getSqlData();
Database::needRoot(true);
Database::needSqlData();
$sqlrdata = Database::getSqlData();
$login_blacklist = [
'root',
'admin',
'froxroot',
'froxlor',
$sqldata['user'],
$sqldata['db'],
$sqlrdata['user'],
];
unset($sqldata);
usnet($sqlrdata);
$login_blacklist = array_unique($login_blacklist);
if (in_array($loginname, $login_blacklist)) {
Response::standardError('loginnameisreservedname', $loginname, true);
}
} else {
$accountnumber = intval(Settings::Get('system.lastaccountnumber')) + 1;
$loginname = Settings::Get('customer.accountprefix') . $accountnumber;
Expand Down
1 change: 1 addition & 0 deletions lib/Froxlor/PhpHelper.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -416,6 +416,7 @@ public static function cleanGlobal(array &$global, AntiXSS &$antiXss)
'mysql_unprivileged_pass',
'admin_pass',
'admin_pass_confirm',
'panel_password_special_char',
];
if (!empty($global)) {
$tmp = $global;
Expand Down
10 changes: 7 additions & 3 deletions lng/de.lng.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -408,7 +408,10 @@
'description' => 'Hier kann ein eigenes RSS-Feed angegeben werden, welches den Kunden auf dem Dashboard angezeigt wird.<br /><small>Leerlassen um das offizielle Froxlor Newsfeed (https://inside.froxlor.org/news/) zu verwenden.</small>',
],
'movetoadmin' => 'Kunde verschieben',
'movecustomertoadmin' => 'Verschiebe den Kunden zum angegebenen Admin/Reseller<br /><small>Leerlassen für keine Änderung.<br />Wird der gewünschte Admin/Reseller hier nicht aufgelistet, hat er sein Kunden-Kontigent erreicht.</small>',
'movecustomertoadmin' => [
'title' => 'Verschiebe den Kunden zum angegebenen Admin/Reseller',
'description' => 'Leerlassen für keine Änderung.<br />Wird der gewünschte Admin/Reseller hier nicht aufgelistet, hat er sein Kunden-Kontigent erreicht.',
],
'note' => 'Hinweis',
'mod_fcgid_umask' => [
'title' => 'Umask (Standard: 022)',
Expand All @@ -432,8 +435,8 @@
'description' => 'Die optionale "includeSubDomains" Direktive, wenn vorhanden, signalisiert dem UA, dass die HSTS Regel für diese Domain und auch jede Subdomain dieser gilt.',
],
'domain_hsts_preload' => [
'title' => 'Füge Domain in die <a href="https://hstspreload.org/" target="_blank">HSTS preload Liste</a> hinzu',
'description' => 'Wenn die Domain in die HSTS preload Liste, verwaltet von Chrome (und genutzt von Firefox und Safari), hinzugefügt werden soll, dann aktivieren Sie diese Einstellung.<br>Die preload-Direktive zu senden kann PERMANTENTE KONSEQUENZEN haben und dazu führen, dass Benutzer auf diese Domain und auch Subdomains nicht zugreifen können.<br>Beachten Sie die Details unter <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> bevor ein Header mit "preload" gesendet wird.',
'title' => 'Füge Domain in die HSTS preload Liste hinzu',
'description' => 'Wenn die Domain in die <a href="https://hstspreload.org/" target="_blank">HSTS preload Liste</a>, verwaltet von Chrome (und genutzt von Firefox und Safari), hinzugefügt werden soll, dann aktivieren Sie diese Einstellung.<br>Die preload-Direktive zu senden kann PERMANTENTE KONSEQUENZEN haben und dazu führen, dass Benutzer auf diese Domain und auch Subdomains nicht zugreifen können.<br>Beachten Sie die Details unter <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> bevor ein Header mit "preload" gesendet wird.',
],
'domain_ocsp_stapling' => [
'title' => 'OCSP stapling',
Expand Down Expand Up @@ -810,6 +813,7 @@
'stringformaterror' => 'Der Wert des Feldes "%s" hat nicht das erwartete Format.',
'loginnameisusingprefix' => 'Sie können keinen Account anlegen, der mit "%s" beginnt, da dieser Prefix für die automatische Namensvergabe eingestellt ist. Bitte wählen Sie einen anderen Accountnamen.',
'loginnameissystemaccount' => 'Der Account "%s" existiert bereits auf dem System und kann daher nicht verwendet werden. Bitte wählen Sie einen anderen Accountnamen.',
'loginnameisreservedname' => 'Der Account-Name "%s" ist systemseitig reserviert und kann nicht verwenden werden.',
'youcantdeleteyourself' => 'Aus Sicherheitsgründen können Sie sich nicht selbst löschen.',
'youcanteditallfieldsofyourself' => 'Hinweis: Aus Sicherheitsgründen können Sie nicht alle Felder Ihres eigenen Accounts bearbeiten.',
'documentrootexists' => 'Es existiert noch ein Verzeichnis "%s" für diesen Kunden. Bitte löschen Sie dieses vorher.',
Expand Down
10 changes: 7 additions & 3 deletions lng/en.lng.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -413,7 +413,10 @@
'description' => 'Specify a custom RSS-feed that will be shown to your customers on their dashboard.<br /><small>Leave this empty to use the official froxlor newsfeed (https://inside.froxlor.org/news/).</small>',
],
'movetoadmin' => 'Move customer',
'movecustomertoadmin' => 'Move customer to the selected admin/reseller<br /><small>Leave this empty for no change.<br />If the desired admin does not show up in the list, his customer-limit has been reached.</small>',
'movecustomertoadmin' => [
'title' => 'Move customer to the selected admin/reseller',
'description' => 'Leave this empty for no change.<br />If the desired admin does not show up in the list, his customer-limit has been reached.',
],
'note' => 'Note',
'mod_fcgid_umask' => [
'title' => 'Umask (default: 022)',
Expand All @@ -440,8 +443,8 @@
'description' => 'The optional "includeSubDomains" directive, if present, signals the UA that the HSTS Policy applies to this HSTS Host as well as any subdomains of the host\'s domain name.',
],
'domain_hsts_preload' => [
'title' => 'Include domain in <a href="https://hstspreload.org/" target="_blank">HSTS preload list</a>',
'description' => 'If you would like this domain to be included in the HSTS preload list maintained by Chrome (and used by Firefox and Safari), then use activate this.<br>Sending the preload directive from your site can have PERMANENT CONSEQUENCES and prevent users from accessing your site and any of its subdomains.<br>Please read the details at <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> before sending the header with "preload".',
'title' => 'Include domain in HSTS preload list',
'description' => 'If you would like this domain to be included in the <a href="https://hstspreload.org/" target="_blank">HSTS preload list</a> maintained by Chrome (and used by Firefox and Safari), then use activate this.<br>Sending the preload directive from your site can have PERMANENT CONSEQUENCES and prevent users from accessing your site and any of its subdomains.<br>Please read the details at <a href="https://hstspreload.org/#removal" target="_blank">https://hstspreload.org/#removal</a> before sending the header with "preload".',
],
'domain_ocsp_stapling' => [
'title' => 'OCSP stapling',
Expand Down Expand Up @@ -882,6 +885,7 @@
'stringformaterror' => 'The value for the field "%s" is not in the expected format.',
'loginnameisusingprefix' => 'You cannot create accounts that begin with "%s", as this prefix is set to be used for the automatic account-naming. Please enter another account name.',
'loginnameissystemaccount' => 'The account "%s" already exists on the system and cannot be used. Please enter another account name.',
'loginnameisreservedname' => 'The account-name "%s" is reserved for system internals and cannot be used.',
'youcantdeleteyourself' => 'You cannot delete yourself for security reasons.',
'youcanteditallfieldsofyourself' => 'Note: You cannot edit all fields of your own account for security reasons.',
'documentrootexists' => 'The directory "%s" already exists for this customer. Please remove this before adding the customer again.',
Expand Down

0 comments on commit d86da23

Please sign in to comment.