From 614b23b18053c58c3f85db5ceaa982484175d276 Mon Sep 17 00:00:00 2001
From: Till Brehm <tbrehm@ispconfig.org>
Date: Mon, 25 Aug 2014 10:35:53 -0400
Subject: [PATCH] Added apache directives check agains regex blacklist in security settings.
---
interface/lib/classes/validate_domain.inc.php | 40 ++++++++++++++++++++++++++++++++++++++++
1 files changed, 40 insertions(+), 0 deletions(-)
diff --git a/interface/lib/classes/validate_domain.inc.php b/interface/lib/classes/validate_domain.inc.php
index d92de9b..8df0d2f 100644
--- a/interface/lib/classes/validate_domain.inc.php
+++ b/interface/lib/classes/validate_domain.inc.php
@@ -97,6 +97,45 @@
$result = $this->_check_unique($field_value . '.' . $check_domain, true);
if(!$result) return $this->get_error('domain_error_autosub');
}
+
+ /* Check apache directives */
+ function web_apache_directives($field_name, $field_value, $validator) {
+ global $app;
+
+ if(trim($field_value) != '') {
+ $security_config = $app->getconf->get_security_config('ids');
+
+ if($security_config['apache_directives_scan_enabled'] == 'yes') {
+
+ // Get blacklist
+ $blacklist_path = '/usr/local/ispconfig/security/apache_directives.blacklist';
+ if(is_file('/usr/local/ispconfig/security/apache_directives.blacklist.custom')) $blacklist_path = '/usr/local/ispconfig/security/apache_directives.blacklist.custom';
+ if(!is_file($blacklist_path)) $blacklist_path = realpath(ISPC_ROOT_PATH.'/../security/apache_directives.blacklist');
+
+ $directives = explode("\n",$field_value);
+ $regex = explode("\n",file_get_contents($blacklist_path));
+ $blocked = false;
+ $blocked_line = '';
+
+ if(is_array($directives) && is_array($regex)) {
+ foreach($directives as $directive) {
+ $directive = trim($directive);
+ foreach($regex as $r) {
+ if(preg_match(trim($r),$directive)) {
+ $blocked = true;
+ $blocked_line = $directive;
+ };
+ }
+ }
+ }
+ }
+ }
+
+ if($blocked === true) {
+ return $this->get_error('apache_directive_blocked_error').' '.$blocked_line;
+ }
+ }
+
/* internal validator function to match regexp */
function _regex_validate($domain_name, $allow_wildcard = false) {
@@ -175,5 +214,6 @@
}
return true; // admin may always add wildcard domain
}
+
}
--
Gitblit v1.9.1