From ebd0e986ed11f2a34fb58cdd33efbfab192083ad Mon Sep 17 00:00:00 2001
From: Till Brehm <tbrehm@ispconfig.org>
Date: Fri, 22 Apr 2016 05:26:17 -0400
Subject: [PATCH] Added PHP 7 check in installer and updater.
---
install/dist/lib/opensuse.lib.php | 189 +++++++++++++++++++++++++++++++++++++----------
1 files changed, 149 insertions(+), 40 deletions(-)
diff --git a/install/dist/lib/opensuse.lib.php b/install/dist/lib/opensuse.lib.php
index e104f4a..154f0cb 100644
--- a/install/dist/lib/opensuse.lib.php
+++ b/install/dist/lib/opensuse.lib.php
@@ -29,7 +29,23 @@
*/
class installer_dist extends installer_base {
-
+
+ public function __construct() {
+ //** check apache modules */
+ $mods = getapachemodules();
+ if(in_array('authz_compat', $mods, true)) {
+ swriteln($inst->lng(' WARNING! You are using mod_authz_compat.'));
+ swriteln($inst->lng(' Please make sure that your apache config uses the new auth syntax:'));
+ swriteln($inst->lng(' <Directory />'));
+ swriteln($inst->lng(' Options None'));
+ swriteln($inst->lng(' AllowOverride None'));
+ swriteln($inst->lng(' Require all denied'));
+ swriteln($inst->lng(' </Directory>'."\n"));
+
+ swriteln($inst->lng(' If it uses the old syntax (deny from all) ISPConfig would fail to work.'));
+ }
+ }
+
public function configure_mailman($status = 'insert') {
global $conf;
@@ -109,11 +125,12 @@
//* Create aliasaes
exec('/usr/lib/mailman/bin/genaliases 2>/dev/null');
+ if(is_file('/var/lib/mailman/data/virtual-mailman')) exec('postmap /var/lib/mailman/data/virtual-mailman');
}
function configure_postfix($options = '')
{
- global $conf;
+ global $conf,$autoinstall;
$cf = $conf['postfix'];
$config_dir = $cf['config_dir'];
@@ -240,8 +257,13 @@
if(!stristr($options, 'dont-create-certs')) {
//* Create the SSL certificate
- $command = 'cd '.$config_dir.'; '
- .'openssl req -new -outform PEM -out smtpd.cert -newkey rsa:2048 -nodes -keyout smtpd.key -keyform PEM -days 365 -x509';
+ if(AUTOINSTALL){
+ $command = 'cd '.$config_dir.'; '
+ ."openssl req -new -subj '/C=".escapeshellcmd($autoinstall['ssl_cert_country'])."/ST=".escapeshellcmd($autoinstall['ssl_cert_state'])."/L=".escapeshellcmd($autoinstall['ssl_cert_locality'])."/O=".escapeshellcmd($autoinstall['ssl_cert_organisation'])."/OU=".escapeshellcmd($autoinstall['ssl_cert_organisation_unit'])."/CN=".escapeshellcmd($autoinstall['ssl_cert_common_name'])."' -outform PEM -out smtpd.cert -newkey rsa:4096 -nodes -keyout smtpd.key -keyform PEM -days 3650 -x509";
+ } else {
+ $command = 'cd '.$config_dir.'; '
+ .'openssl req -new -outform PEM -out smtpd.cert -newkey rsa:4096 -nodes -keyout smtpd.key -keyform PEM -days 3650 -x509';
+ }
exec($command);
$command = 'chmod o= '.$config_dir.'/smtpd.key';
@@ -427,7 +449,6 @@
'virtual_transport = dovecot',
'smtpd_sasl_type = dovecot',
'smtpd_sasl_path = private/auth',
- 'receive_override_options = no_address_mappings'
);
// Make a backup copy of the main.cf file
@@ -479,10 +500,14 @@
$content = str_replace('{mysql_server_ispconfig_password}', $conf['mysql']['ispconfig_password'], $content);
$content = str_replace('{mysql_server_database}', $conf['mysql']['database'], $content);
$content = str_replace('{mysql_server_host}', $conf['mysql']['host'], $content);
+ $content = str_replace('{server_id}', $conf['server_id'], $content);
wf("$config_dir/$configfile", $content);
exec("chmod 600 $config_dir/$configfile");
exec("chown root:root $config_dir/$configfile");
+
+ // Dovecot shall ignore mounts in website directory
+ if(is_installed('doveadm')) exec("doveadm mount add '/srv/www/*' ignore > /dev/null 2> /dev/null");
}
@@ -500,6 +525,7 @@
$content = str_replace('{mysql_server_port}', $conf["mysql"]["port"], $content);
$content = str_replace('{mysql_server_ip}', $conf['mysql']['ip'], $content);
wf($conf["amavis"]["config_dir"].'/amavisd.conf', $content);
+ chmod($conf['amavis']['config_dir'].'/amavisd.conf', 0640);
// Adding the amavisd commands to the postfix configuration
@@ -529,7 +555,9 @@
unset($content);
// Add the clamav user to the vscan group
- exec('groupmod --add-user clamav vscan');
+ //exec('groupmod --add-user clamav vscan');
+ $command = 'usermod -a -G clamav vscan';
+ caselog($command." &> /dev/null", __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
}
@@ -629,6 +657,9 @@
if($conf['apache']['installed'] == false) return;
//* Create the logging directory for the vhost logfiles
exec('mkdir -p /var/log/ispconfig/httpd');
+
+ //* enable apache logio module
+ exec('a2enmod logio');
//if(is_file('/etc/suphp.conf')) {
replaceLine('/etc/suphp.conf', 'php=php', 'x-httpd-suphp="php:/srv/www/cgi-bin/php5"', 0, 0);
@@ -647,7 +678,7 @@
$content = rf('/etc/apache2/httpd.conf');
if(!stristr($content, 'Include /etc/apache2/sites-enabled/')) {
- af('/etc/apache2/httpd.conf', "\n<Directory /srv/www>\n Options FollowSymlinks\n</Directory>\n\nInclude /etc/apache2/sites-enabled/\n\n");
+ af('/etc/apache2/httpd.conf', "\n<Directory /srv/www>\n Options +FollowSymlinks\n</Directory>\n\nInclude /etc/apache2/sites-enabled/\n\n");
}
unset($content);
@@ -655,10 +686,12 @@
$vhost_conf_dir = $conf['apache']['vhost_conf_dir'];
$vhost_conf_enabled_dir = $conf['apache']['vhost_conf_enabled_dir'];
- //copy('tpl/apache_ispconfig.conf.master',$vhost_conf_dir.'/ispconfig.conf');
- $content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/apache_ispconfig.conf.master', 'tpl/apache_ispconfig.conf.master');
+ $tpl = new tpl('apache_ispconfig.conf.master');
+ $tpl->setVar('apache_version',getapacheversion());
+
$records = $this->db->queryAllRecords('SELECT * FROM '.$conf['mysql']['master_database'].'.server_ip WHERE server_id = '.$conf['server_id']." AND virtualhost = 'y'");
-
+ $ip_addresses = array();
+
if(is_array($records) && count($records) > 0) {
foreach($records as $rec) {
if($rec['ip_type'] == 'IPv6') {
@@ -671,15 +704,17 @@
foreach($ports as $port) {
$port = intval($port);
if($port > 0 && $port < 65536 && $ip_address != '') {
- $content .= 'NameVirtualHost '.$ip_address.":".$port."\n";
+ $ip_addresses[] = array('ip_address' => $ip_address, 'port' => $port);
}
}
}
}
}
-
- $content .= "\n";
- wf($vhost_conf_dir.'/ispconfig.conf', $content);
+
+ if(count($ip_addresses) > 0) $tpl->setLoop('ip_adresses',$ip_addresses);
+
+ wf($vhost_conf_dir.'/ispconfig.conf', $tpl->grab());
+ unset($tpl);
if(!@is_link($vhost_conf_enabled_dir."/000-ispconfig.conf")) {
exec("ln -s ".$vhost_conf_dir."/ispconfig.conf ".$vhost_conf_enabled_dir."/000-ispconfig.conf");
@@ -873,6 +908,31 @@
//* copy the ISPConfig server part
$command = "cp -rf ../server $install_dir";
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+
+ //* Make a backup of the security settings
+ if(is_file('/usr/local/ispconfig/security/security_settings.ini')) copy('/usr/local/ispconfig/security/security_settings.ini','/usr/local/ispconfig/security/security_settings.ini~');
+
+ //* copy the ISPConfig security part
+ $command = 'cp -rf ../security '.$install_dir;
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+
+ //* Apply changed security_settings.ini values to new security_settings.ini file
+ if(is_file('/usr/local/ispconfig/security/security_settings.ini~')) {
+ $security_settings_old = ini_to_array(file_get_contents('/usr/local/ispconfig/security/security_settings.ini~'));
+ $security_settings_new = ini_to_array(file_get_contents('/usr/local/ispconfig/security/security_settings.ini'));
+ if(is_array($security_settings_new) && is_array($security_settings_old)) {
+ foreach($security_settings_new as $section => $sval) {
+ if(is_array($sval)) {
+ foreach($sval as $key => $val) {
+ if(isset($security_settings_old[$section]) && isset($security_settings_old[$section][$key])) {
+ $security_settings_new[$section][$key] = $security_settings_old[$section][$key];
+ }
+ }
+ }
+ }
+ file_put_contents('/usr/local/ispconfig/security/security_settings.ini',array_to_ini($security_settings_new));
+ }
+ }
//* Create a symlink, so ISPConfig is accessible via web
// Replaced by a separate vhost definition for port 8080
@@ -998,12 +1058,38 @@
$this->db->query($sql);
}
- //* Chmod the files
- $command = "chmod -R 750 $install_dir";
+ // chown install dir to root and chmod 755
+ $command = 'chown root:root '.$install_dir;
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+ $command = 'chmod 755 '.$install_dir;
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
- //* chown the files to the ispconfig user and group
- $command = "chown -R ispconfig:ispconfig $install_dir";
+ //* Chmod the files and directories in the install dir
+ $command = 'chmod -R 750 '.$install_dir.'/*';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+
+ //* chown the interface files to the ispconfig user and group
+ $command = 'chown -R ispconfig:ispconfig '.$install_dir.'/interface';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+
+ //* chown the server files to the root user and group
+ $command = 'chown -R root:root '.$install_dir.'/server';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+
+ //* chown the security files to the root user and group
+ $command = 'chown -R root:root '.$install_dir.'/security';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+
+ //* chown the security directory and security_settings.ini to root:ispconfig
+ $command = 'chown root:ispconfig '.$install_dir.'/security/security_settings.ini';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+ $command = 'chown root:ispconfig '.$install_dir.'/security';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+ $command = 'chown root:ispconfig '.$install_dir.'/security/ids.whitelist';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+ $command = 'chown root:ispconfig '.$install_dir.'/security/ids.htmlfield';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
+ $command = 'chown root:ispconfig '.$install_dir.'/security/apache_directives.blacklist';
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
//* Make the global language file directory group writable
@@ -1046,25 +1132,39 @@
exec("chmod 600 $install_dir/server/lib/mysql_clientdb.conf");
exec("chown root:root $install_dir/server/lib/mysql_clientdb.conf");
}
+
+ if(is_dir($install_dir.'/interface/invoices')) {
+ exec('chmod -R 770 '.escapeshellarg($install_dir.'/interface/invoices'));
+ exec('chown -R ispconfig:ispconfig '.escapeshellarg($install_dir.'/interface/invoices'));
+ }
+
+ exec('chown -R root:root /usr/local/ispconfig/interface/ssl');
// TODO: FIXME: add the www-data user to the ispconfig group. This is just for testing
// and must be fixed as this will allow the apache user to read the ispconfig files.
// Later this must run as own apache server or via suexec!
if($conf['apache']['installed'] == true){
- $command = 'groupmod --add-user '.$conf['apache']['user'].' ispconfig';
+ //$command = 'groupmod --add-user '.$conf['apache']['user'].' ispconfig';
+ $command = 'usermod -a -G ispconfig '.$conf['apache']['user'];
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
if(is_group('ispapps')){
- $command = 'groupmod --add-user '.$conf['apache']['user'].' ispapps';
+ //$command = 'groupmod --add-user '.$conf['apache']['user'].' ispapps';
+ $command = 'usermod -a -G ispapps '.$conf['apache']['user'];
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
}
}
if($conf['nginx']['installed'] == true){
- $command = 'groupmod --add-user '.$conf['nginx']['user'].' ispconfig';
+ //$command = 'groupmod --add-user '.$conf['nginx']['user'].' ispconfig';
+ $command = 'usermod -a -G ispconfig '.$conf['nginx']['user'];
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
if(is_group('ispapps')){
- $command = 'groupmod --add-user '.$conf['nginx']['user'].' ispapps';
+ //$command = 'groupmod --add-user '.$conf['nginx']['user'].' ispapps';
+ $command = 'usermod -a -G ispapps '.$conf['nginx']['user'];
caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
}
+ // add nobody user to www group, as the default php-fpm pool from opensuse runs as nobody
+ $command = 'usermod -a -G www nobody';
+ caselog($command.' &> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
}
//* Make the shell scripts executable
@@ -1080,31 +1180,32 @@
// Dont just copy over the virtualhost template but add some custom settings
-
- $content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/apache_ispconfig.vhost.master', "tpl/apache_ispconfig.vhost.master");
- $content = str_replace('{vhost_port}', $conf['apache']['vhost_port'], $content);
+ $tpl = new tpl('apache_ispconfig.vhost.master');
+ $tpl->setVar('vhost_port',$conf['apache']['vhost_port']);
// comment out the listen directive if port is 80 or 443
if($conf['apache']['vhost_port'] == 80 or $conf['apache']['vhost_port'] == 443) {
- $content = str_replace('{vhost_port_listen}', '#', $content);
+ $tpl->setVar('vhost_port_listen','#');
} else {
- $content = str_replace('{vhost_port_listen}', '', $content);
+ $tpl->setVar('vhost_port_listen','');
}
- if(is_file('/usr/local/ispconfig/interface/ssl/ispserver.crt') && is_file('/usr/local/ispconfig/interface/ssl/ispserver.key')) {
- $content = str_replace('{ssl_comment}', '', $content);
+ if(is_file($install_dir.'/interface/ssl/ispserver.crt') && is_file($install_dir.'/interface/ssl/ispserver.key')) {
+ $tpl->setVar('ssl_comment','');
} else {
- $content = str_replace('{ssl_comment}', '#', $content);
+ $tpl->setVar('ssl_comment','#');
}
if(is_file($install_dir.'/interface/ssl/ispserver.crt') && is_file($install_dir.'/interface/ssl/ispserver.key') && is_file($install_dir.'/interface/ssl/ispserver.bundle')) {
- $content = str_replace('{ssl_bundle_comment}', '', $content);
+ $tpl->setVar('ssl_bundle_comment','');
} else {
- $content = str_replace('{ssl_bundle_comment}', '#', $content);
+ $tpl->setVar('ssl_bundle_comment','#');
}
+
+ $tpl->setVar('apache_version',getapacheversion());
+ $content = $tpl->grab();
$content = str_replace('/var/www/', '/srv/www/', $content);
-
- wf("$vhost_conf_dir/ispconfig.vhost", $content);
+ wf($vhost_conf_dir.'/ispconfig.vhost', $content);
//if(!is_file('/srv/www/php-fcgi-scripts/ispconfig/.php-fcgi-starter')) {
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/apache_ispconfig_fcgi_starter.master', 'tpl/apache_ispconfig_fcgi_starter.master');
@@ -1193,14 +1294,14 @@
//exec('chmod +r /var/log/clamav/freshclam.log');
//* Install the update script
- if(is_file('/usr/local/bin/ispconfig_update_from_svn.sh')) unlink('/usr/local/bin/ispconfig_update_from_svn.sh');
- exec('chown root /usr/local/ispconfig/server/scripts/update_from_svn.sh');
- exec('chmod 700 /usr/local/ispconfig/server/scripts/update_from_svn.sh');
+ if(is_file('/usr/local/bin/ispconfig_update_from_dev.sh')) unlink('/usr/local/bin/ispconfig_update_from_dev.sh');
+ exec('chown root /usr/local/ispconfig/server/scripts/update_from_dev.sh');
+ exec('chmod 700 /usr/local/ispconfig/server/scripts/update_from_dev.sh');
exec('chown root /usr/local/ispconfig/server/scripts/update_from_tgz.sh');
exec('chmod 700 /usr/local/ispconfig/server/scripts/update_from_tgz.sh');
exec('chown root /usr/local/ispconfig/server/scripts/ispconfig_update.sh');
exec('chmod 700 /usr/local/ispconfig/server/scripts/ispconfig_update.sh');
- if(!is_link('/usr/local/bin/ispconfig_update_from_svn.sh')) exec('ln -s /usr/local/ispconfig/server/scripts/ispconfig_update.sh /usr/local/bin/ispconfig_update_from_svn.sh');
+ if(!is_link('/usr/local/bin/ispconfig_update_from_dev.sh')) exec('ln -s /usr/local/ispconfig/server/scripts/ispconfig_update.sh /usr/local/bin/ispconfig_update_from_dev.sh');
if(!is_link('/usr/local/bin/ispconfig_update.sh')) exec('ln -s /usr/local/ispconfig/server/scripts/ispconfig_update.sh /usr/local/bin/ispconfig_update.sh');
//set the fast cgi starter script to executable
@@ -1241,8 +1342,16 @@
//* Remove Domain module as its functions are available in the client module now
if(@is_dir('/usr/local/ispconfig/interface/web/domain')) exec('rm -rf /usr/local/ispconfig/interface/web/domain');
+
+ // Add symlink for patch tool
+ if(!is_link('/usr/local/bin/ispconfig_patch')) exec('ln -s /usr/local/ispconfig/server/scripts/ispconfig_patch /usr/local/bin/ispconfig_patch');
-
+ // Change mode of a few files from amavisd
+ if(is_file($conf['amavis']['config_dir'].'/conf.d/50-user')) chmod($conf['amavis']['config_dir'].'/conf.d/50-user', 0640);
+ if(is_file($conf['amavis']['config_dir'].'/50-user~')) chmod($conf['amavis']['config_dir'].'/50-user~', 0400);
+ if(is_file($conf['amavis']['config_dir'].'/amavisd.conf')) chmod($conf['amavis']['config_dir'].'/amavisd.conf', 0640);
+ if(is_file($conf['amavis']['config_dir'].'/amavisd.conf~')) chmod($conf['amavis']['config_dir'].'/amavisd.conf~', 0400);
+
}
public function configure_dbserver()
@@ -1263,7 +1372,7 @@
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/mysql_clientdb.conf.master', "tpl/mysql_clientdb.conf.master");
$content = str_replace('{hostname}', $conf['mysql']['host'], $content);
$content = str_replace('{username}', $conf['mysql']['admin_user'], $content);
- $content = str_replace('{password}', $conf['mysql']['admin_password'], $content);
+ $content = str_replace('{password}', addslashes($conf['mysql']['admin_password']), $content);
wf("$install_dir/server/lib/mysql_clientdb.conf", $content);
exec('chmod 600 '."$install_dir/server/lib/mysql_clientdb.conf");
exec('chown root:root '."$install_dir/server/lib/mysql_clientdb.conf");
--
Gitblit v1.9.1