From d51f9dfac3d6d801b8894b7850754f4e64b13d7c Mon Sep 17 00:00:00 2001 From: Miraty Date: Wed, 19 Apr 2023 14:59:07 +0200 Subject: [PATCH] Set umask to 0077 everywhere --- check.php | 11 +++++------ fn/ht.php | 9 ++++++--- pg-act/ht/add-onion.php | 7 +++++-- pg-view/ht/index.php | 5 ++++- router.php | 9 ++++----- 5 files changed, 24 insertions(+), 17 deletions(-) diff --git a/check.php b/check.php index 4e510b4..17e7df2 100644 --- a/check.php +++ b/check.php @@ -52,7 +52,7 @@ function curlTest($address, $post = [], $tor = false) { $result = curl_exec($req); $status_code = curl_getinfo($req, CURLINFO_RESPONSE_CODE); if ($status_code >= 400 OR $result === false) { - var_dump(curl_exec($req)); + var_dump($result); var_dump(curl_error($req)); exit($address . ' test failed with status code ' . $status_code . LF); } @@ -129,7 +129,7 @@ function testNs($domain) { 'ns' => $ns, ]); - preg_match('#\(?[0-9a-z-]{16,128}\._domain-verification\.' . preg_quote(CORE_DOMAIN) . '\.)\#', curlTest('/ns/zone-add', []), $matches); + preg_match('#\(?[0-9a-z-]{16,128}\._domain-verification\.' . preg_quote(CORE_DOMAIN, '#') . '\.)\#', curlTest('/ns/zone-add', []), $matches); curlTest('/reg/ns', [ 'action' => 'add', 'domain' => $domain, @@ -157,7 +157,7 @@ function testNs($domain) { 'value' => 'letsencrypt.org', ]); exec(CONF['dns']['kdig_path'] . ' @' . CONF['reg']['address'] . ' ' . $domain . ' CAA', $output); - if (preg_match('/^' . preg_quote($domain) . '[ \t]+7200[ \t]+IN[ \t]+CAA[ \t]+0[ \t]+issue[ \t]+"letsencrypt\.org"$/Dm', implode(LF, $output)) !== 1) + if (preg_match('/^' . preg_quote($domain, '/') . '[ \t]+7200[ \t]+IN[ \t]+CAA[ \t]+0[ \t]+issue[ \t]+"letsencrypt\.org"$/Dm', implode(LF, $output)) !== 1) exit('Error: /ns/caa: CAA record not set' . LF); curlTest('/ns/edit', [ @@ -166,7 +166,7 @@ function testNs($domain) { . '@ 86400 NS ' . CONF['ns']['servers'][0] . "\r\n", ]); exec(CONF['dns']['kdig_path'] . ' @' . CONF['reg']['address'] . ' aaaa.' . $domain . ' AAAA', $output); - if (preg_match('/[ \t]+' . preg_quote(CONF['ht']['ipv6_address']) . '$/Dm', implode(LF, $output)) !== 1) + if (preg_match('/[ \t]+' . preg_quote(CONF['ht']['ipv6_address'], '/') . '$/Dm', implode(LF, $output)) !== 1) exit('Error: /ns/edit: AAAA record not set' . LF); } @@ -222,14 +222,13 @@ exit ]); if (preg_match('#\http\://(?[0-9a-z]{56})\.onion/\#D', $html, $matches) !== 1) exit('Can\'t find onion address.' . LF); - sleep(5); + sleep(5); // Onion services are not immediately reachable if (curlTest('http://' . $matches['onion'] . '.onion/', tor: true) !== TEST_CONTENT) exit('Unexpected onion service response (' . $matches['onion'] . '.onion)' . LF); curlTest('/ht/del', [ 'site' => 'onion:' . $matches['onion'] . '.onion', ]); } - } $domain = testReg(); diff --git a/fn/ht.php b/fn/ht.php index 77be8da..0fdbabf 100644 --- a/fn/ht.php +++ b/fn/ht.php @@ -2,16 +2,19 @@ function htSetupUserFs($id) { // Setup SFTP directory - umask(0002); - if (mkdir(CONF['ht']['ht_path'] . '/fs/' . $id, 0775) !== true) + if (mkdir(CONF['ht']['ht_path'] . '/fs/' . $id, 0000) !== true) output(500, 'Can\'t create user directory.'); + if (chmod(CONF['ht']['ht_path'] . '/fs/' . $id, 0775) !== true) + output(500, 'Can\'t chmod user directory.'); exec(CONF['ht']['sudo_path'] . ' ' . CONF['ht']['chgrp_path'] . ' ' . CONF['ht']['sftpgo_group'] . ' ' . CONF['ht']['ht_path'] . '/fs/' . $id . ' --no-dereference', result_code: $code); if ($code !== 0) output(500, 'Can\'t change user directory group.'); // Setup Tor config directory - if (mkdir(CONF['ht']['tor_config_path'] . '/' . $id, 0755) !== true) + if (mkdir(CONF['ht']['tor_config_path'] . '/' . $id, 0000) !== true) output(500, 'Can\'t create Tor config directory.'); + if (chmod(CONF['ht']['tor_config_path'] . '/' . $id, 0775) !== true) + output(500, 'Can\'t chmod Tor config directory.'); // Setup Tor keys directory exec(CONF['ht']['sudo_path'] . ' -u ' . CONF['ht']['tor_user'] . ' ' . CONF['ht']['mkdir_path'] . ' --mode=0700 ' . CONF['ht']['tor_keys_path'] . '/' . $id, result_code: $code); diff --git a/pg-act/ht/add-onion.php b/pg-act/ht/add-onion.php index 93b674a..c484274 100644 --- a/pg-act/ht/add-onion.php +++ b/pg-act/ht/add-onion.php @@ -6,10 +6,13 @@ if (dirsStatuses('onion')[$_POST['dir']] !== false) rateLimit(); // Add Tor config +$torConfFile = CONF['ht']['tor_config_path'] . '/' . $_SESSION['id'] . '/' . $_POST['dir']; $torConf = 'HiddenServiceDir ' . CONF['ht']['tor_keys_path'] . '/' . $_SESSION['id'] . '/' . $_POST['dir'] . '/ HiddenServicePort 80 ' . CONF['ht']['onion_internal_host'] . LF; -if (file_put_contents(CONF['ht']['tor_config_path'] . '/' . $_SESSION['id'] . '/' . $_POST['dir'], $torConf) === false) - output(500, 'Failed to write new Tor configuration.'); +if (file_put_contents($torConfFile, $torConf) === false) + output(500, 'Failed to write new Tor configuration file.'); +if (chmod($torConfFile, 0644) !== true) + output(500, 'Failed to give correct permissions to new Tor configuration file.'); // Reload Tor exec(CONF['ht']['sudo_path'] . ' ' . CONF['ht']['tor_reload_cmd'], $output, $code); diff --git a/pg-view/ht/index.php b/pg-view/ht/index.php index f905bc2..45ee6eb 100644 --- a/pg-view/ht/index.php +++ b/pg-view/ht/index.php @@ -76,7 +76,10 @@ $quota = (($_SESSION['type'] ?? '') === 'approved') ? CONF['ht']['user_quota_app

- sftp://@:/ + +
diff --git a/router.php b/router.php index 38299a3..c9076c0 100644 --- a/router.php +++ b/router.php @@ -1,4 +1,5 @@ setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); date_default_timezone_set('UTC'); -$locale = 'en'; -foreach (explode(',', preg_replace('/[A-Z0-9]|q=|;|-|\./', '', $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '')) as $client_locale) { +foreach (explode(',', preg_replace('/[A-Z0-9]|q=|;|-|\./', '', $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '')) as $client_locale) if (in_array($client_locale, array_diff(scandir(ROOT_PATH . '/locales'), ['..', '.']), true)) { $locale = $client_locale; break; } -} -define('LOCALE', $locale); +define('LOCALE', $locale ?? 'en'); setlocale(LC_MESSAGES, 'C.UTF-8'); -bindtextdomain('messages', 'locales/' . LOCALE); +bindtextdomain('messages', ROOT_PATH . '/locales/' . LOCALE); header('Content-Language: ' . LOCALE); const SERVICES_USER = ['reg', 'ns', 'ht'];