Ticket #318: fix_318-2.diff

File fix_318-2.diff, 12.2 kB (added by anarcat, 1 month ago)

second brain dump

  • debian/postinst

    old new  
    8383# Mail server hostname 
    8484DEFAULT_MX="" 
    8585 
    86 # MySQL configuration 
    87 MYSQL_HOST="" 
    88 MYSQL_DATABASE="" 
    89 MYSQL_USER="" 
    90 MYSQL_PASS="" 
     86# Note: MySQL username/password configuration now stored in /etc/alternc/mysql-root.cnf 
     87 
    9188# quels clients mysql sont permis (%, localhost, etc) 
    9289MYSQL_CLIENT="" 
    9390 
    …… 
    119116    update_var alternc/ns2 NS2_HOSTNAME 
    120117    update_var alternc/bind_internal BIND_INTERNAL 
    121118    update_var alternc/default_mx DEFAULT_MX  
    122     update_var alternc/mysql/host MYSQL_HOST  
    123     update_var alternc/mysql/db MYSQL_DATABASE  
    124     update_var alternc/mysql/user MYSQL_USER  
    125     update_var alternc/mysql/password MYSQL_PASS  
    126119    update_var alternc/mysql/client MYSQL_CLIENT  
    127120    update_var alternc/alternc_location ALTERNC_LOC 
    128121    update_var alternc/mynetwork SMTP_RELAY_NETWORKS 
    129122    sed -e "$SED_SCRIPT" < $CONFIGFILE > $CONFIGFILE.tmp 
    130123    mv -f $CONFIGFILE.tmp $CONFIGFILE 
    131124 
     125    echo "Updating /etc/alternc/mysql.cnf" 
     126    # build local.sh if it does not exist 
     127    if [ ! -f $CONFIGFILE ]; then 
     128        cat > $CONFIGFILE <<EOF 
     129# AlternC - Web Hosting System - MySQL Configuration 
     130# Automatically generated by AlternC configuration, do not edit 
     131# This file will be modified on package configuration 
     132# (e.g. upgrade or dpkg-reconfigure alternc) 
     133[client] 
     134host = "" 
     135database = "" 
     136user = "" 
     137password = "" 
     138EOF 
     139        chown root:www-data $CONFIGFILE 
     140        chmod 640 $CONFIGFILE 
     141    fi 
     142 
     143    # Update the mysql configuration file 
     144    SED_SCRIPT="" 
     145    update_var alternc/mysql/host host 
     146    update_var alternc/mysql/db database 
     147    update_var alternc/mysql/user user 
     148    update_var alternc/mysql/password password 
     149    sed -e "$SED_SCRIPT" < /etc/alternc/mysql.cnf > /etc/alternc/mysql.cnf.$$ 
     150    mv -f /etc/alternc/mysql.cnf.$$ /etc/alternc/mysql.cnf 
     151 
    132152    # forget the password 
    133153    db_reset alternc/mysql/password || true 
    134154    db_fset alternc/mysql/password "seen" "false" || true 

  • debian/postrm

    old new  
    1515 
    1616case "$1" in 
    1717  purge) 
    18     rm -f /etc/alternc/local.sh /etc/alternc/bureau.conf 
     18    rm -f /etc/alternc/local.sh /etc/alternc/mysql.cnf /etc/alternc/bureau.conf 
    1919    rm -f /var/backups/alternc/etc-installed.tar.gz 
    2020 
    2121    # Purge database? 

  • debian/changelog

    old new  
    11alternc (0.9.7+dev) stable; urgency=low UNRELEASED 
    22 
     3  * move mysql configuration into a valid MySQL configuration file 
     4    (/etc/alternc/mysql.cnf). This fixes a serious security issue 
     5    (#318) where the MySQL root password was passed on the commandline. 
    36  * standardisation of the web interface, along with some esthetic changes, by 
    47    Marc Angles, sponsored by Koumbit 
    58  * styles can now be changed locally in admin/styles/base.css 

  • debian/config

    old new  
    3838    # source the current config 
    3939    . /etc/alternc/local.sh 
    4040fi 
     41if [ -r /etc/alternc/mysql.cnf ]; then 
     42    # make mysql configuration available as shell variables 
     43    # to convert from .cnf to shell syntax, we: 
     44    # * match only lines with "equal" in them (/=/) 
     45    # * remove whitespace (s) 
     46    # * convert mysql variables into our MYSQL_ naming convention (;s) 
     47    # * print the result (;p) 
     48    # XXX: removing the ws breaks passwords with spaces, which are legal 
     49    eval `sed -n -e '/=/{s/ //g;s/host/MYSQL_HOST/;s/user/MYSQL_LOGIN/;s/password/MYSQL_PWD/;p}' /etc/alternc/mysql.cnf` 
     50fi 
    4151 
    4252# mettre les valeurs de local.sh comme "default" pour debconf 
    4353db_get alternc/hostingname 

  • bureau/class/local.php

    old new  
    2222} 
    2323 
    2424fclose($config_file); 
     25 
     26$config_file = fopen('/etc/alternc/mysql.cnf', 'r'); 
     27while (FALSE !== ($line = fgets($config_file))) { 
     28    if (ereg('^([A-Za-z0-9_]*) *= *(.*)$', trim($line), $regs)) { 
     29        switch ($regs[1]) { 
     30        case "user": 
     31            $GLOBALS['L_MYSQL_LOGIN'] = $regs[2]; 
     32            break; 
     33        case "password": 
     34            $GLOBALS['L_MYSQL_PWD'] = $regs[2]; 
     35            break; 
     36        case "host": 
     37            $GLOBALS['L_MYSQL_HOST'] = $regs[2]; 
     38            break; 
     39        case "database": 
     40            $GLOBALS['L_MYSQL_DATABASE'] = $regs[2]; 
     41            break; 
     42        } 
     43    } 
     44} 
     45 
     46fclose($config_file); 

  • src/basedir_prot.sh

    old new  
    77# dans alternc/html/u/user avec open_base_dir 
    88 
    99# ce script a les dépendances suivantes: 
    10 # (mysql, /etc/alternc/local.sh) OR /usr/bin/get_account_by_domain dans 
    11 # l'ancien package alternc-admintools désormais dans alternc natif. 
    12 # cut, awk, sort 
     10# /usr/bin/get_account_by_domain dans l'ancien package 
     11# alternc-admintools désormais dans alternc natif.  cut, awk, sort 
    1312 
    1413override_d=/var/alternc/apacheconf 
    1514override_f=${override_d}/override_php.conf 
    …… 
    1817. /etc/alternc/local.sh 
    1918. /usr/lib/alternc/functions.sh 
    2019 
    21 if [ -z "$MYSQL_HOST" ] 
    22 then 
    23     MYSQL_HOST="localhost" 
    24 fi 
    25  
    2620echo -n "adding open_base_dir protection for:" 
    2721# boucle sur tous les domaines hébergés, ou sur les arguments de la 
    2822# ligne de commande 

  • src/sqlbackup.sh

    old new  
    2929 
    3030set -e 
    3131 
    32 # Get mysql user and password :  
    33 . /etc/alternc/local.sh 
    34  
    3532function dobck { 
    3633    local ext 
    3734    local i 
    …… 
    6360        mv -f "${target_dir}/${db}.sql${ext}" \ 
    6461              "${target_dir}/${db}.sql.${i}${ext}" 2>/dev/null || true  
    6562        if [ "$compressed" -eq 1 ]; then 
    66             mysqldump -h"$MYSQL_HOST" -u"$login" -p"$pass" "$db" --add-drop-table --allow-keywords -Q -f -q -a -e | 
     63            mysqldump --defaults-file=/etc/alternc/mysql-alternc.cnf --add-drop-table --allow-keywords -Q -f -q -a -e | 
    6764                gzip -c > "${target_dir}/${db}.sql${ext}" 
    6865        else 
    69             mysqldump -h"$MYSQL_HOST" -u"$login" -p"$pass" "$db" --add-drop-table --allow-keywords -Q -f -q -a -e \ 
     66            mysqldump --defaults-file=/etc/alternc/mysql-alternc.cnf --add-drop-table --allow-keywords -Q -f -q -a -e \ 
    7067                > "${target_dir}/${db}.sql" 
    7168        fi 
    7269 
    …… 
    8380    mode=1 
    8481fi 
    8582 
    86 /usr/bin/mysql -h"$MYSQL_HOST" -u"$MYSQL_USER" -p"$MYSQL_PASS" \ 
    87     "$MYSQL_DATABASE" -B << EOF | tail -n '+2' | dobck 
     83/usr/bin/mysql --defaults-file=/etc/alternc/mysql.cnf -B << EOF | tail -n '+2' | dobck 
    8884SELECT login, pass, db, bck_history, bck_gzip, bck_dir 
    8985  FROM db 
    9086 WHERE bck_mode=$mode; 

  • src/update_domains.sh

    old new  
    7474 
    7575. "$CONFIG_FILE" 
    7676 
    77 if [ -z "$MYSQL_HOST" -o -z "$MYSQL_DATABASE" -o -z "$MYSQL_USER" -o \ 
    78      -z "$MYSQL_PASS" -o -z "$DEFAULT_MX" -o -z "$PUBLIC_IP" ]; then 
    79     echo "Bad configuration. Please use:" 
    80     echo "   dpkg-reconfigure alternc" 
    81     exit 1 
    82 fi 
    83  
    8477if [ -f "$LOCK_FILE" ]; then 
    8578    echo "`date` $0: last cron unfinished or stale lock file." | 
    8679        tee -a "$DOMAIN_LOG_FILE" >&2 
    …… 
    9689HTTP_DNS="$DATA_ROOT/dns" 
    9790HTML_HOME="$DATA_ROOT/html" 
    9891 
    99 MYSQL_SELECT="mysql -h${MYSQL_HOST} -u${MYSQL_USER} 
    100                     -p${MYSQL_PASS} -Bs ${MYSQL_DATABASE}" 
    101 MYSQL_DELETE="mysql -h${MYSQL_HOST} -u${MYSQL_USER} 
    102                     -p${MYSQL_PASS} ${MYSQL_DATABASE}" 
     92MYSQL_SELECT="mysql --defaults-file=/etc/alternc/mysql-alternc.cnf -Bs " 
     93MYSQL_DELETE="mysql --defaults-file=/etc/alternc/mysql-alternc.cnf " 
    10394 
    10495######################################################################## 
    10596# Functions 

  • src/fixperms.sh

    old new  
    6363    done 
    6464} 
    6565 
    66 mysql -h"$MYSQL_HOST" -p"$MYSQL_PASS" -u"$MYSQL_USER" "$MYSQL_DATABASE" -B -e "select uid,login from membres" |grep -v ^uid|doone 
     66mysql --defaults-file=/etc/alternc/mysql.cnf -B -e "select uid,login from membres" |grep -v ^uid|doone 
    6767 

  • tools/get_domains_by_account

    old new  
    7474# Have to get AlternC conf file : 
    7575! [ -f "$ALTERNC_CONF_FILE" ] && { echo $MISSING_CONF_FILE ; exit 1 ; } || . $ALTERNC_CONF_FILE 
    7676# Must have access to mysql to retreive accounts owning domains : 
    77 [ -z "$MYSQL_HOST" ] && MYSQL_HOST=localhost 
    78 $mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -D$MYSQL_DATABASE -e "select count(*) from domaines_standby;" > /dev/null 2>&1 
    79 [ "$?" != 0 ] && { echo "$MYSQL_UNREACHABLE_DATABASE" ; exit 1 ; } || mysql="$mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -D$MYSQL_DATABASE -B -N -e " 
     77mysql="$mysql --defaults-file=/etc/alternc/mysql.cnf -B -N -e" 
     78$mysql "select count(*) from domaines_standby;" > /dev/null 2>&1 
     79[ "$?" != 0 ] && { echo "$MYSQL_UNREACHABLE_DATABASE" ; exit 1 ; } 
    8080 
    8181# Does the stuff 
    8282$mysql "select concat(a.sub, if(a.sub=\"\",\"\", \".\"), a.domaine) from sub_domaines a, membres b where a.compte = b.uid and b.login = \"${1}\";" 

  • tools/top_http_users

    old new  
    168168# Have to get AlternC conf file : 
    169169[ -f "$ALTERNC_CONF_FILE" ] || { echo $MISSING_CONF_FILE ; exit 1 ; } && . $ALTERNC_CONF_FILE 
    170170# Must have access to mysql to retreive accounts owning domains : 
    171 [ -z "$MYSQL_HOST" ] && MYSQL_HOST=localhost 
    172 $mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -D$MYSQL_DATABASE -e "select count(*) from domaines_standby;" > /dev/null 2>&1 
    173 [ "$?" != 0 ] && { echo "$MYSQL_UNREACHABLE_DATABASE" ; exit 1 ; } || mysql="$mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -D$MYSQL_DATABASE -B -N -e " 
    174  
     171mysql="$mysql --defaults-file=/etc/alternc/mysql.cnf -B -N -e" 
     172$mysql "select count(*) from domaines_standby;" > /dev/null 2>&1 
     173[ "$?" != 0 ] && { echo "$MYSQL_UNREACHABLE_DATABASE" ; exit 1 ; } 
    175174# Prevents executing more than one shell at the same time 
    176175$lockfilecreate --retry 1 $LOCK_FILE 
    177176if [ $? != 0 ] 

  • tools/get_account_by_domain

    old new  
    7575[ "$1" = "-h" ] || [ "$1" = "--help" ] && { echo $HELP ; echo $USAGE ; exit 0 ; } 
    7676# Have to get AlternC conf file : 
    7777! [ -f "$ALTERNC_CONF_FILE" ] && { echo $MISSING_CONF_FILE ; exit 1 ; } || . $ALTERNC_CONF_FILE 
    78 # Must have access to mysql to retreive accounts owning domains : 
    79 [ -z "$MYSQL_HOST" ] && MYSQL_HOST=localhost 
    80 $mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -D$MYSQL_DATABASE -e "select count(*) from domaines_standby;" > /dev/null 2>&1 
    81 [ "$?" != 0 ] && { echo "$MYSQL_UNREACHABLE_DATABASE" ; exit 1 ; } || mysql="$mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -D$MYSQL_DATABASE -B -N -e " 
     78mysql=$mysql --defaults-file=/etc/alternc/mysql.cnf 
     79$mysql -e "select count(*) from domaines_standby;" > /dev/null 2>&1 
     80[ "$?" != 0 ] && { echo "$MYSQL_UNREACHABLE_DATABASE" ; exit 1 ; } 
    8281 
    8382# Does the stuff 
    84 $mysql "select concat(a.login, \" (\", a.mail, \")\") from membres a, sub_domaines b where a.uid = b.compte and concat(if(sub=\"\", \"\", concat(sub, \".\")), domaine)  = \"${1}\";" 
     83$mysql -B -N -e "select concat(a.login, \" (\", a.mail, \")\") from membres a, sub_domaines b where a.uid = b.compte and concat(if(sub=\"\", \"\", concat(sub, \".\")), domaine)  = \"${1}\";" 
    8584 
    8685