Skip to content

Commit bbb4b7d

Browse files
dshamanskaiadshamanskaia
committed
BUGFIX SVM-4194 Security fix for client area custom actions
1 parent 4d4b3b4 commit bbb4b7d

7 files changed

Lines changed: 26 additions & 17 deletions

File tree

‎modules/servers/solusvmpro/VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
4.2.2
1+
4.2.3

‎modules/servers/solusvmpro/js/hostname.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,10 @@ $(function () {
3939
ajax: 1,
4040
ac: 'Custom_ChangeHostname'
4141
};
42+
ajaxData.token = token.indexOf('token=') !== -1 ? token.split('token=')[1] : token;
4243
$.ajax({
43-
/*type: "POST",*/
44-
url: document.location.href + token,
44+
type: "POST",
45+
url: document.location.href.split('#')[0],
4546
data: ajaxData,
4647
cache: false,
4748
dataType: 'json'/*,

‎modules/servers/solusvmpro/js/rescuemode.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,10 @@ $(function () {
4242
ac: 'Custom_ChangeRescueMode'
4343
};
4444

45+
ajaxData.token = token.indexOf('token=') !== -1 ? token.split('token=')[1] : token;
4546
$.ajax({
46-
url: document.location.href + token,
47+
type: "POST",
48+
url: document.location.href.split('#')[0],
4749
data: ajaxData,
4850
cache: false,
4951
dataType: 'json'/*,

‎modules/servers/solusvmpro/js/rootpassword.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,10 @@ $(function () {
4444
ajax: 1,
4545
ac: 'Custom_ChangeRootPassword'
4646
};
47+
ajaxData.token = token.indexOf('token=') !== -1 ? token.split('token=')[1] : token;
4748
$.ajax({
48-
url: document.location.href + token,
49+
type: "POST",
50+
url: document.location.href.split('#')[0],
4951
data: ajaxData,
5052
cache: false,
5153
dataType: 'json'/*,

‎modules/servers/solusvmpro/js/vncpassword.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,10 @@ $(function () {
4444
ajax: 1,
4545
ac: 'Custom_ChangeVNCPassword'
4646
};
47+
ajaxData.token = token.indexOf('token=') !== -1 ? token.split('token=')[1] : token;
4748
$.ajax({
48-
url: document.location.href + token,
49+
type: "POST",
50+
url: document.location.href.split('#')[0],
4951
data: ajaxData,
5052
cache: false,
5153
dataType: 'json'/*,

‎modules/servers/solusvmpro/solusvmpro.php‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -918,7 +918,7 @@ function solusvmpro_AdminLink( $params ) {
918918
function solusvmpro_Custom_ChangeHostname( $params = '' ) {
919919
global $_LANG;
920920

921-
$newhostname = $_GET['newhostname'];
921+
$newhostname = isset( $_POST['newhostname'] ) ? $_POST['newhostname'] : '';
922922
$check_section = SolusVM::dns_verify_rdns_section( $newhostname );
923923
if ( $check_section ) {
924924
## The call string for the connection function
@@ -976,7 +976,7 @@ function solusvmpro_Custom_ChangeHostname( $params = '' ) {
976976
function solusvmpro_Custom_ChangeRootPassword( $params = '' ) {
977977
global $_LANG;
978978

979-
$newrootpassword = $_GET['newrootpassword'];
979+
$newrootpassword = isset( $_POST['newrootpassword'] ) ? $_POST['newrootpassword'] : '';
980980
$checkNewRootPassword = SolusVM::validateRootPassword( $newrootpassword );
981981
if ( $checkNewRootPassword ) {
982982
## The call string for the connection function
@@ -1033,7 +1033,7 @@ function solusvmpro_Custom_ChangeRootPassword( $params = '' ) {
10331033
function solusvmpro_Custom_ChangeVNCPassword( $params = '' ) {
10341034
global $_LANG;
10351035

1036-
$newvncpassword = $_GET['newvncpassword'];
1036+
$newvncpassword = isset( $_POST['newvncpassword'] ) ? $_POST['newvncpassword'] : '';
10371037
$checkNewVNCPassword = SolusVM::validateVNCPassword( $newvncpassword );
10381038
if ( $checkNewVNCPassword ) {
10391039
## The call string for the connection function
@@ -1094,9 +1094,10 @@ function solusvmpro_Custom_ChangeVNCPassword( $params = '' ) {
10941094

10951095
function solusvmpro_ClientArea( $params ) {
10961096
$notCustomFuntions = [ 'reboot', 'shutdown', 'boot' ];
1097-
if ( isset( $_GET['modop'] ) && ( $_GET['modop'] == 'custom' ) ) {
1098-
if ( isset( $_GET['a'] ) && !in_array( $_GET['a'], $notCustomFuntions ) ) {
1099-
$functionName = 'solusvmpro_' . 'Custom_' . $_GET['a'];
1097+
if ( isset( $_REQUEST['modop'] ) && ( $_REQUEST['modop'] == 'custom' ) ) {
1098+
if ( isset( $_REQUEST['a'] ) && !in_array( $_REQUEST['a'], $notCustomFuntions ) ) {
1099+
check_token();
1100+
$functionName = 'solusvmpro_' . 'Custom_' . $_REQUEST['a'];
11001101
if ( function_exists( $functionName ) ) {
11011102
$functionName( $params );
11021103
} else {
@@ -1231,7 +1232,7 @@ function solusvmpro_Custom_ChangeRescueMode( $params = '' ) {
12311232
global $_LANG;
12321233

12331234
$allowedActions = array( 'rescueenable', 'rescuedisable' );
1234-
$rescueAction = isset( $_GET['rescueAction'] ) ? $_GET['rescueAction'] : '';
1235+
$rescueAction = isset( $_POST['rescueAction'] ) ? $_POST['rescueAction'] : '';
12351236

12361237
if ( in_array( $rescueAction, $allowedActions, true ) ) {
12371238
$callArray = array(

‎modules/servers/solusvmpro/templates/clientareaBootstrap.tpl‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,29 +27,30 @@
2727

2828
if (!reload) {
2929
var vserverid = {/literal}{$data.vserverid}{literal};
30+
var token = '&token={/literal}{$token}{literal}';
3031
window.solusvmpro_get_and_fill_client_data(vserverid);
3132
window.solusvmpro_hostname(vserverid, {
3233
'solusvmpro_invalidHostname': '{/literal}{$LANG.solusvmpro_invalidHostname}{literal}',
3334
'solusvmpro_change': '{/literal}{$LANG.solusvmpro_change}{literal}'
34-
});
35+
}, token);
3536
window.solusvmpro_rootpassword(vserverid, {
3637
'solusvmpro_invalidRootpassword': '{/literal}{$LANG.solusvmpro_invalidRootpassword}{literal}',
3738
'solusvmpro_change': '{/literal}{$LANG.solusvmpro_change}{literal}',
3839
'solusvmpro_confirmRootPassword': '{/literal}{$LANG.solusvmpro_confirmRootPassword}{literal}',
3940
'solusvmpro_confirmErrorPassword': '{/literal}{$LANG.solusvmpro_confirmErrorPassword}{literal}',
4041
'solusvmpro_confirmPassword': '{/literal}{$LANG.solusvmpro_confirmPassword}{literal}'
41-
});
42+
}, token);
4243
window.solusvmpro_vncpassword(vserverid, {
4344
'solusvmpro_invalidVNCpassword': '{/literal}{$LANG.solusvmpro_invalidVNCpassword}{literal}',
4445
'solusvmpro_change': '{/literal}{$LANG.solusvmpro_change}{literal}',
4546
'solusvmpro_confirmVNCPassword': '{/literal}{$LANG.solusvmpro_confirmVNCPassword}{literal}',
4647
'solusvmpro_confirmErrorPassword': '{/literal}{$LANG.solusvmpro_confirmErrorPassword}{literal}',
4748
'solusvmpro_confirmPassword': '{/literal}{$LANG.solusvmpro_confirmPassword}{literal}'
48-
});
49+
}, token);
4950
window.solusvmpro_rescuemode(vserverid, {
5051
'solusvmpro_refresh': '{/literal}{$LANG.solusvmpro_refresh}{literal}',
5152
'solusvmpro_processing': '{/literal}{$LANG.solusvmpro_processing}{literal}'
52-
});
53+
}, token);
5354

5455
var cookieNameForAccordionGroup = 'solusvmpro_activeAccordionGroup_Client';
5556
var last = document.cookie.replace(new RegExp("(?:(?:^|.*;)\\s*" + encodeURIComponent(cookieNameForAccordionGroup).replace(/[\-\.\+\*]/g, "\\$&") + "\\s*\\=\\s*([^;]*).*$)|^.*$"), "$1")

0 commit comments

Comments
 (0)