* Merged shell-escape-fix

php/cbsd.php

@@ -0,0 +1,58 @@
+<?php
+
+class CBSD {
+
+	static function run($cmd, $args){
+
+		$prepend='env NOCOLOR=1 /usr/local/bin/sudo /usr/local/bin/cbsd ';
+		$defines = array(
+			'{cbsd_loc}' => "/usr/local/bin/cbsd"
+		);
+
+		$specs = array(
+			0 => array('pipe','r'),
+			1 => array('pipe','w'),
+			2 => array('pipe','r')
+		);
+
+		$cmd = vsprintf($cmd, $args); # make sure we deal with a string
+		$cmd = strtr($cmd, $defines);
+		$full_cmd = $prepend.trim($cmd);
+
+		if ($cmd != escapeshellcmd($cmd)){
+			die("Shell escape attempt");
+		}
+
+		$process = proc_open($full_cmd,$specs,$pipes,null,null);
+
+		$error=false;
+		$error_message='';
+		$message='';
+		if (is_resource($process)){
+			$buf=stream_get_contents($pipes[1]);
+			$buf0=stream_get_contents($pipes[0]);
+			$buf1=stream_get_contents($pipes[2]);
+			fclose($pipes[0]);
+			fclose($pipes[1]);
+			fclose($pipes[2]);
+
+			$task_id=-1;
+			$return_value = proc_close($process);
+			if($return_value==0) $message=trim($buf); else {
+				$error=true;
+				$error_message=$buf;
+			}
+
+			return array(
+				'cmd'=>$cmd,
+				'full_cmd'=>$full_cmd,
+				'retval'=>$return_value,
+				'message'=>$message,
+				'error'=>$error,
+				'error_message'=>$error_message
+			);
+		}
+	}
+
+}
+

php/config.php

@@ -1,4 +1,5 @@
 <?php
+
 class Config
 {
 	/* Список языков, используемых в проекте */
@@ -6,7 +7,7 @@ class Config
 		'en'=>'English',
 		'ru'=>'Russian',
 	);
-	
+
 	public $os_types_names=array(
 		'netbsd'=>'NetBSD',
 		'dflybsd'=>'DragonflyBSD',
@@ -16,7 +17,7 @@ class Config
 		'openbsd'=>'OpenBSD',
 		'windows'=>'Windows',
 	);
-	
+
 	public $other_titles=array(
 		'settings'=>'CBSD Settings',
 		'users'=>'CBSD Users',
@@ -35,91 +36,91 @@ class Config
 			'title'=>'Jails containers control panel',
 			'icon'=>'icon-server',
 		),
-		
+
 		'instance_jail'=>array(
 			'name'=>'Template for jail',
 			'title'=>'Helpers and wizard for containers',
 			'icon'=>'icon-cubes',
 		),
-		
+
 		'bhyvevms'=>array(
 			'name'=>'Bhyve VMs',
 			'title'=>'Virtual machine control panel',
 			'icon'=>'icon-th-list',
 		),
-/*
+		/*
 		'nodes'=>array(
 			'name'=>'Nodes',
 			'title'=>'Nodes control panel',
 			'icon'=>'icon-buffer',
 		),
-*/
+		*/
 		'vm_packages'=>array(
 			'name'=>'VM Packages',
 			'title'=>'Manage VM Packages group',
 			'icon'=>'icon-cubes',
 		),
-		
+
 		'k8s'=>array(
 			'name'=>'K8S clusters',
 			'title'=>'Manage K8S clusters',
 			'icon'=>'icon-cubes',
 		),
-		
+
 		'vpnet'=>array(
 			'name'=>'Virtual Private Network',
 			'title'=>'Manage for virtual private networks',
 			'icon'=>'icon-plug',
 		),
-		
+
 		'authkey'=>array(
 			'name'=>'Authkeys',
 			'title'=>'Manage for SSH auth key',
 			'icon'=>'icon-key',
 		),
-		
+
 		'media'=>array(
 			'name'=>'Storage Media',
 			'title'=>'Virtual Media Manager',
 			'icon'=>'icon-inbox',
 		),
-		
+
 		'imported'=>array(
 			'name'=>'Imported images',
 			'title'=>'Imported images',
 			'icon'=>'icon-upload',
 		),
-/*		
+		/*
 		'repo'=>array(
 			'name'=>'Repository',
 			'title'=>'Remote repository',
 			'icon'=>'icon-globe',
 		),
-*/		
+		*/
 		'bases'=>array(
 			'name'=>'FreeBSD Bases',
 			'title'=>'FreeBSD bases manager',
 			'icon'=>'icon-database',
 		),
-		
+
 		'sources'=>array(
 			'name'=>'FreeBSD Sources',
 			'title'=>'FreeBSD sources manager',
 			'icon'=>'icon-edit',
 		),
-/*
+		/*
 		'jail_marketplace'=>array(
 			'name'=>'Jail Marketplace',
 			'title'=>'Public remote containers marketplace',
 			'icon'=>'icon-flag',
 		),
-*//*
+		*//*
 		'bhyve_marketplace'=>array(
 			'name'=>'Bhyve Marketplace',
 			'title'=>'Public remote virtual machine marketplace',
 			'icon'=>'icon-flag-checkered',
 		),
-*/
+		*/
 		'tasklog'=>array(
 			'name'=>'TaskLog',
 			'title'=>'System task log',
@@ -130,10 +131,9 @@ class Config
 			'name'=>'SQLite admin',
 			'title'=>'SQLite admin interface',
 			'icon'=>'icon-wpforms',
-		),
-
+		)
 	);
-	
+
 	public $os_types=array(
 		array(
 			'os'=>'DragonflyBSD',
@@ -178,66 +178,59 @@ class Config
 			),
 		)
 	);
-	
+
 	public $os_types_obtain=array();
 	public $os_interfaces=array();
-	
-	function __construct()
-	{
-		$array=array();
-		$array1=array();
-		// $res=ClonOS::cbsd_cmd('get_bhyve_profiles src=vm clonos=1'); for obtain/library
-		$res=ClonOS::cbsd_cmd('get_bhyve_profiles src=vm clonos=1');
-		if($res['retval']==0)
-		{
+
+	function __construct(){
+		$res=CBSD::run('get_bhyve_profiles src=vm clonos=1', array());
+		if($res['retval']==0){
 			$this->os_types=$this->create_bhyve_profiles($res);
 		}
-		
-		$res1=ClonOS::cbsd_cmd('get_bhyve_profiles src=cloud');
-		if($res1['retval']==0)
-		{
+
+		$res1=CBSD::run('get_bhyve_profiles src=cloud', array());
+		if($res1['retval']==0){
 			$this->os_types_obtain=$this->create_bhyve_profiles($res1);
 		}
-		
-		$res2=ClonOS::cbsd_cmd('cbsd get_interfaces');
-		if($res2['retval']==0)
-		{
+
+		$res2=CBSD::run('cbsd get_interfaces', array());
+		if($res2['retval']==0){
 			$this->os_interfaces=$this->create_interfaces($res2);
 		}
 	}
-	function create_bhyve_profiles($info)
-	{
-		$array1=array();
+
+	function create_bhyve_profiles($info){
+		$os_names = array();
 		$res=json_decode($info['message'],true);
-		if(!empty($res))foreach($res as $item)
-		{
-			$os_name=$this->os_types_names[$item['type']];
-			if(isset($array[$os_name]))
-			{
-				$array[$os_name]['items'][]=$item;
-			}else{
-				$array[$os_name]=array('os'=>$os_name,'items'=>array($item));
+		if(!is_null($res) && $res != false){
+			foreach($res as $item){
+				$os_name=$this->os_types_names[$item['type']];
+				if(isset($os_names[$os_name])){
+					$os_names[$os_name]['items'][]=$item;
+				}else{
+					$os_names[$os_name]=array('os'=>$os_name,'items'=>array($item));
+				}
 			}
 		}
-		if(!empty($array))foreach($array as $item) $array1[]=$item;
-		unset($array);
-		return $array1;
-		//$this->os_types=$array1;
+		return $os_names;
 	}
-	function create_interfaces($info)
-	{
+
+	function create_interfaces($info){
 		$res=json_decode($info['message'],true);
-		return $res;
+		if(!is_null($res) && $res != false){
+			return $res;
+		} else {
+			return array();
+		}
 	}
-	
-	function os_types_create($obtain='new')
-	{
+
+	function os_types_create($obtain='new'){
 		$obtain=($obtain=='obtain');
 		if($obtain)
 			$info=$this->os_types_obtain;
 		else
 			$info=$this->os_types;
-		
+
 		$html='';
 		foreach($info as $num1=>$os)
 		{
@@ -258,53 +251,45 @@ class Config
 		}
 		return $html;
 	}
-	
-	
-	function authkeys_list()
-	{
+
+	function authkeys_list(){
 		$db=new Db('base','authkey');
 		$res=$db->select('SELECT idx,name FROM authkey;', array());
-		
+
 		$html='';
-		if(!empty($res))foreach($res as $item)
-		{
+		if(!empty($res))foreach($res as $item){
 			$html.='					<option value="'.$item['idx'].'">'.$item['name'].'</option>'.PHP_EOL;
 		}
 		return $html;
 	}
-	
-	function vm_packages_list()
-	{
+
+	function vm_packages_list(){
 		$db=new Db('base','local');
 		$res=$db->select('select id,name,description,pkg_vm_ram,pkg_vm_disk,pkg_vm_cpus,owner from vmpackages order by name asc;', array());
-		
+
 		$html='<option value="0"></option>';
 		$min=0;
 		$min_id=0;
-		if(!empty($res))foreach($res as $item)
-		{
+		if(!empty($res))foreach($res as $item){
 			$cpu=$item['pkg_vm_cpus'];
 			$ram=trim($item['pkg_vm_ram']);
 			$ed=substr($ram,-1);
-			if($ed=='b')
-			{
+			if($ed=='b'){
 				$ed=substr($ram,-2,1).'b';
 				$ram=substr($ram,0,-2);
 			}
 			if($ed=='m' || $ed=='g') $ed.='b';
-			if($ed=='mb')
-			{
+			if($ed=='mb'){
 				$ram1=substr($ram,0,-1);
 				$ram1=$ram1/1000000;
 			}
-			if($ed=='gb')
-			{
+			if($ed=='gb'){
 				$ram1=substr($ram,0,-1);
 				$ram1=$ram1/1000;
 			}
 			$res1=$cpu+$ram1;
 			if($min>$res1 || $min==0) {$min=$res1;$min_id=$item['id'];}
-			
+
 			$name='<strong>'.$item['name'].'</strong> (cpu: '.$cpu.'; ram: '.$ram.'; hdd: '.$item['pkg_vm_disk'].')';
 			$html.='					<option value="'.$item['id'].'" title="'.$item['description'].'">'.$name.'</option>'.PHP_EOL;
 		}

php/forms.php

@@ -22,31 +22,26 @@ class Forms
 	private $name='';
 	private $db='';
 	private $html='';
-	
-	function __construct($jname,$helper='',$db_path=false)
-	{
+
+	function __construct($jname,$helper='',$db_path=false){
 		$this->name=$jname;
-		if($jname=='')
-		{
+		if($jname==''){
 			$database=$helper;
 		}else if($jname=='cbsd-settings'){
 			$this->db=new Db('cbsd-settings');
 		}else{
 			$database=array('jname'=>$jname,'helper'=>$helper);
 		}
-		if($helper!='')
-		{
-			if($db_path!==false)
-			{
+		if($helper!=''){
+			if($db_path!==false){
 				$this->db=new Db('file',$db_path);
 			}else{
 				$this->db=new Db('helper',$database);
 			}
 		}
 	}
-	
-	function generate()
-	{
+
+	function generate(){
 		if($this->db->error) return;
 		//$query="select * from forms order by group_id asc, order_id asc";
 		$query="select * from forms order by groupname asc, group_id asc, order_id asc";
@@ -55,16 +50,14 @@ class Forms
 		//echo '<pre>';print_r($fields);
 		//$defaults=array();
 		//$currents=array();
-		
+
 		// Строим карту формы с группами элементов
 		$groups=array();
 		foreach($fields as $key=>$field)
 		{
 			$group=$field['groupname'];
-			if(!empty($group))
-			{
-				if($field['type']=='group_add')
-				{	// Expand
+			if(!empty($group)){
+				if($field['type']=='group_add'){	// Expand
 					$groups[$group]['_title']=$field['desc'];
 				}else if($field['type']=='delimer'){
 					// Delimer
@@ -89,12 +82,12 @@ class Forms
 				$this->html.='<div class="pad-head"></div>';
 			*/
 			$last_type=$field['type'];
-			
+
 			if(isset($field['cur']) && isset($field['def']))
 			{
 				if(empty($field['cur'])) $field['cur']=$field['def'];
 			}
-			
+
 			$tpl=$this->getElement($field['type'],$field);
 			$params=array('param','desc','attr','cur');
 			foreach($params as $param)
@@ -102,29 +95,28 @@ class Forms
 				if(isset($field[$param]))
 					$tpl=str_replace('${'.$param.'}',$field[$param],$tpl);
 			}
-			
+
 			//$value=$field['def'];
 			//if(isset($field['cur']) && !empty($field['cur'])) $value=$field['cur'];
 			$value=$field['cur'];
 			$tpl=str_replace('${value}',$value,$tpl);
-			
+
 			$value=$field['def'];
 			$tpl=str_replace('${def}',$value,$tpl);
-			
+
 			$required=($field['mandatory']==1)?' required':'';
 			$tpl=str_replace('${required}',$required,$tpl);
 			$arr[$key]=$tpl;
-			
+
 			//if($field['param']!='-') $currents[$field['param']]=$field['cur'];
 			//if($field['param']!='-') $defaults[$field['param']]=$field['def'];
 		}
-		
+
 		// Выстраиваем форму по карте
 		$this->html='<form class="helper" name="" onsubmit="return false;"><div class="form-fields">';
 		foreach($groups as $key=>$txt)
 		{
-			if(is_numeric($key))
-			{
+			if(is_numeric($key)){
 				$this->html.=$arr[$key];
 			}else if(is_array($txt)){
 				$group_name=key($txt);
@@ -134,8 +126,7 @@ class Forms
 				{
 					$group_id=$val1['_group_id'];
 					unset($val1['_group_id']);
-					if(is_array($val1))
-					{
+					if(is_array($val1)){
 						$this->html.='<div class="form-field"><fieldset id="ind-'.$group_id.'"><legend>'.$group_title.'</legend>';
 						foreach($val1 as $key2=>$val2)
 							$this->html.=$arr[$val2];
@@ -148,21 +139,19 @@ class Forms
 			}
 		}
 		$this->html.='</div>';
-		
+
 		$this->setButtons();
 		$this->html.='</form>';
 		return array('html'=>$this->html);	//	,'currents'=>$currents	//,'defaults'=>$defaults
 	}
-	
-	function getElement($el,$arr=array())
-	{
+
+	function getElement($el,$arr=array()){
 		$tpl='';
 		switch(trim($el))
 		{
 			case 'inputbox':
 				$res=$this->getInputAutofill($arr);
-				if($res===false)
-				{
+				if($res===false){
 					$list='';
 					$datalist='';
 				}else{
@@ -190,29 +179,26 @@ class Forms
 		}
 		return $tpl;
 	}
-	
-	function getInputAutofill($arr)
-	{
-		if(isset($arr['link']))
-		{
+
+	function getInputAutofill($arr){
+		if(isset($arr['link'])){
 			$id=$arr['link'];	//$arr['param'].'-'.
 			$tpl='<datalist id="'.$id.'">';
 			$query="select * from ? order by order_id asc";
 			$opts=$this->db->select($query, array([$arr['link']]));
-			if(!empty($opts))foreach($opts as $key=>$opt)
-			{
+			if(!empty($opts))foreach($opts as $key=>$opt){
 				$tpl.='<option>'.$opt['text'].'</option>';
 			}
 			$tpl.='</datalist>';
 			return array('list'=>$id,'datalist'=>$tpl);
-		}else return false;
+		}else {
+			return false;
+		}
 	}
-	
-	function getSelect($el,$arr)
-	{
+
+	function getSelect($el,$arr){
 		$tpl='<div class="form-field"><select name="${param}">';
-		if(isset($arr['link']))
-		{
+		if(isset($arr['link'])){
 			$query="select * from ? order by order_id asc";
 			$opts=$this->db->select($query, array([$arr['link']]));
 			// Пустое поле в списках оказалось ненужным!
@@ -226,16 +212,13 @@ class Forms
 		$tpl.='</select><span class="default val-${def}" title="Click to fill dafault value">[default]</span><span class="small">${desc}</span></div>';
 		return $tpl;
 	}
-	
-	function getRadio($el,$arr)
-	{
+
+	function getRadio($el,$arr){
 		$tpl='<div class="form-field"><fieldset><legend>${desc}</legend>';
-		if(isset($arr['link']))
-		{
+		if(isset($arr['link'])){
 			$query="select * from ? order by order_id asc";
 			$opts=$this->db->select($query, array([$arr['link']]));
-			if(!empty($opts))foreach($opts as $key=>$opt)
-			{
+			if(!empty($opts))foreach($opts as $key=>$opt){
 				$checked=($opt['id']==$arr['cur'])?' checked':'';
 				$tpl.='<label for="${param}-'.$opt['id'].'">'.$opt['text'].':</label><input type="radio" name="${param}" value="'.$opt['id'].'" id="${param}-'.$opt['id'].'"'.$checked.' />';
 			}
@@ -243,9 +226,8 @@ class Forms
 		$tpl.='</fieldset></div>';
 		return $tpl;
 	}
-	
-	function setButtons($arr=array())
-	{
+
+	function setButtons($arr=array()){
 		$this->html.='<div class="buttons"><input type="button" value="Apply" class="save-helper-values" title="Save and apply params" /> &nbsp; <input type="button" value="Clear" class="clear-helper" title="Restore loaded params" /></div>';
 	}
 }