* Merged shell-escape-fix

php/cbsd.php

@@ -0,0 +1,58 @@
+<?php
+
+class CBSD {
+
+	static function run($cmd, $args){
+
+		$prepend='env NOCOLOR=1 /usr/local/bin/sudo /usr/local/bin/cbsd ';
+		$defines = array(
+			'{cbsd_loc}' => "/usr/local/bin/cbsd"
+		);
+
+		$specs = array(
+			0 => array('pipe','r'),
+			1 => array('pipe','w'),
+			2 => array('pipe','r')
+		);
+
+		$cmd = vsprintf($cmd, $args); # make sure we deal with a string
+		$cmd = strtr($cmd, $defines);
+		$full_cmd = $prepend.trim($cmd);
+
+		if ($cmd != escapeshellcmd($cmd)){
+			die("Shell escape attempt");
+		}
+
+		$process = proc_open($full_cmd,$specs,$pipes,null,null);
+
+		$error=false;
+		$error_message='';
+		$message='';
+		if (is_resource($process)){
+			$buf=stream_get_contents($pipes[1]);
+			$buf0=stream_get_contents($pipes[0]);
+			$buf1=stream_get_contents($pipes[2]);
+			fclose($pipes[0]);
+			fclose($pipes[1]);
+			fclose($pipes[2]);
+
+			$task_id=-1;
+			$return_value = proc_close($process);
+			if($return_value==0) $message=trim($buf); else {
+				$error=true;
+				$error_message=$buf;
+			}
+
+			return array(
+				'cmd'=>$cmd,
+				'full_cmd'=>$full_cmd,
+				'retval'=>$return_value,
+				'message'=>$message,
+				'error'=>$error,
+				'error_message'=>$error_message
+			);
+		}
+	}
+
+}
+

php/config.php

@@ -1,4 +1,5 @@
 <?php
+
 class Config
 {
 	/* Список языков, используемых в проекте */
@@ -47,13 +48,13 @@ class Config
 			'title'=>'Virtual machine control panel',
 			'icon'=>'icon-th-list',
 		),
-/*
+		/*
 		'nodes'=>array(
 			'name'=>'Nodes',
 			'title'=>'Nodes control panel',
 			'icon'=>'icon-buffer',
 		),
-*/
+		*/
 		'vm_packages'=>array(
 			'name'=>'VM Packages',
 			'title'=>'Manage VM Packages group',
@@ -89,13 +90,13 @@ class Config
 			'title'=>'Imported images',
 			'icon'=>'icon-upload',
 		),
-/*		
+		/*
 		'repo'=>array(
 			'name'=>'Repository',
 			'title'=>'Remote repository',
 			'icon'=>'icon-globe',
 		),
-*/		
+		*/
 		'bases'=>array(
 			'name'=>'FreeBSD Bases',
 			'title'=>'FreeBSD bases manager',
@@ -107,19 +108,19 @@ class Config
 			'title'=>'FreeBSD sources manager',
 			'icon'=>'icon-edit',
 		),
-/*
+		/*
 		'jail_marketplace'=>array(
 			'name'=>'Jail Marketplace',
 			'title'=>'Public remote containers marketplace',
 			'icon'=>'icon-flag',
 		),
-*//*
+		*//*
 		'bhyve_marketplace'=>array(
 			'name'=>'Bhyve Marketplace',
 			'title'=>'Public remote virtual machine marketplace',
 			'icon'=>'icon-flag-checkered',
 		),
-*/
+		*/
 		'tasklog'=>array(
 			'name'=>'TaskLog',
 			'title'=>'System task log',
@@ -130,8 +131,7 @@ class Config
 			'name'=>'SQLite admin',
 			'title'=>'SQLite admin interface',
 			'icon'=>'icon-wpforms',
-		),
-
+		)
 	);
 
 	public $os_types=array(
@@ -182,56 +182,49 @@ class Config
 	public $os_types_obtain=array();
 	public $os_interfaces=array();
 
-	function __construct()
-	{
-		$array=array();
-		$array1=array();
-		// $res=ClonOS::cbsd_cmd('get_bhyve_profiles src=vm clonos=1'); for obtain/library
-		$res=ClonOS::cbsd_cmd('get_bhyve_profiles src=vm clonos=1');
-		if($res['retval']==0)
-		{
+	function __construct(){
+		$res=CBSD::run('get_bhyve_profiles src=vm clonos=1', array());
+		if($res['retval']==0){
 			$this->os_types=$this->create_bhyve_profiles($res);
 		}
 
-		$res1=ClonOS::cbsd_cmd('get_bhyve_profiles src=cloud');
-		if($res1['retval']==0)
-		{
+		$res1=CBSD::run('get_bhyve_profiles src=cloud', array());
+		if($res1['retval']==0){
 			$this->os_types_obtain=$this->create_bhyve_profiles($res1);
 		}
 
-		$res2=ClonOS::cbsd_cmd('cbsd get_interfaces');
-		if($res2['retval']==0)
-		{
+		$res2=CBSD::run('cbsd get_interfaces', array());
+		if($res2['retval']==0){
 			$this->os_interfaces=$this->create_interfaces($res2);
 		}
 	}
-	function create_bhyve_profiles($info)
-	{
-		$array1=array();
+
+	function create_bhyve_profiles($info){
+		$os_names = array();
 		$res=json_decode($info['message'],true);
-		if(!empty($res))foreach($res as $item)
-		{
+		if(!is_null($res) && $res != false){
+			foreach($res as $item){
 				$os_name=$this->os_types_names[$item['type']];
-			if(isset($array[$os_name]))
-			{
-				$array[$os_name]['items'][]=$item;
+				if(isset($os_names[$os_name])){
+					$os_names[$os_name]['items'][]=$item;
 				}else{
-				$array[$os_name]=array('os'=>$os_name,'items'=>array($item));
+					$os_names[$os_name]=array('os'=>$os_name,'items'=>array($item));
 				}
 			}
-		if(!empty($array))foreach($array as $item) $array1[]=$item;
-		unset($array);
-		return $array1;
-		//$this->os_types=$array1;
 		}
-	function create_interfaces($info)
-	{
-		$res=json_decode($info['message'],true);
-		return $res;
+		return $os_names;
 	}
 
-	function os_types_create($obtain='new')
-	{
+	function create_interfaces($info){
+		$res=json_decode($info['message'],true);
+		if(!is_null($res) && $res != false){
+			return $res;
+		} else {
+			return array();
+		}
+	}
+
+	function os_types_create($obtain='new'){
 		$obtain=($obtain=='obtain');
 		if($obtain)
 			$info=$this->os_types_obtain;
@@ -259,46 +252,38 @@ class Config
 		return $html;
 	}
 
-	
-	function authkeys_list()
-	{
+	function authkeys_list(){
 		$db=new Db('base','authkey');
 		$res=$db->select('SELECT idx,name FROM authkey;', array());
 
 		$html='';
-		if(!empty($res))foreach($res as $item)
-		{
+		if(!empty($res))foreach($res as $item){
 			$html.='					<option value="'.$item['idx'].'">'.$item['name'].'</option>'.PHP_EOL;
 		}
 		return $html;
 	}
 
-	function vm_packages_list()
-	{
+	function vm_packages_list(){
 		$db=new Db('base','local');
 		$res=$db->select('select id,name,description,pkg_vm_ram,pkg_vm_disk,pkg_vm_cpus,owner from vmpackages order by name asc;', array());
 
 		$html='<option value="0"></option>';
 		$min=0;
 		$min_id=0;
-		if(!empty($res))foreach($res as $item)
-		{
+		if(!empty($res))foreach($res as $item){
 			$cpu=$item['pkg_vm_cpus'];
 			$ram=trim($item['pkg_vm_ram']);
 			$ed=substr($ram,-1);
-			if($ed=='b')
-			{
+			if($ed=='b'){
 				$ed=substr($ram,-2,1).'b';
 				$ram=substr($ram,0,-2);
 			}
 			if($ed=='m' || $ed=='g') $ed.='b';
-			if($ed=='mb')
-			{
+			if($ed=='mb'){
 				$ram1=substr($ram,0,-1);
 				$ram1=$ram1/1000000;
 			}
-			if($ed=='gb')
-			{
+			if($ed=='gb'){
 				$ram1=substr($ram,0,-1);
 				$ram1=$ram1/1000;
 			}

php/forms.php

@@ -23,21 +23,17 @@ class Forms
 	private $db='';
 	private $html='';
 
-	function __construct($jname,$helper='',$db_path=false)
-	{
+	function __construct($jname,$helper='',$db_path=false){
 		$this->name=$jname;
-		if($jname=='')
-		{
+		if($jname==''){
 			$database=$helper;
 		}else if($jname=='cbsd-settings'){
 			$this->db=new Db('cbsd-settings');
 		}else{
 			$database=array('jname'=>$jname,'helper'=>$helper);
 		}
-		if($helper!='')
-		{
-			if($db_path!==false)
-			{
+		if($helper!=''){
+			if($db_path!==false){
 				$this->db=new Db('file',$db_path);
 			}else{
 				$this->db=new Db('helper',$database);
@@ -45,8 +41,7 @@ class Forms
 		}
 	}
 
-	function generate()
-	{
+	function generate(){
 		if($this->db->error) return;
 		//$query="select * from forms order by group_id asc, order_id asc";
 		$query="select * from forms order by groupname asc, group_id asc, order_id asc";
@@ -61,10 +56,8 @@ class Forms
 		foreach($fields as $key=>$field)
 		{
 			$group=$field['groupname'];
-			if(!empty($group))
-			{
-				if($field['type']=='group_add')
-				{	// Expand
+			if(!empty($group)){
+				if($field['type']=='group_add'){	// Expand
 					$groups[$group]['_title']=$field['desc'];
 				}else if($field['type']=='delimer'){
 					// Delimer
@@ -123,8 +116,7 @@ class Forms
 		$this->html='<form class="helper" name="" onsubmit="return false;"><div class="form-fields">';
 		foreach($groups as $key=>$txt)
 		{
-			if(is_numeric($key))
-			{
+			if(is_numeric($key)){
 				$this->html.=$arr[$key];
 			}else if(is_array($txt)){
 				$group_name=key($txt);
@@ -134,8 +126,7 @@ class Forms
 				{
 					$group_id=$val1['_group_id'];
 					unset($val1['_group_id']);
-					if(is_array($val1))
-					{
+					if(is_array($val1)){
 						$this->html.='<div class="form-field"><fieldset id="ind-'.$group_id.'"><legend>'.$group_title.'</legend>';
 						foreach($val1 as $key2=>$val2)
 							$this->html.=$arr[$val2];
@@ -154,15 +145,13 @@ class Forms
 		return array('html'=>$this->html);	//	,'currents'=>$currents	//,'defaults'=>$defaults
 	}
 
-	function getElement($el,$arr=array())
-	{
+	function getElement($el,$arr=array()){
 		$tpl='';
 		switch(trim($el))
 		{
 			case 'inputbox':
 				$res=$this->getInputAutofill($arr);
-				if($res===false)
-				{
+				if($res===false){
 					$list='';
 					$datalist='';
 				}else{
@@ -191,28 +180,25 @@ class Forms
 		return $tpl;
 	}
 
-	function getInputAutofill($arr)
-	{
-		if(isset($arr['link']))
-		{
+	function getInputAutofill($arr){
+		if(isset($arr['link'])){
 			$id=$arr['link'];	//$arr['param'].'-'.
 			$tpl='<datalist id="'.$id.'">';
 			$query="select * from ? order by order_id asc";
 			$opts=$this->db->select($query, array([$arr['link']]));
-			if(!empty($opts))foreach($opts as $key=>$opt)
-			{
+			if(!empty($opts))foreach($opts as $key=>$opt){
 				$tpl.='<option>'.$opt['text'].'</option>';
 			}
 			$tpl.='</datalist>';
 			return array('list'=>$id,'datalist'=>$tpl);
-		}else return false;
+		}else {
+			return false;
+		}
 	}
 
-	function getSelect($el,$arr)
-	{
+	function getSelect($el,$arr){
 		$tpl='<div class="form-field"><select name="${param}">';
-		if(isset($arr['link']))
-		{
+		if(isset($arr['link'])){
 			$query="select * from ? order by order_id asc";
 			$opts=$this->db->select($query, array([$arr['link']]));
 			// Пустое поле в списках оказалось ненужным!
@@ -227,15 +213,12 @@ class Forms
 		return $tpl;
 	}
 
-	function getRadio($el,$arr)
-	{
+	function getRadio($el,$arr){
 		$tpl='<div class="form-field"><fieldset><legend>${desc}</legend>';
-		if(isset($arr['link']))
-		{
+		if(isset($arr['link'])){
 			$query="select * from ? order by order_id asc";
 			$opts=$this->db->select($query, array([$arr['link']]));
-			if(!empty($opts))foreach($opts as $key=>$opt)
-			{
+			if(!empty($opts))foreach($opts as $key=>$opt){
 				$checked=($opt['id']==$arr['cur'])?' checked':'';
 				$tpl.='<label for="${param}-'.$opt['id'].'">'.$opt['text'].':</label><input type="radio" name="${param}" value="'.$opt['id'].'" id="${param}-'.$opt['id'].'"'.$checked.' />';
 			}
@@ -244,8 +227,7 @@ class Forms
 		return $tpl;
 	}
 
-	function setButtons($arr=array())
-	{
+	function setButtons($arr=array()){
 		$this->html.='<div class="buttons"><input type="button" value="Apply" class="save-helper-values" title="Save and apply params" /> &nbsp; <input type="button" value="Clear" class="clear-helper" title="Restore loaded params" /></div>';
 	}
 }