inc/security.php (523f8e8) - webinterface.git

security.php

<?php
/*
This file belongs to the Webinterface of schokokeks.org Hosting

Written by schokokeks.org Hosting, namely
  Bernd Wurst <bernd@schokokeks.org>
  Hanno Böck <hanno@schokokeks.org>

This code is published under a 0BSD license.

Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.
*/

require_once('inc/error.php');
require_once('inc/base.php');
require_once('vendor/autoload.php');

function gen_pw_hash($password)
{
    $pwhash = crypt($password, '$6$' . random_string(6));
    if (strlen($pwhash) < 13) {
        /* returns a string shorter than 13 chars on failure */
        system_failure("Failed to calculate password hash!");
    }
    return $pwhash;
}

function check_pw_hash($password, $pwhash)
{
    $checkhash = crypt($password, $pwhash);
    if (strlen($checkhash) < 13) {
        /* returns a string shorter than 13 chars on failure */
        system_failure("Invalid password hash!");
    }
    return hash_equals($checkhash, $pwhash);
}

function filter_output_html($data)
{
    if (!$data) {
        return "";
    }
    return htmlspecialchars($data, ENT_QUOTES);
}

function verify_input_ascii($data)
{
    $data = (string) $data;
    $filtered = filter_var($data, FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH);
    if ($filtered != $data) {
        logger(LOG_WARNING, 'inc/security', 'verify_input_ascii', 'Ungültige Daten: ' . $data);
        system_failure("Ihre Eingabe enthielt ungültige Zeichen");
    }
    return $filtered;
}

function filter_input_username($input)
{
    $username = preg_replace("/[^[:alnum:]\_\.\+\-]/", "", $input);
    if ($username === "") {
        system_failure("Leerer Benutzername!");
    }
    return $username;
}

function verify_input_username($input)
{
    if (filter_input_username($input) != $input) {
        logger(LOG_WARNING, 'inc/security', 'verify_input_username', 'Ungültige Daten: ' . $input);
        system_failure("Ihre Daten enthielten ungültige Zeichen!");
    }
}

function verify_input_hostname($input, $wildcard = false)
{
    if (filter_input_hostname($input, $wildcard) != $input) {
        logger(LOG_WARNING, 'inc/security', 'verify_input_hostname', 'Ungültige Daten: ' . $input);
        system_failure("Ihre Daten enthielten ungültige Zeichen!");
    }
}

function verify_input_ipv4($input)
{
    if (!preg_match("/^([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){3}$/", $input)) {
        system_failure('Keine IP-Adresse');
    }
}

function verify_input_ipv6($input)
{
    // ripped from Perl module Net-IPv6Addr v0.2
    if (!preg_match("/^(([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}|[0-9a-f]{0,4}::|:(?::[a-f0-9]{1,4}){1,6}|(?:[a-f0-9]{1,4}:){1,6}:|(?:[a-f0-9]{1,4}:)(?::[a-f0-9]{1,4}){1,6}|(?:[a-f0-9]{1,4}:){2}(?::[a-f0-9]{1,4}){1,5}|(?:[a-f0-9]{1,4}:){3}(?::[a-f0-9]{1,4}){1,4}|(?:[a-f0-9]{1,4}:){4}(?::[a-f0-9]{1,4}){1,3}|(?:[a-f0-9]{1,4}:){5}(?::[a-f0-9]{1,4}){1,2}|(?:[a-f0-9]{1,4}:){6}(?::[a-f0-9]{1,4}))$/i", $input)) {
        system_failure("Ungültige IPv6-Adresse");
    }
}

function verify_input_recorddata($input)
{
    if (strstr($input, "\\") || strstr($input, '"')) {
        system_failure("Ungültige Zeichen");
    }
}

function filter_quotes($input)
{
    return preg_replace('/["\'`]/', '', $input);
}

function filter_shell($input)
{
    return preg_replace('/[^-[:alnum:]\_\.\+ßäöüÄÖÜ/%§=]/', '', $input);
}

function verify_shell($input)
{
    if (filter_shell($input) != $input) {
        system_failure("Ihre Daten enthielten ungültige Zeichen!");
    }
}

function filter_ssh_key($key)
{
    $keyparts = explode(" ", trim($key));

if ((count($keyparts) > 3) || (count($keyparts) < 2)) {
        system_failure("Ungültiger SSH-Key!");
    }

if (preg_match("/^[a-z0-9]+-[a-z0-9-]+$/", $keyparts[0]) === 0) {
        system_failure("Ungültiger SSH-Key!");
    }

if (base64_decode($keyparts[1], 1) == false) {
        system_failure("Ungültiger SSH-Key!");
    }

if ((count($keyparts) === 3) && (preg_match("/^[a-zA-Z0-9@._-]+$/", $keyparts[2]) === 0)) {
        system_failure("Ungültige Zeichen im Kommentar des SSH-Keys!");
    }

if (count($keyparts) === 2) {
        return $keyparts[0] . " " . $keyparts[1];
    } else {
        return $keyparts[0] . " " . $keyparts[1] . " " . $keyparts[2];
    }
}

function check_date($input)
{
    return (bool) preg_match("/[0-9]{4}-(0?[1-9]|10|11|12)-([012]?[0-9]|30|31)/", $input);
}

function check_emailaddr($input)
{
    return (bool) filter_var($input, FILTER_VALIDATE_EMAIL) == $input;
}

function check_domain($input)
{
    return (bool) preg_match("/^[a-z0-9\.\-]+\.[a-z\-]{2,63}$/i", $input);
}

webinterface.git

move crypt password hash verification to its own function