webinterface.git

@@ -44,6 +44,7 @@ class DB extends PDO {

       return $response;

     } else {

       if (strtoupper(substr($stmt, 0, 6)) == "INSERT" ||

+          strtoupper(substr($stmt, 0, 7)) == "REPLACE" ||

           strpos(strtoupper($stmt), "WHERE") > 0) { // Das steht nie am Anfang

         $backtrace = debug_backtrace();

         if (config("enable_debug")) {

@@ -109,7 +109,7 @@ function get_domain_list($customerno, $uid = NULL)

     $query .= " kunde={$customerno}";

   }

   $query .= " ORDER BY domainname,tld";

-  $result = db_query($query);

+  $result = db_query($query, array()); // FIXME Übergebe leeren array um die Warnung zu unterdrücken

   $domains = array();

   DEBUG('Result set is '.$result->rowCount()." rows.<br />\n");

   if ($result->rowCount() > 0)

@@ -77,7 +77,7 @@ abstract class KeksData

     if (is_array($fields))

       $fields = implode(',', $fields);

-    $res = db_query("SELECT {$fields} FROM {$table} {$where}");

+    $res = db_query("SELECT {$fields} FROM {$table} {$where}", array()); // FIXME Übergebe leeren array um die Warnung zu unterdrücken

     $return = array();

     while ($arr = $res->fetch())

       array_push($return, $arr);

@@ -104,7 +104,7 @@ abstract class KeksData

       $value = db_escape_string($value);

       array_push($upd, "`{$key}`='{$value}'");

     }

-    db_query("UPDATE {$this->default_table} SET ".implode(', ', $upd)." WHERE id={$this->data['id']};");

+    db_query("UPDATE {$this->default_table} SET ".implode(', ', $upd)." WHERE id=?", array($this->data['id']));

   }

   abstract function parse($data);

@@ -78,7 +78,7 @@ function redirect($target)

 function my_server_id()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT server FROM system.useraccounts WHERE uid={$uid}");

+  $result = db_query("SELECT server FROM system.useraccounts WHERE uid=?", array($uid));

   $r = $result->fetch();

   DEBUG($r);

   return $r['server'];

@@ -88,7 +88,7 @@ function my_server_id()

 function additional_servers()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT server FROM system.user_server WHERE uid={$uid}");

+  $result = db_query("SELECT server FROM system.user_server WHERE uid=?", array($uid));

   $servers = array();

   while ($s = $result->fetch())

     $servers[] = $s['server'];

@@ -25,7 +25,7 @@ function mailman_subdomains($domain)

     return array();

   }

   $domain = (int) $domain;

-  $result = db_query("SELECT id, hostname FROM mail.mailman_domains WHERE domain={$domain}");

+  $result = db_query("SELECT id, hostname FROM mail.mailman_domains WHERE domain=?", array($domain));

   $ret = array();

   while ($line = $result->fetch())

   {

@@ -39,7 +39,7 @@ function dns_in_use($domain)

   if ( ! in_array('dns', config('modules')))

     return false;

   $domain = (int) $domain;

-  $result = db_query("SELECT id FROM dns.custom_records WHERE domain={$domain}");

+  $result = db_query("SELECT id FROM dns.custom_records WHERE domain=?", array($domain));

   return ($result->rowCount() > 0);

 }

@@ -51,16 +51,16 @@ function mail_in_use($domain)

     return false;

   }

   $domain = (int) $domain;

-  $result = db_query("SELECT mail FROM kundendaten.domains WHERE id={$domain}");

+  $result = db_query("SELECT mail FROM kundendaten.domains WHERE id=?", array($domain));

   if ($result->rowCount() < 1)

     system_failure("Domain not found");

   $d = $result->fetch();

   if ($d['mail'] == 'none')

     return false; // manually disabled

-  $result = db_query("SELECT id FROM mail.virtual_mail_domains WHERE domain={$domain}");

+  $result = db_query("SELECT id FROM mail.virtual_mail_domains WHERE domain=?", array($domain));

   if ($result->rowCount() < 1)

     return true; // .courier

-  $result = db_query("SELECT acc.id FROM mail.vmail_accounts acc LEFT JOIN mail.virtual_mail_domains dom ON (acc.domain=dom.id) WHERE dom.domain={$domain}");

+  $result = db_query("SELECT acc.id FROM mail.vmail_accounts acc LEFT JOIN mail.virtual_mail_domains dom ON (acc.domain=dom.id) WHERE dom.domain=?", array($domain));

   return ($result->rowCount() > 0);

 }

@@ -71,12 +71,12 @@ function web_in_use($domain)

   $domain = (int) $domain;

-  $result = db_query("SELECT id FROM kundendaten.domains WHERE id={$domain} AND webserver=1");

+  $result = db_query("SELECT id FROM kundendaten.domains WHERE id=? AND webserver=1", array($domain));

   if ($result->rowCount() < 1)

     return false;

-  $result = db_query("SELECT id FROM vhosts.vhost WHERE domain={$domain}");

-  $result2 = db_query("SELECT id FROM vhosts.alias WHERE domain={$domain}");

+  $result = db_query("SELECT id FROM vhosts.vhost WHERE domain=?", array($domain));

+  $result2 = db_query("SELECT id FROM vhosts.alias WHERE domain=?", array($domain));

   return ($result->rowCount() > 0 || $result2->rowCount() > 0);

 }

@@ -24,7 +24,7 @@ define("CERT_NOCHAIN", 2);

 function user_certs()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, valid_from, valid_until, subject, cn FROM vhosts.certs WHERE uid=${uid} ORDER BY cn");

+  $result = db_query("SELECT id, valid_from, valid_until, subject, cn FROM vhosts.certs WHERE uid=? ORDER BY cn", array($uid));

   $ret = array();

   while ($i = $result->fetch())

     $ret[] = $i;

@@ -35,7 +35,7 @@ function user_certs()

 function user_csr()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, created, hostname, bits FROM vhosts.csr WHERE uid=${uid} ORDER BY hostname");

+  $result = db_query("SELECT id, created, hostname, bits FROM vhosts.csr WHERE uid=? ORDER BY hostname", array($uid));

   $ret = array();

   while ($i = $result->fetch())

     $ret[] = $i;

@@ -48,7 +48,7 @@ function cert_details($id)

   $id = (int) $id;

   $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, lastchange, valid_from, valid_until, subject, cn, cert, `key` FROM vhosts.certs WHERE uid={$uid} AND id={$id}");

+  $result = db_query("SELECT id, lastchange, valid_from, valid_until, subject, cn, cert, `key` FROM vhosts.certs WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

   if ($result->rowCount() != 1)

     system_failure("Ungültiges Zertifikat #{$id}");

   return $result->fetch();

@@ -60,7 +60,7 @@ function csr_details($id)

   $id = (int) $id;

   $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT id, created, hostname, bits, `replace`, csr, `key` FROM vhosts.csr WHERE uid={$uid} AND id={$id}");

+  $result = db_query("SELECT id, created, hostname, bits, `replace`, csr, `key` FROM vhosts.csr WHERE uid=:uid AND id=:id", array(":uid" => $uid, ":id" => $id));

   if ($result->rowCount() != 1)

     system_failure("Ungültiger CSR");

   return $result->fetch();

@@ -87,8 +87,7 @@ function get_chain($cert)

   if (! isset($certdata['issuer']['CN'])) {

     return NULL;

   }

-  $issuer = db_escape_string($certdata['issuer']['CN']);

-  $result = db_query("SELECT id FROM vhosts.certchain WHERE cn='{$issuer}'");

+  $result = db_query("SELECT id FROM vhosts.certchain WHERE cn=?", array($certdata['issuer']['CN']));

   if ($result->rowCount() > 0)

   {

     $c = $result->fetch();

@@ -139,7 +138,7 @@ function validate_certificate($cert, $key)

   $chain = (int) get_chain($cert);

   if ($chain)

   {

-    $result = db_query("SELECT content FROM vhosts.certchain WHERE id={$chain}");

+    $result = db_query("SELECT content FROM vhosts.certchain WHERE id=?", array($chain));

     $tmp = $result->fetch();

     $chaincert = $tmp['content'];

     $chainfile = tempnam(sys_get_temp_dir(), 'webinterface');

@@ -183,16 +182,11 @@ function save_cert($info, $cert, $key)

 {

   openssl_pkey_export($key, $key);

   openssl_x509_export($cert, $cert);

-  $subject = db_escape_string(filter_input_general($info['subject']));

-  $cn = db_escape_string(filter_input_general($info['cn']));

-  $valid_from = db_escape_string($info['valid_from']);

-  $valid_until = db_escape_string($info['valid_until']);

-  $chain = maybe_null( get_chain($cert) );

-  $cert = db_escape_string($cert);

-  $key = db_escape_string($key);

   $uid = (int) $_SESSION['userinfo']['uid'];

-  db_query("INSERT INTO vhosts.certs (uid, subject, cn, valid_from, valid_until, chain, cert, `key`) VALUES ({$uid}, '{$subject}', '{$cn}', '{$valid_from}', '{$valid_until}', {$chain}, '{$cert}', '{$key}')");

+  db_query("INSERT INTO vhosts.certs (uid, subject, cn, valid_from, valid_until, chain, cert, `key`) VALUES (:uid, :subject, :cn, :valid_from, :valid_until, :chain, :cert, :key)", 

+        array(":uid" => $uid, ":subject" => filter_input_general($info['subject']), ":cn" => filter_input_general($info['cn']), ":valid_from" => $info['valid_from'], 

+              ":valid_until" => $info['valid_until'], ":chain" => get_chain($cert), ":cert" => $cert, ":key" => $key));

 }

@@ -210,12 +204,21 @@ function refresh_cert($id, $info, $cert, $key = NULL)

   $valid_from = db_escape_string($info['valid_from']);

   $valid_until = db_escape_string($info['valid_until']);

+  $args = array(":subject" => filter_input_general($info['subject']),

+                ":cn" => filter_input_general($info['cn']),

+                ":cert" => $cert,

+                ":valid_from" => $info['valid_from'],

+                ":valid_until" => $info['valid_until'],

+                ":chain" => get_chain($cert),

+                ":id" => $id);

+

   $keyop = '';

   if ($key) {

     openssl_pkey_export($key, $key);

-    $keyop = ", `key`='".db_escape_string($key)."'";

+    $keyop = ", `key`=:key";

+    $args[":key"] = $key;

   }

-  db_query("UPDATE vhosts.certs SET subject='{$subject}', cn='{$cn}', cert='{$cert}'{$keyop}, valid_from='{$valid_from}', valid_until='{$valid_until}', chain={$chain} WHERE id={$id} LIMIT 1");

+  db_query("UPDATE vhosts.certs SET subject=:subject, cn=:cn, cert=:cert{$keyop}, valid_from=:valid_from, valid_until=:valid_until, chain=:chain WHERE id=:id", $args);

 }

@@ -224,7 +227,7 @@ function delete_cert($id)

   $uid = (int) $_SESSION['userinfo']['uid'];

   $id = (int) $id;

-  db_query("DELETE FROM vhosts.certs WHERE uid={$uid} AND id={$id} LIMIT 1");

+  db_query("DELETE FROM vhosts.certs WHERE uid=? AND id=?", array($uid, $id));

 }

 function delete_csr($id)

@@ -232,7 +235,7 @@ function delete_csr($id)

   $uid = (int) $_SESSION['userinfo']['uid'];

   $id = (int) $id;

-  db_query("DELETE FROM vhosts.csr WHERE uid={$uid} AND id={$id} LIMIT 1");

+  db_query("DELETE FROM vhosts.csr WHERE uid=? AND id=?", array($uid, $id));

 }

@@ -305,12 +308,10 @@ function save_csr($cn, $bits, $replace=NULL)

   $uid = (int) $_SESSION['userinfo']['uid'];

   $cn = db_escape_string(filter_input_hostname($cn, true));

-  $bits = (int) $bits;

-  $replace = ($replace ? (int) $replace : 'NULL');

-  $csr = db_escape_string($csr);

-  $key = db_escape_string($key);

-  db_query("INSERT INTO vhosts.csr (uid, hostname, bits, `replace`, csr, `key`) VALUES ({$uid}, '{$cn}', {$bits}, {$replace}, '{$csr}', '{$key}')");

-  $id = mysql_insert_id();

+  db_query("INSERT INTO vhosts.csr (uid, hostname, bits, `replace`, csr, `key`) VALUES (:uid, :cn, :bits, :replace, :csr, :key)",

+           array(":uid" => $uid, ":cn" => filter_input_hostname($cn, true), ":bits" => $bits, 

+                 ":replace" => $replace, ":csr" => $csr, ":key" => $key));

+  $id = db_insert_id();

   return $id;  

 }

@@ -26,14 +26,14 @@ require_once("certs.php");

 function traffic_month($vhost_id)

 {

   $vhost_id = (int) $vhost_id;

-  $result = db_query("SELECT sum(mb_in+mb_out) as mb FROM vhosts.traffic where date > CURDATE() - INTERVAL 1 MONTH AND vhost_id = {$vhost_id}");

+  $result = db_query("SELECT sum(mb_in+mb_out) as mb FROM vhosts.traffic where date > CURDATE() - INTERVAL 1 MONTH AND vhost_id = ?", array($vhost_id));

   $data = $result->fetch();

   return $data['mb'];

 }

 function autoipv6_address($vhost_id, $mode = 1)

 {

-  $result = db_query("SELECT uid, v6_prefix FROM vhosts.v_vhost LEFT JOIN system.servers ON (servers.hostname = server) WHERE v_vhost.id={$vhost_id}");

+  $result = db_query("SELECT uid, v6_prefix FROM vhosts.v_vhost LEFT JOIN system.servers ON (servers.hostname = server) WHERE v_vhost.id=?", array($vhost_id));

   $data = $result->fetch();

   if (!$data['v6_prefix'])

   {

@@ -53,7 +53,7 @@ function autoipv6_address($vhost_id, $mode = 1)

 function list_vhosts()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

-  $result = db_query("SELECT vh.id,fqdn,domain,docroot,docroot_is_default,php,cgi,vh.certid AS cert, vh.ssl, vh.options,logtype,errorlog,IF(dav.id IS NULL OR dav.type='svn', 0, 1) AS is_dav,IF(dav.id IS NULL OR dav.type='dav', 0, 1) AS is_svn, IF(webapps.id IS NULL, 0, 1) AS is_webapp, stats FROM vhosts.v_vhost AS vh LEFT JOIN vhosts.dav ON (dav.vhost=vh.id) LEFT JOIN vhosts.webapps ON (webapps.vhost = vh.id) WHERE uid={$uid} ORDER BY domain,hostname");

+  $result = db_query("SELECT vh.id,fqdn,domain,docroot,docroot_is_default,php,cgi,vh.certid AS cert, vh.ssl, vh.options,logtype,errorlog,IF(dav.id IS NULL OR dav.type='svn', 0, 1) AS is_dav,IF(dav.id IS NULL OR dav.type='dav', 0, 1) AS is_svn, IF(webapps.id IS NULL, 0, 1) AS is_webapp, stats FROM vhosts.v_vhost AS vh LEFT JOIN vhosts.dav ON (dav.vhost=vh.id) LEFT JOIN vhosts.webapps ON (webapps.vhost = vh.id) WHERE uid=? ORDER BY domain,hostname", array($uid));

   $ret = array();

   while ($item = $result->fetch())

     array_push($ret, $item);

@@ -160,7 +160,7 @@ function get_vhost_details($id)

 function get_aliases($vhost)

 {

-  $result = db_query("SELECT id,fqdn,options FROM vhosts.v_alias WHERE vhost={$vhost}");

+  $result = db_query("SELECT id,fqdn,options FROM vhosts.v_alias WHERE vhost=?", array($vhost));

   $ret = array();

   while ($item = $result->fetch()) {

     array_push($ret, $item);

@@ -22,15 +22,20 @@ $section = 'vhosts_certs';

 if ($_GET['action'] == 'new')

 {

   check_form_token('vhosts_certs_new');

+  if (! isset($_POST['cert'])) {

+    system_failure("Es wurde kein Zertifikat eingegeben");

+  }

   $cert = $_POST['cert'];

-  $key = $_POST['key'];

+  $key = NULL;

   if (! isset($_POST['key']) && isset($_REQUEST['csr']))

   {

     $csr = csr_details($_REQUEST['csr']);

     $key = $csr['key'];

+  } else {

+    $key = $_POST['key'];

   }

   $oldcert = NULL;

-  if ($_REQUEST['replace'])

+  if (isset($_REQUEST['replace']))

   {

     $oldcert = cert_details($_REQUEST['replace']);

   }