webinterface.git

@@ -0,0 +1,42 @@

+<?php

+/*

+This file belongs to the Webinterface of schokokeks.org Hosting

+

+Written 2008-2018 by schokokeks.org Hosting, namely

+  Bernd Wurst <bernd@schokokeks.org>

+  Hanno Böck <hanno@schokokeks.org>

+

+To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

+

+You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

+http://creativecommons.org/publicdomain/zero/1.0/

+

+Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

+*/

+

+require_once('contacts.php');

+

+if (isset($_GET['q'])) {

+    $id = search_pgp_key($_GET['q']);

+    $result = array("status" => "notfound",

+        "id" => NULL);

+    if ($id) {

+        $result['status'] = 'found';

+        $result['id'] = $id;

+    }

+    echo json_encode($result);

+    die();

+}

+if (isset($_GET['id'])) {

+    $id = fetch_pgp_key($_GET['id']);

+    $result = array("status" => "notfound", "id" => NULL);

+    if ($id) {

+        $result['status'] = 'found';

+        $result['id'] = $id;

+    }

+    echo json_encode($result);

+    die();

+}

+

+

+

@@ -27,6 +27,34 @@ function check_number( field )

     }

 }

+

+function receive_pgpidcheck(result) {

+    if (result.status == 'found') {

+        $('#pgpid').val(result.id);

+        $("#pgpid_feedback").html('<img src="../../images/ok.png" style="height: 16px; width: 16px;" />');

+    } else {

+        $('#pgpkey').closest('tr').show();

+        $("#pgpid_feedback").html('<img src="../../images/error.png" style="height: 16px; width: 16px;" /><br>Es wurde kein PGP-Key zu dieser ID gefunden. Bitte geben Sie unten den kompletten Key ein.');

+

+    }

+}

+

+

+function receive_pgpid(result) {

+    if (result.status == 'found' && ! $('#pgpid').val()) {

+        $('#pgpid').val(result.id);

+        $("#pgpid_feedback").html('<img src="../../images/ok.png" style="height: 16px; width: 16px;" /><br>Es wurde ein PGP-Key auf einem Keyserver gefunden. Falls Sie einen anderen (oder gar keinen) PGP-Key nutzen möchten, ändern Sie dies bitte hier.');

+    }

+}

+

+function pgpid_change() {

+    val = $('#pgpid').val().replace(/\s/g, "");;

+    if (val.length == 8 || val.length == 16 || val.length == 40) {

+        $.getJSON("ajax_pgp?id="+encodeURIComponent(val), receive_pgpidcheck)

+    }

+}

+

+

 function email_change() {

     var new_email = $('#email').val();

     if (new_email != old_email) {

@@ -34,16 +62,21 @@ function email_change() {

     } else {

         $('#designated-row').hide();

     }

+    if (new_email && ! $('#pgpid').val()) {

+        $.getJSON("ajax_pgp?q="+encodeURIComponent(new_email), receive_pgpid)

+    }

 }

 $(function() {

-    $('#telefon').on("change paste", check_number("telefon") );

-    $('#mobile').on("change paste", check_number("mobile") );

-    $('#telefax').on("change paste", check_number("telefax") );

+    $('#telefon').on("focusout", check_number("telefon") );

+    $('#mobile').on("focusout", check_number("mobile") );

+    $('#telefax').on("focusout", check_number("telefax") );

     if ($('#designated-row')) {

         $('#designated-row').hide();

-        $('#email').on("change paste", email_change);

         old_email = $('#email').val();

     }

+    $('#email').on("focusout", email_change);

+    $('#pgpid').on("focusout", pgpid_change);

+    $('#pgpkey').closest('tr').hide();

 });

@@ -76,10 +76,14 @@ $html .= '<tr class="'.($odd == true ? 'odd' : 'even').'"><td><label for="telefo

 $odd = !$odd;

 if ($domains) {

-    $html .= '<tr class="'.($odd == true ? 'odd' : 'even').'" id="designated-row"><td><label for="designated"><strong>Inhaberwechsel:</strong></label></td><td><input type="checkbox" name="designated" id="designated" value="yes"><label for="designated">Die Änderung der E-Mail-Adresse bewirkt rechtlich einen Inhaberwechsel. Ich bestätige, dass mir eine explizite Zustimmung des alten und neuen Inhabers für diese Änderung vorliegt. Eine Speicherung der Änderungen ist nur mit dieser Zustimmung möglich.</label></td></tr>';

-    $odd = !$odd;

+    $html .= '<tr class="odd" id="designated-row"><td><label for="designated"><strong>Inhaberwechsel:</strong></label></td><td><input type="checkbox" name="designated" id="designated" value="yes"><label for="designated">Die Änderung der E-Mail-Adresse bewirkt rechtlich einen Inhaberwechsel. Ich bestätige, dass mir eine explizite Zustimmung des alten und neuen Inhabers für diese Änderung vorliegt. Eine Speicherung der Änderungen ist nur mit dieser Zustimmung möglich.</label></td></tr>';

 }

+$html .= '<tr class="'.($odd == true ? 'odd' : 'even').'"><td><label for="pgpid">PGP-Key-ID:</label></td><td><input type="text" name="pgpid" id="pgpid" value="'.$c['pgp_id'].'"><span id="pgpid_feedback"></span></td></tr>';

+$odd = !$odd;

+$html .= '<tr class="'.($odd == true ? 'odd' : 'even').'"><td><label for="pgpkey">PGP-Key (ASCII-Armored):</label></td><td><textarea name="pgpkey" id="pgpkey">'.$c['pgp_key'].'</textarea></td></tr>';

+$odd = !$odd;

+

 $html .= '<tr class="even"><td>&nbsp;</td><td><input type="submit" value="Speichern" /></td></tr>';

 $html .= '</table>';

@@ -15,6 +15,7 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 */

 require_once('inc/debug.php');

+require_once('inc/security.php');

 require_role(array(ROLE_CUSTOMER));

 require_once('class/domain.php');

@@ -306,6 +307,59 @@ function delete_contact($id) {

 }

+function search_pgp_key($search) {

+    if (! check_emailaddr($search)) {

+        # Keine Ausgabe weil diese Funktion im AJAX-Call verwendet wird

+        return NULL;

+    }

+    $output = array();

+    exec('LC_ALL=C /usr/bin/gpg --batch --with-colons --keyserver hkp://pool.sks-keyservers.net --search-key '.escapeshellarg($search), $output);

+    DEBUG($output);

+    $keys = array();

+    foreach($output AS $row) {

+        if (substr($row, 0, 4) === 'pub:') {

+            $parts = explode(':', $row);

+            if ($parts[5] && ($parts[5] < time())) {

+                // abgelaufener key

+                continue;

+            }

+            // array-key = create-timestamp

+            // array-value = key-id

+            $keys[$parts[4]] = $parts[1];

+        }

+    }

+    if (count($keys) == 0) {

+        return NULL;

+    }

+    ksort($keys, SORT_NUMERIC);

+    DEBUG(end($keys));

+    // liefert den neuesten Key

+    return end($keys);

+}

+

+

+function fetch_pgp_key($pgp_id) {

+    $output = array();

+    $ret = NULL;

+    DEBUG('/usr/bin/gpg --batch --keyserver hkp://pool.sks-keyservers.net --recv-key '.escapeshellarg($pgp_id));

+    exec('/usr/bin/gpg --batch --keyserver hkp://pool.sks-keyservers.net --recv-key '.escapeshellarg($pgp_id), $output, $ret);

+    DEBUG($output);

+    DEBUG($ret);

+    if ($ret == 0) {

+        exec('/usr/bin/gpg --batch --with-colons --list-keys '.escapeshellarg($pgp_id), $output);

+        DEBUG($output);

+        foreach ($output AS $row) {

+            if (substr($row, 0, 4) === 'fpr:') {

+                $parts = explode(':', $row);

+                // Fingerprint

+                return $parts[9];

+            }

+        }

+    }

+    return NULL;

+}

+

+

 function domainlist_by_contact($c) {

     $cid = (int) $_SESSION['customerinfo']['customerno'];

     $result = db_query("SELECT id FROM kundendaten.domains WHERE (owner=? OR admin_c=?) AND kunde=?", array($c['id'], $c['id'], $cid));

@@ -333,9 +387,16 @@ function contact_as_string($contact)

         $email = "<strike>$email</strike><br/>".filter_input_general($new_email).footnote('Die E-Mail-Adresse wurde noch nicht bestätigt');

     }

     $email = implode("<br>\n", array_filter(array($email, filter_input_general($contact['phone']), filter_input_general($contact['fax']), filter_input_general($contact['mobile']))));

+    $pgp = '';

+    if ($contact['pgp_id']) {

+        $pgpid = $contact['pgp_id'];

+        if (strlen($pgpid) > 20) {

+            $pgpid = substr($pgpid, 0, 20).' '.substr($pgpid, 20);

+        }

+        $pgp = '<p class="contact-pgp">'.other_icon('key.png').' PGP ID:<br>'.$pgpid.'</p>';

+    }

-

-    $contact_string = "<p class=\"contact-id\">#{$contact['id']}</p><p class=\"contact-address\"><strong>$name</strong>$adresse</p><p class=\"contact-contact\">$email</p>";

+    $contact_string = "<p class=\"contact-id\">#{$contact['id']}</p><p class=\"contact-address\"><strong>$name</strong>$adresse</p><p class=\"contact-contact\">$email</p>$pgp";

     return $contact_string;

 }

@@ -136,7 +136,19 @@ if (isset($_REQUEST['action']) && $_REQUEST['action'] == 'delete') {

         $c['fax'] = NULL;

     }

-    // FIXME: PGP-ID/Key fehlen

+    

+    if (isset($_REQUEST['pgpid'])) {

+        $pgpid = preg_replace('/[^0-9a-fA-F]/', '', $_REQUEST['pgpid']);

+        DEBUG('PGP-ID: '.$pgpid.' / Länge: '.strlen($pgpid));

+        if (strlen($pgpid) == 8 || strlen($pgpid) == 16 || strlen($pgpid) == 40) {

+            $c['pgp_id'] = $_REQUEST['pgpid'];

+            if (isset($_REQUEST['pgpkey']) && $_REQUEST['pgpkey']) {

+                $c['pgp_key'] = $_REQUEST['pgpkey'];

+            }

+        } else {

+            warning('Ihre PGP-ID wurde nicht übernommen, da sie syntaktisch falsch erscheint');

+        }

+    }

     if (isset($_REQUEST['domainholder']) && $_REQUEST['domainholder'] == 1) {

@@ -52,7 +52,7 @@ if ($_SESSION['role'] & ROLE_SYSTEMUSER) {

     $shortcuts[] = array( 'section' => 'Webserver', 

                           'weight'  => 80, 

                           'file'    => 'certs', 

-                          'icon'    => 'secure.png', 

+                          'icon'    => 'key.png', 

                           'title'   => 'HTTPS-Zertifikate',

                           'alert'   => $alert );

   }

@@ -129,7 +129,7 @@ if (count($vhosts) > 0)

     }

     elseif ($vhost['cert'])

     {

-      output("<td>".other_icon("secure.png", "HTTPS mit eigenem Zertifikat")."</td>");

+      output("<td>".other_icon("key.png", "HTTPS mit eigenem Zertifikat")."</td>");

     }

     elseif (strstr($vhost['options'], "letsencrypt")) {

       // Letsencrypt gewählt aber noch nicht aktiv