My bear, whose name is Misha Gorbachev, himself accidentally went walking
And where hi has brought Russian Vodka. Probably stealed ...
But we were able to finish our work
7. cronjobs_edit.php
Code:
<?php
/*
* (с) 2009, Russia, Moscow
* Serge Obookhoff AKA Hong Lee
* www.data-stream.ru && www.veterinars.ru
* Last Revision at 01/2009
* Written for ispCP Team (www.isp-control.net) ONLY.
* Written using the old, dead blanks VHCS.
* All Functions rewritten.
*
* Notice: If you use this script you have own risks.
*
*/
//bypass ispCP HTML input control
$min = implode ("," , $_POST['min']);
$hour = implode ("," , $_POST['hour']);
$day_of_month = implode ("," , $_POST['day_of_month']);
$month = implode ("," , $_POST['month']);
$day_of_week = implode ("," , $_POST['day_of_week']);
unset($_POST['month'], $_POST['day_of_week'], $_POST['min'], $_POST['hour'], $_POST['day_of_month']);
require '../include/ispcp-lib.php';
check_login(__FILE__);
$tpl = new pTemplate();
$tpl->define_dynamic('page', Config::get('CLIENT_TEMPLATE_PATH') . '/cronjobs_edit.tpl');
$tpl->define_dynamic('page_message', 'page');
$tpl->define_dynamic('logged_from', 'page');
$theme_color = Config::get('USER_INITIAL_THEME');
$tpl->assign(
array('TR_CLIENT_CRONJOBS_TITLE' => tr('ispCP - Client/Cronjob Manager'),
'THEME_COLOR_PATH' => "../themes/$theme_color",
'THEME_CHARSET' => tr('encoding'),
'ISP_LOGO' => get_logo($_SESSION['user_id'])
)
);
if (!isset($_GET['cron_id']) && !isset($_POST['Submit'])) {
set_page_message(tr('Nothing to do!'));
user_goto('cronjobs_overview.php');
}
if (isset($_GET['cron_id']) && $_GET['cron_id'] !== '') {
$cron_id = $_GET['cron_id'];}
function update_cron_job(&$tpl, &$sql, $cron_id, $user_id, &$min, &$hour, &$day_of_month, &$month, &$day_of_week, &$file_type) {
/* if ((empty($min) | empty($hour) | empty($day_of_month) | empty($month) | empty($day_of_week) | empty($_POST['name']) | empty($_POST['description']) | empty($_POST['command_line'])) && isset($_POST['Submit'])) {
*
* set_page_message(tr('Please type All Fields and choise all Values!'));
* return;
* }
*/
foreach($_POST as $key => $value)
{
$a = $key;
$$a = $value;
}
//do all checks of command_line
/* Start (c) Vladimir Sinitsyn*/
// Vladimir Sinitsyn aka SenatoR
// Russia, Yekaterinburg
// Русские, привет! =)
// $command_line mey be "perl /var/www/virtual/hackers.ru/htdocs/cgi-bin/decoder.pl?file=/etc/passwd-"
// We must use security check!
$stop_word = array('/etc/','password','passwd','groups'); //STOP Words!
//Let`s start our work!
$temp = explode(" ", $command_line); //We`ve divided line two parts - command (php) and values.
$command = $temp[0];
$stream = $temp[1];
unset($temp);
//We have only 3 commands, so, make it without "cool" things, use simle code..
if($command != "php" && $command != "perl" && $command != "python") {
set_page_message(tr('Comand not Allowed!'));
return;
}
//Если список большой - сделаем проверку иначе!
foreach($stop_word as $k=>$v)
{
if(strpos($stream,$v) == true) {
set_page_message(tr('Are you a cunning Hacker ?! But I am not only stupid machine!!! I will write delation to Admin!'));
write_log("WARNING: Perhaps hacking! ". $_SESSION['user_logged'] . ": add Cron Job: " . $name . " with comnd: " . $command_line);
user_goto('cronjobs_edit.php');
return 0;
} //Hackers ALLERT... `stop word'
}
$flag = 0; //Use one thing!
foreach($file_type as $k=>$v) //Start
{
if(strpos($stream,$v) == true) //Works fast!!! (its important)
{
$flag++; //Yeah! Its good!
$file = preg_replace("/(\\".$v.").*/i","\\1",$stream); //CUT ALL!!! Only filename in $file!
break; //Stop
}
}
if($flag == 0) {
set_page_message(tr('File type wrong!'));
return;
}//File type wrong!
//Check files and permission
if(!file_exists($file)) {
set_page_message(tr('File not found!'));
return;
} //No file!
if(!is_readable($file)) {
set_page_message(tr('File not readable!'));
return;
}; //Wrong permissions!
if(strpos("cgi",$file) || strpos("pl",$file)) // only for cgi and pl and so..
{
if(!is_executable($file)) {
set_page_message(tr('Wrong permissions!'));
return;
}; //Wrong permissions!
}
/* End (c) */
$query = "
UPDATE
hcrondtab
SET
name = ?, coment = ?, min = ?, hour = ?, day = ?, mon = ?, dow = ?, cmd = ?, activ = ?, runonce = ?, lastrun = ?
WHERE
id = ?
";
$rs = exec_query($sql, $query, array($name, $description, $min, $hour, $day_of_month, $month, $day_of_week, $command_line, $activ, $runonce, $lastrun =0, $cron_id));
write_log($_SESSION['user_logged'] . ": updeted Cron Job: " . $name);
set_page_message(tr('Cron Job successfully updated!'));
user_goto('cronjobs_overview.php');
} // End of update_cron_job();
function gen_cron_job(&$tpl, &$sql, $cron_id, $user_id, &$new_value) {
$query = "
SELECT
`id`, `domain`, `name`, `coment`, `min`, `hour`, `day`, `mon`, `dow`, `cmd`, `runonce`,`lastrun`, `activ`
FROM
`hcrondtab`
WHERE
domain = $user_id
AND
id = $cron_id
";
$rs = exec_query($sql, $query, $cron_id);
if ($rs->RecordCount() == 0) {
set_page_message(tr('No CronJob with this ID!'));
header('Location: cronjobs_overview.php');
exit(0);
}
if ($rs->fields['activ'] == 1) {$active_yes = 'selected'; $active_no = '';}
else {$active_no = 'selected'; $active_yes = '';}
if ($rs->fields['runonce'] == 1) {$runonce_yes = 'selected'; $runonce_no = '';}
else {$runonce_no = 'selected'; $runonce_yes = '';}
$tpl->assign(
array('NAME' => $rs->fields['name'],
'DESCRIPTION' => $rs->fields['coment'],
'COMMAND_LINE' => $rs->fields['cmd'],
'ACTIVE' => $rs->fields['activ'],
'ACTIVE_YES' => $active_yes,
'ACTIVE_NO' => $active_no,
'ID' => $rs->fields['id'],
'ALLOWED' => 'php, perl, python',
'FILETYPE' => $new_value,
'RUNONCE_YES' => $runonce_yes,
'RUNONCE_NO' => $runonce_no,
)
);
} // End of gen_cron_job();
/*
*
* static page messages.
*
*/
gen_client_mainmenu($tpl, Config::get('CLIENT_TEMPLATE_PATH') . '/main_menu_webtools.tpl');
gen_client_menu($tpl, Config::get('CLIENT_TEMPLATE_PATH') . '/menu_webtools.tpl');
gen_logged_from($tpl);
check_permissions($tpl);
$file_type = array('.php','.php4','.php5','.cgi','.pl','.py'); //List of GOOD files ;-)
$new_value = implode (" ", $file_type);
if (isset($_GET['cron_id']) && is_numeric($_GET['cron_id']) && isset($_POST['Submit'])) update_cron_job($tpl, $sql, $_GET['cron_id'], $_SESSION['user_id'], $min, $hour, $day_of_month, $month, $day_of_week, $file_type);
gen_cron_job($tpl, $sql, $cron_id, $_SESSION['user_id'], $new_value);
$tpl->assign(
array('TR_CRON_MANAGER' => tr('Cronjob Manager'),
'TR_EDIT_CRONJOB' => tr('Edit Cronjob'),
'TR_NAME' => tr('Name'),
'TR_DESCRIPTION' => tr('Description'),
'TR_ACTIVE' => tr('Active'),
'YES' => tr('Yes'),
'NO' => tr('No'),
'TR_CRONJOB' => tr('Cronjob'),
'TR_COMMAND' => tr('Command to run:'),
'TR_MIN' => tr('Minute(s):'),
'TR_HOUR' => tr('Hour(s):'),
'TR_DAY' => tr('Day(s):'),
'TR_MONTHS' => tr('Month(s):'),
'TR_WEEKDAYS' => tr('Weekday(s):'),
'TR_UPDATE' => tr('Update'),
'TR_CANCEL' => tr('Cancel'),
)
);
gen_page_message($tpl);
$tpl->parse('PAGE', 'page');
$tpl->prnt();
if (Config::get('DUMP_GUI_DEBUG'))
dump_gui_debug();
unset_messages();
?>
8. cronjobs_edit.tpl
Code:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset={THEME_CHARSET}">
<title>{TR_CLIENT_CRONJOBS_TITLE}</title>
<meta name="robots" content="noindex">
<meta name="robots" content="nofollow">
<link href="{THEME_COLOR_PATH}/css/ispcp.css" rel="stylesheet" type="text/css">
<script type="text/javascript" src="{THEME_COLOR_PATH}/css/ispcp.js"></script>
</head>
<body onload="MM_preloadImages('{THEME_COLOR_PATH}/images/icons/database_a.gif','{THEME_COLOR_PATH}/images/icons/domains_a.gif','{THEME_COLOR_PATH}/images/icons/ftp_a.gif','{THEME_COLOR_PATH}/images/icons/general_a.gif' ,'{THEME_COLOR_PATH}/images/icons/email_a.gif','{THEME_COLOR_PATH}/images/icons/webtools_a.gif','{THEME_COLOR_PATH}/images/icons/statistics_a.gif','{THEME_COLOR_PATH}/images/icons/support_a.gif')">
<!-- BDP: logged_from --><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td height="20" nowrap="nowrap" class="backButton"> <a href="change_user_interface.php?action=go_back"><img src="{THEME_COLOR_PATH}/images/icons/close_interface.png" width="16" height="16" border="0" align="absmiddle"></a> {YOU_ARE_LOGGED_AS}</td>
</tr>
</table>
<!-- EDP: logged_from -->
<table width="100%" border="0" cellspacing="0" cellpadding="0" height="100%" style="border-collapse: collapse;padding:0;margin:0;">
<tr>
<td align="left" valign="top" style="vertical-align: top; width: 195px; height: 56px;"><img src="{THEME_COLOR_PATH}/images/top/top_left.jpg" border="0"></td>
<td style="height: 56px; width:100%; background-image: url({THEME_COLOR_PATH}/images/top/top_bg.jpg)"><img src="{THEME_COLOR_PATH}/images/top/top_left_bg.jpg" border="0"></td>
<td style="width: 73px; height: 56px;"><img src="{THEME_COLOR_PATH}/images/top/top_right.jpg" border="0"></td>
</tr>
<tr>
<td style="width: 195px; vertical-align: top;">{MENU}</td>
<td colspan="2" style="vertical-align: top;"><table style="width: 100%; border-collapse: collapse;padding:0;margin:0;">
<tr height="95">
<td style="padding-left:30px; width: 100%; background-image: url({THEME_COLOR_PATH}/images/top/middle_bg.jpg);">{MAIN_MENU}</td>
<td style="padding:0;margin:0;text-align: right; width: 73px;vertical-align: top;"><img src="{THEME_COLOR_PATH}/images/top/middle_right.jpg" border="0"></td>
</tr>
<tr>
<td colspan="3"><table width="100%" border="0" cellspacing="0" cellpadding="0">
<tr>
<td align="left"><table width="100%" cellpadding="5" cellspacing="5">
<tr>
<td width="25"><img src="{THEME_COLOR_PATH}/images/content/table_icon_tools.png" width="25" height="25"></td>
<td colspan="2" class="title">{TR_CRON_MANAGER}</td>
</tr>
</table></td>
<td width="27" align="right"> </td>
</tr>
<tr>
<td><form name="add_cronjob" method="post" action="cronjobs_edit.php?cron_id={ID}">
<table width="100%" cellpadding="5" cellspacing="5">
<tr>
<td width="25"> </td>
<td colspan="5" class="content3"><b>{TR_EDIT_CRONJOB}</b></td>
</tr>
<!-- BDP: page_message -->
<tr>
<td width="25"> </td>
<td colspan="5" class="title"><span class="message">{MESSAGE}</span></td>
</tr>
<!-- EDP: page_message -->
<tr>
<td nowrap="nowrap"> </td>
<td nowrap="nowrap" class="content2">{TR_NAME}</td>
<td colspan="4" class="content"><input name="name" type="text" class="textinput" id="name" style="width:170px" value="{NAME}"></td>
</tr>
<tr>
<td nowrap="nowrap"> </td>
<td nowrap="nowrap" class="content2">{TR_DESCRIPTION}</td>
<!--td colspan="4" class="content"><input name="description" type="text" class="textinput" id="description" style="width:170px" value="{DESCTIPTON}"></td-->
<td colspan="4" class="content"><input name="description" type="text" class="textinput" id="description" style="width:170px" value="{DESCRIPTION}"></td>
</tr>
<tr>
<td nowrap="nowrap"> </td>
<td nowrap="nowrap" class="content2">{TR_ACTIVE}</td>
<td colspan="4" class="content"><select name="activ">
<option value="1" {ACTIVE_YES}>{YES}</option>
<option value="0" {ACTIVE_NO}>{NO}</option>
</select></td>
</tr>
<tr>
<td nowrap="nowrap"> </td>
<td nowrap="nowrap" class="content2">Run only once and when delete Job</td>
<td colspan="4" class="content"><select name="runonce">
<option value="1" {RUNONCE_YES}>{YES}</option>
<option value="-1" {RUNONCE_NO}>{NO}</option>
</select></td>
</tr>
<tr>
<td> </td>
<td colspan="5" class="content3"><b>{TR_CRONJOB}</b></td>
</tr>
<tr>
<td width="25"> </td>
<td colspan="3" class="content2">{TR_COMMAND}</td>
<td colspan="2" class="content2">Comand Line Syntax:</td>
</tr>
<tr>
<td width="25"> </td>
<td colspan="3" class="content"><input name="command_line" type="text" class="textinput" id="command_line" style="width:370px" value="{COMMAND_LINE}"></td>
<td colspan="2" class="content2">Enter properly COMMAND, space, full SERVER PATH to executed script!</td>
</tr>
<tr>
<td width="25"> </td>
<td colspan="5" class="content2">Allowed commands in only <b>{ALLOWED}</b> . And allowed file extension is <b>{FILETYPE}</b></td>
</tr>
<tr>
<td nowrap="nowrap"> </td>
<td align="center" nowrap="nowrap" class="content2">{TR_MIN}</td>
<td align="center" class="content2">{TR_HOUR}</td>
<td align="center" class="content2">{TR_DAY}</td>
<td align="center" class="content2">{TR_MONTHS}</td>
<td align="center" class="content2">{TR_WEEKDAYS}</td>
</tr>
<tr align="center" valign="top">
<td width="25" nowrap="nowrap"> </td>
<td width="200" nowrap="nowrap" class="content"><select name="min[]" size="6" multiple id="min"">
<option value="*">Every Minute</option>
<option value="*/2">Every Other Minute</option>
<option value="*/5">Every Five Minutes</option>
<option value="*/10">Every Ten Minutes</option>
<option value="*/15">Every Fifteen Minutes</option>
<option value="0">0</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
<option value="7">7</option>
<option value="8">8</option>
<option value="9">9</option>
<option value="10">10</option>
<option value="11">11</option>
<option value="12">12</option>
<option value="13">13</option>
<option value="14">14</option>
<option value="15">15</option>
<option value="16">16</option>
<option value="17">17</option>
<option value="18">18</option>
<option value="19">19</option>
<option value="20">20</option>
<option value="21">21</option>
<option value="22">22</option>
<option value="23">23</option>
<option value="24">24</option>
<option value="25">25</option>
<option value="26">26</option>
<option value="27">27</option>
<option value="28">28</option>
<option value="29">29</option>
<option value="30">30</option>
<option value="31">31</option>
<option value="32">32</option>
<option value="33">33</option>
<option value="34">34</option>
<option value="35">35</option>
<option value="36">36</option>
<option value="37">37</option>
<option value="38">38</option>
<option value="39">39</option>
<option value="40">40</option>
<option value="41">41</option>
<option value="42">42</option>
<option value="43">43</option>
<option value="44">44</option>
<option value="45">45</option>
<option value="46">46</option>
<option value="47">47</option>
<option value="48">48</option>
<option value="49">49</option>
<option value="50">50</option>
<option value="51">51</option>
<option value="52">52</option>
<option value="53">53</option>
<option value="54">54</option>
<option value="55">55</option>
<option value="56">56</option>
<option value="57">57</option>
<option value="58">58</option>
<option value="59">59</option>
</select></td>
<td class="content"><select name="hour[]" multiple size="6" id="hour">
<option value="*">Every Hour</option>
<option value="*/2">Every Other Hour</option>
<option value="*/4">Every Four Hours</option>
<option value="*/6">Every Six Hours</option>
<option value="0">0 = 12 AM/Midnight</option>
<option value="1">1 = 1 AM</option>
<option value="2">2 = 2 AM</option>
<option value="3">3 = 3 AM</option>
<option value="4">4 = 4 AM</option>
<option value="5">5 = 5 AM</option>
<option value="6">6 = 6 AM</option>
<option value="7">7 = 7 AM</option>
<option value="8">8 = 8 AM</option>
<option value="9">9 = 9 AM</option>
<option value="10">10 = 10 AM</option>
<option value="11">11 = 11 AM</option>
<option value="12">12 = 12 PM/Noon</option>
<option value="13">13 = 1 PM</option>
<option value="14">14 = 2 PM</option>
<option value="15">15 = 3 PM</option>
<option value="16">16 = 4 PM</option>
<option value="17">17 = 5 PM</option>
<option value="18">18 = 6 PM</option>
<option value="19">19 = 7 PM</option>
<option value="20">20 = 8 PM</option>
<option value="21">21 = 9 PM</option>
<option value="22">22 = 10 PM</option>
<option value="23">23 = 11 PM</option>
</select></td>
<td class="content"><select name="day_of_month[]" multiple size="6" id="day_of_month">
<option value="*">Every Day</option>
<option value="1">1</option>
<option value="2">2</option>
<option value="3">3</option>
<option value="4">4</option>
<option value="5">5</option>
<option value="6">6</option>
<option value="7">7</option>
<option value="8">8</option>
<option value="9">9</option>
<option value="10">10</option>
<option value="11">11</option>
<option value="12">12</option>
<option value="13">13</option>
<option value="14">14</option>
<option value="15">15</option>
<option value="16">16</option>
<option value="17">17</option>
<option value="18">18</option>
<option value="19">19</option>
<option value="20">20</option>
<option value="21">21</option>
<option value="22">22</option>
<option value="23">23</option>
<option value="24">24</option>
<option value="25">25</option>
<option value="26">26</option>
<option value="27">27</option>
<option value="28">28</option>
<option value="29">29</option>
<option value="30">30</option>
<option value="31">31</option>
</select></td>
<td class="content"><select name="month[]" multiple size="6" id="month">
<option value="*">Every Month</option>
<option value="1">January</option>
<option value="2">February</option>
<option value="3">March</option>
<option value="4">April</option>
<option value="5">May</option>
<option value="6">June</option>
<option value="7">July</option>
<option value="8">August</option>
<option value="9">September</option>
<option value="10">October</option>
<option value="11">November</option>
<option value="12">December</option>
</select></td>
<td class="content"><select name="day_of_week[]" multiple size="6" id="day_of_week">
<option value="*">Every Weekday</option>
<option value="0">Sunday</option>
<option value="1">Monday</option>
<option value="2">Tuesday</option>
<option value="3">Wednesday</option>
<option value="4">Thursday</option>
<option value="5">Friday</option>
<option value="6">Saturday</option>
</select></td>
</tr>
<tr>
<td width="25"> </td>
<td colspan="5"><input name="Submit" type="submit" class="button" value=" {TR_UPDATE} ">
<input name="button" type="button" class="button" onclick="MM_goToURL('parent','cronjobs_overview.php');return document.MM_returnValue" value="{TR_CANCEL}"></td>
</tr>
</table>
<input type="hidden" name="uaction" value="update_cronjob">
</form></td>
<td> </td>
</tr>
<tr>
<td> </td>
<td> </td>
</tr>
</table></td>
</tr>
</table></td>
</tr>
</table>
</body>
</html>
9 And the next code is UNTESTED.
open ./ispcp/gui/reseller/domain_delete.php
And aftet
/* check for subdomains */
...
die();
Add code
Code:
/* check for cronjobs */
$query = "SELECT COUNT(id) AS cronnum FROM hcrondtab WHERE domain = ?";
$res = exec_query($sql, $query, array($del_id));
$data = $res->FetchRow();
if ($data['cronnum'] > 0) {
/* ERR - we have cronjobs for this domain */
set_page_message(tr('Domain you are trying to remove has CronJobs !<br> first remove them !'));
header("Location: users.php");
die();
}
open ./ispcp/gui/include/admin-functions.php
above // Lets Delete SQL DBs and Users
add
Code:
//delete CronJobs
$query = "DELETE FROM `hcrondtab` WHERE `domain` = ?";
$rs = exec_query($sql, $query, array($admin_id));
10. If you need, after testing of All, you can etit second lines at cronjobs_add.php cronjobs_edit.php :
$stop_word = array('/etc/','password','passwd','groups'); //STOP Words!
$file_type = array('.php','.php4','.php5','.cgi','.pl','.py'); //List of GOOD files ;-)
if($command != "php" && $command != "perl" && $command != "python") //List of GOOD command
I thing that let users use "sh" and anoter bash comans are very unsecured!
Let's go testing all together!
Known problems
1. After deleting subdomain and aliases they cronjops are present.
2. Can't illuminate time choising menu whith voids from DB. Mey by we can construct selections form under php and pass to Smarty {MIN}, {HOUR} еtс...
TODO in future
1. Button or link to test CronJob and popup window for geting ansers and logs.
2. Standartisation of messages in language format of ispcp. Localisation.
Search
Member List
Calendar
Help
/
Writing CronJobs Web int. It's time!
