From 7a49b5dedcc68f5ef7e44721bed0f9ba1dd8d76b Mon Sep 17 00:00:00 2001 From: slawkens Date: Thu, 16 Feb 2023 10:53:06 +0100 Subject: [PATCH] Disable add php pages in admin panel for security. Option to disable plugins upload --- admin/pages/pages.php | 12 ++- admin/pages/plugins.php | 159 ++++++++++++++++++++-------------------- config.php | 4 + 3 files changed, 93 insertions(+), 82 deletions(-) diff --git a/admin/pages/pages.php b/admin/pages/pages.php index 8e61224b..19821a8e 100644 --- a/admin/pages/pages.php +++ b/admin/pages/pages.php @@ -76,18 +76,18 @@ if (!empty($action)) { $enable_tinymce = $_page['enable_tinymce'] == '1'; $access = $_page['access']; } else { - if(Pages::update($id, $name, $p_title, $body, $player_id, $php, $enable_tinymce, $access)) { + if(Pages::update($id, $name, $p_title, $body, $player_id, $php, $enable_tinymce, $access, $errors)) { $action = $name = $p_title = $body = ''; $player_id = 1; $access = 0; $php = false; $enable_tinymce = true; - success("Updated successful."); + success('Updated successful.'); } } } else if ($action == 'hide') { Pages::toggleHidden($id, $errors, $status); - success(($status == 1 ? 'Show' : 'Hide') . " successful."); + success(($status == 1 ? 'Show' : 'Hide') . ' successful.'); } if (!empty($errors)) @@ -152,6 +152,10 @@ class Pages $errors[] = 'Enable PHP is wrong.'; return false; } + if ($php == 1 && !getBoolean(config('admin_pages_php_enable'))) { + $errors[] = 'PHP pages disabled on this server. To enable go to config.php and change admin_pages_php_enable to "yes".'; + return false; + } if(!isset($enable_tinymce) || ($enable_tinymce != 0 && $enable_tinymce != 1)) { $errors[] = 'Enable TinyMCE is wrong.'; return false; @@ -200,7 +204,7 @@ class Pages return !count($errors); } - static public function update($id, $name, $title, $body, $player_id, $php, $enable_tinymce, $access) + static public function update($id, $name, $title, $body, $player_id, $php, $enable_tinymce, $access, &$errors) { if(!self::verify($name, $title, $body, $player_id, $php, $enable_tinymce, $access, $errors)) { return false; diff --git a/admin/pages/plugins.php b/admin/pages/plugins.php index 6072455b..f754edf4 100644 --- a/admin/pages/plugins.php +++ b/admin/pages/plugins.php @@ -13,94 +13,97 @@ $use_datatable = true; require_once LIBS . 'plugins.php'; -$twig->display('admin.plugins.form.html.twig'); - -if (isset($_REQUEST['uninstall'])) { - $uninstall = $_REQUEST['uninstall']; - - if (Plugins::uninstall($uninstall)) { - success('Successfully uninstalled plugin ' . $uninstall); - } else { - error('Error while uninstalling plugin ' . $uninstall . ': ' . Plugins::getError()); - } +if (!getBoolean(config('admin_plugins_manage_enable'))) { + warning('Plugin installation and management is disabled in config.
If you wish to enable, go to config.php and change admin_plugins_manage_enable to "yes".'); } -else if (isset($_REQUEST['enable'])) { - $enable = $_REQUEST['enable']; - if (Plugins::enable($enable)) { - success('Successfully enabled plugin ' . $enable); - } else { - error('Error while enabling plugin ' . $enable . ': ' . Plugins::getError()); - } -} -else if (isset($_REQUEST['disable'])) { - $disable = $_REQUEST['disable']; - if (Plugins::disable($disable)) { - success('Successfully disabled plugin ' . $disable); - } else { - error('Error while disabling plugin ' . $disable . ': ' . Plugins::getError()); - } -} else if (isset($_FILES['plugin']['name'])) { - $file = $_FILES['plugin']; - $filename = $file['name']; - $tmp_name = $file['tmp_name']; - $type = $file['type']; +else { + $twig->display('admin.plugins.form.html.twig'); - $name = explode('.', $filename); - $accepted_types = array('application/zip', 'application/x-zip-compressed', 'multipart/x-zip', 'application/x-compressed', 'application/octet-stream', 'application/zip-compressed'); + if (isset($_REQUEST['uninstall'])) { + $uninstall = $_REQUEST['uninstall']; - if (isset($file['error'])) { - $error = 'Error uploading file'; - switch ($file['error']) { - case UPLOAD_ERR_OK: - $error = false; - break; - case UPLOAD_ERR_INI_SIZE: - case UPLOAD_ERR_FORM_SIZE: - $error .= ' - file too large (limit of ' . ini_get('upload_max_filesize') . ' bytes). You can enlarge the limits by changing "upload_max_filesize" in php.ini'; - break; - case UPLOAD_ERR_PARTIAL: - $error .= ' - file upload was not completed.'; - break; - case UPLOAD_ERR_NO_FILE: - $error .= ' - zero-length file uploaded.'; - break; - default: - $error .= ' - internal error #' . $file['error']; - break; + if (Plugins::uninstall($uninstall)) { + success('Successfully uninstalled plugin ' . $uninstall); + } else { + error('Error while uninstalling plugin ' . $uninstall . ': ' . Plugins::getError()); } - } + } else if (isset($_REQUEST['enable'])) { + $enable = $_REQUEST['enable']; + if (Plugins::enable($enable)) { + success('Successfully enabled plugin ' . $enable); + } else { + error('Error while enabling plugin ' . $enable . ': ' . Plugins::getError()); + } + } else if (isset($_REQUEST['disable'])) { + $disable = $_REQUEST['disable']; + if (Plugins::disable($disable)) { + success('Successfully disabled plugin ' . $disable); + } else { + error('Error while disabling plugin ' . $disable . ': ' . Plugins::getError()); + } + } else if (isset($_FILES['plugin']['name'])) { + $file = $_FILES['plugin']; + $filename = $file['name']; + $tmp_name = $file['tmp_name']; + $type = $file['type']; - if (isset($error) && $error != false) { - error($error); - } else { - if (is_uploaded_file($file['tmp_name'])) { - $filetype = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); - if ($filetype == 'zip') // check if it is zipped/compressed file - { - $tmp_filename = pathinfo($filename, PATHINFO_FILENAME); - $targetzip = BASE . 'plugins/' . $tmp_filename . '.zip'; + $name = explode('.', $filename); + $accepted_types = array('application/zip', 'application/x-zip-compressed', 'multipart/x-zip', 'application/x-compressed', 'application/octet-stream', 'application/zip-compressed'); - if (move_uploaded_file($tmp_name, $targetzip)) { // move uploaded file - if (Plugins::install($targetzip)) { - foreach (Plugins::getWarnings() as $warning) { - warning($warning); + if (isset($file['error'])) { + $error = 'Error uploading file'; + switch ($file['error']) { + case UPLOAD_ERR_OK: + $error = false; + break; + case UPLOAD_ERR_INI_SIZE: + case UPLOAD_ERR_FORM_SIZE: + $error .= ' - file too large (limit of ' . ini_get('upload_max_filesize') . ' bytes). You can enlarge the limits by changing "upload_max_filesize" in php.ini'; + break; + case UPLOAD_ERR_PARTIAL: + $error .= ' - file upload was not completed.'; + break; + case UPLOAD_ERR_NO_FILE: + $error .= ' - zero-length file uploaded.'; + break; + default: + $error .= ' - internal error #' . $file['error']; + break; + } + } + + if (isset($error) && $error != false) { + error($error); + } else { + if (is_uploaded_file($file['tmp_name'])) { + $filetype = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); + if ($filetype == 'zip') // check if it is zipped/compressed file + { + $tmp_filename = pathinfo($filename, PATHINFO_FILENAME); + $targetzip = BASE . 'plugins/' . $tmp_filename . '.zip'; + + if (move_uploaded_file($tmp_name, $targetzip)) { // move uploaded file + if (Plugins::install($targetzip)) { + foreach (Plugins::getWarnings() as $warning) { + warning($warning); + } + + $info = Plugins::getPluginJson(); + success((isset($info['name']) ? '' . $info['name'] . ' p' : 'P') . 'lugin has been successfully installed.'); + } else { + $error = Plugins::getError(); + error(!empty($error) ? $error : 'Unexpected error happened while installing plugin. Please try again later.'); } - $info = Plugins::getPluginJson(); - success((isset($info['name']) ? '' . $info['name'] . ' p' : 'P') . 'lugin has been successfully installed.'); - } else { - $error = Plugins::getError(); - error(!empty($error) ? $error : 'Unexpected error happened while installing plugin. Please try again later.'); - } - - unlink($targetzip); // delete the Zipped file - } else - error('There was a problem with the upload. Please try again.'); + unlink($targetzip); // delete the Zipped file + } else + error('There was a problem with the upload. Please try again.'); + } else { + error('The file you are trying to upload is not a .zip file. Please try again.'); + } } else { - error('The file you are trying to upload is not a .zip file. Please try again.'); + error('Error uploading file - unknown error.'); } - } else { - error('Error uploading file - unknown error.'); } } } diff --git a/config.php b/config.php index 2e54562a..93228eca 100644 --- a/config.php +++ b/config.php @@ -299,6 +299,10 @@ $config = array( 'status_interval' => 60, // admin panel + 'admin_plugins_manage_enable' => 'yes', // you can disable possibility to upload and uninstall plugins, for security + // enable support for plain php pages in admin panel, for security + // existing pages still will be working, so you need to delete them manually + 'admin_pages_php_enable' => 'no', 'admin_panel_modules' => 'statistics,web_status,server_status,lastlogin,created,points,coins,balance', // default - statistics,web_status,server_status,lastlogin,created,points,coins,balance // other