gh_mirrors/1Panel
1
0
Fork 0
mirror of https://github.com/1Panel-dev/1Panel.git synced 2025-01-31 14:08:06 +08:00
Code

fix: 修复网站配置文件读取漏洞 (#1814)

Browse Source
This commit is contained in:
zhengkunwang 2023-08-02 22:38:32 +08:00 committed by GitHub
parent f6b84d384e
commit d34e7492e1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
19 changed files with 283 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
backend/app/api/v1/website.go
View File

@ -428,6 +428,28 @@ func (b *BaseApi) UpdateWebsiteWafConfig(c *gin.Context) {
helper.SuccessWithData(c, nil)
}
// @Tags Website WAF
// @Summary Update website waf file
// @Description 更新 网站 waf 配置文件
// @Accept json
// @Param request body request.WebsiteWafUpdate true "request"
// @Success 200
// @Security ApiKeyAuth
// @Router /websites/waf/file/update [post]
// @x-panel-log {"bodyKeys":["websiteId"],"paramKeys":[],"BeforeFuntions":[{"input_column":"id","input_value":"websiteId","isList":false,"db":"websites","output_column":"primary_domain","output_value":"domain"}],"formatZH":"WAF 配置文件修改 [domain]","formatEN":"WAF conf file update [domain]"}
func (b *BaseApi) UpdateWebsiteWafFile(c *gin.Context) {
var req request.WebsiteWafFileUpdate
if err := c.ShouldBindJSON(&req); err != nil {
helper.ErrorWithDetail(c, constant.CodeErrBadRequest, constant.ErrTypeInvalidParams, err)
return
}
if err := websiteService.UpdateWafFile(req); err != nil {
helper.ErrorWithDetail(c, constant.CodeErrInternalServer, constant.ErrTypeInternalServer, err)
return
}
helper.SuccessWithData(c, nil)
}
// @Tags Website Nginx
// @Summary Update website nginx conf
// @Description 更新 网站 nginx 配置

1
backend/app/dto/request/nginx.go
View File

@ -4,7 +4,6 @@ import "github.com/1Panel-dev/1Panel/backend/app/dto"
type NginxConfigFileUpdate struct {
Content string `json:"content" validate:"required"`
FilePath string `json:"filePath" validate:"required"`
Backup bool `json:"backup" validate:"required"`
}

12
backend/app/dto/request/website.go
View File

@ -75,6 +75,12 @@ type WebsiteWafReq struct {
Rule string `json:"rule" validate:"required"`
}
type WebsiteRedirectUpdate struct {
WebsiteID uint `json:"websiteId" validate:"required"`
Key string `json:"key" validate:"required"`
Enable bool `json:"enable" validate:"required"`
}
type WebsiteWafUpdate struct {
WebsiteID uint `json:"websiteId" validate:"required"`
Key string `json:"key" validate:"required"`
@ -199,3 +205,9 @@ type WebsiteProxyReq struct {
type WebsiteRedirectReq struct {
WebsiteID uint `json:"websiteId" validate:"required"`
}
type WebsiteWafFileUpdate struct {
WebsiteID uint `json:"websiteID" validate:"required"`
Content string `json:"content" validate:"required"`
Type string `json:"type" validate:"required,oneof=cc ip_white ip_block url_white url_block cookie_block args_check post_check ua_check file_ext_block"`
}

4
backend/app/dto/response/nginx.go
View File

@ -49,3 +49,7 @@ type NginxRedirectConfig struct {
Content string `json:"content"`
RedirectRoot bool `json:"redirectRoot"`
}
type NginxFile struct {
Content string `json:"content"`
}

1
backend/app/dto/response/website.go
View File

@ -27,7 +27,6 @@ type WebsiteNginxConfig struct {
type WebsiteWafConfig struct {
Enable bool `json:"enable"`
FilePath string `json:"filePath"`
Content string `json:"content"`
}

34
backend/app/service/nginx.go
View File

@ -20,7 +20,7 @@ type NginxService struct {
}
type INginxService interface {
GetNginxConfig() (response.FileInfo, error)
GetNginxConfig() (*response.NginxFile, error)
GetConfigByScope(req request.NginxScopeReq) ([]response.NginxParam, error)
UpdateConfigByScope(req request.NginxConfigUpdate) error
GetStatus() (response.NginxStatus, error)
@ -31,20 +31,17 @@ func NewINginxService() INginxService {
return &NginxService{}
}
func (n NginxService) GetNginxConfig() (response.FileInfo, error) {
func (n NginxService) GetNginxConfig() (*response.NginxFile, error) {
nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
if err != nil {
return response.FileInfo{}, err
return nil, err
}
configPath := path.Join(constant.AppInstallDir, constant.AppOpenresty, nginxInstall.Name, "conf", "nginx.conf")
info, err := files.NewFileInfo(files.FileOption{
Path: configPath,
Expand: true,
})
byteContent, err := files.NewFileOp().GetContent(configPath)
if err != nil {
return response.FileInfo{}, err
return nil, err
}
return response.FileInfo{FileInfo: *info}, nil
return &response.NginxFile{Content: string(byteContent)}, nil
}
func (n NginxService) GetConfigByScope(req request.NginxScopeReq) ([]response.NginxParam, error) {
@ -86,31 +83,32 @@ func (n NginxService) GetStatus() (response.NginxStatus, error) {
func (n NginxService) UpdateConfigFile(req request.NginxConfigFileUpdate) error {
fileOp := files.NewFileOp()
nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
filePath := path.Join(constant.AppInstallDir, constant.AppOpenresty, nginxInstall.Name, "conf", "nginx.conf")
if err != nil {
return err
}
if req.Backup {
backupPath := path.Join(path.Dir(req.FilePath), "bak")
backupPath := path.Join(path.Dir(filePath), "bak")
if !fileOp.Stat(backupPath) {
if err := fileOp.CreateDir(backupPath, 0755); err != nil {
return err
}
}
newFile := path.Join(backupPath, "nginx.bak"+"-"+time.Now().Format("2006-01-02-15-04-05"))
if err := fileOp.Copy(req.FilePath, backupPath); err != nil {
if err := fileOp.Copy(filePath, backupPath); err != nil {
return err
}
if err := fileOp.Rename(path.Join(backupPath, "nginx.conf"), newFile); err != nil {
return err
}
}
oldContent, err := os.ReadFile(req.FilePath)
oldContent, err := os.ReadFile(filePath)
if err != nil {
return err
}
if err := fileOp.WriteFile(req.FilePath, strings.NewReader(req.Content), 0644); err != nil {
if err = fileOp.WriteFile(filePath, strings.NewReader(req.Content), 0644); err != nil {
return err
}
nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
if err != nil {
return err
}
return nginxCheckAndReload(string(oldContent), req.FilePath, nginxInstall.ContainerName)
return nginxCheckAndReload(string(oldContent), filePath, nginxInstall.ContainerName)
}

19
backend/app/service/website.go
View File

@ -71,6 +71,7 @@ type IWebsiteService interface {
GetWafConfig(req request.WebsiteWafReq) (response.WebsiteWafConfig, error)
UpdateWafConfig(req request.WebsiteWafUpdate) error
UpdateWafFile(req request.WebsiteWafFileUpdate) (err error)
GetPHPConfig(id uint) (*response.PHPConfig, error)
UpdatePHPConfig(req request.WebsitePHPConfigUpdate) error
@ -848,7 +849,6 @@ func (w WebsiteService) GetWafConfig(req request.WebsiteWafReq) (response.Websit
if err != nil {
return res, nil
}
res.FilePath = filePath
res.Content = string(content)
return res, nil
@ -2282,3 +2282,20 @@ func (w WebsiteService) UpdateRedirectFile(req request.NginxRedirectUpdate) (err
}()
return updateNginxConfig(constant.NginxScopeServer, nil, &website)
}
func (w WebsiteService) UpdateWafFile(req request.WebsiteWafFileUpdate) (err error) {
var (
website model.Website
nginxInstall model.AppInstall
)
website, err = websiteRepo.GetFirst(commonRepo.WithByID(req.WebsiteID))
if err != nil {
return err
}
nginxInstall, err = getAppInstallByKey(constant.AppOpenresty)
if err != nil {
return
}
rulePath := path.Join(nginxInstall.GetPath(), "www", "sites", website.Alias, "waf", "rules", fmt.Sprintf("%s.json", req.Type))
return files.NewFileOp().WriteFile(rulePath, strings.NewReader(req.Content), 0755)
}

1
backend/router/ro_website.go
View File

@ -41,6 +41,7 @@ func (a *WebsiteRouter) InitWebsiteRouter(Router *gin.RouterGroup) {
groupRouter.POST("/waf/config", baseApi.GetWebsiteWafConfig)
groupRouter.POST("/waf/update", baseApi.UpdateWebsiteWafConfig)
groupRouter.POST("/waf/file/update", baseApi.UpdateWebsiteWafFile)
groupRouter.GET("/php/config/:id", baseApi.GetWebsitePHPConfig)
groupRouter.POST("/php/config", baseApi.UpdateWebsitePHPConfig)

64
cmd/server/docs/docs.go
View File

@ -1,5 +1,5 @@
// Code generated by swaggo/swag. DO NOT EDIT.
// Package docs GENERATED BY SWAG; DO NOT EDIT
// This file was generated by swaggo/swag
package docs
import "github.com/swaggo/swag"
@ -11334,6 +11334,57 @@ const docTemplate = `{
}
}
},
"/websites/waf/file/update": {
"post": {
"security": [
{
"ApiKeyAuth": []
}
],
"description": "更新 网站 waf 配置文件",
"consumes": [
"application/json"
],
"tags": [
"Website WAF"
],
"summary": "Update website waf file",
"parameters": [
{
"description": "request",
"name": "request",
"in": "body",
"required": true,
"schema": {
"$ref": "#/definitions/request.WebsiteWafUpdate"
}
}
],
"responses": {
"200": {
"description": "OK"
}
},
"x-panel-log": {
"BeforeFuntions": [
{
"db": "websites",
"input_column": "id",
"input_value": "websiteId",
"isList": false,
"output_column": "primary_domain",
"output_value": "domain"
}
],
"bodyKeys": [
"websiteId"
],
"formatEN": "WAF conf file update [domain]",
"formatZH": "WAF 配置文件修改 [domain]",
"paramKeys": []
}
}
},
"/websites/waf/update": {
"post": {
"security": [
@ -15526,8 +15577,7 @@ const docTemplate = `{
"type": "object",
"required": [
"backup",
"content",
"filePath"
"content"
],
"properties": {
"backup": {
@ -15535,9 +15585,6 @@ const docTemplate = `{
},
"content": {
"type": "string"
},
"filePath": {
"type": "string"
}
}
},
@ -17131,9 +17178,6 @@ const docTemplate = `{
},
"enable": {
"type": "boolean"
},
"filePath": {
"type": "string"
}
}
}

60
cmd/server/docs/swagger.json
View File

@ -11327,6 +11327,57 @@
}
}
},
"/websites/waf/file/update": {
"post": {
"security": [
{
"ApiKeyAuth": []
}
],
"description": "更新 网站 waf 配置文件",
"consumes": [
"application/json"
],
"tags": [
"Website WAF"
],
"summary": "Update website waf file",
"parameters": [
{
"description": "request",
"name": "request",
"in": "body",
"required": true,
"schema": {
"$ref": "#/definitions/request.WebsiteWafUpdate"
}
}
],
"responses": {
"200": {
"description": "OK"
}
},
"x-panel-log": {
"BeforeFuntions": [
{
"db": "websites",
"input_column": "id",
"input_value": "websiteId",
"isList": false,
"output_column": "primary_domain",
"output_value": "domain"
}
],
"bodyKeys": [
"websiteId"
],
"formatEN": "WAF conf file update [domain]",
"formatZH": "WAF 配置文件修改 [domain]",
"paramKeys": []
}
}
},
"/websites/waf/update": {
"post": {
"security": [
@ -15519,8 +15570,7 @@
"type": "object",
"required": [
"backup",
"content",
"filePath"
"content"
],
"properties": {
"backup": {
@ -15528,9 +15578,6 @@
},
"content": {
"type": "string"
},
"filePath": {
"type": "string"
}
}
},
@ -17124,9 +17171,6 @@
},
"enable": {
"type": "boolean"
},
"filePath": {
"type": "string"
}
}
}

38
cmd/server/docs/swagger.yaml
View File

@ -2773,12 +2773,9 @@ definitions:
type: boolean
content:
type: string
filePath:
type: string
required:
- backup
- content
- filePath
type: object
request.NginxConfigUpdate:
properties:
@ -3846,8 +3843,6 @@ definitions:
type: string
enable:
type: boolean
filePath:
type: string
type: object
host: localhost
info:
@ -11038,6 +11033,39 @@ paths:
summary: Load websit waf conf
tags:
- Website WAF
/websites/waf/file/update:
post:
consumes:
- application/json
description: 更新 网站 waf 配置文件
parameters:
- description: request
in: body
name: request
required: true
schema:
$ref: '#/definitions/request.WebsiteWafUpdate'
responses:
"200":
description: OK
security:
- ApiKeyAuth: []
summary: Update website waf file
tags:
- Website WAF
x-panel-log:
BeforeFuntions:
- db: websites
input_column: id
input_value: websiteId
isList: false
output_column: primary_domain
output_value: domain
bodyKeys:
- websiteId
formatEN: WAF conf file update [domain]
formatZH: WAF 配置文件修改 [domain]
paramKeys: []
/websites/waf/update:
post:
consumes:

1
frontend/src/api/interface/nginx.ts
View File

@ -26,7 +26,6 @@ export namespace Nginx {
export interface NginxFileUpdate {
content: string;
filePath: string;
backup: boolean;
}
}

7
frontend/src/api/interface/website.ts
View File

@ -250,7 +250,6 @@ export namespace Website {
export interface WafRes {
enable: boolean;
filePath: string;
content: string;
}
@ -260,6 +259,12 @@ export namespace Website {
key: string;
}
export interface WafFileUpdate {
websiteId: number;
type: string;
content: string;
}
export interface DelReq {
id: number;
}

4
frontend/src/api/modules/website.ts
View File

@ -151,6 +151,10 @@ export const UpdateWafEnable = (req: Website.WafUpdate) => {
return http.post<any>(`/websites/waf/update`, req);
};
export const UpdateWafFile = (req: Website.WafFileUpdate) => {
return http.post<any>(`/websites/waf/file/update`, req);
};
export const UpdateNginxFile = (req: Website.NginxUpdate) => {
return http.post<any>(`/websites/nginx/update`, req);
};

24
frontend/src/views/website/website/config/safety/ccdeny/index.vue
View File

@ -33,8 +33,7 @@
<script lang="ts" setup>
import { Website } from '@/api/interface/website';
import { SaveFileContent } from '@/api/modules/files';
import { GetWafConfig, UpdateWafEnable } from '@/api/modules/website';
import { GetWafConfig, UpdateWafEnable, UpdateWafFile } from '@/api/modules/website';
import { checkNumberRange, Rules } from '@/global/form-rules';
import i18n from '@/lang';
import { MsgSuccess } from '@/utils/message';
@ -51,28 +50,29 @@ const id = computed(() => {
return props.id;
});
let data = ref<Website.WafRes>();
let loading = ref(false);
let form = reactive({
const data = ref<Website.WafRes>();
const loading = ref(false);
const form = reactive({
enable: false,
cycle: 60,
frequency: 120,
});
let req = ref<Website.WafReq>({
const req = ref<Website.WafReq>({
websiteId: 0,
key: '$CCDeny',
rule: 'cc',
});
let enableUpdate = ref<Website.WafUpdate>({
const enableUpdate = ref<Website.WafUpdate>({
websiteId: 0,
key: '$CCDeny',
enable: false,
});
let fileUpdate = reactive({
path: '',
const fileUpdate = reactive({
content: '',
websiteId: 0,
type: 'cc',
});
let rules = ref({
const rules = ref({
cycle: [Rules.requiredInput, checkNumberRange(1, 9999999)],
frequency: [Rules.requiredInput, checkNumberRange(1, 9999999)],
});
@ -89,7 +89,6 @@ const get = async () => {
form.frequency = Number(params[0]);
form.cycle = Number(params[1]);
}
fileUpdate.path = data.value.filePath;
};
const updateEnable = async (enable: boolean) => {
@ -111,7 +110,7 @@ const submit = async (formEl: FormInstance | undefined) => {
}
fileUpdate.content = String(form.frequency) + '/' + String(form.cycle);
loading.value = true;
SaveFileContent(fileUpdate)
UpdateWafFile(fileUpdate)
.then(() => {
MsgSuccess(i18n.global.t('commons.msg.updateSuccess'));
})
@ -124,6 +123,7 @@ const submit = async (formEl: FormInstance | undefined) => {
onMounted(() => {
req.value.websiteId = id.value;
enableUpdate.value.websiteId = id.value;
fileUpdate.websiteId = id.value;
get();
});
</script>

22
frontend/src/views/website/website/config/safety/file-block-list/index.vue
View File

@ -32,9 +32,8 @@
</template>
<script lang="ts" setup>
import { Website } from '@/api/interface/website';
import { GetWafConfig, UpdateWafEnable } from '@/api/modules/website';
import { GetWafConfig, UpdateWafEnable, UpdateWafFile } from '@/api/modules/website';
import { computed, onMounted, reactive, ref } from 'vue';
import { SaveFileContent } from '@/api/modules/files';
import i18n from '@/lang';
import { MsgSuccess } from '@/utils/message';
@ -48,23 +47,24 @@ const id = computed(() => {
return props.id;
});
let loading = ref(false);
let data = ref([]);
let req = ref<Website.WafReq>({
const loading = ref(false);
const data = ref([]);
const req = ref<Website.WafReq>({
websiteId: 0,
key: '$fileExtDeny',
rule: 'file_ext_block',
});
let fileUpdate = reactive({
path: '',
const fileUpdate = reactive({
content: '',
websiteId: 0,
type: 'file_ext_block',
});
let enableUpdate = ref<Website.WafUpdate>({
const enableUpdate = ref<Website.WafUpdate>({
websiteId: 0,
key: '$fileExtDeny',
enable: false,
});
let exts = ref();
const exts = ref();
const get = async () => {
data.value = [];
@ -81,7 +81,6 @@ const get = async () => {
});
}
fileUpdate.path = res.data.filePath;
enableUpdate.value.enable = res.data.enable;
};
@ -109,7 +108,7 @@ const openCreate = () => {
const submit = async (extArray: string[]) => {
fileUpdate.content = JSON.stringify(extArray);
loading.value = true;
SaveFileContent(fileUpdate)
UpdateWafFile(fileUpdate)
.then(() => {
exts.value = '';
MsgSuccess(i18n.global.t('commons.msg.updateSuccess'));
@ -134,6 +133,7 @@ const updateEnable = async (enable: boolean) => {
onMounted(() => {
req.value.websiteId = id.value;
enableUpdate.value.websiteId = id.value;
fileUpdate.websiteId = id.value;
get();
});
</script>

25
frontend/src/views/website/website/config/safety/simple-list/index.vue
View File

@ -40,9 +40,8 @@
</template>
<script lang="ts" setup>
import { Website } from '@/api/interface/website';
import { GetWafConfig, UpdateWafEnable } from '@/api/modules/website';
import { GetWafConfig, UpdateWafEnable, UpdateWafFile } from '@/api/modules/website';
import { computed, onMounted, reactive, ref } from 'vue';
import { SaveFileContent } from '@/api/modules/files';
import i18n from '@/lang';
import { checkIpV4V6 } from '@/utils/util';
import { MsgSuccess } from '@/utils/message';
@ -55,7 +54,7 @@ const props = defineProps({
},
rule: {
type: String,
default: 'ipWhiteList',
default: 'ip_white',
},
paramKey: {
type: String,
@ -72,23 +71,24 @@ const key = computed(() => {
return props.paramKey;
});
let loading = ref(false);
let data = ref([]);
let req = ref<Website.WafReq>({
const loading = ref(false);
const data = ref([]);
const req = ref<Website.WafReq>({
websiteId: 0,
key: '$ipWhiteAllow',
rule: 'ip_white',
});
let fileUpdate = reactive({
path: '',
const fileUpdate = reactive({
content: '',
websiteId: 0,
type: 'ip_white',
});
let enableUpdate = ref<Website.WafUpdate>({
const enableUpdate = ref<Website.WafUpdate>({
websiteId: 0,
key: '$ipWhiteAllow',
enable: false,
});
let ips = ref();
const ips = ref();
const get = async () => {
data.value = [];
@ -105,7 +105,6 @@ const get = async () => {
});
}
enableUpdate.value.enable = res.data.enable;
fileUpdate.path = res.data.filePath;
};
const removeIp = (index: number) => {
@ -152,7 +151,7 @@ const openCreate = () => {
const submit = async (ipList: string[]) => {
fileUpdate.content = JSON.stringify(ipList);
loading.value = true;
SaveFileContent(fileUpdate)
UpdateWafFile(fileUpdate)
.then(() => {
ips.value = '';
get();
@ -180,6 +179,8 @@ onMounted(() => {
req.value.key = key.value;
enableUpdate.value.websiteId = id.value;
enableUpdate.value.key = key.value;
fileUpdate.type = rule.value;
fileUpdate.websiteId = id.value;
get();
});
</script>

21
frontend/src/views/website/website/config/safety/value-list/index.vue
View File

@ -47,9 +47,8 @@
</template>
<script lang="ts" setup>
import { Website } from '@/api/interface/website';
import { GetWafConfig, UpdateWafEnable } from '@/api/modules/website';
import { GetWafConfig, UpdateWafEnable, UpdateWafFile } from '@/api/modules/website';
import { computed, onMounted, reactive, ref } from 'vue';
import { SaveFileContent } from '@/api/modules/files';
import i18n from '@/lang';
import { MsgSuccess } from '@/utils/message';
@ -77,18 +76,19 @@ const key = computed(() => {
return props.paramKey;
});
let loading = ref(false);
let data = ref([]);
let req = ref<Website.WafReq>({
const loading = ref(false);
const data = ref([]);
const req = ref<Website.WafReq>({
websiteId: 0,
key: '',
rule: 'url',
});
let fileUpdate = reactive({
path: '',
const fileUpdate = reactive({
content: '',
websiteId: 0,
type: 'url',
});
let enableUpdate = ref<Website.WafUpdate>({
const enableUpdate = ref<Website.WafUpdate>({
websiteId: 0,
key: '$UrlDeny',
enable: false,
@ -118,7 +118,6 @@ const get = async () => {
}
});
}
fileUpdate.path = res.data.filePath;
};
const remove = (index: number) => {
@ -157,7 +156,7 @@ const submit = async (addArray: string[]) => {
fileUpdate.content = JSON.stringify(contentArray.value);
loading.value = true;
SaveFileContent(fileUpdate)
UpdateWafFile(fileUpdate)
.then(() => {
add.value = {
value: '',
@ -178,6 +177,8 @@ onMounted(() => {
req.value.key = key.value;
enableUpdate.value.key = key.value;
enableUpdate.value.websiteId = id.value;
fileUpdate.websiteId = id.value;
fileUpdate.type = rule.value;
get();
});
</script>

9
frontend/src/views/website/website/nginx/source/index.vue
View File

@ -48,7 +48,6 @@ import { MsgSuccess } from '@/utils/message';
const extensions = [StreamLanguage.define(nginx), oneDark];
let data = ref();
let content = ref('');
let loading = ref(false);
let useOld = ref(false);
@ -56,7 +55,6 @@ let useOld = ref(false);
const submit = () => {
loading.value = true;
UpdateNginxConfigFile({
filePath: data.value.path,
content: content.value,
backup: useOld.value,
})
@ -70,17 +68,20 @@ const submit = () => {
};
const getNginx = async () => {
try {
const res = await GetNginx();
data.value = res.data;
content.value = data.value.content;
content.value = res.data.content;
useOld.value = false;
} catch (error) {}
};
const getDefaultConfig = async () => {
loading.value = true;
try {
const res = await GetAppDefaultConfig('openresty');
content.value = res.data;
useOld.value = true;
} catch (error) {}
loading.value = false;
};