mirror/webgui
1
0
Fork 0
mirror of https://github.com/unraid/webgui.git synced 2026-05-08 05:12:14 -05:00
Code Issues Packages Projects Releases Wiki Activity

encryption: include 'escapeshellarg' for script execution

Browse Source
This commit is contained in:
bergware
2025-05-30 01:59:28 +02:00
parent b53237f39d
commit 2799e45205
1 changed files with 30 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
emhttp/plugins/dynamix/include/update.encryption.php
+30 -27
View File
@@ -1,6 +1,6 @@
<?PHP <?PHP
/* Copyright 2005-2023, Lime Technology /* Copyright 2005-2025, Lime Technology
* Copyright 2012-2023, Bergware International. * Copyright 2012-2025, Bergware International.
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License version 2, * modify it under the terms of the GNU General Public License version 2,
@@ -25,60 +25,63 @@ $oldkey = dirname($newkey).'/oldfile';
$delkey = !is_file($newkey); $delkey = !is_file($newkey);
$crypto = []; $crypto = [];
foreach (glob('/dev/disk/by-id/*CRYPT-LUKS*',GLOB_NOSORT) as $disk) { foreach (glob('/dev/disk/by-id/*CRYPT-LUKS*', GLOB_NOSORT) as $disk) {
$disk = explode('-',$disk); $disk = explode('-',$disk);
$crypto[] = array_pop($disk); $crypto[] = array_pop($disk);
} }
if (count($crypto)==0) die(); if (count($crypto) == 0) die();
function delete_file(...$file) { function delete_file(...$file) {
array_map('unlink',array_filter($file,'is_file')); array_map('unlink', array_filter($file,'is_file'));
} }
function removeKey($key,$disk) {
function removeKey($key, $disk) {
$match = $slots = 0; $match = $slots = 0;
$dump = popen("cryptsetup luksDump /dev/$disk",'r'); $dump = popen("cryptsetup luksDump ".escapeshellarg("/dev/$disk"), 'r');
while (($row = fgets($dump))!==false) { while (($row = fgets($dump)) !== false) {
if (strncmp($row,'Version:',8)==0) { if (strncmp($row,'Version:',8) == 0) {
switch (trim(explode(':',$row)[1])) { switch (trim(explode(':', $row)[1])) {
case 1: $match = '/^Key Slot \d+: ENABLED$/'; break; case 1: $match = '/^Key Slot \d+: ENABLED$/'; break;
case 2: $match = '/^\s+\d+: luks2$/'; break; case 2: $match = '/^\s+\d+: luks2$/'; break;
} }
} }
if ($match && preg_match($match,$row)) $slots++; if ($match && preg_match($match, $row)) $slots++;
} }
pclose($dump); pclose($dump);
if ($slots > 1) exec("cryptsetup luksRemoveKey /dev/$disk $key &>/dev/null"); if ($slots > 1) exec("cryptsetup luksRemoveKey ".escapeshellarg("/dev/$disk")." ".escapeshellarg($key)." &>/dev/null");
} }
function diskname($name) { function diskname($name) {
global $disks; global $disks;
foreach ($disks as $disk) if (strncmp($name,$disk['device'],strlen($disk['device']))==0) return $disk['name']; foreach ($disks as $disk) if (strncmp($name, $disk['device'], strlen($disk['device'])) == 0) return $disk['name'];
return $name; return $name;
} }
function reply($text,$type) {
global $oldkey,$newkey,$delkey; function reply($text, $type) {
global $oldkey, $newkey, $delkey;
$reply = _var($_POST,'#reply'); $reply = _var($_POST,'#reply');
if (realpath(dirname($reply))=='/var/tmp') file_put_contents($reply,$text."\0".$type); if (realpath(dirname($reply)) == '/var/tmp') file_put_contents($reply, $text."\0".$type);
delete_file($oldkey); delete_file($oldkey);
if (_var($_POST,'newinput','text')=='text' || $delkey) delete_file($newkey); if (_var($_POST,'newinput','text') == 'text' || $delkey) delete_file($newkey);
die(); die();
} }
if (isset($_POST['oldinput'])) { if (isset($_POST['oldinput'])) {
switch ($_POST['oldinput']) { switch ($_POST['oldinput']) {
case 'text': case 'text':
file_put_contents($oldkey,base64_decode(_var($_POST,'oldluks'))); file_put_contents($oldkey, base64_decode(_var($_POST,'oldluks')));
break; break;
case 'file': case 'file':
file_put_contents($oldkey,base64_decode(explode(';base64,',_var($_POST,'olddata','x;base64,'))[1])); file_put_contents($oldkey, base64_decode(explode(';base64,',_var($_POST,'olddata','x;base64,'))[1]));
break; break;
} }
} else { } else {
if (is_file($newkey)) copy($newkey,$oldkey); if (is_file($newkey)) copy($newkey, $oldkey);
} }
if (is_file($oldkey)) { if (is_file($oldkey)) {
$disk = $crypto[0]; // check first disk only (key is the same for all disks) $disk = $crypto[0]; // check first disk only (key is the same for all disks)
exec("cryptsetup luksOpen --test-passphrase --key-file $oldkey /dev/$disk &>/dev/null",$null,$error); exec("cryptsetup luksOpen --test-passphrase --key-file ".escapeshellarg($oldkey)." ".escapeshellarg("/dev/$disk")." &>/dev/null", $null, $error);
} else $error = 1; } else $error = 1;
if ($error > 0) reply(_('Incorrect existing key'),'warning'); if ($error > 0) reply(_('Incorrect existing key'),'warning');
@@ -86,24 +89,24 @@ if ($error > 0) reply(_('Incorrect existing key'),'warning');
if (isset($_POST['newinput'])) { if (isset($_POST['newinput'])) {
switch ($_POST['newinput']) { switch ($_POST['newinput']) {
case 'text': case 'text':
file_put_contents($newkey,base64_decode(_var($_POST,'newluks'))); file_put_contents($newkey, base64_decode(_var($_POST,'newluks')));
$luks = 'luksKey'; $luks = 'luksKey';
$data = rawurlencode(_var($_POST,'newluks')); $data = rawurlencode(_var($_POST,'newluks'));
break; break;
case 'file': case 'file':
file_put_contents($newkey,base64_decode(explode(';base64,',_var($_POST,'newdata','x;base64,'))[1])); file_put_contents($newkey, base64_decode(explode(';base64,',_var($_POST,'newdata','x;base64,'))[1]));
$luks = 'luksKey=&luksKeyfile'; $luks = 'luksKey=&luksKeyfile';
$data = $newkey; $data = $newkey;
break; break;
} }
$good = $bad = []; $good = $bad = [];
foreach ($crypto as $disk) { foreach ($crypto as $disk) {
exec("cryptsetup luksAddKey --key-file $oldkey /dev/$disk $newkey &>/dev/null",$null,$error); exec("cryptsetup luksAddKey --key-file ".escapeshellarg($oldkey)." ".escapeshellarg("/dev/$disk")." ".escapeshellarg($newkey)." &>/dev/null", $null, $error);
if ($error==0) $good[] = $disk; else $bad[] = diskname($disk); if ($error == 0) $good[] = $disk; else $bad[] = diskname($disk);
} }
if (count($bad)==0) { if (count($bad) == 0) {
// all okay, remove the old key // all okay, remove the old key
foreach ($good as $disk) removeKey($oldkey,$disk); foreach ($good as $disk) removeKey($oldkey, $disk);
exec("emcmd ".escapeshellarg("changeDisk=apply&$luks=$data")); exec("emcmd ".escapeshellarg("changeDisk=apply&$luks=$data"));
reply(_('Key successfully changed'),'success'); reply(_('Key successfully changed'),'success');
} else { } else {