diff --git a/var/www/common.php b/var/www/common.php
index 242b2bf..8503c5d 100644
--- a/var/www/common.php
+++ b/var/www/common.php
@@ -106,6 +106,7 @@ server {
}
';
const MAX_NUM_USER_DBS = 5; //maximum number of databases a user may have
+const MAX_NUM_USER_ONIONS = 3; //maximum number of onion domains a user may have
function get_onion_v2($pkey) : string {
$keyData = openssl_pkey_get_details($pkey);
@@ -523,13 +524,23 @@ function del_user_db(PDO $db, int $user_id, string $mysql_db) {
$stmt = $db->prepare('SELECT null FROM mysql_databases WHERE user_id = ? AND mysql_database = ?;');
$stmt->execute([$user_id, $mysql_db]);
if($stmt->fetch()){
- $db->exec('REVOKE ALL PRIVILEGES ON `'.preg_replace('/[^a-z0-9]/i', '', $mysql_db)."`.* FROM '".preg_replace('/[^a-z0-9]/i', '', $user['mysql_user'])."'@'%';");
+ $stmt = $db->prepare('REVOKE ALL PRIVILEGES ON `'.preg_replace('/[^a-z0-9]/i', '', $mysql_db)."`.* FROM ?@'%';");
+ $stmt->execute([$user['mysql_user']]);
$db->exec('DROP DATABASE IF EXISTS `'.preg_replace('/[^a-z0-9]/i', '', $mysql_db).'`;');
$stmt = $db->prepare('DELETE FROM mysql_databases WHERE user_id = ? AND mysql_database = ?;');
$stmt->execute([$user_id, $mysql_db]);
}
}
+function del_user_onion(PDO $db, int $user_id, string $onion) {
+ $stmt = $db->prepare('SELECT null FROM onions WHERE user_id = ? AND onion = ? AND enabled IN (0, 1);');
+ $stmt->execute([$user_id, $onion]);
+ if($stmt->fetch()){
+ $stmt = $db->prepare("UPDATE onions SET enabled='-1' WHERE user_id = ? AND onion = ?;");
+ $stmt->execute([$user_id, $onion]);
+ }
+}
+
function check_csrf_error(){
if(empty($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']){
return 'Invalid CSRF token, please try again.';
diff --git a/var/www/html/home.php b/var/www/html/home.php
index 1d19e0d..a5ce448 100644
--- a/var/www/html/home.php
+++ b/var/www/html/home.php
@@ -38,6 +38,78 @@ if(isset($_POST['action']) && $_POST['action']==='del_db_2' && !empty($_POST['db
}
del_user_db($db, $user['id'], $_POST['db']);
}
+if(isset($_POST['action']) && $_POST['action']==='del_onion' && !empty($_POST['onion'])){
+ if($error=check_csrf_error()){
+ die($error);
+ } ?>
+
+Daniel's Hosting - Delete onion domain
+
+
+
+
+This will delete your onion domain .onion and all data asociated with it. It can't be un-done. Are you sure?
+
+No, don't delete.
+$data[message]";
+ $ok = false;
+ } else {
+ $check=$db->prepare('SELECT null FROM onions WHERE onion=?;');
+ $check->execute([$onion]);
+ if($check->fetch(PDO::FETCH_NUM)){
+ $msg = 'Error onion already exists.
';
+ $ok = false;
+ }
+ }
+ }else{
+ $onion_version = 3;
+ if(isset($_REQUEST['onion_type']) && in_array($_REQUEST['onion_type'], [2, 3])){
+ $onion_version = $_REQUEST['onion_type'];
+ }
+ $check=$db->prepare('SELECT null FROM onions WHERE onion=?;');
+ do{
+ $data = generate_new_onion($onion_version);
+ $priv_key = $data['priv_key'];
+ $onion = $data['onion'];
+ $onion_version = $data['version'];
+ $check->execute([$onion]);
+ }while($check->fetch(PDO::FETCH_NUM));
+ }
+ $priv_key=trim(str_replace("\r", '', $priv_key));
+ $stmt = $db->prepare('SELECT COUNT(*) FROM onions WHERE user_id = ?;');
+ $stmt->execute([$user['id']]);
+ $count = $stmt->fetch(PDO::FETCH_NUM);
+ if($count[0]>=MAX_NUM_USER_ONIONS) {
+ $ok = false;
+ }
+ if($ok){
+ $stmt=$db->prepare('INSERT INTO onions (user_id, onion, private_key, version, enabled) VALUES (?, ?, ?, ?, 2);');
+ $stmt->execute([$user['id'], $onion, $priv_key, $onion_version]);
+ }
+}
+if(isset($_POST['action']) && $_POST['action']==='del_onion_2' && !empty($_POST['onion'])){
+ if($error=check_csrf_error()){
+ die($error);
+ }
+ del_user_onion($db, $user['id'], $_POST['onion']);
+}
if(isset($_REQUEST['action']) && isset($_REQUEST['onion']) && $_REQUEST['action']==='edit'){
if($error=check_csrf_error()){
die($error);
@@ -74,15 +146,21 @@ echo 'Daniel\'s Hosting - Dashboard';
echo '';
echo '';
echo '';
+echo '';
echo '';
echo "Logged in as $user[username] Logout | Change passwords | FileManager | Delete account
";
+if(!empty($msg)){
+ echo $msg;
+}
echo "Enter system account password to check your $user[system_account]@" . ADDRESS . " mail:
";
echo 'Domains';
echo '';
echo 'MySQL Database';
echo ' |