From a520c987e64259b36b0a7745e7b156a426f49f71 Mon Sep 17 00:00:00 2001 From: Daniel Winzen Date: Fri, 22 Feb 2019 07:19:27 +0100 Subject: [PATCH] Allow adding and removing onion domains --- var/www/common.php | 13 +++++- var/www/html/home.php | 100 +++++++++++++++++++++++++++++++++++++++++- 2 files changed, 110 insertions(+), 3 deletions(-) diff --git a/var/www/common.php b/var/www/common.php index 242b2bf..8503c5d 100644 --- a/var/www/common.php +++ b/var/www/common.php @@ -106,6 +106,7 @@ server { } '; const MAX_NUM_USER_DBS = 5; //maximum number of databases a user may have +const MAX_NUM_USER_ONIONS = 3; //maximum number of onion domains a user may have function get_onion_v2($pkey) : string { $keyData = openssl_pkey_get_details($pkey); @@ -523,13 +524,23 @@ function del_user_db(PDO $db, int $user_id, string $mysql_db) { $stmt = $db->prepare('SELECT null FROM mysql_databases WHERE user_id = ? AND mysql_database = ?;'); $stmt->execute([$user_id, $mysql_db]); if($stmt->fetch()){ - $db->exec('REVOKE ALL PRIVILEGES ON `'.preg_replace('/[^a-z0-9]/i', '', $mysql_db)."`.* FROM '".preg_replace('/[^a-z0-9]/i', '', $user['mysql_user'])."'@'%';"); + $stmt = $db->prepare('REVOKE ALL PRIVILEGES ON `'.preg_replace('/[^a-z0-9]/i', '', $mysql_db)."`.* FROM ?@'%';"); + $stmt->execute([$user['mysql_user']]); $db->exec('DROP DATABASE IF EXISTS `'.preg_replace('/[^a-z0-9]/i', '', $mysql_db).'`;'); $stmt = $db->prepare('DELETE FROM mysql_databases WHERE user_id = ? AND mysql_database = ?;'); $stmt->execute([$user_id, $mysql_db]); } } +function del_user_onion(PDO $db, int $user_id, string $onion) { + $stmt = $db->prepare('SELECT null FROM onions WHERE user_id = ? AND onion = ? AND enabled IN (0, 1);'); + $stmt->execute([$user_id, $onion]); + if($stmt->fetch()){ + $stmt = $db->prepare("UPDATE onions SET enabled='-1' WHERE user_id = ? AND onion = ?;"); + $stmt->execute([$user_id, $onion]); + } +} + function check_csrf_error(){ if(empty($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']){ return 'Invalid CSRF token, please try again.'; diff --git a/var/www/html/home.php b/var/www/html/home.php index 1d19e0d..a5ce448 100644 --- a/var/www/html/home.php +++ b/var/www/html/home.php @@ -38,6 +38,78 @@ if(isset($_POST['action']) && $_POST['action']==='del_db_2' && !empty($_POST['db } del_user_db($db, $user['id'], $_POST['db']); } +if(isset($_POST['action']) && $_POST['action']==='del_onion' && !empty($_POST['onion'])){ + if($error=check_csrf_error()){ + die($error); + } ?> + +Daniel's Hosting - Delete onion domain + + + + +

This will delete your onion domain .onion and all data asociated with it. It can't be un-done. Are you sure?

+
+ + +
+

No, don't delete.

+$data[message]

"; + $ok = false; + } else { + $check=$db->prepare('SELECT null FROM onions WHERE onion=?;'); + $check->execute([$onion]); + if($check->fetch(PDO::FETCH_NUM)){ + $msg = '

Error onion already exists.

'; + $ok = false; + } + } + }else{ + $onion_version = 3; + if(isset($_REQUEST['onion_type']) && in_array($_REQUEST['onion_type'], [2, 3])){ + $onion_version = $_REQUEST['onion_type']; + } + $check=$db->prepare('SELECT null FROM onions WHERE onion=?;'); + do{ + $data = generate_new_onion($onion_version); + $priv_key = $data['priv_key']; + $onion = $data['onion']; + $onion_version = $data['version']; + $check->execute([$onion]); + }while($check->fetch(PDO::FETCH_NUM)); + } + $priv_key=trim(str_replace("\r", '', $priv_key)); + $stmt = $db->prepare('SELECT COUNT(*) FROM onions WHERE user_id = ?;'); + $stmt->execute([$user['id']]); + $count = $stmt->fetch(PDO::FETCH_NUM); + if($count[0]>=MAX_NUM_USER_ONIONS) { + $ok = false; + } + if($ok){ + $stmt=$db->prepare('INSERT INTO onions (user_id, onion, private_key, version, enabled) VALUES (?, ?, ?, ?, 2);'); + $stmt->execute([$user['id'], $onion, $priv_key, $onion_version]); + } +} +if(isset($_POST['action']) && $_POST['action']==='del_onion_2' && !empty($_POST['onion'])){ + if($error=check_csrf_error()){ + die($error); + } + del_user_onion($db, $user['id'], $_POST['onion']); +} if(isset($_REQUEST['action']) && isset($_REQUEST['onion']) && $_REQUEST['action']==='edit'){ if($error=check_csrf_error()){ die($error); @@ -74,15 +146,21 @@ echo 'Daniel\'s Hosting - Dashboard'; echo ''; echo ''; echo ''; +echo ''; echo ''; echo "

Logged in as $user[username] Logout | Change passwords | FileManager | Delete account

"; +if(!empty($msg)){ + echo $msg; +} echo "

Enter system account password to check your $user[system_account]@" . ADDRESS . " mail:

"; echo '

Domains

'; echo ''; -echo ''; +echo ''; $stmt=$db->prepare('SELECT onion, private_key, enabled, enable_smtp, num_intros, max_streams FROM onions WHERE user_id = ?;'); $stmt->execute([$user['id']]); +$count_onions = 0; while($onion=$stmt->fetch(PDO::FETCH_ASSOC)){ + ++$count_onions; echo "'; echo ''; if(in_array($onion['enabled'], [0, 1])){ - echo ''; + echo ''; }else{ echo ''; } echo ''; } +if($count_onions"; + echo ''; +} echo '
OnionPrivate keyEnabledSMTP enabledNr. of introsMax streams per rend circuitSave
OnionPrivate keyEnabledSMTP enabledNr. of introsMax streams per rend circuitAction
$onion[onion].onion"; if(isset($_REQUEST['show_priv'])){ echo "
$onion[private_key]
"; @@ -98,12 +176,30 @@ while($onion=$stmt->fetch(PDO::FETCH_ASSOC)){ echo '		'; + echo 'Unavailable
Add additional hidden service:
'; + echo ''; + echo ''; + echo '
'; echo '

MySQL Database

'; echo '';