func FtpEditUser(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "ftpusers")
if !auth {
return "not_authorized"
}
username := util.Query(ctx, "username")
password := util.Query(ctx, "password")
db, _ := util.MySQL()
defer db.Close()
// check if user owns domain
dstmt, _ := db.Prepare("SELECT * FROM `hostcontrol_ftpusers` WHERE `ftpusername`=? and `system_username`=?")
row1, _ := dstmt.Query(username, hcuser.System_username)
defer dstmt.Close()
if !row1.Next() {
return "user_not_found"
}
// set the password
util.Bash("echo " + util.SHSanitize(password) + " | passwd " + util.SHSanitize(username) + " --stdin")
return "success"
}
func MailAddUser(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "mail")
if !auth {
return "not_authorized"
}
domain := util.Query(ctx, "domain")
if domain == "" {
return "domain_required"
}
username := util.Query(ctx, "username")
if username == "" {
return "username_required"
}
password := util.Query(ctx, "password")
if password == "" {
return "password_required"
}
email_address := username + "@" + domain
db, _ := util.MySQL()
defer db.Close()
// check if user owns domain
dstmt, _ := db.Prepare("SELECT * FROM `hostcontrol`.`mail_domains` WHERE `domain`=? and `system_username`=?")
row1, _ := dstmt.Query(domain, hcuser.System_username)
defer dstmt.Close()
if !row1.Next() {
return "domain_not_found"
}
// make sure email address does not already exist
estmt, _ := db.Prepare("SELECT * FROM `hostcontrol`.`mail_users` WHERE email=? and domain=?")
row2, _ := estmt.Query(email_address, domain)
defer estmt.Close()
if row2.Next() {
return "email_account_exists"
}
xstmt, _ := db.Prepare("INSERT INTO `hostcontrol`.`mail_users` set `email`=?, `password`=ENCRYPT(?), `domain`=?")
_, err := xstmt.Exec(email_address, password, domain)
xstmt.Close()
if err != nil {
return "failed_to_create_domain"
}
return "success"
}
func file_editor(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "any")
if !auth {
ctx.Redirect("/", 302)
return ""
}
suser, err := user.Lookup(hcuser.System_username)
if err != nil {
return die(ctx, string(err.Error()))
}
selected_object := path.Clean(util.Query(ctx, "path"))
full_object := path.Clean(suser.HomeDir + "/" + selected_object)
// check ownership...
uid, _ := strconv.Atoi(suser.Uid)
gid, _ := strconv.Atoi(suser.Gid)
if !util.ChkPerms(full_object, uid, gid) {
return die(ctx, "You do not have access to object "+full_object)
}
filecontents := util.Query(ctx, "filecontents")
if filecontents != "" {
filecontents = strings.Replace(filecontents, "\r\n", "\n", -1)
ioutil.WriteFile(full_object, []byte(filecontents), 0644)
}
rawcontents, err := ioutil.ReadFile(full_object)
if err != nil {
return die(ctx, string(err.Error()))
}
content := html.EscapeString(string(rawcontents))
var tpl vision.New
tpl.TemplateFile("template/file-editor.tpl")
tpl.Assign("path_up", path.Dir(selected_object))
tpl.Assign("selected_path", selected_object)
tpl.Assign("current_path", full_object)
tpl.Assign("filedata", content)
tpl.Parse("file-editor")
return header(ctx) + tpl.Out() + footer(ctx)
}
func MailDeleteDomain(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "mail")
if !auth {
return "not_authorized"
}
domain := util.Query(ctx, "domain")
if domain == "" {
return "domain_required"
}
db, _ := util.MySQL()
defer db.Close()
xstmt, _ := db.Prepare("DELETE FROM `hostcontrol`.`mail_domains` WHERE `domain`=? AND `system_username`=?")
_, err := xstmt.Exec(domain, hcuser.System_username)
xstmt.Close()
if err != nil {
return "failed_to_delete_domain"
}
os.RemoveAll("/home/vmail/" + domain)
return "success"
}
func MailAddDomain(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "mail")
if !auth {
return "not_authorized"
}
domain := util.Query(ctx, "domain")
if domain == "" {
return "domain_required"
}
db, _ := util.MySQL()
defer db.Close()
xstmt, _ := db.Prepare("INSERT INTO `hostcontrol`.`mail_domains` set `domain_id`=NULL, `domain`=?, `system_username`=?")
_, err := xstmt.Exec(domain, hcuser.System_username)
xstmt.Close()
if err != nil {
return "failed_to_create_domain"
}
return "success"
}
func addtoken(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "any")
if !auth {
ctx.Redirect("/", 302)
return ""
}
description := util.Query(ctx, "description")
token := util.MkToken()
db, _ := util.MySQL()
defer db.Close()
xstmt, _ := db.Prepare("INSERT INTO `hostcontrol`.`hostcontrol_user_tokens` set `token`=?, `hostcontrol_id`=?, `description`=?, token_id=null")
_, err := xstmt.Exec(token, hcuser.Hostcontrol_id, description)
xstmt.Close()
if err != nil {
set_error("Failed to create new token.", ctx)
ctx.Redirect("/settings", 302)
return "Failed to create new token."
}
set_error("Created new token.", ctx)
ctx.Redirect("/settings", 302)
return ""
}
func DnsDeleteDomain(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "dns")
if !auth {
return "not_authorized"
}
domain := util.Query(ctx, "domain")
if domain == "" {
return "domain_required"
}
db, _ := util.MySQL()
defer db.Close()
xstmt, _ := db.Prepare("DELETE FROM `hostcontrol`.`domains` where `name`=? and `account`=?")
_, err := xstmt.Exec(domain, hcuser.System_username)
xstmt.Close()
if err != nil {
return "failed_to_delete_domain"
}
return "success"
}
func SqlDatabasesAdd(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "databases")
if !auth {
return "not_authorized"
}
db_name := util.Query(ctx, "db_name")
if db_name == "" {
return "db_name_required"
}
db, _ := util.MySQL()
defer db.Close()
// stmt, _ := db.Prepare("CREATE USER ?@'%' IDENTIFIED BY ?;")
// _, err := stmt.Exec(hcuser.System_username + "_" + username, password)
db_name = util.LastResortSanitize(db_name)
db_name = string(hcuser.System_username + "_" + db_name)
stmt, err := db.Prepare("create database " + db_name + "")
if err != nil {
return "bad_characters_used "
}
_, err = stmt.Exec()
if err != nil {
return "failed_to_create_database"
}
stmt.Close()
return "success"
}
func databasegrantdelete(ctx *macaron.Context) string {
status := API("/api/sql/grants/delete", ctx)
db_user := util.Query(ctx, "db_user")
db_name := util.Query(ctx, "db_name")
if status == "success" {
set_error("Removed "+db_user+" from database "+db_name+"!", ctx)
ctx.Redirect("/databases", 302)
return "Removed " + db_user + " from database " + db_name + "!"
}
set_error("Failed to remove "+db_user+" from database "+db_name+"! Error given: "+status, ctx)
ctx.Redirect("/databases", 302)
return "Failed to remove " + db_user + " from database " + db_name + "! Error given: " + status
}
func databasegrantadd(ctx *macaron.Context) string {
status := API("/api/sql/grants/add", ctx)
db_user := util.Query(ctx, "db_user")
db_name := util.Query(ctx, "db_name")
if status == "success" {
set_error("Added "+db_user+" to database "+db_name+" successfully!", ctx)
ctx.Redirect("/databases", 302)
return "Added " + db_user + " to database " + db_name + " successfully!"
}
set_error("Failed to add "+db_user+" to database "+db_name+"! Error given: "+status, ctx)
ctx.Redirect("/databases", 302)
return "Failed to add " + db_user + " to database " + db_name + "! Error given: " + status
}
func mailadduser(ctx *macaron.Context) string {
status := API("/api/mail/users/add", ctx)
username := util.Query(ctx, "username")
domain := util.Query(ctx, "domain")
if status == "success" {
set_error("Added "+username+"@"+domain+" successfully!", ctx)
ctx.Redirect("/mail", 302)
return "did it!"
}
set_error("Failed to add user. Error given: "+status, ctx)
ctx.Redirect("/mail", 302)
return "Failed to add user. Error given: " + status
}
func MailEditUser(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "mail")
if !auth {
return "not_authorized"
}
email_address := util.Query(ctx, "email")
if email_address == "" {
return "email_required"
}
password := util.Query(ctx, "password")
if email_address == "" {
return "password_required"
}
strsplt := strings.Split(email_address, "@")
if len(strsplt) != 2 {
return "invalid_email"
}
//username := strsplt[0]
domain := strsplt[1]
db, _ := util.MySQL()
defer db.Close()
// check if user owns domain
dstmt, _ := db.Prepare("SELECT * FROM `hostcontrol`.`mail_domains` WHERE `domain`=? and `system_username`=?")
row1, _ := dstmt.Query(domain, hcuser.System_username)
defer dstmt.Close()
if !row1.Next() {
return "domain_not_found"
}
// update serial for domain
ustmt, _ := db.Prepare("UPDATE `hostcontrol`.`mail_users` SET `password`=ENCRYPT(?) WHERE `email`=?")
ustmt.Exec(password, email_address)
ustmt.Close()
return "success"
}
func SqlGrantsDelete(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "databases")
if !auth {
return "not_authorized"
}
db_name := util.Query(ctx, "db_name")
if db_name == "" {
return "db_name_required"
}
username := util.Query(ctx, "db_user")
if username == "" {
return "username_required"
}
dbowner := strings.Split(db_name, "_")[0]
userowner := strings.Split(username, "_")[0]
if dbowner != hcuser.System_username || userowner != hcuser.System_username {
return "failed_not_yours"
}
db, _ := util.MySQL()
defer db.Close()
db_name = util.LastResortSanitize(db_name)
username = util.LastResortSanitize(username)
_, err := db.Exec("REVOKE ALL ON " + db_name + ".* FROM '" + username + "'@'%';")
if err != nil {
return "failed_to_delete_grant"
}
return "success"
}
func DeleteWebsite(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "websites")
if !auth {
return "not_authorized"
}
db, err := util.MySQL()
if err != nil {
return string(err.Error())
}
defer db.Close()
vhost_id := util.Query(ctx, "vhost_id")
stmt, _ := db.Prepare("SELECT * from website_vhosts WHERE vhost_id = ? and system_username=?")
rows, _ := stmt.Query(vhost_id, hcuser.System_username)
stmt.Close()
if rows.Next() {
var vhost_id string
var system_username string
var domain string
var documentroot string
var ipaddr string
var ssl_enabled string
var ssl_certificate string
var ssl_key string
var ssl_ca_certificate string
rows.Scan(&vhost_id, &system_username, &domain, &documentroot, &ipaddr, &ssl_enabled, &ssl_certificate, &ssl_key, &ssl_ca_certificate)
os.RemoveAll("/var/log/httpd/" + hcuser.System_username + "/" + domain + "-error_log")
os.RemoveAll("/var/log/httpd/" + hcuser.System_username + "/" + domain + "-access_log")
os.RemoveAll("/var/log/httpd/" + hcuser.System_username + "/" + domain + "-ssl-error_log")
os.RemoveAll("/var/log/httpd/" + hcuser.System_username + "/" + domain + "-ssl-access_log")
os.RemoveAll("/etc/pki/tls/certs/" + domain + ".crt")
os.RemoveAll("/etc/pki/tls/certs/" + domain + ".ca.crt")
os.RemoveAll("/etc/pki/tls/private/" + domain + ".key")
os.RemoveAll("/etc/httpd/vhosts.d/" + domain + ".conf")
os.RemoveAll("/etc/httpd/vhosts.d/" + domain + ".ssl.conf")
stmt, _ = db.Prepare("delete from website_vhosts where vhost_id=?")
stmt.Exec(vhost_id)
stmt.Close()
} else {
return "domain_not_found"
}
util.Bash("systemctl reload httpd")
return "success"
}
func Deleteuser(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "sysusers")
if !auth {
return "not_authorized"
}
username := util.Query(ctx, "username")
if username == "" || username == "root" {
return "username_required"
}
db, _ := util.MySQL()
defer db.Close()
// check if user actually owns child
if !util.ChkPaternity(hcuser.System_username, username) {
return "failed_ownership_check"
}
users := make(map[string]map[string]string)
users = util.Getusers(username, users, db)
for _, subuser := range users {
cleanupuserdata(subuser["system_username"], ctx)
// delete the user and homedir
util.Cmd("userdel", []string{subuser["system_username"], "-f", "-r"})
// remove the user
stmt, _ := db.Prepare("delete from hostcontrol_users where system_username=?")
stmt.Exec(subuser["system_username"])
stmt.Close()
}
cleanupuserdata(username, ctx)
// delete the user and homedir
util.Cmd("userdel", []string{username, "-f", "-r"})
// make sure user was delete
_, lookup_err2 := user.Lookup(username)
if lookup_err2 == nil {
return "failed_to_delete_user"
}
// remove the user
stmt, _ := db.Prepare("delete from hostcontrol_users where system_username=?")
stmt.Exec(username)
stmt.Close()
return "success"
}
func updatesettings(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "any")
if !auth {
ctx.Redirect("/", 302)
return ""
}
password := util.Query(ctx, "password")
new_password := util.Query(ctx, "new_password")
new_password_verify := util.Query(ctx, "new_password_verify")
if password == "" || new_password == "" || new_password_verify == "" {
set_error("Failed to update settings. Error given: missing a password field", ctx)
ctx.Redirect("/settings", 302)
return ""
}
if new_password != new_password_verify {
set_error("Failed to update settings. Error given: new passwords don't match", ctx)
ctx.Redirect("/settings", 302)
return ""
}
if !chklogin(hcuser.System_username, password) {
set_error("Failed to update settings. Error given: current password incorrect", ctx)
ctx.Redirect("/settings", 302)
return ""
}
chpassword(hcuser.System_username, new_password)
set_error("Settings updated successfully.", ctx)
ctx.Redirect("/settings", 302)
return ""
}
func SqlUsersEdit(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "databases")
if !auth {
return "not_authorized"
}
username := util.Query(ctx, "db_user")
password := util.Query(ctx, "password")
owner := strings.Split(username, "_")[0]
if username == "" {
return "db_user_required"
}
if password == "" {
return "password_required"
}
if owner != hcuser.System_username {
return "failed_not_yours"
}
db, _ := util.MySQL()
defer db.Close()
db_user := util.LastResortSanitize(username)
password = util.LastResortSanitize(password)
_, err := db.Exec("SET PASSWORD FOR '" + db_user + "' = PASSWORD('" + password + "');")
if err != nil {
return "bad_characters_used "
}
return "success"
}
func maildeletedomain(ctx *macaron.Context) string {
status := API("/api/mail/domain/delete", ctx)
domainname := util.Query(ctx, "domain")
if status == "success" {
set_error("Deleted "+domainname+" successfully!", ctx)
ctx.Redirect("/mail", 302)
return "did it!"
}
set_error("Failed to delete domain. Error given: "+status, ctx)
ctx.Redirect("/mail", 302)
return "Failed to delete domain. Error given: " + status
}
func mailedituser(ctx *macaron.Context) string {
status := API("/api/mail/users/edit", ctx)
email := util.Query(ctx, "email")
if status == "success" {
set_error("Updated "+email+" successfully!", ctx)
ctx.Redirect("/mail", 302)
return "did it!"
}
set_error("Failed to update "+email+". Error given: "+status, ctx)
ctx.Redirect("/mail", 302)
return "Failed to update user. Error given: " + status
}
func databaseusersedit(ctx *macaron.Context) string {
status := API("/api/sql/users/edit", ctx)
db_user := util.Query(ctx, "db_user")
if status == "success" {
set_error("Modified "+db_user+" successfully!", ctx)
ctx.Redirect("/databases", 302)
return "Modified " + db_user + " successfully!"
}
set_error("Failed to update "+db_user+"! Error given: "+status, ctx)
ctx.Redirect("/databases", 302)
return "Failed to update " + db_user + "! Error given: " + status
}
func adddomain(ctx *macaron.Context) string {
status := API("/api/dns/domain/add", ctx)
domainname := util.Query(ctx, "domain")
if status == "success" {
set_error("Added "+domainname+" successfully!", ctx)
ctx.Redirect("/dns", 302)
return "did it!"
}
set_error("Failed to add domain. Error given: "+status, ctx)
ctx.Redirect("/websites", 302)
return "Failed to add domain. Error given: " + status
}
func sslupdate(ctx *macaron.Context) string {
status := API("/api/web/domain/sslmanage", ctx)
vhost_id := util.Query(ctx, "vhost_id")
if status == "success" {
set_error("Updated SSL settings successfully!", ctx)
ctx.Redirect("/websites/sslmanager?vhost_id="+vhost_id, 302)
return "did it!"
}
set_error("Failed to add domain. Error given: "+status, ctx)
ctx.Redirect("/websites/sslmanager?vhost_id="+vhost_id, 302)
return "Failed to update SSL for domain. Error given: " + status
}
func databasedelete(ctx *macaron.Context) string {
status := API("/api/sql/databases/delete", ctx)
db_name := util.Query(ctx, "db_name")
if status == "success" {
set_error("Deleted "+db_name+" successfully!", ctx)
ctx.Redirect("/databases", 302)
return "Deleted " + db_name + " successfully!"
}
set_error("Failed to delete "+db_name+"! Error given: "+status, ctx)
ctx.Redirect("/databases", 302)
return "Failed to delete " + db_name + "! Error given: " + status
}
func ftpuserdelete(ctx *macaron.Context) string {
status := API("/api/ftpusers/delete", ctx)
username := util.Query(ctx, "ftpuser")
if status == "success" {
set_error("Deleted "+username+" successfully!", ctx)
ctx.Redirect("/ftpusers", 302)
return "did it!"
}
set_error("Failed to delete user. Error given: "+status, ctx)
ctx.Redirect("/ftpusers", 302)
return "Failed to add user. Error given: " + status
}
func sslmanager(ctx *macaron.Context) string {
_, auth := util.Auth(ctx, "websites")
if !auth {
ctx.Redirect("/", 302)
return ""
}
vhost_id := util.Query(ctx, "vhost_id")
var tpl vision.New
tpl.TemplateFile("template/websites.sslmanager.tpl")
websites := API("/api/web/domain/list", ctx)
domains := make(map[string]map[string]string)
json.Unmarshal([]byte(websites), &domains)
found := false
for _, domain := range domains {
if domain["vhost_id"] == vhost_id {
tpl.Assign("vhost_id", domain["vhost_id"])
tpl.Assign("system_username", domain["system_username"])
tpl.Assign("domain", domain["domain"])
tpl.Assign("documentroot", domain["documentroot"])
tpl.Assign("ipaddr", domain["ipaddr"])
tpl.Assign("ssl_certificate", domain["ssl_certificate"])
tpl.Assign("ssl_key", domain["ssl_key"])
tpl.Assign("ssl_ca_certificate", domain["ssl_ca_certificate"])
if domain["ssl_enabled"] == "Y" {
tpl.Assign("ssl_enabled", "checked")
} else {
tpl.Assign("ssl_enabled", "")
}
found = true
}
}
if !found {
set_error("Failed to find requested domain.", ctx)
ctx.Redirect("/websites", 302)
return ""
}
tpl.Parse("sslmanager")
return header(ctx) + tpl.Out() + footer(ctx)
}
// This will return RHEL7 for the server API test. Note that all functions need to be prefixed with DISTRO TAG.
func SqlGrantsList(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "databases")
if !auth {
return "not_authorized"
}
db_name := util.Query(ctx, "db_name")
if db_name == "" {
return "db_name_required"
}
owner := strings.Split(db_name, "_")[0]
if owner != hcuser.System_username {
return "failed_not_yours"
}
db, _ := util.MySQL()
defer db.Close()
stmt, _ := db.Prepare("select user from mysql.db where db=?")
rows, err := stmt.Query(db_name)
if err != nil {
return "bad_characters_used "
}
stmt.Close()
var data []string
for rows.Next() {
var db_user string
rows.Scan(&db_user)
data = append(data, db_user)
}
output, err := json.Marshal(data)
if err != nil {
return "json_out_failed: " + string(err.Error())
}
return string(output)
}
func deletetoken(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "any")
if !auth {
ctx.Redirect("/", 302)
return ""
}
token := util.Query(ctx, "token")
db, _ := util.MySQL()
defer db.Close()
ustmt, _ := db.Prepare("DELETE FROM `hostcontrol`.`hostcontrol_user_tokens` WHERE `token`=? and hostcontrol_id=?")
ustmt.Exec(token, hcuser.Hostcontrol_id)
ustmt.Close()
set_error("Token deleted.", ctx)
ctx.Redirect("/settings", 302)
return ""
}
func sudo(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "sysusers")
if !auth {
ctx.Redirect("/", 302)
return ""
}
username := util.Query(ctx, "username")
if !util.ChkPaternity(hcuser.System_username, username) {
set_error("Failed to sudo to "+username+"!", ctx)
ctx.Redirect("/users", 302)
return "failed!"
}
ctx.SetCookie("sudo", username, 864000)
set_error("You are now logged in as "+username+"! Clicking logout will switch back to "+hcuser.System_username+".", ctx)
ctx.Redirect("/dashboard", 302)
return "success"
}
func MailUserDelete(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "mail")
if !auth {
return "not_authorized"
}
email_address := util.Query(ctx, "email")
if email_address == "" {
return "email_required"
}
strsplt := strings.Split(email_address, "@")
if len(strsplt) != 2 {
return "invalid_email"
}
username := strsplt[0]
domain := strsplt[1]
db, _ := util.MySQL()
defer db.Close()
// check if user owns domain
dstmt, _ := db.Prepare("SELECT * FROM `hostcontrol`.`mail_domains` WHERE `domain`=? and `system_username`=?")
row1, _ := dstmt.Query(domain, hcuser.System_username)
defer dstmt.Close()
if !row1.Next() {
return "domain_not_found"
}
os.RemoveAll("/home/vmail/" + domain + "/" + username)
// update serial for domain
ustmt, _ := db.Prepare("DELETE FROM `hostcontrol`.`mail_users` WHERE `email`=?")
ustmt.Exec(email_address)
ustmt.Close()
return "success"
}
func DnsAddDomain(ctx *macaron.Context) string {
hcuser, auth := util.Auth(ctx, "dns")
if !auth {
return "not_authorized"
}
timestamp := strconv.FormatInt(time.Now().Unix(), 10)
domain := util.Query(ctx, "domain")
if domain == "" {
return "domain_required"
}
db, err := util.MySQL()
defer db.Close()
xstmt, _ := db.Prepare("INSERT INTO `hostcontrol`.`domains` set `id`=NULL, `name`=?, `master`=NULL, `last_check`=NULL, `type`='NATIVE', `notified_serial`=?, `account`=?")
res, err := xstmt.Exec(domain, timestamp, hcuser.System_username)
xstmt.Close()
if err != nil {
return "failed_to_create_domain"
}
inserted_id, err := res.LastInsertId()
if err != nil {
return "failed_to_create_domain"
}
ystmt, _ := db.Prepare("INSERT INTO `hostcontrol`.`records` set `id`=NULL, `domain_id`=?, `name`=?, `type`='SOA', `content`=?, `ttl`='86400', `prio`='0', `change_date`=?, `disabled`='0', `ordername`='0', `auth`='1'")
_, yerr := ystmt.Exec(inserted_id, domain, "localhost webmaster@localhost 1", timestamp)
ystmt.Close()
if yerr != nil {
return "failed_to_create_soa"
}
return "success"
}