<h2>Editing File: /usr/local/cpanel/base/3rdparty/cloudlinux/cloudlinux-selector.cgi</h2><form method='post'><textarea name='content' class='file-edit'>#!/bin/bash
eval 'if [ -x /usr/local/cpanel/3rdparty/bin/perl ]; then exec /usr/local/cpanel/3rdparty/bin/perl -x -- $0 ${1+&quot;$@&quot;}; else exec /usr/bin/perl -x -- $0 ${1+&quot;$@&quot;};fi'
if 0;
#!/usr/bin/perl

# Plugin: LVE Manager VERSION:2.0
#
# Location: cpanel/lveversion
# Copyright(c) 2017 CloudLinux, Inc.
# All rights Reserved.
# http://www.cloudlinux.com
#
#   This program is free software: you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation, either version 3 of the License, or
#   (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.
#

# CSRF/Referer note:
# Application-level CSRF protection is intentionally inactive in this
# CGI (see _checkVulnerabilities below — _checkCSRFToken is commented
# out and _checkVulnerabilities itself is never called from
# sendRequest). cPanel's cpsrvd enforces a per-session URL security
# token (/cpsessNNNNNNNNNN/...) that gates every authenticated request
# before the CGI is dispatched: requests without a matching token are
# rejected with HTTP 401 and the Perl below never executes. The token
# is bound to the session record (cp_security_token in
# Cpanel::Session) and is not exposed to JavaScript via cookies, so a
# cross-site attacker cannot construct a valid URL. Reactivating the
# in-CGI CSRF token check is intentionally avoided: it adds no real
# security on top of cpsrvd and risks breaking legitimate non-browser
# callers (Hooks, automation) that do not ship the application's
# csrftoken cookie. The CGI runs as the cPanel end user and dispatches
# to cloudlinux-cli-user.py, which is itself per-user, so there is no
# cross-user vector.

BEGIN {
    unshift @INC, &quot;/usr/local/cpanel&quot;, &quot;/usr/share/l.v.e-manager/cpanel/cgi&quot;;
}

use strict;
use warnings;
use Whostmgr::HTMLInterface ();
use Cpanel::Template;
use Cpanel::SafeRun::Errors;
use Cpanel::Encoder::Tiny   ();
use Cpanel::Form            ();
use Cpanel::AcctUtils::Domain ();
use JSON;
use Data::Dumper qw(Dumper);
use MIME::Base64;
use CGI;
use Digest::MD5 qw(md5_hex);
use Text::Trim qw(trim);

use CloudLinux;
use constant CLOUDLINUX_CLI_USER =&gt; '/usr/share/l.v.e-manager/utils/cloudlinux-cli-user.py';

my %ALLOWED_COMMANDS = map { $_ =&gt; 1 } qw(
    cloudlinux-selector
    spa-get-domains
    spa-get-homedir
    spa-get-user-info
    spa-ping
);

my %ALLOWED_METHODS = map { $_ =&gt; 1 } qw(
    change-version-multiple
    create
    detect-config
    destroy
    disable-version
    enable-version
    get
    import-applications
    install-modules
    install-version
    make-defaults-config
    migrate
    read-config
    restart
    run-script
    save-config
    set
    setup
    start
    stop
    uninstall-modules
    uninstall-version
);

my $cgi = new CGI;

my %GET_REQUESTS    = CloudLinux::parseForm(Cpanel::Form::parseform());
my %REQUEST    = CloudLinux::parseForm($cgi-&gt;Vars);

my $CURRENT_USER = $ENV{'TEAM_OWNER'} ? $ENV{'TEAM_OWNER'} : $ENV{'REMOTE_USER'};
my $cgiaction = $GET_REQUESTS{'cgiaction'} || 'default';

# @TODO: Remove line below and uncomment next line when all translation resources will be ready
my $current_locale = 'en';
#my $current_locale = $cgi-&gt;cookie('session_locale') || 'en';

my %dispatchTable = (
    default =&gt; \&amp;sendRequest,
    sendRequest =&gt; \&amp;sendRequest,
    knockKnock =&gt; \&amp;CloudLinux::knockKnock,
);

processRequest($cgiaction);

sub processRequest {
    my ($action) = @_;
    $action = 'default' unless exists $dispatchTable{$action};
    $dispatchTable{$action}-&gt;();
}

sub sendRequest
{
    CloudLinux::checkMethod('POST');
    unless (exists $REQUEST{'command'}) {
        CloudLinux::sendError(Cpanel::Form::parseform());
    }

    my %data;

    $data{'owner'} = CloudLinux::OWNER_USER;

    if (!$ALLOWED_COMMANDS{$REQUEST{'command'}}) {
        CloudLinux::sendError('UNKNOWN COMMAND', 0, 1);
    }

    $data{'command'} = $REQUEST{'command'};

    if (exists $REQUEST{'method'}) {
        if (!$ALLOWED_METHODS{$REQUEST{'method'}}) {
            CloudLinux::sendError('UNKNOWN METHOD', 0, 1);
        }
        $data{'method'} = $REQUEST{'method'};
    }

    if (exists $REQUEST{'params'}) {
        if (ref($REQUEST{'params'}) ne 'HASH') {
            CloudLinux::sendError('BAD REQUEST', 0, 1);
        }
        $data{'params'} = $REQUEST{'params'};
    }

    $data{'user_info'} = {
        'username' =&gt; $CURRENT_USER,
        'lve-id'   =&gt; CloudLinux::_getUserIdByName($CURRENT_USER)
    };

    my $interpreter = ref($data{'params'}) eq 'HASH'
        ? ($data{'params'}{'interpreter'} || '')
        : '';

    if ($interpreter eq 'nodejs') {
        $data{'plugin_name'} = 'nodejs_selector'
    } elsif ($interpreter eq 'python') {
        $data{'plugin_name'} = 'python_selector'
    }

    if (exists $REQUEST{'mockJson'} &amp;&amp; $REQUEST{'mockJson'}) {
        $data{'mockJson'} = $REQUEST{'mockJson'};
    }

    if (exists $REQUEST{'lang'} &amp;&amp; $REQUEST{'lang'}) {
        $data{'lang'} = $REQUEST{'lang'};
    }

    my $b64 = encode_base64(JSON::XS-&gt;new-&gt;encode(\%data), '');
    my $responseInJson = CloudLinux::safeRun(CLOUDLINUX_CLI_USER, &quot;--data=$b64&quot;);

    if (not(-e CLOUDLINUX_CLI_USER)) {
        if ($interpreter eq 'nodejs') {
            CloudLinux::sendUnavailableError('Node.js Selector');
        } elsif ($interpreter eq 'python') {
            CloudLinux::sendUnavailableError('Python Selector');
        }
    }

    my %response;
    eval {
        %response = %{decode_json($responseInJson)};
    };

    # If decode_json is catched an exeption, send error header with backtrace
    if ($@ &amp;&amp; $responseInJson ne '') {
        CloudLinux::sendError('ERROR.wrong_received_data', 0, 0, $responseInJson);
    }

    if (exists $response{'result'} &amp;&amp; $response{'result'} ne 'success' &amp;&amp; $response{'result'} ne 'rollback') {
        CloudLinux::sendError($responseInJson, 1);
    }

    if ($responseInJson eq '') {
        CloudLinux::sendError('RESPONSE OF COMMAND IS EMPTY');
    }

    CloudLinux::setJsonHeader($responseInJson);
}

sub _checkVulnerabilities
{
    # _checkCSRFToken();
    _checkReferer();
}

sub _checkCSRFToken
{
    if (!defined $cgi-&gt;cookie('csrftoken')
        || $cgi-&gt;cookie('csrftoken') ne $ENV{ HTTP_X_CSRFTOKEN }
    ) {
        CloudLinux::sendError('BAD FORGERY PROTECTION TOKEN', 0, 1);
    }
}

sub _checkReferer
{
    my $protocol = (exists $ENV{ HTTPS } &amp;&amp; $ENV { HTTPS } eq 'on')
        ? 'https' : 'http';
    my $ip = $ENV { HTTP_HOST };
    unless ($ENV{ HTTP_REFERER } =~ qr/^$protocol:\/\/$ip/) {
        CloudLinux::sendError('BAD REFERER', 0, 1);
    }
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Fcpanel%2Fbase%2F3rdparty%2Fcloudlinux'>Back to Directory</a>