Viewing File: /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/lib/panels/da/user/index.html

<?php 

if($_SERVER['REQUEST_METHOD'] != 'GET' && $_SERVER['REQUEST_METHOD'] != 'POST'){
	echo "HTTP/1.1 405 Method Not Allowed\n";
	echo "Content-Type: text/html\n";
	echo "\n";
	echo "<h1>405 Method Not Allowed</h1>";
	exit(0);
}

if(!empty($_SERVER['QUERY_STRING'])){
	parse_str($_SERVER['QUERY_STRING'], $_GET);

	foreach($_GET as $k => $v){
		$_REQUEST[$k] = $v;
	}
}

if(!empty($_SERVER['POST'])){
	parse_str($_SERVER['POST'], $_POST);

	foreach($_POST as $k => $v){
		$_REQUEST[$k] = $v;
	}
}

echo "HTTP/1.1 200 OK\n";
echo "Content-Type: text/html\n";
if((@$_GET['act'] == 'backups' || @$_GET['act'] == 'templates') && !empty($_GET['download']) && substr_count($_GET['download'], './') == 0){
	echo 'Content-Disposition: attachment; filename="'.$_GET['download'].'"'."\n";
}
echo "\n";

define('SOFTACULOUS', 1);
include_once(dirname(dirname(__FILE__)).'/enduser/universal.php');

if(file_exists($globals['path'].'/conf/universal.json') && is_readable($globals['path'].'/conf/universal.json') && (filesize($globals['path'].'/conf/universal.json') > 0)){
	
	$secure_file = @file_get_contents($globals['path'].'/conf/universal.json');
	
	if(empty($secure_file)){
		die('Failed to load universal.json');
	}
	
	$secure_val = json_decode($secure_file, true);
	if(is_array($secure_val)){
		$globals = array_merge($globals, $secure_val);
	}
}

$orig_gid = (int) getenv('soft_egid');
$orig_uid = (int) getenv('soft_euid');

$env_userdata = posix_getpwnam($_SERVER['USERNAME']);

if(empty($env_userdata) || $env_userdata['uid'] !== $orig_uid || $env_userdata['gid'] !== $orig_gid){
	die('Unauthorised web access : Incorrect username');
}

// These commands need to be executed as root
$da_version = @shell_exec('/usr/local/directadmin/directadmin v');

// Sometimes the document root API fails so we are taking the domains list from CLI
//$tmp_document_root = @shell_exec("/usr/local/directadmin/directadmin --DocumentRoot");

if(!empty($tmp_document_root)){

	$tmp_document_root = json_decode($tmp_document_root, true);

	if(!empty($tmp_document_root['users'][$env_userdata['name']])){
		$da_dom_data['users'][$env_userdata['name']] = $tmp_document_root['users'][$env_userdata['name']];
	}
	
	// Not needed anymore
	unset($tmp_document_root);
}

// Is the user uploading a file ? We need to chown it
if(!empty($_REQUEST['act']) && $_REQUEST['act'] == 'wordpress' && !empty($_REQUEST['upload']) && !empty($_POST['custom_file'])){

	$custom_file = da_optPOST('custom_file');
	$r_custom_file = preg_replace('#/home/tmp/#', '', $custom_file);
	
	// Security check
	if(substr_count($r_custom_file, '/') == 0 && !is_link($custom_file)){
		chown('/home/tmp/'.$r_custom_file, $orig_uid);
		chgrp('/home/tmp/'.$r_custom_file, $orig_gid);
	}
}

// We don't have functions.php yet
function da_optPOST($name, $default = ''){

global $error;

	//Check the POSTED NAME was posted
	if(isset($_POST[$name])){
	
		return da_inputsec(da_htmlizer(trim($_POST[$name])));
		
	}else{
		
		return $default;
	
	}

}

function da_inputsec($string){
	
	//get_magic_quotes_gpc is depricated in php 7.4
	if(version_compare(PHP_VERSION, '7.4', '<')){
		if(!get_magic_quotes_gpc()){
		
			$string = addslashes($string);
		
		}else{
		
			$string = stripslashes($string);
			$string = addslashes($string);
		
		}
	}else{
		$string = addslashes($string);
	}
	
	// This is to replace ` which can cause the command to be executed in exec()
	$string = str_replace('`', '\`', $string);
	
	return $string;

}

function da_htmlizer($string){

global $globals;

	$string = htmlentities($string, ENT_QUOTES, $globals['charset']);
	
	preg_match_all('/(&amp;#(\d{1,7}|x[0-9a-fA-F]{1,6});)/', $string, $matches);//r_print($matches);
	
	foreach($matches[1] as $mk => $mv){		
		$tmp_m = da_entity_check($matches[2][$mk]);
		$string = str_replace($matches[1][$mk], $tmp_m, $string);
	}
	
	return $string;
	
}

function da_entity_check($string){
	
	//Convert Hexadecimal to Decimal
	$num = ((substr($string, 0, 1) === 'x') ? hexdec(substr($string, 1)) : (int) $string);
	
	//Squares and Spaces - return nothing 
	$string = (($num > 0x10FFFF || ($num >= 0xD800 && $num <= 0xDFFF) || $num < 0x20) ? '' : '&#'.$num.';');
	
	return $string;
			
}

posix_setgid($orig_gid);
posix_setuid($orig_uid);
putenv('soft_egid');
putenv('soft_euid');

// Still Root ?		
if(posix_getuid() == 0 || posix_geteuid() == 0){
	echo 'ERROR IN SHIFTING TO USER LEVEL';exit(1);
}

include(dirname(dirname(__FILE__)).'/enduser/inc.php');