1: | <?php declare(strict_types=1); |
2: | |
3: | |
4: | |
5: | |
6: | |
7: | |
8: | |
9: | |
10: | |
11: | |
12: | |
13: | |
14: | use Module\Support\Auth; |
15: | use Opcenter\Filesystem\Quota; |
16: | use Opcenter\Filesystem\Quota\Project; |
17: | use Opcenter\Map; |
18: | use Opcenter\Process; |
19: | use Opcenter\Service\Validators\Billing\ParentInvoice; |
20: | |
21: | |
22: | |
23: | |
24: | |
25: | |
26: | |
27: | class Site_Module extends Auth |
28: | implements Module\Skeleton\Contracts\Hookable |
29: | { |
30: | use ImpersonableTrait; |
31: | |
32: | |
33: | const AMNESTY_MULTIPLIER = Diskquota_Module::AMNESTY_MULTIPLIER; |
34: | |
35: | const DEPENDENCY_MAP = []; |
36: | |
37: | |
38: | protected $exportedFunctions = [ |
39: | '*' => PRIVILEGE_SITE, |
40: | 'get_admin_email' => PRIVILEGE_SITE | PRIVILEGE_USER, |
41: | 'ip_address' => PRIVILEGE_SITE | PRIVILEGE_USER, |
42: | 'split_hostname' => PRIVILEGE_SITE | PRIVILEGE_USER, |
43: | 'bless' => PRIVILEGE_ADMIN | PRIVILEGE_RESELLER |
44: | ]; |
45: | |
46: | |
47: | |
48: | |
49: | |
50: | |
51: | |
52: | |
53: | public function user_service_enabled(string $user, string $service): bool |
54: | { |
55: | $svc_cache = $this->user_svc_cache; |
56: | $svc_file = $this->domain_fs_path() . '/etc/' . $service . '.pamlist'; |
57: | $site = $this->site_id; |
58: | |
59: | if (!file_exists($svc_file)) { |
60: | return error("Invalid service name `%s'", $service); |
61: | } |
62: | |
63: | |
64: | if (!isset($svc_cache[$site]) || |
65: | filemtime($svc_file) > $svc_cache[$site]['mtime'] |
66: | ) { |
67: | $fp = fopen($svc_file, 'r'); |
68: | $contents = fread($fp, filesize($svc_file)); |
69: | foreach (explode("\n", $contents) as $line) { |
70: | $svc_cache[$site]['users'][trim($line)][$service] = 1; |
71: | } |
72: | |
73: | fclose($fp); |
74: | $svc_cache[$site]['mtime'] = filemtime($svc_file); |
75: | } |
76: | |
77: | return isset($svc_cache[$site]['users'][$user][$service]); |
78: | |
79: | } |
80: | |
81: | |
82: | |
83: | |
84: | |
85: | |
86: | |
87: | |
88: | public function get_bandwidth_usage(int $type = null) |
89: | { |
90: | deprecated_func('Use bandwidth_usage()'); |
91: | |
92: | return $this->bandwidth_usage($type); |
93: | } |
94: | |
95: | |
96: | |
97: | |
98: | |
99: | |
100: | public function get_bandwidth_rollover(): int |
101: | { |
102: | deprecated_func('Use bandwidth_rollover'); |
103: | |
104: | return $this->bandwidth_rollover(); |
105: | } |
106: | |
107: | |
108: | |
109: | |
110: | |
111: | |
112: | |
113: | |
114: | |
115: | |
116: | |
117: | public function set_admin_email(string $email): bool |
118: | { |
119: | if ($this->auth_is_demo()) { |
120: | return error("Email may not be changed in demo mode"); |
121: | } |
122: | |
123: | if (!preg_match(Regex::EMAIL, $email)) { |
124: | return error('Invalid e-mail address, ' . $email); |
125: | } |
126: | $oldemail = $this->getConfig('siteinfo', 'email'); |
127: | $pgdb = \PostgreSQL::initialize(); |
128: | $pgdb->query("UPDATE siteinfo SET email = '" . $email . "' WHERE site_id = '" . $this->site_id . "';"); |
129: | |
130: | $this->setConfig('siteinfo', 'email', $email); |
131: | |
132: | $ret = $pgdb->affected_rows() > 0; |
133: | if (!$ret) { |
134: | return false; |
135: | } |
136: | parent::sendNotice('email', [ |
137: | 'email' => $oldemail, |
138: | 'ip' => \Auth::client_ip() |
139: | ]); |
140: | |
141: | return true; |
142: | } |
143: | |
144: | |
145: | |
146: | |
147: | |
148: | |
149: | |
150: | public function kill_user(string $user): bool |
151: | { |
152: | if (!IS_CLI) { |
153: | return $this->query('site_kill_user', $user); |
154: | } |
155: | |
156: | if (!($uid = $this->user_get_uid_from_username($user))) { |
157: | return error("Failed to lookup user `%s'", $user); |
158: | } |
159: | |
160: | if ($uid < \User_Module::MIN_UID) { |
161: | return error("User `%s' is system user", $user); |
162: | } |
163: | |
164: | foreach (Process::matchUser($uid) as $pid) { |
165: | Process::killAs($pid, SIGKILL, $uid); |
166: | } |
167: | |
168: | return true; |
169: | } |
170: | |
171: | |
172: | |
173: | |
174: | |
175: | |
176: | public function get_admin_email(): string |
177: | { |
178: | return $this->getConfig('siteinfo', 'email'); |
179: | } |
180: | |
181: | |
182: | |
183: | |
184: | |
185: | |
186: | |
187: | |
188: | |
189: | |
190: | |
191: | public function ip_address(): string |
192: | { |
193: | $addr = $this->common_get_ip_address() ?: $this->common_get_ip6_address(); |
194: | |
195: | return is_array($addr) ? array_pop($addr) : $addr; |
196: | } |
197: | |
198: | |
199: | |
200: | |
201: | |
202: | |
203: | |
204: | |
205: | |
206: | |
207: | |
208: | |
209: | |
210: | |
211: | |
212: | |
213: | public function get_account_quota(): array |
214: | { |
215: | if (!IS_CLI) { |
216: | return $this->query('site_get_account_quota'); |
217: | } |
218: | |
219: | $project = $this->getServiceValue('diskquota', 'group'); |
220: | $quota = (array)Quota::getGroup($this->group_id); |
221: | if ($project) { |
222: | $project = (new Project($project))->get(); |
223: | $qhard = min(max($project['qhard']-($project['qused']+$quota['qhard']), $project['qhard']), $project['qhard']); |
224: | $fhard = min(max($project['fhard']-($project['fused']+$quota['fhard']), $project['fhard']), $project['fhard']); |
225: | $quota['qhard'] = $qhard ?: $quota['qhard']; |
226: | $quota['fhard'] = $fhard ?: $quota['fhard']; |
227: | } |
228: | |
229: | return $quota + ['dynamic' => (bool)$project]; |
230: | } |
231: | |
232: | |
233: | |
234: | |
235: | |
236: | |
237: | |
238: | public function get_port_range(): array |
239: | { |
240: | deprecated_func('Use ssh_port_range()'); |
241: | return $this->ssh_port_range(); |
242: | } |
243: | |
244: | public function bless(string $site, string $admin, array $newcfg): bool |
245: | { |
246: | |
247: | } |
248: | |
249: | |
250: | |
251: | |
252: | |
253: | |
254: | |
255: | public function wipe(string $token = ''): bool|string |
256: | { |
257: | $token = strtolower((string)$token); |
258: | $calctoken = $this->_calculateToken(); |
259: | if (!$token) { |
260: | |
261: | if (!defined('AJAX') || !AJAX) { |
262: | $msg = 'This is the most nuclear of options. ' . |
263: | "Respond with the following token `%s' to confirm"; |
264: | |
265: | warn($msg, $calctoken); |
266: | } |
267: | |
268: | return $calctoken; |
269: | } |
270: | |
271: | if ($token !== $calctoken) { |
272: | $msg = "provided token `%s' does not match confirmation token `%s'"; |
273: | |
274: | return error($msg, $token, $calctoken); |
275: | } |
276: | |
277: | if (!IS_CLI) { |
278: | return $this->query('site_wipe', $token); |
279: | } |
280: | if (!Crm_Module::COPY_ADMIN) { |
281: | return error('Admin reminder address not setup - disallowing account reset'); |
282: | } |
283: | $editor = new Util_Account_Editor($this->getAuthContext()->getAccount()); |
284: | |
285: | $editor->importConfig(); |
286: | $afi = $this->getApnscpFunctionInterceptor(); |
287: | $modules = $afi->list_all_modules(); |
288: | foreach ($modules as $m) { |
289: | $c = $afi->get_class_from_module($m); |
290: | $class = $c::instantiateContexted($this->getAuthContext()); |
291: | $class->_reset($editor); |
292: | } |
293: | $addcmd = $editor->setMode('add')->getCommand(); |
294: | |
295: | |
296: | Mail::send(Crm_Module::COPY_ADMIN, 'Account Wipe', $addcmd); |
297: | $delproc = new Util_Account_Editor($this->getAuthContext()->getAccount()); |
298: | if (!$delproc->delete()) { |
299: | return false; |
300: | } |
301: | $proc = new Util_Process_Schedule('now'); |
302: | $ret = $proc->run($addcmd); |
303: | |
304: | return $ret['success']; |
305: | } |
306: | |
307: | |
308: | |
309: | |
310: | |
311: | |
312: | private function _calculateToken(): string |
313: | { |
314: | |
315: | $inode = fileinode($this->domain_info_path()); |
316: | $hash = hash('crc32', (string)$inode); |
317: | |
318: | return $hash; |
319: | } |
320: | |
321: | |
322: | |
323: | |
324: | |
325: | |
326: | |
327: | public function storage_amnesty(): bool |
328: | { |
329: | return $this->diskquota_amnesty(); |
330: | } |
331: | |
332: | |
333: | |
334: | |
335: | |
336: | |
337: | public function amnesty_active(): bool |
338: | { |
339: | return $this->diskquota_amnesty_active(); |
340: | } |
341: | |
342: | |
343: | |
344: | |
345: | |
346: | |
347: | |
348: | public function hijack(string $user): string |
349: | { |
350: | if ($this->user_exists($user)) { |
351: | if ($user === $this->username) { |
352: | return $this->session_id; |
353: | } |
354: | |
355: | return $this->impersonateRole($this->site, $user); |
356: | } |
357: | |
358: | if (AUTH_SUBORDINATE_SITE_SSO && ($invoice = $this->getServiceValue('billing', 'invoice')) |
359: | && ($siteid = \Auth::get_site_id_from_anything($user))) |
360: | { |
361: | |
362: | |
363: | $site = "site{$siteid}"; |
364: | $parent = Map::load(ParentInvoice::MAP_FILE, 'r-')->fetch($site); |
365: | if ($parent === $this->site) { |
366: | return $this->impersonateRole($site); |
367: | } |
368: | } |
369: | |
370: | error("unknown user `%s'", $user); |
371: | |
372: | return $this->session_id; |
373: | } |
374: | |
375: | public function _create() |
376: | { |
377: | return; |
378: | } |
379: | |
380: | public function _delete() |
381: | { |
382: | return; |
383: | } |
384: | |
385: | public function _edit() |
386: | { |
387: | return; |
388: | } |
389: | |
390: | |
391: | |
392: | |
393: | |
394: | |
395: | |
396: | public function _verify_conf(\Opcenter\Service\ConfigurationContext $ctx): bool |
397: | { |
398: | return true; |
399: | } |
400: | |
401: | public function _edit_user(string $userold, string $usernew, array $oldpwd) |
402: | { |
403: | if ($usernew === $userold) { |
404: | return; |
405: | } |
406: | } |
407: | |
408: | public function _create_user(string $user) |
409: | { |
410: | } |
411: | |
412: | public function _delete_user(string $user) |
413: | { |
414: | } |
415: | |
416: | |
417: | } |
418: | |