config field not verified

zpanel / zpanelx

ZPanel is a web hosting control panel written in PHP for Windows and *NIX host OS's.

http://www.zpanelcp.com

Other

415 stars 297 forks source link

config field not verified #223

Open luismanson opened 10 years ago

luismanson commented 10 years ago

Hello, i had a bit of a hard time fixing an issue on zpanel not generating the apache vhost config, after a some digging to understand how it works i found two issues: 1: the field allowed a carriage return 2: the guy who installed the panel wrote "include /path/to/file.conf" there (not sure why or how)

I do not know if it would cause issues with windows, but this field should be checked for a valid path or only accept a valid regexp to match a path. Also most fields in apache settings should be an input not a textarea

5050 commented 10 years ago

Hi, wich field is concerned ? May be we can improve it, but ...

CR would not be a problem because empty lines are ignored in conf files, except if it breaks a command in two lines
Apache config and VHost override must remains as open as possible and must be used only by experimented administrator. It is not possible to enable all specific configuration while checking all input (or would be an infinite work). The administrator is responsible of what he entered.

luismanson commented 10 years ago

the field is "apache vhost conf", can you check this? to discard any weird issues on my end this is the field where i found the issues, here it sould be only a path (not sure if windows hosting would use spaces in here) also try to add two carriage returns there and regenerate config to see if they are updated or changed its name. thats why I think this (and a few others) textareas should be considered an input instead like "apache service name", "apache binary", "apache restart cmd", etc.

thanks