inc/common.php

   1 <?php
   2 if (version_compare(PHP_VERSION, '8.0.0', '<'))
   3         die("This webserver is using PHP version ".PHP_VERSION." but we require at least PHP 8.0.0.<br>".
   4             "If you already installed PHP8 but are still seeing this error, then it means ".
   5             "apache/nginx/.. is loading an older PHP version. Eg. on Debian/Ubuntu you need ".
   6             "<code>apt-get install libapache2-mod-php8.2</code> (or a similar version) and ".
   7             "<code>apt-get remove libapache2-mod-php7.4</code> (or a similar version). ".
   8             "You may also need to choose again the PHP module to load in apache via <code>a2enmod php8.2</code>");
   9
  10 define('UPATH', dirname(__DIR__));
  11
  12 function get_config($setting)
  13 {
  14         GLOBAL $config;
  15
  16         $item = $config;
  17         foreach(explode("::", $setting) as $x)
  18         {
  19                 if (isset($item[$x]))
  20                         $item = $item[$x];
  21                 else
  22                         return NULL;
  23         }
  24         return $item;
  25 }
  26
  27 function page_requires_no_config()
  28 {
  29         if (str_ends_with($_SERVER['SCRIPT_FILENAME'],"install.php") ||
  30             str_ends_with($_SERVER['SCRIPT_FILENAME'],"installation.php"))
  31         {
  32                 return TRUE;
  33         }
  34         return FALSE;
  35 }
  36
  37 function page_requires_no_login()
  38 {
  39         if (str_ends_with($_SERVER['SCRIPT_FILENAME'],"login/index.php") ||
  40             page_requires_no_config())
  41         {
  42                 return TRUE;
  43         }
  44         return FALSE;
  45 }
  46
  47 function read_config_file()
  48 {
  49         GLOBAL $config;
  50         GLOBAL $config_transition_unreal_server;
  51
  52         $config = Array();
  53         if (!file_exists(UPATH."/config/config.php") && file_exists(UPATH."/config.php"))
  54         {
  55                 require_once UPATH . "/config.php";
  56                 require_once UPATH . "/config/compat.php";
  57         }
  58         if ((@include(UPATH . "/config/config.php")) !== 1)
  59                 return false;
  60         if (isset($config['unrealircd']))
  61                 $config_transition_unreal_server = true;
  62         /* Upgrade needed? */
  63         $plugins_modified = false;
  64         foreach ($config["plugins"] as $k=>$v)
  65         {
  66                 if ($v == "sql_auth")
  67                 {
  68                         $config["plugins"][$k] = "sql_db";
  69                         $plugins_modified = true;
  70                 } else
  71                 if ($v == "file_auth")
  72                 {
  73                         $config["plugins"][$k] = "file_db";
  74                         $plugins_modified = true;
  75                 }
  76         }
  77         if ($plugins_modified)
  78                 write_config_file();
  79
  80         return true;
  81 }
  82
  83 function read_config_db()
  84 {
  85         GLOBAL $config;
  86
  87         if (page_requires_no_config())
  88                 return;
  89
  90         $merge = DbSettings::get();
  91         /* DB settings overwrite config.php keys: */
  92         $config = array_merge($config, $merge);
  93 }
  94
  95 function config_is_file_item($name)
  96 {
  97         if (($name == "plugins") ||
  98             ($name == "mysql") ||
  99             ($name == "base_url") ||
 100             ($name == "secrets"))
 101         {
 102                 return true;
 103         }
 104         return false;
 105 }
 106
 107 function write_config_file()
 108 {
 109         GLOBAL $config;
 110
 111         $file_settings = [];
 112         foreach($config as $k=>$v)
 113         {
 114                 if (config_is_file_item($k))
 115                         $file_settings[$k] = $v;
 116         }
 117
 118         $cfg_filename = UPATH.'/config/config.php';
 119         $tmpfile = UPATH.'/config/config.tmp.'.bin2hex(random_bytes(8)).'.php';
 120         $fd = fopen($tmpfile, "w");
 121         if (!$fd)
 122                 die("Could not write to temporary config file $tmpfile.<br>We need write permissions on the config/ directory!<br>");
 123
 124         $str = var_export($file_settings, true);
 125         if ($str === null)
 126                 die("Error while running write_config_file() -- weird!");
 127         if (!fwrite($fd, "<?php\n".
 128                     "/* This config file is written automatically by the UnrealIRCd webpanel.\n".
 129                     " * You are not really supposed to edit it manually.\n".
 130                     " */\n".
 131                     '$config = '.$str.";\n"))
 132         {
 133                 die("Error writing to config file $tmpfile (on fwrite).<br>");
 134         }
 135         if (!fclose($fd))
 136                 die("Error writing to config file $tmpfile (on close).<br>");
 137         /* Now atomically rename the file */
 138         if (!rename($tmpfile, $cfg_filename))
 139                 die("Could not write (rename) to file ".$cfg_filename."<br>");
 140         if (function_exists('opcache_invalidate'))
 141                 opcache_invalidate($cfg_filename);
 142
 143         /* Do not re-read config, as it would reinitialize config
 144          * without having the DB settings read. (And it also
 145          * serves no purpose)
 146          */
 147         return true;
 148 }
 149
 150 // XXX: handle unsetting of config items :D - explicit unset function ?
 151
 152 function write_config($setting = null)
 153 {
 154         GLOBAL $config;
 155
 156         /* Specific request? Easy, write only this setting to the DB (never used for file) */
 157         if ($setting !== null)
 158         {
 159                 return DbSettings::set($setting, $config[$setting]);
 160         }
 161
 162         /* Otherwise write the whole config.
 163          * TODO: avoid writing settings file if unneeded,
 164          *       as it is more noisy than db settings.
 165          */
 166         $db_settings = [];
 167
 168         foreach($config as $k=>$v)
 169         {
 170                 if (!config_is_file_item($k))
 171                         $db_settings[$k] = $v;
 172         }
 173
 174         if (!write_config_file())
 175                 return false;
 176
 177         foreach($db_settings as $k=>$v)
 178         {
 179                 $ret = DbSettings::set($k, $v);
 180                 if (!$ret)
 181                         return $ret;
 182         }
 183
 184         return true;
 185 }
 186
 187 function get_version()
 188 {
 189         $fd = @fopen(UPATH."/.git/FETCH_HEAD", "r");
 190         if ($fd === false)
 191                 return "unknown";
 192         $line = fgets($fd, 512);
 193         fclose($fd);
 194         $commit = substr($line, 0, 8);
 195         return $commit; /* short git commit id */
 196 }
 197
 198 function generate_secrets()
 199 {
 200         GLOBAL $config;
 201
 202         if (!isset($config['secrets']))
 203                 $config['secrets'] = Array();
 204
 205         if (!isset($config['secrets']['pepper']))
 206                 $config['secrets']['pepper'] = rtrim(base64_encode(random_bytes(16)),'=');
 207
 208         if (!isset($config['secrets']['key']))
 209                 $config['secrets']['key'] = rtrim(base64_encode(sodium_crypto_aead_xchacha20poly1305_ietf_keygen()),'=');
 210 }
 211
 212 function secret_encrypt(string $text)
 213 {
 214         GLOBAL $config;
 215
 216         $key = base64_decode($config['secrets']['key']);
 217         $nonce = \random_bytes(\SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);
 218         $encrypted_text = sodium_crypto_aead_xchacha20poly1305_ietf_encrypt($text, '', $nonce, $key);
 219         return "secret:".rtrim(base64_encode($nonce),'=').':'.rtrim(base64_encode($encrypted_text),'='); // secret:base64(NONCE):base64(ENCRYPTEDTEXT)
 220 }
 221
 222 function secret_decrypt(string $crypted)
 223 {
 224         GLOBAL $config;
 225
 226         $key = base64_decode($config['secrets']['key']);
 227         $d = explode(":", $crypted);
 228         if (count($d) != 3)
 229                 return null;
 230         $nonce = base64_decode($d[1]);
 231         $ciphertext = base64_decode($d[2]);
 232
 233         $ret = sodium_crypto_aead_xchacha20poly1305_ietf_decrypt($ciphertext, '', $nonce, $key);
 234         if ($ret === false)
 235                 return null;
 236         return $ret;
 237 }
 238
 239 function upgrade_check()
 240 {
 241         GLOBAL $config_transition_unreal_server;
 242         GLOBAL $config;
 243
 244         /* Moving of a config.php item to DB: */
 245         if ($config_transition_unreal_server)
 246                 write_config();
 247
 248         /* Our own stuff may need upgrading.. */
 249         /* - generating secrets */
 250         if (!isset($config['secrets']))
 251         {
 252                 generate_secrets();
 253                 write_config_file();
 254         }
 255         /* - encrypting rpc_password */
 256         if (isset($config['unrealircd']) &&
 257             isset($config['unrealircd']['rpc_password']) &&
 258             !str_starts_with($config['unrealircd']['rpc_password'], "secret:"))
 259         {
 260                 $ret = secret_encrypt($config['unrealircd']['rpc_password']);
 261                 if ($ret !== false)
 262                 {
 263                         $config['unrealircd']['rpc_password'] = $ret;
 264                         write_config('unrealircd');
 265                 }
 266         }
 267
 268         $version = get_version();
 269         if (!isset($config['webpanel_version']))
 270                 $config['webpanel_version'] = '';
 271         if ($version != $config['webpanel_version'])
 272         {
 273                 $versioninfo = [
 274                         "old_version" => $config['webpanel_version'],
 275                         "new_version" => $version
 276                         ];
 277                 /* And inform the hook (eg the database backends) */
 278                 Hook::run(HOOKTYPE_UPGRADE, $versioninfo);
 279                 /* And set the new version now that the upgrade is "done" */
 280                 $config['webpanel_version'] = $version;
 281                 write_config("webpanel_version");
 282         }
 283 }
 284
 285 function panel_start_session($user = false)
 286 {
 287         if (!isset($_SESSION))
 288         {
 289                 session_set_cookie_params(86400); // can't set this to session_timeout due to catch-22
 290                 session_start();
 291         }
 292
 293         if ($user === false)
 294         {
 295                 $user = unreal_get_current_user();
 296                 if ($user === false)
 297                         return false;
 298         }
 299
 300         $timeout = 3600;
 301         if (isset($user->user_meta['session_timeout']))
 302                 $timeout = (INT)$user->user_meta['session_timeout'];
 303
 304         if (!isset($_SESSION['session_timeout']))
 305                 $_SESSION['session_timeout'] = $timeout;
 306
 307         $_SESSION['last-activity'] = time();
 308         return true;
 309 }
 310
 311 /* Now read the config, and redirect to install screen if we don't have it */
 312 $config_transition_unreal_server = false;
 313 if (!read_config_file())
 314 {
 315         if (page_requires_no_config())
 316         {
 317                 /* Allow empty conf */
 318         } else
 319         if (!file_exists(UPATH."/config/config.php") && !file_exists(UPATH."/config.php"))
 320         {
 321                 header("Location: settings/install.php");
 322                 die();
 323         }
 324 }
 325
 326 require_once UPATH . "/Classes/class-hook.php";
 327 if (!is_dir(UPATH . "/vendor"))
 328         die("The vendor/ directory is missing. Most likely the admin forgot to run 'composer install'\n");
 329 require_once UPATH . '/vendor/autoload.php';
 330 require_once UPATH . "/Classes/class-cmodes.php";
 331 require_once UPATH . "/inc/defines.php";
 332 require_once UPATH . "/misc/strings.php";
 333 require_once UPATH . "/misc/channel-lookup-misc.php";
 334 require_once UPATH . "/misc/user-lookup-misc.php";
 335 require_once UPATH . "/misc/server-lookup-misc.php";
 336 require_once UPATH . "/misc/ip-whois-misc.php";
 337 require_once UPATH . "/Classes/class-log.php";
 338 require_once UPATH . "/Classes/class-message.php";
 339 require_once UPATH . "/Classes/class-rpc.php";
 340 require_once UPATH . "/Classes/class-paneluser.php";
 341 require_once UPATH . "/plugins.php";
 342
 343 /* Do various checks and reading, except during setup step 1. */
 344 if (!page_requires_no_config())
 345 {
 346         /* Now that plugins are loaded, read config from DB */
 347         read_config_db();
 348
 349         /* Check if anything needs upgrading (eg on panel version change) */
 350         upgrade_check();
 351
 352         /* And a check... */
 353         if (!get_config("base_url"))
 354                 die("The base_url was not found in your config. Setup went wrong?");
 355 }
 356
 357 $pages = [
 358         "Overview"     => "",
 359         "Users"        => "users",
 360         "Channels"     => "channels",
 361         "Servers"      => "servers",
 362         "Server Bans"  => [
 363                 "Server Bans" => "server-bans",
 364                 "Name Bans" => "server-bans/name-bans.php",
 365                 "Ban Exceptions" => "server-bans/ban-exceptions.php"
 366         ],
 367         "Spamfilter"   => "spamfilter.php",
 368         "Tools" => [
 369                 "IP WHOIS" => "tools/ip-whois.php",
 370         ],
 371         "Settings" => [
 372                 "Plugins" => "settings/plugins.php",
 373         ],
 374
 375         "News" => "news.php",
 376 ];
 377
 378 if (!panel_start_session())
 379 {
 380         if (!page_requires_no_login())
 381         {
 382                 if (!is_auth_provided())
 383                         die("No authentication plugin loaded. You must load either sql_db, file_db, or a similar auth plugin!");
 384                 $current_page = $_SERVER['REQUEST_URI'];
 385                 header("Location: ".get_config("base_url")."login/?redirect=".urlencode($current_page));
 386                 die;
 387         }
 388 } else {
 389         $pages["Settings"]["Accounts"] = "settings";
 390         if (current_user_can(PERMISSION_MANAGE_USERS))
 391                 $pages["Settings"]["Role Editor"] = "settings/user-role-edit.php";
 392         $user = unreal_get_current_user();
 393         if ($user)
 394         {
 395                 /* Add logout page, if logged in */
 396                 $pages["Logout"] = "login/?logout=true";
 397         }
 398 }
 399
 400 Hook::run(HOOKTYPE_NAVBAR, $pages);
 401
 402 /* Example to add new menu item:
 403  *
 404  * class MyPlugin
 405  * {
 406  *
 407  *        function __construct()
 408  *        {
 409  *                Hook::func(HOOKTYPE_NAVBAR, [$this, 'add_menu'])
 410  *        }
 411  *
 412  *        function add_menu(&$pages) // this should pass by reference (using the & prefix)
 413  *        {
 414  *                $page_name = "My New Page";
 415  *                $page_link = "link/to/page.php";
 416  *                $pages[$page_name] = $page_link;
 417  *        }
 418  * }
 419 */