One Hat Cyber Team

View File Name : HookTask.php

<?php

/**
 * HookTask, Loginsssl Hook related Task
 * 
 * @copyright Copyright (c) 2007 DotRoll Kft. (http://www.dotroll.com)
 * @author Zoltán Istvanovszki <zoltan.istvanovszki@dotroll.com>
 * @since 2018.02.14.
 * @package CXS_2.0
 */
class HookTask extends \CommonTask {

	/**
	 * Loginsssl Hook related Task
	 */
	public function mainAction() {
		$input = $this->getPassedData();
		if (
			empty($input['context']['category']) ||
			empty($input['context']['event']) ||
			empty($input['context']['stage']) ||
			empty($input['data']['user']) ||
			$input['context']['category'] != 'Whostmgr' ||
			!\in_array($input['context']['event'], ['Accounts::Create', 'Accounts::Modify', 'Accounts::Remove'])
		) {
			echo '1 Not known context';
			return;
		}
		if (isset($input['data']['is_restore']) && $input['data']['is_restore'] == 1) {
			echo '1 is session is restoration';
			return;
		}
		if (
			$input['context']['event'] == 'Accounts::Remove' &&
			$input['context']['stage'] == 'pre' &&
			$accountsummary = \json_decode(\exec("/usr/sbin/whmapi1 --output=json accountsummary user={$input['data']['user']}"), true)
		) {
			$this->log("Accounts::Remove pre: {$input['data']['user']}");
			$this->log("Accounts::Remove pre: \$accountsummary: " . \var_export($accountsummary, true));
			if (
				!empty($accountsummary['data']['acct'][0]['user']) &&
				$accountsummary['data']['acct'][0]['user'] == $input['data']['user'] &&
				!empty($accountsummary['data']['acct'][0]['ipv6']) &&
				$accountsummary['data']['acct'][0]['suspended'] == 0 &&
				$ipv6 = \Records::findFirst("domain_id = 1 AND type = 'AAAA' AND name = '{$input['data']['user']}.ipv6.loginssl.com'")
			) {
				$this->log("Accounts::Remove pre: {$input['data']['user']} remove IPv6 loginssl {$ipv6->content}");
				$ipv6->delete();
				// Remove IPv6 range from cPanel
				\exec("/usr/sbin/whmapi1 ipv6_disable_account user={$input['data']['user']}");
				\exec("/usr/sbin/whmapi1 ipv6_range_remove name={$input['data']['user']}");
				\DnsApi::query("/ipv6/remove/{$ipv6->content}");
				$this->updateSoa();
			}
			\Records::findFirst("domain_id = 1 AND type = 'A' AND name = '{$input['data']['user']}.loginssl.com'")->delete();
			$this->log("Accounts::Remove pre: {$input['data']['user']} remove IPv4 loginssl {$input['data']['user']}.loginssl.com");
		} elseif (
			$input['context']['event'] == 'Accounts::Create' &&
			$input['context']['stage'] == 'pre'
		) {
			if (
				empty($input['data']['domain']) ||
				\in_array($input['data']['domain'], ['ns1.webspacecontrol.com', 'ns2.webspacecontrol.com', 'glbns.com', 'loginssl.com']) ||
				\strpos($input['data']['domain'], '.glbns.com') !== false ||
				\strpos($input['data']['domain'], 'dotroll') !== false ||
				\strpos($input['data']['domain'], '.loginssl.com') !== false ||
				\strpos($input['data']['domain'], 'microware') !== false ||
				\strpos($input['data']['domain'], 'domainbc') !== false
			) {
				echo "0 {$input['data']['domain']} not allowed!";
				$this->log("Hook Accounts::Create: 0 {$input['data']['domain']} not allowed!");
			} elseif (\Records::find("name = '" . $input['data']['user'] . ".loginssl.com'")->getFirst()) {
				echo "0 {$input['data']['user']}.loginssl.com exist!";
				$this->log("Hook Accounts::Create: 0 {$input['data']['user']}.loginssl.com exist!");
			} else {
				echo "1 {$input['data']['user']}.loginssl.com not exist!";
				$this->log("Hook Accounts::Create: 1 {$input['data']['user']}.loginssl.com not exist!");
			}
			return;
		} elseif (
			$input['context']['event'] == 'Accounts::Modify' &&
			$input['context']['stage'] == 'pre' &&
			!empty($input['data']['newuser'])
		) {
			if ($input['data']['user'] != $input['data']['newuser']) {
				if (\Records::find("name = '" . $input['data']['newuser'] . ".loginssl.com'")->getFirst()) {
					echo "0 {$input['data']['newuser']}.loginssl.com exist!";
					$this->log("Hook Accounts::Modify: 0 {$input['data']['newuser']}.loginssl.com exist!");
				} else {
					echo "1 {$input['data']['newuser']}.loginssl.com not exist!";
					$this->log("Hook Accounts::Modify: 1 {$input['data']['newuser']}.loginssl.com not exist!");
				}
			} else {
				echo "1 Username not changed, so not need loginssl check!";
			}
		} elseif (
			\in_array($input['context']['event'], ['Accounts::Modify', 'Accounts::Create']) &&
			$input['context']['stage'] == 'post' &&
			!\Records::find("name = '" . $input['data']['user'] . ".loginssl.com'")->getFirst() &&
			$accountsummary = \json_decode(\exec("/usr/sbin/whmapi1 --output=json accountsummary user={$input['data']['user']}"), true)
		) {
			$ip = $accountsummary['data']['acct'][0]['ip'];
			$email = $accountsummary['data']['acct'][0]['email'];
			$record = new \Records();
			$record->name = "{$input['data']['user']}.loginssl.com";
			$record->content = $ip;
			if ($record->save() === false) {
				$this->log("Create: {$record->name} $ip failed with message: " . \implode(\PHP_EOL, $record->getMessages()));
			} else {
				$this->log("Create: {$record->name} $ip success");
			}
			// IPv6 create
			$this->addIpv6($input['data']['user'], $email, $ip);
			$this->updateSoa();
			return;
		} elseif (
			$input['context']['event'] == 'Accounts::Modify' &&
			$input['context']['stage'] == 'post' &&
			!empty($input['data']['newuser']) &&
			$input['data']['user'] != $input['data']['newuser'] &&
			!\Records::find("name = '" . $input['data']['newuser'] . ".loginssl.com'")->getFirst() &&
			$ip = $this->getCpanelIp($input['data']['newuser'])
		) {
			$record = new \Records();
			$record->name = "{$input['data']['newuser']}.loginssl.com";
			$record->content = $ip;
			if ($record->save() === false) {
				$this->log("Create: {$record->name} $ip failed with message: " . \implode(\PHP_EOL, $record->getMessages()));
			} else {
				$this->log("Create: {$record->name} $ip success");
				$this->updateSoa();
			}
			return;
		}
		echo '1 Not known context';
	}

	/**
	 * Process data from STDIN
	 * 
	 * @return array
	 */
	private function getPassedData(): array {
		// Get input from STDIN.
		$raw = '';
		$stdin = \fopen('php://stdin', 'r');
		if (\is_resource($stdin)) {
			\stream_set_blocking($stdin, 0);
			while (($line = \fgets($stdin, 1024)) !== false) {
				$raw .= \trim($line);
			}
			\fclose($stdin);
		}
		// Process and JSON-decode the raw output.
		if (!empty($raw)) {
			return \json_decode($raw, true);
		}
		return [
			'context' => [],
			'data' => [],
			'hook' => [],
		];
	}

}