One Hat Cyber Team

View File Name : Suspend.php

<?php

/**
 * Suspend, User friendly suspend
 * 
 * @copyright Copyright (c) 2007 DotRoll Kft. (http://www.dotroll.com)
 * @author Zoltán Istvanovszki <zoltan.istvanovszki@dotroll.com>
 * @since 2017.06.15.
 * @package CXS_2.0
 */

namespace CXS;

class Suspend extends CommonComponent {

	/**
	 * Init
	 */
	public function onConstruct() {

	}

	/**
	 * Execute user friendly suspend
	 *
	 * @param string $hash Username
	 * @param string $LOG CXS  result
	 */
	public function execute(string $hash, string $LOG = '') {
		if (!$uid = $this->checkHash($hash)) {
			return;
		}

		$today = \date('Ymd');
		if ($today > 20251218 && $today < 20260106) {
			return;
		}

		$this->log("userFriendlySuspend $hash");
		/* @var $excludeUsers \CXS\ExcludeUsers */
		$excludeUsers = $this->di->get('excludeUsers');
		$excludeUsers->store();
		if ($excludeUsers->has($hash)) {
			$this->push("Suspend skip, because $hash in exclude list");
			$excludeUsers = null;
			unset($excludeUsers);
			return;
		}
		$excludeUsers = null;
		unset($excludeUsers);
		/* @var $suspended \Suspended */
		$suspended = \Suspended::findFirstByHash($hash);
		if (empty($suspended->hash)) {
			$suspended = new \Suspended();
			$suspended->hash = $hash;
			$suspended->hostname = $this->getHostname();
			$suspended->save();
		}

		if ($this->getType() == 'DirectAdmin') {
			if (\is_file("/usr/local/directadmin/data/users/$hash/cxs.conf")) {
				$this->push("Suspend skip, because '/usr/local/directadmin/data/users/$hash/cxs.conf' in already exist");
				return;
			}
		} else {
			if (\is_file("/usr/local/apache/conf/userdata/cxs/$hash.conf")) {
				$this->push("Suspend skip, because '/usr/local/apache/conf/userdata/cxs/$hash.conf' in already exist");
				return;
			}
		}
		$this->log("userFriendlySuspend action $hash");

		if ($this->getType() != 'DirectAdmin') {
			// Restore e-mail limit to package value
			/* @var $limit \CXS\Limit */
			$limit = $this->di->get('limit');
			$limit->restore($hash);
		}

		// Redirect all HTTP and HTTPS hits to redirect page
		$this->addRedirect($hash);

		// Disable crons if users have
		$this->disableCron($hash);

		// Block with CSF
		$this->csfDeny($hash, $uid);

		// Kill processes
		$this->killProcesses($hash);

		if (!empty($LOG)) {
			// Send suspend e-mail to user and domreg@
			if ($this->di->get('config')->application->enviroment == 'dotroll') {
				/* @var $ticket \CXS\Ticket */
				$ticket = $this->di->get('ticket');
				$ticket->open('suspend', $hash, $LOG);
			} else {
				/* @var $email \CXS\Email */
				$email = $this->di->get('email');
				$email->send('suspend', $hash, $LOG);
			}
		}

		$LOG = null;
		unset($LOG);
		$limit = null;
		unset($limit);
		$ticket = null;
		unset($ticket);
	}

	/**
	 * Add suspend redirect
	 * 
	 * @param string $hash User
	 */
	public function addRedirect(string $hash) {
		if ($this->checkHash($hash) === false) {
			return;
		}
		$fp = \fopen($this->getType() == 'DirectAdmin' ? "/usr/local/directadmin/data/users/$hash/cxs.conf" : "/usr/local/apache/conf/userdata/cxs/$hash.conf", 'w');
		\fwrite($fp, "<Directory /home/$hash/>\n");
		\fwrite($fp, 'RedirectMatch ' . ($this->getType() == 'DirectAdmin' ? '^/(?!suspended/index.html$).*$.* /suspended/index.html' : '.* /cgi-sys/suspendedpage.cgi') . "\n");
		\fwrite($fp, "</Directory>\n");
		\fclose($fp);
		\exec('/usr/sbin/apachectl graceful 2> /dev/null');
		$this->push("User: $hash Added suspend redirect");
		$fp = null;
		unset($fp);
	}

	/**
	 * Disable crons with exit if users have
	 *
	 * @param string $hash Username
	 */
	public function disableCron(string $hash) {
		if ($this->checkHash($hash) === false) {
			return;
		}
		$this->log("disableCron $hash");
		$output = \explode(\PHP_EOL, \shell_exec("crontab -l -u $hash"));
		foreach ($output as &$line) {
			if (empty(\trim($line)) || \preg_match('/^\s*#/', $line)) {
				continue;
			}
			if (\preg_match('/exit;\s/', $line)) {
				continue;
			}
			if (\preg_match('/^(\s*\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+)(.+)$/', $line, $matches)) {
				$line = $matches[1] . 'exit; ' . $matches[2];
			}
		}
		$tempFile = \tempnam(\sys_get_temp_dir(), 'crontab_');
		\file_put_contents($tempFile, \implode(\PHP_EOL, $output) . \PHP_EOL);
		\exec("crontab -u $hash $tempFile");
		\unlink($tempFile);
		$this->push("User: $hash Cron disabled");
		$output = null;
		unset($output);
	}

	/**
	 * Block with CSF
	 * 
	 * @param string $hash User
	 * @param int $uid UID
	 */
	public function csfDeny(string $hash, int $uid) {
		$this->log("csfDeny $hash");
		\exec('/usr/sbin/csf --deny "tcp|out|any|any|u=' . $uid . '" "cxscron"');
		\exec('/usr/sbin/csf --deny "udp|out|any|any|u=' . $uid . '" "cxscron"');
		$this->push("User: $hash CSF denied");
	}

	/**
	 * Kill processes
	 * 
	 * @param string $hash User
	 */
	public function killProcesses(string $hash) {
		// \exec("/bin/ps faxu | /bin/grep -F \"$(/opt/CXS/support.php -ll | /bin/grep -v ' ')\" | /bin/grep -v grep | /bin/awk '{ print $2 }' | /usr/bin/xargs --no-run-if-empty kill -9");
	}

	/**
	 * List suspended webhosts
	 */
	public function list() {
		$jobResponse = '';
		foreach (\glob("/usr/local/apache/conf/userdata/cxs/*.conf") as $hash) {
			$jobResponse .= \substr(\str_replace('/usr/local/apache/conf/userdata/cxs/', '', $hash), 0, -5) . \PHP_EOL;
			// $this->log("Found suspended user: " . \substr(\str_replace('/usr/local/apache/conf/userdata/cxs/', '', $hash), 0, -5));
		}
		foreach (\glob("/usr/local/directadmin/data/users/*/cxs.conf") as $hash) {
			$jobResponse .= \str_replace(['/usr/local/directadmin/data/users/', '/cxs.conf'], '', $hash) . \PHP_EOL;
			// $this->log("Found suspended user: " . \substr(\str_replace('/usr/local/apache/conf/userdata/cxs/', '', $hash), 0, -5));
		}
		$this->push(\trim($jobResponse));
	}
}