CVE-2022-0753 (HTML, published 2022-03-03T16:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
install/deb/phpmyadmin/hestia-sso.php
web/delete/backup/exclusion/index.php
web/delete/backup/index.php
web/delete/cron/index.php
web/delete/db/index.php
web/delete/dns/index.php
web/delete/key/index.php
web/delete/log/auth/index.php
web/delete/log/index.php
web/delete/mail/index.php
web/delete/notification/index.php
web/delete/web/cache/index.php
web/delete/web/index.php
web/download/backup/index.php
web/edit/cron/index.php
web/edit/db/index.php
web/edit/dns/index.php
web/edit/firewall/index.php
web/edit/ip/index.php
web/edit/mail/index.php
web/edit/package/index.php
web/edit/user/index.php
web/edit/web/index.php
web/inc/main.php
web/login/index.php
web/suspend/cron/index.php
web/suspend/db/index.php
web/suspend/dns/index.php
web/suspend/mail/index.php
web/suspend/user/index.php
web/suspend/web/index.php
web/templates/includes/title.html
web/templates/pages/add_cron.html
web/templates/pages/add_db.html
web/templates/pages/add_dns.html
web/templates/pages/add_dns_rec.html
web/templates/pages/add_firewall.html
web/templates/pages/add_firewall_banlist.html
web/templates/pages/add_firewall_ipset.html
web/templates/pages/add_ip.html
web/templates/pages/add_key.html
web/templates/pages/add_mail.html
web/templates/pages/add_mail_acc.html
web/templates/pages/add_package.html
web/templates/pages/add_user.html
web/templates/pages/add_web.html
web/templates/pages/edit_backup_exclusions.html
web/templates/pages/edit_cron.html
web/templates/pages/edit_db.html
web/templates/pages/edit_dns.html
web/templates/pages/edit_dns_rec.html
web/templates/pages/edit_firewall.html
web/templates/pages/edit_ip.html
web/templates/pages/edit_mail.html
web/templates/pages/edit_mail_acc.html
web/templates/pages/edit_package.html
web/templates/pages/edit_server.html
web/templates/pages/edit_server_bind9.html
web/templates/pages/edit_server_dovecot.html
web/templates/pages/edit_server_httpd.html
web/templates/pages/edit_server_mysql.html
web/templates/pages/edit_server_nginx.html
web/templates/pages/edit_server_pgsql.html
web/templates/pages/edit_server_php.html
web/templates/pages/edit_server_service.html
web/templates/pages/edit_user.html
web/templates/pages/edit_web.html
web/templates/pages/generate_ssl.html
web/templates/pages/list_backup_detail.html
web/templates/pages/list_cron.html
web/templates/pages/list_db.html
web/templates/pages/list_dns.html
web/templates/pages/list_dns_rec.html
web/templates/pages/list_mail.html
web/templates/pages/list_mail_acc.html
web/templates/pages/list_packages.html
web/templates/pages/list_ssl.html
web/templates/pages/list_user.html
web/templates/pages/list_web.html
web/templates/pages/list_webapps.html
web/templates/pages/list_weblog.html
web/templates/pages/login/reset_2.html
web/templates/pages/login/reset_3.html
web/templates/pages/setup_webapp.html
web/unsuspend/cron/index.php
web/unsuspend/db/index.php
web/unsuspend/dns/index.php
web/unsuspend/mail/index.php
web/unsuspend/web/index.php
Commit message: Fix XXS issues (#2432)

* XSS patches

* Reslove XSS vulnrebilty

* Resolve XSS vulnrebility

* Prevent showing edit form from non exsiting records

* Improve error handling message

Create a function

* Make sure $user from $_SESSION is escapeshellarg

Prevent double escapeshellarg in Edit/web/index

* Enable translateable errors in /inc/main.php

Fix  "White" screen issue when trying to loginas non existing user

* Prevent double escapeshellarg()

* Do not remove unset($output)

* Resolve linting errors

Vulnerable code:
                $time = $_GET['exp'];
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$v_username." ".$v_system, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-user-backup ".$v_username." ".$v_backup, $output, $return_var);
    $user=$_GET['user'];
    exec(HESTIA_CMD."v-delete-cron-job ".$v_username." ".$v_job, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-database ".$v_username." ".$v_database, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
    header("Location: /list/dns/?domain=".$_GET['domain']);
    exit;
    $user = $_GET['user'];
    $v_user = escapeshellarg(trim($user));
    exec(HESTIA_CMD."v-delete-user-ssh-key ".$v_user." ".$v_key);
    $user=$_GET['user'];
$v_username = escapeshellarg($user);
exec(HESTIA_CMD."v-delete-user-auth-log ".$v_username, $output, $return_var);
    exec(HESTIA_CMD."v-log-user-login ".$v_username." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
    $user=$_GET['user'];
// Set correct page reload target
if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
    header("Location: /list/log/?user=$user&token=$token");
} else {
    header("Location: /list/log/");
}

$v_username = escapeshellarg($user);
exec(HESTIA_CMD."v-delete-user-log ".$v_username." ".$output, $return_var);
    $user=$_GET['user'];
    exec(HESTIA_CMD."v-delete-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-delete-user-notification ".$v_username." ".$v_id, $output, $return_var);
    exec(HESTIA_CMD."v-acknowledge-user-notification ".$v_username." ".$v_id, $output, $return_var);
    $user=$_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-purge-nginx-cache ".$v_username." ".$v_domain, $output, $return_var);
    $user = $_GET['user'];
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD . 'v-delete-web-domain ' . $v_username . ' ' . $v_domain . " 'yes'", $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-schedule-user-backup-download ".$v_username." ".$backup, $output, $return_var);
check_return_code($return_var, $output);
check_return_code($return_var, $output);
    check_return_code($return_var, $output);
    check_return_code($return_var, $output);

check_return_code($return_var, $output);
check_return_code($return_var, $output);
    if ($_SESSION['userContext'] !== 'admin') {
        if (!in_array($v_domain, $user_domains)) {
            header("Location: /list/mail/");
            exit;
        }
    }
    if ($_SESSION['userContext'] !== 'admin') {
        if (!in_array($v_domain, $user_domains)) {
            header("Location: /list/mail/");
            exit;
        }
    }
check_return_code($return_var, $output);
exec(HESTIA_CMD."v-list-web-domains ".escapeshellarg($user)." json", $output, $return_var);
// List domain
if ($_SESSION['userContext'] !== 'admin') {
    if (!in_array($v_domain, $user_domains)) {
        header("Location: /list/mail/");
        exit;
    }
}

    $user = $_SESSION['user'];
    $user = $_SESSION['look'];
        echo '<span style="font-size: 18px;"><b>ERROR: Unable to retrieve account details.</b><br>Please <b><a href="/login/">log in</a></b> again.</span>';
        $_SESSION['error_msg'] = 'You have been logged out. Please log in again.';
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-cron-job ".$v_username." ".$v_job, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-database ".$v_username." ".$v_database, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-dns-record ".$v_username." ".$v_domain." ".$v_record_id, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-suspend-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
    $v_username = escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-suspend-user ".$v_username, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-web-domain ".$v_username." ".$v_domain, $output, $return_var);
<title><?=$_SERVER['HTTP_HOST']; ?> - <?=_($TAB)?> - <?=_('Hestia Control Panel');?></title>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
										<option v_type="hostname" domain="<?=$v_domain?>"><?=_('Use domain hostname');?></option>
									<div id="td_imap_hostname">mail.<?=$v_domain?></div>
									<div id="td_smtp_hostname">mail.<?=$v_domain?></div>
										<div><a class="vst" href="http://<?=$v_webmail_alias?>" target="_blank">http://<?=$v_webmail_alias?> <i></i></a></div>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
											<input type="hidden" name="v-custom-doc-root_prepath" value="<?=$v_custom_doc_root_prepath;?>">
													<option value="<?=$domain;?>" selected="selected"><?=$domain;?></option>
													<option value="<?=$domain;?>"><?=$domain;?></option>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
												<?=_("To enable Let's Encrypt SSL, ensure that DNS records exist for mail.$v_domain and $v_webmail_alias!")?><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_domain?>"><?=_('Generate CSR');?></a></span>
																	<?=$v_ssl_subject?>
																		<?=$v_ssl_aliases?>
																	<?=$v_ssl_not_before?>
																	<?=$v_ssl_not_after?>
																	<?=$v_ssl_signature?>
																	<?=$v_ssl_pub_key?>
																	<?=$v_ssl_issuer?>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
									<div id="td_imap_hostname">mail.<?=$v_domain?></div>
									<div id="td_smtp_hostname">mail.<?=$v_domain?></div>
										<div><a class="vst" href="http://<?=$v_webmail_alias?>" target="_blank">http://<?=$v_webmail_alias?> <i></i></a></div>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<br><br>

								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
					$ssh_key_url = "/list/key/?user=".$user."&token=".$_SESSION['token']."";
					$log_url = "/list/log/?user=".$user."&token=".$_SESSION['token']."";
				<a href="/login/?loginas=<?=$v_username?>&token=<?=$_SESSION['token']?>" id="btn-create" class="ui-button cancel" dir="ltr" title="<?=_('login as');?>"><i class="fas fa-sign-in-alt status-icon maroon"></i><?=_('login as');?></a>
						<input type="hidden" name="delete_url" value="/delete/user/?user=<?=$v_username?>&token=<?=$_SESSION['token']?>" />
							<p class="confirmation"><?=sprintf(_('DELETE_USER_CONFIRMATION'),$v_username)?></p>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
											<div><img class="qr-code" src="<?=$v_qrcode; ?>"></div>
			<a href="/delete/web/cache/?domain=<?=$v_domain;?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
				<a href="/add/webapp/?domain=<?=$v_domain?>" class="ui-button cancel" dir="ltr">
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
											<label><input type="radio" name="v-redirect" value="<?='www.'.$v_domain;?>" <?php if ($v_redirect == "www.".$v_domain) echo "checked"; ?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),"www.".$v_domain);?></label></input><br />
											<label><input type="radio" name="v-redirect" value="<?=$v_domain;?>" <?php if( $v_redirect == $v_domain) echo "checked";?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),$v_domain);?></label></input><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_domain?>"><?=_('Generate CSR');?></a></span>
															<option value="<?=$domain;?>"
																<?=$domain;?>
			<?php
				if (!empty($_SESSION['error_msg'])) {
					$msg_icon = 'fa-exclamation-circle status-icon red';
					$msg_text = htmlentities($_SESSION['error_msg']);
					$msg_id = 'vst-error';
				} else {
					if (!empty($_SESSION['ok_msg'])) {
						$msg_icon = 'fa-check-circle status-icon green';
						$msg_text = $_SESSION['ok_msg'];
						$msg_id = 'vst-ok';
					}
				}
			?>
			<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
		$backup = $_GET['backup'];
		$backup = $_GET['backup'];
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Command'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
									<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
									<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Record'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
			v_unit_id="<?=$key."@".$_GET['domain']?>" v_section="mail_acc" sort-date="<?=strtotime($data[$key]['DATE'].' '.$data[$key]['TIME'])?>" sort-name="<?=$key?>" sort-disk="<?=$data[$key]['U_DISK']?>"
						<b><?=$key."@".$_GET['domain']?></b>
						<b><a href="/edit/mail/?domain=<?=htmlspecialchars($_GET['domain'])?>&account=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Mail Account');?>: <?=$key?>@<?=htmlspecialchars($_GET['domain'])?>"><?=$key."@".$_GET['domain']?></a></b>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php
									if (!empty($_SESSION['error_msg'])) {
										$msg_icon = 'fa-exclamation-circle status-icon red';
										$msg_text = htmlentities($_SESSION['error_msg']);
										$msg_id = 'vst-error';
									} else {
										if (!empty($_SESSION['ok_msg'])) {
											$msg_icon = 'fa-check-circle status-icon green';
											$msg_text = $_SESSION['ok_msg'];
											$msg_id = 'vst-ok';
										}
									}
								?>
								<span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=$msg_text;?></span>
							<td class="vst-text" style="padding: 12px 0 0 0;"><?=_('SSL Certificate');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.crt', 'v_crt');"><i class="fas fa-download"></i></a>
								<?=_('SSL Key');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.key', 'v_key');"><i class="fas fa-download"></i></a>
								<?=_('SSL CSR');?> <a href="javascript:saveTextToBlob('<?php echo $v_domain;?>.csr', 'v_crt');"><i class="fas fa-download"></i></a>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = 'Name'; } else { $label = 'Date'; } ?>
								<?=_($label)?> <i class="fas fa-sort-alpha-down"></i>
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/edit/web/?domain=<?=$v_domain?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
					<a href="/add/webapp/?app=<?=$webapp['name'];?>&domain=<?=$v_domain?>" class="ui-button cancel" dir="ltr"><?=_('Setup');?></a>
				<div class="l-menu__item"><a href="/edit/user/?user=<?=$user; ?>" title="<?=$user?>" class="l-profile__username"><i class="fas fa-user-circle"></i></a></div>
											<input type="hidden" name="token" value="<?=$_SESSION['token'];?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>">
											<input type="hidden" name="token" value="<?=$_SESSION['token'];?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'], ENT_QUOTES|ENT_HTML5)?>">
											<input type="hidden" name="code" value="<?=htmlentities($_GET['code'], ENT_QUOTES|ENT_HTML5)?>">
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/add/webapp/?domain=<?=$v_domain?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-cron-job ".$v_username." ".$v_job, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-database ".$v_username." ".$v_database, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-dns-domain ".$v_username." ".$v_domain, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-dns-record ".$v_username." ".$v_domain." ".$v_record_id, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-mail-domain ".$v_username." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-mail-account ".$v_username." ".$v_domain." ".$v_account, $output, $return_var);
    $v_username = escapeshellarg($user);
    exec(HESTIA_CMD."v-unsuspend-domain ".$v_username." ".$v_domain, $output, $return_var);

Fixed code:
                if(is_numeric($_GET['exp'])){
                    $time = $_GET['exp'];
                }else{
                    $time = 0; 
                }
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-user-backup-exclusions ".$user." ".$v_system, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-user-backup ".$user." ".$v_backup, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-cron-job ".$user." ".$v_job, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-database ".$user." ".$v_database, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-dns-domain ".$user." ".$v_domain, $output, $return_var);
    if($return_var > 0){
        header("Location: /list/dns/");
        exit;
    }else{
        header("Location: /list/dns/?domain=".$_GET['domain']);
        exit;
    }
    
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-delete-user-ssh-key ".$user." ".$v_key);
    $user=escapeshellarg($_GET['user']);
exec(HESTIA_CMD."v-delete-user-auth-log ".$user, $output, $return_var);
    exec(HESTIA_CMD."v-log-user-login ".$user." ".$v_ip." success ".$v_session_id." ".$v_user_agent, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
exec(HESTIA_CMD."v-delete-user-log ".$user." ".$output, $return_var);
if($return_var > 0){
    header("Location: /list/log/");
}else{
    // Set correct page reload target
    if (($_SESSION['userContext'] === "admin") && (!empty($_GET['user']))) {
        header("Location: /list/log/?user=$user&token=$token");
    } else {
        header("Location: /list/log/");
    }
}

    $user=scapeshellarg($user);
    exec(HESTIA_CMD."v-delete-mail-domain ".$user." ".$v_domain, $output, $return_var);
    if($return_var > 0){
       header("Location: /list/mail/"); 
    }
    exec(HESTIA_CMD."v-delete-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
    if($return_var > 0){
       header("Location: /list/mail/"); 
    }else{
    }
    exec(HESTIA_CMD."v-delete-user-notification ".$user." ".$v_id, $output, $return_var);
    exec(HESTIA_CMD."v-acknowledge-user-notification ".$user." ".$v_id, $output, $return_var);
    $user=escapeshellarg($_GET['user']);
    exec(HESTIA_CMD."v-purge-nginx-cache ".$user." ".$v_domain, $output, $return_var);
    $user = escapeshellarg($user);
    exec(HESTIA_CMD . 'v-delete-web-domain ' . $user . ' ' . $v_domain . " 'yes'", $output, $return_var);
    exec(HESTIA_CMD."v-schedule-user-backup-download ".$user." ".$backup, $output, $return_var);
check_return_code_redirect($return_var, $output, '/list/cron/');
check_return_code_redirect($return_var, $output, '/list/db/');
    check_return_code_redirect($return_var, $output,'/list/dns/');
    check_return_code_redirect($return_var, $output,'/list/dns/');
    if(empty($data[$_GET['record_id']])){
        header("Location: /list/dns/");
        $_SESSION['error_msg'] = _("Unknown record ID");
    }
check_return_code_redirect($return_var, $output,'/list/firewall');
check_return_code_redirect($return_var, $output,'/list/ip');
    check_return_code_redirect($return_var, $output, '/list/mail/');
    check_return_code_redirect($return_var, $output, '/list/mail/');
check_return_code_redirect($return_var, $output, '/list/package/');
check_return_code_redirect($return_var, $output, '/list/user/');

exec(HESTIA_CMD."v-list-web-domains ".$user." json", $output, $return_var);
# Check if domain exists if not return /list/web/
check_return_code_redirect($return_var, $output, '/list/web/');
    $user = escapeshellarg($_SESSION['user']);
    $user = escapeshellarg($_SESSION['look']);
function check_return_code_redirect($return_var, $output, $location){
    if ($return_var != 0) {
        $error = implode('<br>', $output);
        if (empty($error)) {
            $error = sprintf(_('Error code:'), $return_var);
        }
        $_SESSION['error_msg'] = $error;
        header("Location:".$location);
    }

}
function show_error_panel($data){
    if (!empty($data['error_msg'])) {
        $msg_icon = 'fa-exclamation-circle status-icon red';
        $msg_text = $data['error_msg'];
        $msg_id = 'vst-error';
    } else {
        if (!empty($data['ok_msg'])) {
        $msg_icon = 'fa-check-circle status-icon green';
        $msg_text = $data['ok_msg'];
        $msg_id = 'vst-ok';
    }
    }
    ?>
        <span class="<?=$msg_id;?>"> <i class="fas <?=$msg_icon;?>"></i> <?=htmlentities($msg_text);?></span>
    <?php
}

        $_SESSION['error_msg'] = _('You have been logged out. Please log in again.');
        $_SESSION['error_msg'] = _('You have been logged out. Please log in again.');
            }else{
                # User doesn't exists
                header('Location: /');
    exec(HESTIA_CMD."v-suspend-cron-job ".$user." ".$v_job, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-database ".$user." ".$v_database, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-dns-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-dns-record ".$user." ".$v_domain." ".$v_record_id, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-mail-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-user ".$user, $output, $return_var);
    exec(HESTIA_CMD."v-suspend-web-domain ".$user." ".$v_domain, $output, $return_var);
<title><?=htmlentities($_SERVER['HTTP_HOST']); ?> - <?=_($TAB)?> - <?=_('Hestia Control Panel');?></title>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
										<option v_type="hostname" domain="<?=htmlentities($v_domain)?>"><?=_('Use domain hostname');?></option>
									<div id="td_imap_hostname">mail.<?=htmlentities($v_domain)?></div>
									<div id="td_smtp_hostname">mail.<?=htmlentities($v_domain)?></div>
										<div><a class="vst" href="http://<?=htmlentities($v_webmail_alias)?>" target="_blank">http://<?=htmlentities($v_webmail_alias)?> <i></i></a></div>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
											<input type="hidden" name="v-custom-doc-root_prepath" value="<?=htmlentities($v_custom_doc_root_prepath);?>">
													<option value="<?=htmlentities($domain);?>" selected="selected"><?=htmlentities($domain);?></option>
													<option value="<?=htmlentities($domain);?>"><?=htmlentities($domain);?></option>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
												<?php echo $v_webmail_alias;?>
												<?=sprintf(_("To enable Let's Encrypt SSL, ensure that DNS records exist for mail.%s and %s!"), $v_domain, $v_webmail_alias); ?><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities($v_domain)?>"><?=_('Generate CSR');?></a></span>
																	<?=htmlentities($v_ssl_subject);?>
																		<?=htmlentities($v_ssl_aliases)?>
																	<?=htmlentities($v_ssl_not_before)?>
																	<?=htmlentities($v_ssl_not_after)?>
																	<?=htmlentities($v_ssl_signature)?>
																	<?=htmlentities($v_ssl_pub_key)?>
																	<?=htmlentities($v_ssl_issuer)?>
								<?php show_error_panel($_SESSION);?>
									<div id="td_imap_hostname">mail.<?=htmlentities($v_domain)?></div>
									<div id="td_smtp_hostname">mail.<?=htmlentities($v_domain)?></div>
										<div><a class="vst" href="http://<?=htmlentities($v_webmail_alias)?>" target="_blank">http://<?=htmlentities($v_webmail_alias)?> <i></i></a></div>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
								<?php show_error_panel($_SESSION);?>
					$ssh_key_url = "/list/key/?user=".htmlentities($user)."&token=".$_SESSION['token']."";
					$log_url = "/list/log/?user=".htmlentities($user)."&token=".$_SESSION['token']."";
				<a href="/login/?loginas=<?=htmlentities($v_username)?>&token=<?=$_SESSION['token']?>" id="btn-create" class="ui-button cancel" dir="ltr" title="<?=_('login as');?>"><i class="fas fa-sign-in-alt status-icon maroon"></i><?=_('login as');?></a>
						<input type="hidden" name="delete_url" value="/delete/user/?user=<?=htmlentities($v_username)?>&token=<?=$_SESSION['token']?>" />
							<p class="confirmation"><?=sprintf(_('DELETE_USER_CONFIRMATION'),htmlentities($v_username))?></p>
								<?php show_error_panel($_SESSION);?>
											<div><img class="qr-code" src="<?=htmlentities($v_qrcode); ?>"></div>
			<a href="/delete/web/cache/?domain=<?=htmlentities($v_domain);?>&token=<?=$_SESSION['token'];?>" class="ui-button cancel <?php if ( $v_nginx_cache == 'yes' || ($v_proxy_template == 'caching' && $_SESSION['PROXY_SYSTEM'] == 'nginx')) { echo "block"; } else{ echo "hidden"; }?>" id="v-clear-cache">
				<a href="/add/webapp/?domain=<?=htmlentities($v_domain);?>" class="ui-button cancel" dir="ltr">
								<?php show_error_panel($_SESSION);?>
											<label><input type="radio" name="v-redirect" value="<?='www.'.htmlentities($v_domain);?>" <?php if ($v_redirect == "www.".$v_domain) echo "checked"; ?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),"www.".htmlentities($v_domain));?></label></input><br />
											<label><input type="radio" name="v-redirect" value="<?=htmlentities($v_domain);?>" <?php if( $v_redirect == $v_domain) echo "checked";?> class="v-redirect-custom-value"><?=sprintf(_('Redirect visitors to %s'),htmlentities($v_domain));?></label></input><br />
														<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities($v_domain)?>"><?=_('Generate CSR');?></a></span>
															<option value="<?=htmlentities($domain);?>"
																<?=htmlentities($domain);?>
			<?php show_error_panel($_SESSION);?>
		$backup = htmlentities($_GET['backup']);
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
									<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
									<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Record'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
			v_unit_id="<?=$key."@".htmlentities($_GET['domain']);?>" v_section="mail_acc" sort-date="<?=strtotime($data[$key]['DATE'].' '.$data[$key]['TIME'])?>" sort-name="<?=$key?>" sort-disk="<?=$data[$key]['U_DISK']?>"
						<b><?=$key."@".htmlentities($_GET['domain']);?></b>
						<b><a href="/edit/mail/?domain=<?=htmlspecialchars($_GET['domain'])?>&account=<?=$key?>&token=<?=$_SESSION['token']?>" title="<?=_('Editing Mail Account');?>: <?=$key?>@<?=htmlspecialchars($_GET['domain'])?>"><?=$key."@".htmlentities($_GET['domain']);?></a></b>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
					</td>
								<?php show_error_panel($_SESSION);?>
							<td class="vst-text" style="padding: 12px 0 0 0;"><?=_('SSL Certificate');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.crt', 'v_crt');"><i class="fas fa-download"></i></a>
								<?=_('SSL Key');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.key', 'v_key');"><i class="fas fa-download"></i></a>
								<?=_('SSL CSR');?> <a href="javascript:saveTextToBlob('<?php echo htmlentities($v_domain);?>.csr', 'v_crt');"><i class="fas fa-download"></i></a>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = _('Name'); } else { $label = _('Date'); } ?>
								<?=$label;?> <i class="fas fa-sort-alpha-down"></i>
								<?php if ($_SESSION['userSortOrder'] === 'name') { $label = ('Name'); } else { $label = _('Date'); } ?>
								<?=$label?> <i class="fas fa-sort-alpha-down"></i>
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/edit/web/?domain=<?=htmlentities($v_domain)?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
					<a href="/add/webapp/?app=<?=$webapp['name'];?>&domain=<?=htmlentities($v_domain)?>" class="ui-button cancel" dir="ltr"><?=_('Setup');?></a>
				<div class="l-menu__item"><a href="/edit/user/?user=<?=htmlentities($user); ?>" title="<?=htmlentities($user)?>" class="l-profile__username"><i class="fas fa-user-circle"></i></a></div>
											<input type="hidden" name="token" value="<?=htmlentities($_SESSION['token']);?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user'])?>">
											<input type="hidden" name="token" value="<?=htmlentities($_SESSION['token']);?>"/>
											<input type="hidden" name="user" value="<?=htmlentities($_GET['user']);?>">
											<input type="hidden" name="code" value="<?=htmlentities($_GET['code']);?>">
			<a class="ui-button cancel" dir="ltr" id="btn-back" href="/add/webapp/?domain=<?=htmlentities($v_domain);?>"><i class="fas fa-arrow-left status-icon blue"></i><?=_('Back');?></a>
						$f_name = htmlentities($f_name);
    exec(HESTIA_CMD."v-unsuspend-cron-job ".$user." ".$v_job, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-database ".$user." ".$v_database, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-dns-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-dns-record ".$user." ".$v_domain." ".$v_record_id, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-mail-domain ".$user." ".$v_domain, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-mail-account ".$user." ".$v_domain." ".$v_account, $output, $return_var);
    exec(HESTIA_CMD."v-unsuspend-domain ".$user." ".$v_domain, $output, $return_var);