CVE-2022-1509 (published 2022-04-28T10:15Z)

Sed Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.

Severity: HIGH
CVSS v2 base score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/hestiacp/hestiacp
commit_details: repo_url: https://github.com/hestiacp/hestiacp
author: Jaap Marcus
author_date: 2022-04-27 20:05:17+02:00
msg: [Security] Patches multiple security issue  (#2555)

* Add missing check in is_format_valid

* Add check on v-delete-dns-domain

* Validate theme via is_format_valid

* No need for extra code

* Prevent LF command passed trough + Add test to verify

* Add missing checks

* Don't allow exception for localhost

* Add some more missing checks

* Fix to strict error validation

* Add validation for user

* Fix bug in main.sh

* Use -d instead -f
repository: repo_url: https://github.com/hestiacp/hestiacp
repo_name: hestiacp/hestiacp
description: Hestia Control Panel | A lightweight and powerful control panel for the modern web.
repo_language: Shell
owner: hestiacp
file_changes: filename: v-add-access-key
change_type: ModificationType.MODIFY
diff: @@ -61,12 +61,9 @@ date=$(echo "$time_n_date" |cut -f 2 -d \ )
 #----------------------------------------------------------#
 
 check_args '1' "$#" 'USER [PERMISSIONS] [COMMENT] [FORMAT]'
-is_format_valid 'user'
+is_format_valid 'user' 'comment' 'format'
 is_object_valid 'user' 'USER' "$user"
 is_key_permissions_format_valid "$permissions" "$user"
-if [ -n "$comment" ]; then
-    is_format_valid 'comment'
-fi
 
 #----------------------------------------------------------#
 #                       Action                             #

programming_language: Shell
filename: v-add-backup-host
change_type: ModificationType.MODIFY
diff: @@ -107,7 +107,8 @@ EOF
 if [ "$type" != 'local' ];then
     check_args '4' "$#" "TYPE HOST USERNAME PASSWORD [PATH] [PORT]"
     is_format_valid 'host' 'path' 'port'
-    is_username_format_valid "$username" "username"
+    is_type_valid "$type" 'sftp,ftp,b2'
+    is_username_format_valid "$user" "username"
     is_password_valid
     format_no_quotes "$password" "password"
     

programming_language: Shell
filename: v-add-cron-job
change_type: ModificationType.MODIFY
diff: @@ -44,6 +44,7 @@ is_object_unsuspended 'user' 'USER' "$user"
 is_package_full 'CRON_JOBS'
 get_next_cronjob
 is_format_valid 'job'
+is_format_valid 'restart'
 is_object_new 'cron' 'JOB' "$job"
 
 # Perform verification if read-only mode is enabled

programming_language: Shell
filename: v-add-dns-domain
change_type: ModificationType.MODIFY
diff: @@ -66,6 +66,10 @@ if [ -z "$(is_ip_format_valid $domain)" ]; then
     exit 1
 fi
 
+if [ -n "$restart" ]; then 
+    is_format_valid 'restart'
+fi
+
 is_package_full 'DNS_DOMAINS'
 template=$(get_user_value '$DNS_TEMPLATE')
 is_dns_template_valid "$template"

programming_language: Shell
filename: v-add-dns-record
change_type: ModificationType.MODIFY
diff: @@ -96,6 +96,9 @@ is_object_new "dns/$domain" 'ID' "$id"
 is_dns_fqnd "$rtype" "$dvalue"
 is_dns_nameserver_valid "$domain" "$rtype" "$dvalue"
 is_format_valid 'ttl'
+if [ -n "$restart" ]; then
+    is_format_valid 'restart'
+fi
 
 # Perform verification if read-only mode is enabled
 check_hestia_demo_mode

programming_language: Shell
filename: v-add-fastcgi-cache
change_type: ModificationType.MODIFY
diff: @@ -31,7 +31,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 #----------------------------------------------------------#
 
 check_args '2' "$#" 'USER DOMAIN [DURATION] [DEBUG] [RESTART]'
-is_format_valid 'user' 'domain'
+is_format_valid 'user' 'domain' 'restart'
 is_object_valid 'user' 'USER' "$user"
 is_object_unsuspended 'user' 'USER' "$user"
 is_object_valid 'web' 'DOMAIN' "$domain"

programming_language: Shell
filename: v-add-firewall-chain
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@
 # Argument definition
 chain=$(echo $1 | tr '[:lower:]' '[:upper:]')
 port=$2
+port_ext=$2
 protocol=${4-TCP}
 protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]')
 
@@ -40,7 +41,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 #----------------------------------------------------------#
 
 check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL]'
-is_format_valid 'chain'
+is_format_valid 'chain' 'port_ext' 'protocol'
 is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
 
 # Perform verification if read-only mode is enabled

programming_language: Shell
filename: v-add-mail-domain
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,7 @@ domain_utf=$(idn -t --quiet -u "$domain_idn")
 #----------------------------------------------------------#
 
 check_args '2' "$#" 'USER DOMAIN [ANTISPAM] [ANTIVIRUS] [DKIM] [DKIM_SIZE]'
-is_format_valid 'user' 'domain' 'antispam' 'antivirus' 'dkim' 'dkim_size'
+is_format_valid 'user' 'domain' 'antispam' 'antivirus' 'dkim' 'dkim_size' 'restart'
 is_system_enabled "$MAIL_SYSTEM" 'MAIL_SYSTEM'
 is_object_valid 'user' 'USER' "$user"
 is_object_unsuspended 'user' 'USER' "$user"

programming_language: Shell
filename: v-add-mail-domain-ssl
change_type: ModificationType.MODIFY
diff: @@ -63,6 +63,9 @@ is_web_domain_cert_valid
 # Perform verification if read-only mode is enabled
 check_hestia_demo_mode
 
+if [ -n "$restart" ]; then 
+    is_format_valid "$restart"
+fi
 #----------------------------------------------------------#
 #                       Action                             #
 #----------------------------------------------------------#

programming_language: Shell
filename: v-add-mail-domain-webmail
change_type: ModificationType.MODIFY
diff: @@ -61,7 +61,7 @@ if [ -z "$webmail" ]; then
 fi
 
 check_args '2' "$#" 'USER DOMAIN [WEBMAIL] [RESTART]'
-is_format_valid 'user' 'domain'
+is_format_valid 'user' 'domain' 'restart'
 is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
 is_system_enabled "$IMAP_SYSTEM" 'IMAP_SYSTEM'
 is_type_valid "$WEBMAIL_SYSTEM disabled" "$webmail"

programming_language: Shell
filename: v-add-remote-dns-domain
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,9 @@ source_conf "$HESTIA/conf/hestia.conf"
 
 check_args '2' "$#" 'USER DOMAIN [FLUSH]'
 is_format_valid 'user' 'domain'
+if [ -n "$flush" ]; then
+    is_type_valid "records yes no" "$flush" 
+fi
 is_system_enabled "$DNS_CLUSTER" 'DNS_CLUSTER'
 is_procces_running
 remote_dns_health_check

programming_language: Shell
filename: v-add-remote-dns-host
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 
 args_usage='HOST PORT USER [PASSWORD] [TYPE] [DNS_USER]'
 check_args '3' "$#" "$args_usage"
-is_format_valid 'host' 'port' 'type' 'dns_user'
+is_format_valid 'host' 'port' 'dns_user'
 if [ -z "$password" ]; then
     is_format_valid 'hash'
 else

programming_language: Shell
filename: v-change-user-ns
change_type: ModificationType.MODIFY
diff: @@ -38,29 +38,31 @@ check_args '3' "$#" 'USER NS1 NS2 [NS3] [NS4] [NS5] [NS6] [NS7] [NS8]'
 
 # Checking argument format
 is_format_valid 'user' 'ns1' 'ns2'
+
+ns="$ns1,$ns2"
 if [ -n "$ns3" ]; then
-    ns3=$(echo "$4" | sed -e 's/\.*$//g' -e 's/^\.*//g')
     is_format_valid 'ns3'
+    ns="$ns,$ns3"
 fi
 if [ -n "$ns4" ]; then
-    ns4=$(echo "$5" | sed -e 's/\.*$//g' -e 's/^\.*//g')
     is_format_valid 'ns4'
+    ns="$ns,$ns4"
 fi
 if [ -n "$ns5" ]; then
-    ns5=$(echo "$6" | sed -e 's/\.*$//g' -e 's/^\.*//g')
     is_format_valid 'ns5'
+    ns="$ns,$ns5"
 fi
 if [ -n "$ns6" ]; then
-    ns6=$(echo "$7" | sed -e 's/\.*$//g' -e 's/^\.*//g')
     is_format_valid 'ns6'
+    ns="$ns,$ns6"
 fi
 if [ -n "$ns7" ]; then
-    ns7=$(echo "$8" | sed -e 's/\.*$//g' -e 's/^\.*//g')
     is_format_valid 'ns7'
+    ns="$ns,$ns7"
 fi
 if [ -n "$ns8" ]; then
-    ns8=$(echo "$9" | sed -e 's/\.*$//g' -e 's/^\.*//g')
     is_format_valid 'ns8'
+    ns="$ns,$ns8"
 fi
 is_object_valid 'user' 'USER' "$user"
 is_object_unsuspended 'user' 'USER' "$user"
@@ -72,10 +74,6 @@ check_hestia_demo_mode
 #                       Action                             #
 #----------------------------------------------------------#
 
-# Merging values
-ns="$ns1,$ns2,$ns3,$ns4,$ns5,$ns6,$ns7,$ns8"
-ns=$(echo "$ns" | sed -e "s/,,//g" -e "s/,$//")
-
 # Changing ns values
 update_user_value "$user" '$NS' "$ns"
 

programming_language: Shell
filename: v-change-user-theme
change_type: ModificationType.MODIFY
diff: @@ -27,7 +27,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 #                    Verifications                         #
 #----------------------------------------------------------#
 
-is_format_valid 'user'
+is_format_valid 'user' 'theme'
 is_common_format_valid "$theme" "theme"
 is_object_valid 'user' 'USER' "$user"
 

programming_language: Shell
filename: v-change-web-domain-name
change_type: ModificationType.MODIFY
diff: @@ -40,6 +40,7 @@ format_domain_idn
 
 check_args '3' "$#" 'USER DOMAIN NEW_DOMAIN [RESTART]'
 is_format_valid 'user' 'domain'
+is_domain_format_valid "$new_domain"
 is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
 is_object_valid 'user' 'USER' "$user"
 is_object_unsuspended 'user' 'USER' "$user"

programming_language: Shell
filename: v-check-access-key
change_type: ModificationType.MODIFY
diff: @@ -78,7 +78,7 @@ abort_missmatch() {
 CHECK_RESULT_CALLBACK="abort_missmatch"
 
 check_args '3' "$#" 'ACCESS_KEY_ID SECRET_ACCESS_KEY COMMAND [IP] [FORMAT]'
-is_format_valid 'access_key_id'
+is_format_valid 'access_key_id' 'ip' 'command'
 is_object_valid 'key' 'KEY' "$access_key_id"
 is_format_valid 'secret_access_key'
 check_access_key_secret "$access_key_id" "$secret_access_key" user

programming_language: Shell
filename: v-delete-database-temp-user
change_type: ModificationType.MODIFY
diff: @@ -33,7 +33,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 #----------------------------------------------------------#
 
 check_args '3' "$#" 'USER DATABASE DBUSER [TYPE] [HOST]'
-is_format_valid 'user' 'dbuser'
+is_format_valid 'user' 'database' 'dbuser'
 is_system_enabled "$DB_SYSTEM" 'DB_SYSTEM'
 is_object_valid 'user' 'USER' "$user"
 is_object_unsuspended 'user' 'USER' "$user"

programming_language: Shell
filename: v-delete-dns-on-web-alias
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@
 # Argument definition
 user=$1
 domain=$2
+alias=$3
 domain_idn=$2
 dom_alias=$(idn -t --quiet -u "$3" )
 dom_alias=$(echo $dom_alias |sed -e 's/\.*$//g' -e 's/^\.*//g')
@@ -43,7 +44,7 @@ check_hestia_demo_mode
 #----------------------------------------------------------#
 
 check_args '3' "$#" 'USER DOMAIN ALIAS [RESTART]'
-is_format_valid 'user' 'domain'
+is_format_valid 'user' 'domain' 'alias' 'restart'
 is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
 is_system_enabled "$DNS_SYSTEM" 'DNS_SYSTEM'
 is_object_valid 'user' 'USER' "$user"

programming_language: Shell
filename: v-delete-mail-account-forward
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,7 @@ format_domain_idn
 #----------------------------------------------------------#
 
 check_args '4' "$#" 'USER DOMAIN ACCOUNT FORWARD'
+is_format_valid 'user' 'domain' 'account'
 if [ "$forward"  != ':blackhole:' ]; then
     is_format_valid 'forward'
 fi

programming_language: Shell
filename: v-delete-user-notification
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,7 @@
 
 # Argument definition
 user=$1
-nid=$2
+id=$2
 
 # Includes
 # shellcheck source=/etc/hestiacp/hestia.conf
@@ -27,7 +27,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 #----------------------------------------------------------#
 
 check_args '2' "$#" 'USER NOTIFICATION'
-is_format_valid 'user' 'nid'
+is_format_valid 'user' 'id'
 is_object_valid 'user' 'USER' "$user"
 
 # Perform verification if read-only mode is enabled
@@ -38,7 +38,7 @@ check_hestia_demo_mode
 #----------------------------------------------------------#
 
 # Deleting notification
-sed -i "/NID='$nid' /d" $USER_DATA/notifications.conf 2>/dev/null
+sed -i "/NID='$id' /d" $USER_DATA/notifications.conf 2>/dev/null
 
 # Checking last notification
 if [ -e "$USER_DATA/notifications.conf" ]; then

programming_language: Shell
filename: v-delete-user-ssh-key
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 
 check_args '2' "$#" 'USER KEYID'
 is_format_valid 'user'
+is_no_new_line_format "$key_id"
 is_object_valid 'user' 'USER' "$user"
 
 source "$USER_DATA/user.conf"

programming_language: Shell
filename: v-generate-ssl-cert
change_type: ModificationType.MODIFY
diff: @@ -72,6 +72,11 @@ fi
 args_usage='DOMAIN EMAIL COUNTRY STATE CITY ORG UNIT [ALIASES] [FORMAT]'
 check_args '7' "$#" "$args_usage"
 is_format_valid 'domain' 'aliases' 'format' 'email'
+is_common_format_valid $country "country"
+is_common_format_valid $state "state"
+is_common_format_valid $org "org"
+is_common_format_valid $unit "unit"
+
 
 release="$(lsb_release -s -r)"
 

programming_language: Shell
filename: v-get-user-salt
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,7 @@ csv_list() {
 
 
 check_args '1' "$#" 'USER [IP] [SALT]'
-is_format_valid 'user'
+is_format_valid 'user' 'ip'
 
 # Checking user
 if [ ! -d "$HESTIA/data/users/$user" ]; then

programming_language: Shell
filename: v-log-action
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,8 @@ event_level=$2
 export event_category=$3
 event_details=$4
 
+is_common_format_valid "$event_level" "event level"
+
 # Validate event type input
 if [ "$event_level" != "Info" ] && [ "$event_level" != "Warning" ] && [ "$event_level" != "Error" ]; then 
     echo "Error: Invalid event type specified."
@@ -47,6 +49,7 @@ fi
 
 check_args '4' "$#" 'USER TYPE CATEGORY DETAILS'
 if [ "$user" != "system" ]; then
+    is_format_valid 'user'
     is_object_valid 'user' 'USER' "$user"
 fi
 

programming_language: Shell
filename: v-log-user-logout
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 
 check_args '2' "$#" 'USER SESSION_ID'
 is_format_valid 'user'
+is_common_format_valid "$session_id" "Session ID"
 is_object_valid 'user' 'USER' "$user"
 
 if [ ! -f "$USER_DATA/auth.log" ]; then

programming_language: Shell
filename: v-purge-nginx-cache
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@
 # Argument definition
 user=$1
 domain=$2
+rstart=$3
 
 # Includes
 # shellcheck source=/etc/hestiacp/hestia.conf
@@ -28,8 +29,8 @@ source_conf "$HESTIA/conf/hestia.conf"
 #                    Verifications                         #
 #----------------------------------------------------------#
 
-check_args '2' "$#" 'USER DOMAIN'
-is_format_valid 'user' 'domain'
+check_args '2' "$#" 'USER DOMAIN [RESTART]'
+is_format_valid 'user' 'domain' 'restart'
 is_object_valid 'user' 'USER' "$user"
 is_object_unsuspended 'user' 'USER' "$user"
 is_object_valid 'web' 'DOMAIN' "$domain"

programming_language: Shell
filename: v-schedule-letsencrypt-domain
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 #----------------------------------------------------------#
 
 check_args '2' "$#" 'USER DOMAIN [ALIASES]'
-is_format_valid 'user' 'domain'
+is_format_valid 'user' 'domain' 'aliases'
 is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
 is_system_enabled "$WEB_SSL" 'SSL_SUPPORT'
 is_object_valid 'user' 'USER' "$user"

programming_language: Shell
filename: v-update-host-certificate
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,7 @@ source_conf "$HESTIA/conf/hestia.conf"
 
 check_args '1' "$#" '[USER] [HOSTNAME]'
 is_format_valid 'user'
+is_domain_format_valid "$hostname" "hostname"
 is_system_enabled "$WEB_SYSTEM" 'WEB_SYSTEM'
 is_system_enabled "$WEB_SSL" 'SSL_SUPPORT'
 is_object_valid 'user' 'USER' "$user"

programming_language: Shell
filename: v-update-user-backup-exclusions
change_type: ModificationType.MODIFY
diff: @@ -40,7 +40,7 @@ is_file_valid() {
 #----------------------------------------------------------#
 
 check_args '2' "$#" 'USER FILE'
-is_format_valid 'user' 'vfile'
+is_format_valid 'user'
 is_object_valid 'user' 'USER' "$user"
 is_file_available
 is_file_valid

programming_language: Shell
filename: main.sh
change_type: ModificationType.MODIFY
diff: @@ -686,13 +686,13 @@ is_user_format_valid() {
 }
 
 # Domain format validator
-# removed "" around  \.\. and $(printf '\t'): SC2076: Don't quote right-hand side of =~, it'll match literally rather than as a regex. And we need regex match!
 is_domain_format_valid() {
     object_name=${2-domain}
     exclude="[!|@|#|$|^|&|*|(|)|+|=|{|}|:|,|<|>|?|_|/|\|\"|'|;|%|\`| ]"
     if [[ $1 =~ $exclude ]] || [[ $1 =~ ^[0-9]+$ ]] || [[ $1 =~ \.\. ]] || [[ $1 =~ $(printf '\t') ]] ||  [[ "$1" = "www" ]]; then
         check_result "$E_INVALID" "invalid $object_name format :: $1"
     fi
+    is_no_new_line_format "$1";
 }
 
 # Alias forman validator
@@ -829,6 +829,7 @@ is_extention_format_valid() {
     if [[ "$1" =~ $exclude ]]; then
         check_result "$E_INVALID" "invalid proxy extention format :: $1"
     fi
+    is_no_new_line_format "$1";
 }
 
 # Number format validator
@@ -885,6 +886,14 @@ is_common_format_valid() {
     if [[ $(echo -n "$1" | grep -c '\_\_') -gt 0 ]]; then
            check_result "$E_INVALID" "invalid $2 format :: $1"
     fi
+    is_no_new_line_format "$1";
+}
+
+is_no_new_line_format() {
+    test=$(echo $1 | sed -e 's/\.*$//g' -e 's/^\.*//g');
+    if [[ "$test" != "$1" ]]; then
+      check_result "$E_INVALID" "invalid value :: $1"
+    fi
 }
 
 is_string_format_valid() {
@@ -892,6 +901,7 @@ is_string_format_valid() {
   if [[ "$1" =~ $exclude ]]; then
       check_result "$E_INVALID" "invalid $2 format :: $1"
   fi
+  is_no_new_line_format "$1";
 }
 
 # Database format validator
@@ -900,6 +910,7 @@ is_database_format_valid() {
     if [[ "$1" =~ $exclude ]] || [ 64 -le ${#1} ]; then
         check_result "$E_INVALID" "invalid $2 format :: $1"
     fi
+    is_no_new_line_format "$1";
 }
 
 # Date format validator
@@ -918,6 +929,7 @@ is_dbuser_format_valid() {
     if [[ "$1" =~ $exclude ]]; then
         check_result "$E_INVALID" "invalid $2 format :: $1"
     fi
+    is_no_new_line_format "$1"
 }
 
 # DNS record type validator
@@ -940,7 +952,7 @@ is_dns_record_format_valid() {
         is_domain_format_valid "${1::-1}" 'mx_record'
         is_int_format_valid "$priority" 'priority_record'
     fi
-
+    is_no_new_line_format "$1";
 }
 
 # Email format validator
@@ -1066,7 +1078,7 @@ is_object_format_valid() {
 
 # Role validator
 is_role_valid (){
-    if ! [[ "$1" =~ ^admin|user$ ]]; then
+    if ! [[ "$1" =~ ^admin$|^user$ ]]; then
         check_result "$E_INVALID" "invalid $2 format :: $1"
     fi
 }
@@ -1112,12 +1124,14 @@ is_format_valid() {
                 action)         is_fw_action_format_valid "$arg";;
                 active)         is_boolean_format_valid "$arg" 'active' ;;
                 aliases)        is_alias_format_valid "$arg" ;;
+                alias)          is_alias_format_valid "$arg" ;;        
                 antispam)       is_boolean_format_valid "$arg" 'antispam' ;;
                 antivirus)      is_boolean_format_valid "$arg" 'antivirus' ;;
                 autoreply)      is_autoreply_format_valid "$arg" ;;
                 backup)         is_object_format_valid "$arg" 'backup' ;;
                 charset)        is_object_format_valid "$arg" "$arg_name" ;;
                 charsets)       is_common_format_valid "$arg" 'charsets' ;;
+                chain)          is_object_format_valid "$arg" 'chain' ;;
                 comment)        is_object_format_valid "$arg" 'comment' ;;
                 database)       is_database_format_valid "$arg" 'database';;
                 day)            is_cron_format_valid "$arg" $arg_name ;;
@@ -1126,11 +1140,13 @@ is_format_valid() {
                 dkim)           is_boolean_format_valid "$arg" 'dkim' ;;
                 dkim_size)      is_int_format_valid "$arg" ;;
                 domain)         is_domain_format_valid "$arg" ;;
+                dom_alias)      is_alias_format_valid "$arg" ;;
                 dvalue)         is_dns_record_format_valid "$arg";;
                 email)          is_email_format_valid "$arg" ;;
                 email_forward)  is_email_format_valid "$arg" ;;
                 exp)            is_date_format_valid "$arg" ;;
                 extentions)     is_common_format_valid "$arg" 'extentions' ;;
+                format)         is_type_valid 'plain json shell csv' "$arg" ;;
                 ftp_password)   is_password_format_valid "$arg" ;;
                 ftp_user)       is_user_format_valid "$arg" "$arg_name" ;;
                 hash)           is_hash_format_valid "$arg" "$arg_name" ;;
@@ -1181,9 +1197,11 @@ is_format_valid() {
                 soa)            is_domain_format_valid "$arg" 'SOA' ;;
                 #missing command: is_format_valid_shell
                 shell)          is_format_valid_shell "$arg" ;;
+                ssl_dir)        is_folder_exists "$arg" "$arg_name" ;;
                 stats_pass)     is_password_format_valid "$arg" ;;
                 stats_user)     is_user_format_valid "$arg" "$arg_name" ;;
                 template)       is_object_format_valid "$arg" "$arg_name" ;;
+                theme)          is_common_format_valid "$arg" "$arg_name" ;;
                 ttl)            is_int_format_valid "$arg" 'ttl';;
                 user)           is_user_format_valid "$arg" $arg_name;;
                 wday)           is_cron_format_valid "$arg" $arg_name ;;
@@ -1193,6 +1211,20 @@ is_format_valid() {
     done
 }
 
+is_folder_exists () {
+  if [ ! -d "$1" ]; then 
+    check_result "$E_NOTEXIST" "folder $1 does not exist"
+  fi
+}
+
+is_command_valid_format () {
+  if [[ ! "$1" =~ ^v-[[:alnum:]][-|\.|_[:alnum:]]{0,64}[[:alnum:]]$ ]]; then 
+    check_result "$E_INVALID" "Invalid command format"
+  fi
+  if [[ -n $( echo "$1" | grep -e '\-\-' ) ]]; then 
+    check_result "$E_INVALID" "Invalid command format"
+  fi
+}
 # Check access_key_id name
 # Don't work with legacy key format
 is_access_key_id_format_valid() {
@@ -1495,6 +1527,7 @@ format_no_quotes() {
     if [[ "$1" =~ $exclude ]]; then
        check_result "$E_INVALID" "Invalid $2 contains qoutes (\" or ') :: $1"
     fi
+    is_no_new_line_format "$1"
 }
 
 is_username_format_valid(){

programming_language: Shell
filename: checks.bats
change_type: ModificationType.ADD
diff: @@ -0,0 +1,349 @@
+#!/usr/bin/env bats
+
+if [ "${PATH#*/usr/local/hestia/bin*}" = "$PATH" ]; then
+    . /etc/profile.d/hestia.sh
+fi
+
+load 'test_helper/bats-support/load'
+load 'test_helper/bats-assert/load'
+load 'test_helper/bats-file/load'
+
+function random() {
+head /dev/urandom | tr -dc 0-9 | head -c$1
+}
+
+function setup() {
+    # echo "# Setup_file" > &3
+    if [ $BATS_TEST_NUMBER = 1 ]; then
+        echo 'user=test-5285' > /tmp/hestia-test-env.sh
+        echo 'user2=test-5286' >> /tmp/hestia-test-env.sh
+        echo 'userbk=testbk-5285' >> /tmp/hestia-test-env.sh
+        echo 'userpass1=test-5285' >> /tmp/hestia-test-env.sh
+        echo 'userpass2=t3st-p4ssw0rd' >> /tmp/hestia-test-env.sh
+        echo 'HESTIA=/usr/local/hestia' >> /tmp/hestia-test-env.sh
+        echo 'domain=test-5285.hestiacp.com' >> /tmp/hestia-test-env.sh
+        echo 'domainuk=test-5285.hestiacp.com.uk' >> /tmp/hestia-test-env.sh
+        echo 'rootdomain=testhestiacp.com' >> /tmp/hestia-test-env.sh
+        echo 'subdomain=cdn.testhestiacp.com' >> /tmp/hestia-test-env.sh
+        echo 'database=test-5285_database' >> /tmp/hestia-test-env.sh
+        echo 'dbuser=test-5285_dbuser' >> /tmp/hestia-test-env.sh
+    fi
+    
+    source /tmp/hestia-test-env.sh
+    source $HESTIA/func/main.sh
+    source $HESTIA/conf/hestia.conf
+    source $HESTIA/func/ip.sh
+}
+
+@test "is_access_key_id_format_valid valid" {
+    run is_access_key_id_format_valid 'M0ocDoIKbsoXSqtk1mgc' "key"
+    assert_success
+}
+@test "is_access_key_id_format_valid short" {
+    run is_access_key_id_format_valid 'M0ocDoIKbsoXSqtk1mg' "key"
+    assert_failure $E_INVALID
+}
+@test "is_access_key_id_format_valid long" {
+    run is_access_key_id_format_valid 'M0ocDoIKbsoXSqtk1mgca' "key"
+    assert_failure $E_INVALID
+}
+@test "is_access_key_id_format_valid non alpha" {
+    run is_access_key_id_format_valid 'M0ocDoIKbsoX$qtk1mgc' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_access_key_id_format_valid LHF" {
+    run is_access_key_id_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_user_format_valid valid" {
+    run is_user_format_valid 'hxh54SKbALne4s69VsqJRMbMd8Br' "key"
+    assert_success
+}
+@test "is_user_format_valid short" {
+    run is_user_format_valid 'hxh54SKbALne4s69VsqJR' "key"
+    assert_success
+}
+@test "is_user_format_valid long" {
+    run is_user_format_valid 'hxh54SKbALne4s69VsqJRMbMd8Braaa' "key"
+    assert_failure $E_INVALID
+}
+@test "is_user_format_valid dash" {
+    run is_user_format_valid 'hxh54SKbALne4-s6-VsqJRMbMd8Br' "key"
+    assert_success
+}
+
+@test "is_user_format_valid dash repeat" {
+    run is_user_format_valid 'hxh54SKbALne4s6--VsqJRMbMd8Br' "key"
+    assert_success
+}
+@test "is_user_format_valid dash start" {
+    run is_user_format_valid '-hxh54SKbALne4s6VsqJRMbMd8Br' "key"
+    assert_failure $E_INVALID
+}
+@test "is_user_format_valid dash end" {
+    run is_user_format_valid 'hxh54SKbALne4s6VsqJRMbMd8Br-' "key"
+    assert_failure $E_INVALID
+}
+@test "is_user_format_valid LHF" {
+    run is_user_format_valid 'M0ocDoIK
+    soXSqtk1mgc' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_fw_action_format_valid ACCEPT" {
+    run is_fw_action_format_valid 'ACCEPT' "key"
+    assert_success
+}
+@test "is_fw_action_format_valid DROP" {
+    run is_fw_action_format_valid 'DROP' "key"
+    assert_success
+}
+@test "is_fw_action_format_valid TEST" {
+    run is_fw_action_format_valid 'TEST' "key"
+    assert_failure $E_INVALID
+}
+@test "is_fw_action_format_valid LHF" {
+    run is_fw_protocol_format_valid 'M0ocDoIK
+    soXSqtk1mgc' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_fw_protocol_format_valid ICMP" {
+    run is_fw_protocol_format_valid 'ICMP' "key"
+    assert_success
+}
+
+@test "is_fw_protocol_format_valid UDP" {
+    run is_fw_protocol_format_valid 'UDP' "key"
+    assert_success
+}
+@test "is_fw_protocol_format_valid TCP" {
+    run is_fw_protocol_format_valid 'TCP' "key"
+    assert_success
+}
+@test "is_fw_protocol_format_valid TEST" {
+    run is_fw_protocol_format_valid 'TEST' "key"
+    assert_failure $E_INVALID
+}
+
+
+@test "is_domain_format_valid success" {
+     run is_domain_format_valid 'hestiacp.com' "key"
+    assert_success
+}
+
+@test "is_domain_format_valid www" {
+     run is_domain_format_valid 'www' "key"
+    assert_failure $E_INVALID
+}
+@test "is_domain_format_valid number" {
+     run is_domain_format_valid '12345' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_domain_format_valid .." {
+     run is_domain_format_valid '..' "key"
+    assert_failure $E_INVALID
+}
+@test "is_domain_format_valid LF." {
+     run is_domain_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_alias_format_valid success" {
+     run is_domain_format_valid 'hestiacp.com' "key"
+    assert_success
+}
+
+@test "is_alias_format_valid www" {
+     run is_domain_format_valid 'www' "key"
+    assert_failure $E_INVALID
+}
+@test "is_alias_format_valid number" {
+     run is_domain_format_valid '12345' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_alias_format_valid .." {
+     run is_domain_format_valid '..' "key"
+    assert_failure $E_INVALID
+}
+@test "is_alias_format_valid LF." {
+     run is_domain_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_extention_format_valid test" {
+     run is_extention_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_string_format_valid test" {
+     run is_string_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_database_format_valid test" {
+     run is_database_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_date_format_valid test" {
+     run is_date_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_dbuser_format_valid test" {
+     run is_dbuser_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_dns_type_format_valid test" {
+     run is_dns_type_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_dns_record_format_valid test" {
+     run is_dns_record_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_email_format_valid test" {
+     run is_email_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_fw_port_format_valid test" {
+     run is_fw_port_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_int_format_valid test" {
+     run is_int_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_interface_format_valid test" {
+     run is_interface_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_ip_status_format_valid test" {
+     run is_ip_status_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_cron_format_valid test" {
+     run is_cron_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_name_format_valid test" {
+     run is_name_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+
+@test "is_role_valid test" {
+     run is_role_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_object_format_valid test" {
+     run is_object_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+
+@test "is_common_format_valid test" {
+     run is_common_format_valid 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "format_no_quotes test" {
+     run format_no_quotes 'c
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
+
+@test "is_type_valid" {
+    run is_type_valid 'c
+    1eshutdown
+    r' "test,key"
+    assert_failure $E_INVALID
+}
+
+@test "is_command_valid_format v-list-users" {
+    run is_command_valid_format 'v-list-users'
+    assert_success
+}
+
+@test "is_command_valid_format v-list--users (Fail)" {
+    run is_command_valid_format 'v-list--users'
+    assert_failure $E_INVALID
+}
+
+@test "is_command_valid_format h-list-users (Fail)" {
+    run is_command_valid_format 'h-list-users'
+    assert_failure $E_INVALID
+}
+
+@test "is_command_valid_format list-users (Fail)" {
+    run is_command_valid_format 'list-users'
+    assert_failure $E_INVALID
+}
+
+@test "is_command_valid_format vlist-users (Fail)" {
+    run is_command_valid_format 'vlist-users'
+    assert_failure $E_INVALID
+}
+
+@test "is_command_valid_format LF (Fail)" {
+     run is_command_valid_format 'v-
+1eshutdown
+r' "key"
+    assert_failure $E_INVALID
+}
\ No newline at end of file

programming_language: Shell
filename: main.php
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,7 @@ if (!isset($_SESSION['user_combined_ip'])) {
 }
 
 // Checking user to use session from the same IP he has been logged in
-if ($_SESSION['user_combined_ip'] != $user_combined_ip && $_SERVER['REMOTE_ADDR'] != '127.0.0.1') {
+if ($_SESSION['user_combined_ip'] != $user_combined_ip) {
     $v_user = escapeshellarg($_SESSION['user']);
     $v_session_id = escapeshellarg($_SESSION['token']);
     exec(HESTIA_CMD . 'v-log-user-logout ' . $v_user . ' ' . $v_session_id, $output, $return_var);

programming_language: PHP