Skip to content

Commit 827e76c

Browse files
committed
fix: add protected fields to settings to mitigate high-severity vulnerability
Credits to @jorgectf for the advisories.
1 parent 0a9e23d commit 827e76c

File tree

3 files changed

+61
-46
lines changed

3 files changed

+61
-46
lines changed

api/system/settings.go

Lines changed: 46 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,57 @@
11
package system
22

33
import (
4-
"github.com/0xJacky/Nginx-UI/api"
5-
"github.com/0xJacky/Nginx-UI/settings"
6-
"github.com/gin-gonic/gin"
7-
"net/http"
4+
"github.com/0xJacky/Nginx-UI/api"
5+
"github.com/0xJacky/Nginx-UI/settings"
6+
"github.com/gin-gonic/gin"
7+
"net/http"
8+
"reflect"
89
)
910

1011
func GetSettings(c *gin.Context) {
11-
c.JSON(http.StatusOK, gin.H{
12-
"server": settings.ServerSettings,
13-
"nginx": settings.NginxSettings,
14-
"openai": settings.OpenAISettings,
15-
})
12+
c.JSON(http.StatusOK, gin.H{
13+
"server": settings.ServerSettings,
14+
"nginx": settings.NginxSettings,
15+
"openai": settings.OpenAISettings,
16+
})
1617
}
1718

1819
func SaveSettings(c *gin.Context) {
19-
var json struct {
20-
Server settings.Server `json:"server"`
21-
Nginx settings.Nginx `json:"nginx"`
22-
Openai settings.OpenAI `json:"openai"`
23-
}
24-
25-
if !api.BindAndValid(c, &json) {
26-
return
27-
}
28-
29-
settings.ServerSettings = json.Server
30-
settings.NginxSettings = json.Nginx
31-
settings.OpenAISettings = json.Openai
32-
33-
settings.ReflectFrom()
34-
35-
err := settings.Save()
36-
if err != nil {
37-
api.ErrHandler(c, err)
38-
return
39-
}
20+
var json struct {
21+
Server settings.Server `json:"server"`
22+
Nginx settings.Nginx `json:"nginx"`
23+
Openai settings.OpenAI `json:"openai"`
24+
}
25+
26+
if !api.BindAndValid(c, &json) {
27+
return
28+
}
29+
30+
// todo: omit protected fields when binding
31+
fillSettings(&settings.ServerSettings, &json.Server)
32+
fillSettings(&settings.NginxSettings, &json.Nginx)
33+
fillSettings(&settings.OpenAISettings, &json.Openai)
34+
35+
settings.ReflectFrom()
36+
37+
err := settings.Save()
38+
if err != nil {
39+
api.ErrHandler(c, err)
40+
return
41+
}
42+
43+
GetSettings(c)
44+
}
4045

41-
GetSettings(c)
46+
func fillSettings(targetSettings interface{}, newSettings interface{}) {
47+
s := reflect.TypeOf(targetSettings).Elem()
48+
vt := reflect.ValueOf(targetSettings).Elem()
49+
vn := reflect.ValueOf(newSettings).Elem()
50+
51+
// copy the values from new to target settings if it is not protected
52+
for i := 0; i < s.NumField(); i++ {
53+
if s.Field(i).Tag.Get("protected") != "true" {
54+
vt.Field(i).Set(vn.Field(i))
55+
}
56+
}
4257
}

settings/nginx.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,11 @@ package settings
33
type Nginx struct {
44
AccessLogPath string `json:"access_log_path"`
55
ErrorLogPath string `json:"error_log_path"`
6-
ConfigDir string `json:"config_dir"`
7-
PIDPath string `json:"pid_path"`
8-
TestConfigCmd string `json:"test_config_cmd"`
9-
ReloadCmd string `json:"reload_cmd"`
10-
RestartCmd string `json:"restart_cmd"`
6+
ConfigDir string `json:"config_dir" protected:"true"`
7+
PIDPath string `json:"pid_path" protected:"true"`
8+
TestConfigCmd string `json:"test_config_cmd" protected:"true"`
9+
ReloadCmd string `json:"reload_cmd" protected:"true"`
10+
RestartCmd string `json:"restart_cmd" protected:"true"`
1111
}
1212

1313
var NginxSettings = Nginx{

settings/server.go

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
package settings
22

33
type Server struct {
4-
HttpHost string `json:"http_host"`
5-
HttpPort string `json:"http_port"`
6-
RunMode string `json:"run_mode"`
7-
JwtSecret string `json:"jwt_secret"`
8-
NodeSecret string `json:"node_secret"`
4+
HttpHost string `json:"http_host" protected:"true"`
5+
HttpPort string `json:"http_port" protected:"true"`
6+
RunMode string `json:"run_mode" protected:"true"`
7+
JwtSecret string `json:"jwt_secret" protected:"true"`
8+
NodeSecret string `json:"node_secret" protected:"true"`
99
HTTPChallengePort string `json:"http_challenge_port"`
10-
Email string `json:"email"`
11-
Database string `json:"database"`
12-
StartCmd string `json:"start_cmd"`
10+
Email string `json:"email" protected:"true"`
11+
Database string `json:"database" protected:"true"`
12+
StartCmd string `json:"start_cmd" protected:"true"`
1313
CADir string `json:"ca_dir"`
14-
Demo bool `json:"demo"`
15-
PageSize int `json:"page_size"`
14+
Demo bool `json:"demo" protected:"true"`
15+
PageSize int `json:"page_size" protected:"true"`
1616
GithubProxy string `json:"github_proxy"`
1717
}
1818

0 commit comments

Comments
 (0)