feat: add openBaseDir for php website config (#8866)

Author: zhengkunwang223

agent/app/api/v2/website.go

@@ -1101,3 +1101,23 @@ func (b *BaseApi) ClearProxyCache(c *gin.Context) {
 	}
 	helper.Success(c)
 }
+
+// @Tags Website
+// @Summary Operate Cross Site Access
+// @Accept json
+// @Param request body request.CrossSiteAccessOp true "request"
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /websites/crosssite [post]
+func (b *BaseApi) OperateCrossSiteAccess(c *gin.Context) {
+	var req request.CrossSiteAccessOp
+	if err := helper.CheckBindAndValidate(&req, c); err != nil {
+		return
+	}
+	if err := websiteService.OperateCrossSiteAccess(req); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}

agent/app/dto/request/website.go

@@ -289,3 +289,8 @@ type WebsiteProxyDel struct {
 	ID   uint   `json:"id" validate:"required"`
 	Name string `json:"name" validate:"required"`
 }
+
+type CrossSiteAccessOp struct {
+	WebsiteID uint   `json:"websiteID" validate:"required"`
+	Operation string `json:"operation" validate:"required,oneof=Enable Disable"`
+}

agent/app/dto/response/website.go

@@ -15,6 +15,7 @@ type WebsiteDTO struct {
 	RuntimeName   string `json:"runtimeName"`
 	RuntimeType   string `json:"runtimeType"`
 	SiteDir       string `json:"siteDir"`
+	OpenBaseDir   bool   `json:"openBaseDir"`
 }
 
 type WebsiteRes struct {

agent/app/service/website.go

@@ -124,6 +124,8 @@ type IWebsiteService interface {
 	GetWebsiteResource(websiteID uint) ([]response.Resource, error)
 	ListDatabases() ([]response.Database, error)
 	ChangeDatabase(req request.ChangeDatabase) error
+
+	OperateCrossSiteAccess(req request.CrossSiteAccessOp) error
 }
 
 func NewIWebsiteService() IWebsiteService {
@@ -428,7 +430,7 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 				return err
 			}
 			if runtime.Type == constant.RuntimePHP && runtime.Resource == constant.ResourceAppstore {
-				createPHPConfig(website)
+				createOpenBasedirConfig(website)
 			}
 		}
 		tx, ctx := helper.GetTxAndContext()
@@ -573,6 +575,9 @@ func (w WebsiteService) GetWebsite(id uint) (response.WebsiteDTO, error) {
 		}
 		res.RuntimeType = runtime.Type
 		res.RuntimeName = runtime.Name
+		if runtime.Type == constant.RuntimePHP {
+			res.OpenBaseDir = files.NewFileOp().Stat(path.Join(GetSitePath(website, SiteIndexDir), ".user.ini"))
+		}
 	}
 	return res, nil
 }
@@ -3278,3 +3283,18 @@ func (w WebsiteService) ChangeDatabase(req request.ChangeDatabase) error {
 	website.DbType = req.DatabaseType
 	return websiteRepo.Save(context.Background(), &website)
 }
+
+func (w WebsiteService) OperateCrossSiteAccess(req request.CrossSiteAccessOp) error {
+	website, err := websiteRepo.GetFirst(repo.WithByID(req.WebsiteID))
+	if err != nil {
+		return err
+	}
+	if req.Operation == constant.StatusEnable {
+		createOpenBasedirConfig(&website)
+	}
+	if req.Operation == constant.StatusDisable {
+		fileOp := files.NewFileOp()
+		return fileOp.DeleteFile(path.Join(GetSitePath(website, SiteIndexDir), ".user.ini"))
+	}
+	return nil
+}

agent/app/service/website_utils.go

@@ -349,11 +349,11 @@ func createAllWebsitesWAFConfig(websites []model.Website) error {
 	return nil
 }
 
-func createPHPConfig(website *model.Website) {
+func createOpenBasedirConfig(website *model.Website) {
 	fileOp := files.NewFileOp()
 	userIniPath := path.Join(GetSitePath(*website, SiteIndexDir), ".user.ini")
 	_ = fileOp.CreateFile(userIniPath)
-	_ = fileOp.SaveFile(userIniPath, fmt.Sprintf("open_basedir=/www/sites/%s/index", website.Alias), 0644)
+	_ = fileOp.SaveFile(userIniPath, fmt.Sprintf("open_basedir=/www/sites/%s/index:/tmp/", website.Alias), 0644)
 }
 
 func createWafConfig(website *model.Website, domains []model.WebsiteDomain) error {

agent/router/ro_website.go

@@ -84,5 +84,7 @@ func (a *WebsiteRouter) InitRouter(Router *gin.RouterGroup) {
 		websiteRouter.GET("/resource/:id", baseApi.GetWebsiteResource)
 		websiteRouter.GET("/databases", baseApi.GetWebsiteDatabase)
 		websiteRouter.POST("/databases", baseApi.ChangeWebsiteDatabase)
+
+		websiteRouter.POST("/crosssite", baseApi.OperateCrossSiteAccess)
 	}
 }

frontend/src/api/interface/website.ts

@@ -36,6 +36,7 @@ export namespace Website {
         appName: string;
         runtimeName: string;
         runtimeType: string;
+        openBaseDir: boolean;
     }
     export interface WebsiteRes extends CommonModel {
         protocol: string;
@@ -646,4 +647,9 @@ export namespace Website {
         databaseID: number;
         databaseType: string;
     }
+
+    export interface CrossSiteAccessOp {
+        websiteID: number;
+        operation: string;
+    }
 }

frontend/src/api/modules/website.ts

@@ -343,3 +343,7 @@ export const operateCustomRewrite = (req: Website.CustomRewirte) => {
 export const listCustomRewrite = () => {
     return http.get<string[]>(`/websites/rewrite/custom`);
 };
+
+export const operateCrossSiteAccess = (req: Website.CrossSiteAccessOp) => {
+    return http.post(`/websites/crosssite`, req);
+};

frontend/src/lang/modules/en.ts

@@ -2476,6 +2476,9 @@ const message = {
         useProxy: 'Use Proxy',
         useProxyHelper: 'Use the proxy server address in the panel settings',
         westCN: 'West Digital',
+        openBaseDir: 'Prevent Cross-Site Attacks',
+        openBaseDirHelper:
+            'open_basedir is used to restrict the PHP file access path, which helps prevent cross-site access and enhance security',
     },
     php: {
         short_open_tag: 'Short tag support',

frontend/src/lang/modules/ja.ts

@@ -2382,6 +2382,9 @@ const message = {
         useProxy: 'プロキシを使用',
         useProxyHelper: 'パネル設定のプロキシサーバーアドレスを使用',
         westCN: '西部デジタル',
+        openBaseDir: 'クロスサイト攻撃を防ぐ',
+        openBaseDirHelper:
+            'open_basedir は PHP ファイルのアクセスパスを制限し、クロスサイトアクセスを防ぎセキュリティを向上させるために使用されます',
     },
     php: {
         short_open_tag: '短いタグサポート',