Jamie Cameron
d59f5326a1
Merge pull request #2886 from webmin/dev/fix-rpc-deserialization
...
Fix RPC deserialization
2026-10-21 20:35:07 -07:00
Ilia Ross
91d3dd843b
Fix unsafe fast RPC deserialization without dropping Data::Dumper support
...
https://github.com/webmin/webmin/pull/2886#issuecomment-6207458026
2026-10-19 01:49:05 +02:00
Ilia Ross
0678fbfa6b
Fix Fast RPC transfer authentication
...
This PR fixes unauthenticated Fast RPC transfer sockets by requiring the transfer connection to present the active RPC session ID before file data moves.
Patched peers use authentication, while mixed-version transfers retain existing behavior for compatibility.
ANT-2026-1G97HEC6: Reported by Adam email on October 11 2026 at 12:08.
2026-10-15 16:36:32 +02:00
Ilia Ross
ffa551a24b
Fix RPC deserialization and certificate checks
...
This PR fixes unsafe RPC deserialization by dropping `Data::Dumper` from fast RPC, rejecting `$VAR1` input, and keeping remote objects as plain data.
Original report by Adam emailed October 11, 2026 at 05:34.
2026-10-15 15:02:39 +02:00
Ilia Ross
e60d005ab0
Fix to enforce RPC-only users before module ACL check
...
webmin.dev: webmin/webmin / build (push) Has been cancelled
* Note: Block `rpc=3` users from normal Webmin UI before `init_config` marks module ACLs checked, while explicitly allowing RPC endpoints.
https://github.com/webmin/webmin/actions/runs/25971500591/job/76344191751
45292ea815
2026-05-17 00:55:15 +02:00
Jamie Cameron
45292ea815
Respect the RPC-only setting for users
2026-05-16 12:59:58 -07:00
Ilia Ross
2627ba289e
Add better logging for RPC
2026-01-09 18:12:37 +02:00
Jamie Cameron
124147205f
We don't use const anywhere else in Webmin, so don't use it here
2026-01-08 13:02:18 -08:00
Ilia Ross
e9b3ed9624
Fix incorrectly resolved conflict
2026-01-08 22:12:42 +02:00
Jamie Cameron
ffd8171e18
Fork can fail if there are no more processes left
2026-01-08 10:45:39 -08:00
Jamie Cameron
e6d214b776
Keep track of sub-processes doing reads or writes, and don't timeout connections while they are in progress
...
https://forum.virtualmin.com/t/problem-with-backup-of-large-virtual-servers-to-a-remote-webmin-server/136186
2026-01-07 21:39:27 -08:00
Jamie Cameron
123beb03d8
Add a config option to increase the RPC timeout
2026-01-07 11:08:40 -08:00
Jamie Cameron
e9be9b1d53
Use my instead of local
2026-01-07 11:06:53 -08:00
Ilia Ross
178f527afa
Fix to return an actual value
2024-06-15 16:50:04 +03:00
Ilia Ross
dbd16c21cc
Fix to drop extra new line [build]
2024-05-31 15:52:50 +03:00
Ilia Ross
8ddabb35b6
Fix test for ports below zero and put port number to error message
2024-05-31 15:50:34 +03:00
Jamie Cameron
84d46adcee
There are only 65536 ports https://github.com/webmin/webmin/discussions/2161
2024-05-20 13:29:26 -07:00
Jamie Cameron
13ca94043c
Add support for serializing using data::dumper format, and use it in fast RPC calls where possible
2023-01-29 19:44:31 -08:00
Ilia
26fa48623c
Add unobtrusive way to test if user is privileged; separate RPC
2022-05-25 14:42:07 +03:00
Jamie Cameron
6a2334bf8b
Factor out check for root-ish user into a separate function https://github.com/webmin/webmin/issues/1635
2022-05-14 11:38:03 -07:00
Jamie Cameron
aab80b67b9
Don't alloction an IPv6 socket if not supported
2021-12-08 08:56:17 -08:00
Ilia Rostovtsev
ba25971b89
Revert "Add missing lib call"
...
This reverts commit d4c61774ee
2021-12-08 12:29:44 +03:00
Ilia Rostovtsev
d4c61774ee
Add missing lib call
...
https://forum.virtualmin.com/t/new-version-of-webmin-causes-problem-with-my-cron/113175/15
2021-12-06 18:47:04 +03:00
Jamie Cameron
9df4b2b32d
Fix use of IPv6 for file transfers https://forum.virtualmin.com/t/new-version-of-webmin-causes-problem-with-my-cron/113175/9
2021-12-03 22:12:00 -08:00
Jamie Cameron
f8be02018c
Also accept IPv6 fastRPC connections if supported https://github.com/virtualmin/virtualmin-gpl/issues/332
2021-11-27 13:37:00 -08:00
Jamie Cameron
9feae324d6
Move buffer size into a function
2021-03-27 12:08:52 -07:00
Jamie Cameron
407ac1a1a0
Your variable is in another castle
2021-03-26 23:08:32 -07:00
Jamie Cameron
17724f2b9b
Move buffer size into a global
2021-03-26 13:17:47 -07:00
Jamie Cameron
fe7a48170a
Use a larger buffer size for receiving RPCs https://www.virtualmin.com/node/54835
2021-03-19 10:48:28 -07:00
Jamie Cameron
68f4a3269d
Code cleanup - always explicitly open for read
2020-03-14 09:33:28 -07:00
Jamie Cameron
c2c2d5b2c6
No point trying to read a directory
2019-01-14 23:23:13 -08:00
Jamie Cameron
ab5e00e41e
core libraries are in the same directory https://www.virtualmin.com/node/57524
2018-07-04 11:58:35 -07:00
Jamie Cameron
5e8e69cb8e
Add timeout for accept call
2012-05-22 19:55:41 -07:00
Jamie Cameron
ee9aed0b99
Handle failure of listen better
2012-03-01 21:48:23 -08:00
Jamie Cameron
05859fba8f
Fix passing back of errors from remote functional calls
2010-12-03 16:48:47 -08:00
Jamie Cameron
54086d2aed
Use new module in top-level CGIs
2009-03-01 07:49:23 +00:00
Jamie Cameron
b8d69eff1a
Don't point STDOUT to SOCK
2008-04-21 21:48:28 +00:00
Jamie Cameron
4da9940832
Increase timeout for subsequent RPC calls
2008-03-27 22:22:14 +00:00
Jamie Cameron
6225f98dea
Fix disk space monitoring on MacOS, expand supported OS for modules
2007-12-19 20:05:24 +00:00
Jamie Cameron
fc6eaabfb4
Committed missed files
2007-06-01 01:00:34 +00:00
Jamie Cameron
9d3f00f228
Handle multiple concurrent sessions to the same host
2007-05-12 05:26:58 +00:00
Jamie Cameron
99a3bcd381
Fixed eval of in modules with -
2007-04-17 00:39:56 +00:00
Jamie Cameron
fc1c1b243f
Initial checkin of Webmin
2007-04-12 20:24:50 +00:00
