mirror of
https://github.com/webmin/webmin.git
synced 2026-07-25 02:40:37 +01:00
9ceffce70f
ⓘ This tightens local server-side batch file execution in the Users and Groups module. Both user and group batch endpoints now read local batch files through a shared helper that enforces the module `batchdir` ACL, the user’s global file chooser ACL (`root` / `otherdirs`), and the configured `fileunix` read identity. Existing ACLs remain compatible by treating a missing `batchdir` as `/`, while an explicitly blank value denies local server batch files. Regression coverage was added for allowed paths, denied paths, `otherdirs`, missing/blank `batchdir`, symlink escape rejection, and successful local batch reads. ---- Reproduction / verification steps: 1. Create a constrained Webmin user with access to the `Users and Groups` module. 2. Set the user's Global ACL: - Root directory for file browser: `/home/user1` - Other directories to allow: empty - Browse as Unix user: `nobody` 3. Set the user's `Users and Groups` module ACL: - Can view batch file form?: `Yes` - Batch files must be under directory: `/` 4. Create test files on the Webmin host: ```sh sudo mkdir -p /home/user1 echo ROOT_SECRET_MARKER | sudo tee /root/batch-secret.txt >/dev/null sudo chown root:root /root/batch-secret.txt sudo chmod 600 /root/batch-secret.txt echo ALLOWED_BATCH_MARKER | sudo tee /home/user1/allowed.batch >/dev/null sudo chmod 644 /home/user1/allowed.batch sudo ln -sf /root/batch-secret.txt /home/user1/link-secret.batch echo ROOT_ONLY_ALLOWED_MARKER | sudo tee /home/user1/root-only.batch >/dev/null sudo chown root:root /home/user1/root-only.batch sudo chmod 600 /home/user1/root-only.batch ``` 5. Log in to Webmin as the constrained user and request: ```text /useradmin/batch_exec.cgi?source=1&local=/root/batch-secret.txt /useradmin/gbatch_exec.cgi?source=1&local=/root/batch-secret.txt ``` Expected fixed result: ```text Local file location is not allowed ``` 6. Request an allowed readable file: ```text /useradmin/batch_exec.cgi?source=1&local=/home/user1/allowed.batch /useradmin/gbatch_exec.cgi?source=1&local=/home/user1/allowed.batch ``` Expected fixed result: ```text Invalid action at line 1 : ALLOWED_BATCH_MARKER ``` 7. Request a symlink inside the allowed directory that points outside it: ```text /useradmin/batch_exec.cgi?source=1&local=/home/user1/link-secret.batch /useradmin/gbatch_exec.cgi?source=1&local=/home/user1/link-secret.batch ``` Expected fixed result: ```text Local file location is not allowed ``` 8. Request a root-only file inside the allowed directory: ```text /useradmin/batch_exec.cgi?source=1&local=/home/user1/root-only.batch /useradmin/gbatch_exec.cgi?source=1&local=/home/user1/root-only.batch ``` Expected fixed result: ```text Local file not found ``` The fixed behavior confirms that local batch file imports now enforce the configured global file ACL, reject symlink escapes, and read files using the configured Unix identity instead of the privileged Webmin process.
Documentation | FAQ | Security | Screenshots | Forum
About
Webmin is a web-based system administration tool for Unix-like servers, and services with about 1,000,000 yearly installations worldwide. Using it, it is possible to configure operating system internals, such as users, disk quotas, services or configuration files, as well as modify, and control open-source apps, such as BIND DNS Server, Apache HTTP Server, PHP, MySQL, and many more.
Usability can be expanded by installing modules, which can be custom made. Aside from this, there are two other major projects that extend its functionality:
- Virtualmin is a powerful, flexible, most popular, and most comprehensive web-hosting control panel for Linux, and BSD systems, with over 150,000 installations worldwide. It is available in an open-source community-supported version, and a more feature-filled version with premium support;
- Usermin presents and controls a subset of user-centred features, rather than administrator-level tasks.
Webmin includes 116 standard modules, and there are at least as many third-party modules.
Requirements
Perl 5.10 or higher.
Installation
For detailed installation instructions check our guide on webmin.com/download page.
Development
Lead developer
Developers
Contributors
License
Webmin is released under the BSD License.