Improve validation of RPCs that contain passwords

Signed-off-by: Volker Theile <votdev@gmx.de>

Author: votdev

deb/openmediavault/debian/changelog

@@ -3,6 +3,7 @@ openmediavault (7.7.6-1) stable; urgency=medium
   * Add search field to the `Diagnostics | System Logs | Logs` page.
   * Display more information about the last/current scrub run on the
     BTRFS details page.
+  * Improve validation of RPCs that contain passwords.
 
  -- Volker Theile <volker.theile@openmediavault.org>  Fri, 25 Apr 2025 10:22:31 +0200
 

deb/openmediavault/usr/share/openmediavault/datamodels/rpc.certificatemgmt.json

@@ -147,6 +147,7 @@
 			},
 			"password": {
 				"type": "string",
+				"format": "no-multi-line",
 				"required": true
 			}
 		}

deb/openmediavault/usr/share/openmediavault/datamodels/rpc.emailnotification.json

@@ -49,6 +49,7 @@
 			},
 			"password": {
 			    "type": "string",
+				"format": "no-multi-line",
 				"required": true
 			},
 			"primaryemail": {

deb/openmediavault/usr/share/openmediavault/datamodels/rpc.network.json

@@ -633,6 +633,7 @@
 			},
 			"httppassword": {
 			   "type": "string",
+				"format": "no-multi-line",
 			   "required": true
 			},
 			"httpsenable": {
@@ -655,6 +656,7 @@
 			},
 			"httpspassword": {
 			   "type": "string",
+				"format": "no-multi-line",
 			   "required": true
 			},
 			"ftpenable": {
@@ -677,6 +679,7 @@
 			},
 			"ftppassword": {
 			   "type": "string",
+				"format": "no-multi-line",
 			   "required": true
 			}
 		}

deb/openmediavault/usr/share/openmediavault/datamodels/rpc.rsync.json

@@ -206,6 +206,7 @@
 			},
 			"password": {
 				"type": "string",
+				"format": "no-multi-line",
 				"required": true
 			},
 			"sshcertificateref": {

deb/openmediavault/usr/share/openmediavault/datamodels/rpc.rsyncd.json

@@ -100,6 +100,7 @@
 			            },
 			            "password": {
 			                "type": "string",
+							"format": "no-multi-line",
 						    "required": true
 			            }
 			        }

deb/openmediavault/usr/share/openmediavault/datamodels/rpc.session.json

@@ -10,6 +10,7 @@
 			},
 			"password": {
 				"type": "string",
+				"format": "no-multi-line",
 				"required": true
 			}
 		}

deb/openmediavault/usr/share/openmediavault/datamodels/rpc.usermgmt.json

@@ -10,6 +10,7 @@
 			},
 			"password": {
 				"type": "string",
+				"format": "no-multi-line",
 				"required": true
 			}
 		}
@@ -54,6 +55,7 @@
 	        },
 	        "password": {
 	            "type": "string",
+				"format": "no-multi-line",
 				"required": true
 	        },
 	        "email": {
@@ -99,6 +101,7 @@
 		"properties": {
 			"password": {
 				"type": "string",
+				"format": "no-multi-line",
 				"required": false
 			},
 			"email": {
@@ -236,6 +239,7 @@
 		"properties": {
 			"password":{
 				"type": "string",
+				"format": "no-multi-line",
 				"required": true
 			}
 		}

deb/openmediavault/usr/share/openmediavault/unittests/php/test_openmediavault_datamodel_schema.php

@@ -156,4 +156,20 @@ public function testCheckFormatNetbios4() {
 		$schema->checkFormat("FOO]BAR",
 			[ "format" => "netbiosname" ], "field1");
 	}
+
+	/**
+	 * @doesNotPerformAssertions
+	 */
+	public function testCheckFormatNoMultiLine1() {
+		$schema = $this->getSchema();
+		$schema->checkFormat("foo123",
+			[ "format" => "no-multi-line" ], "field1");
+	}
+
+	public function testCheckFormatNoMultiLine2() {
+		$schema = $this->getSchema();
+		$this->expectException(\OMV\Json\SchemaValidationException::class);
+		$schema->checkFormat("foo\r\nbar",
+			[ "format" => "no-multi-line" ], "field1");
+	}
 }

deb/openmediavault/usr/share/php/openmediavault/datamodel/schema.inc

@@ -149,6 +149,13 @@ class Schema extends \OMV\Json\Schema {
 					  $name, $value);
 				}
 				break;
+			case "no-multi-line":
+				if (!preg_match('/^[^\r\n]*$/', $value)) {
+					throw new \OMV\Json\SchemaValidationException(
+					  "%s: The value contains a multi-line content.",
+					  $name);
+				}
+				break;
 			default:
 				throw new \OMV\Json\SchemaException(
 				  "%s: The format '%s' is not defined.",