security fix: CP-26: Manage Website – File Manager – Upload

Author: usmannasir

install/install.py

@@ -664,6 +664,16 @@ def fixCyberPanelPermissions(self):
         command = 'mount -o remount,rw,hidepid=2 /proc'
         preFlightsChecks.call(command, self.distro, command, command, 1, 0, os.EX_OSERR)
 
+        ## symlink protection
+
+        writeToFile = open('/usr/lib/sysctl.d/50-default.conf', 'a')
+        writeToFile.writelines('fs.protected_hardlinks = 1\n')
+        writeToFile.writelines('fs.protected_symlinks = 1\n')
+        writeToFile.close()
+
+        command = 'sysctl --system'
+        preFlightsChecks.call(command, self.distro, command, command, 1, 0, os.EX_OSERR)
+
         ###
 
     def install_unzip(self):

plogical/upgrade.py

@@ -2097,6 +2097,16 @@ def generate_pass(length=14):
             command = 'chmod 750 /usr/local/lsws/logs'
             Upgrade.executioner(command, 0)
 
+            ## symlink protection
+
+            writeToFile = open('/usr/lib/sysctl.d/50-default.conf', 'a')
+            writeToFile.writelines('fs.protected_hardlinks = 1\n')
+            writeToFile.writelines('fs.protected_symlinks = 1\n')
+            writeToFile.close()
+
+            command = 'sysctl --system'
+            Upgrade.executioner(command, 0)
+
             Upgrade.stdOut("Permissions updated.")
 
         except BaseException as msg: