HEX
Server: Apache
System: Linux www3.pit.tblive.com 5.14.0-687.38.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Aug 12 17:19:12 EDT 2026 x86_64
User: awaldron (1020)
PHP: 8.1.34
Disabled: exec,passthru,shell_exec,system
Upload Files
File: //opt/cloudlinux/venv/lib/python3.11/site-packages/xray/manager/__pycache__/custom.cpython-311.pyc
�

�Pcj�&���dZddlZddlmZddlmZddlmZddlm	Z
ddlmZdd	l
mZd
dlmZd
dlmZmZd
d
lmZd
dlmZmZGd�de��ZdS)zZ
This module contains classes implementing X-Ray Manager behaviour
for custom integration
�N)�ChainMap)�Optional)�	PublicApi)�gettext)�
phpinfo_utils�)�BaseManager�)�is_allowed_ini_path)�XRayManagerError�XRayMissingDomain)�
DomainInfo)�user_mode_verification�with_fpm_reload_restrictedc���eZdZdZddddddddddddddd�Z�fd�Zdefd�Zed���Z	de
fd�Zee
d	edefd
�����Zdedefd�Zd
edeefd�Zdededefd�Zdedefd�Zdedef�fd�Z�xZS)�
CustomManagerz0
    Manager supporting integration scripts
    N)�54�55�56�70�71�72�73�74�80�81�82�83�84�85c����t��j|i|��t��|_|jr|���|_dSttd�����)Nz.X-Ray is not supported by control panel vendor)	�super�__init__r�api�is_xray_integrated�get_all_domains�all_domainsr�_)�self�args�kwargs�	__class__s   ��J/opt/cloudlinux/venv/lib64/python3.11/site-packages/xray/manager/custom.pyr#zCustomManager.__init__2sg��������$�)�&�)�)�)��;�;����"�	X�#�3�3�5�5�D����"�1�%U�#V�#V�W�W�W��returnc�6�t|j|j��S)za
        Get supported PHP versions
        :return: dict with custom supported versions
        )r�VERSIONS�VERSIONS_CUSTOM�r)s r-�supported_versionsz CustomManager.supported_versions;s��
��
�t�';�<�<�<r.c�v�|j���}|j}|�dS|�dd��S)zN
        Check the X-Ray feature status through the panel_info script
        NT�xrayF)r$�
panel_info�supported_cl_features�get)r)�_info�featuress   r-r%z CustomManager.is_xray_integratedBs>��
��#�#�%�%���.�����4��|�|�F�E�*�*�*r.c�8�|j�d���S)z9
        Collect domains from integration script
        T)�with_php)r$�domainsr3s r-r&zCustomManager.get_all_domainsNs���x�����.�.�.r.�domain_namec�j�	|j|}n;#t$r.|j�dd|i���t	|���wxYw|jr]t
j|j||j	j
���}t||�d��|j
d|j|j���S|�|j	j|j��}t||j|j	j
|j	j|j	j|���}|j�d	||j|j��|S)
z<
        Retrieve PHP setting for given domain_name
        z#Domain does not exist on the serverr?)�extra)�domain�trusted_php_version�T)�name�panel_php_version�php_ini_scan_dir�is_selector_applied�user�	panel_fpm)rErIrFrJ�	is_native�ini_pathz@Retrieved domain info: domain %s owned by %s uses php version %s)r'�KeyError�logger�warningr
�phpinfo_moder�get_php_configuration�owner�php�versionr�get_full_php_version�absolute_ini_scan_dir�
is_php_fpm�_validate_ini_pathrL�fpmrK�inforIrF)r)r?�domain_conf�configrL�domain_infos      r-�get_domain_infozCustomManager.get_domain_infoTsi��	1��*�;�7�K�K���	1�	1�	1��K��� E�m�]h�Mi��j�j�j�#�K�0�0�0�	1������!	�"�8��!�"�%0�O�$;�
�
�
�F�� �"(�"=�"=�b�"A�"A�!'�!=�%)� �&� �+�
�
�
�

��.�.�{��/G��IZ�[�[�H�$� � �&�"-�/�"9�%�/�-�%�/�3�!�
���K�	
����N�����)�		
�	
�	
��s	�
�8Ar]c� �|jo|jS)z�
        Check if selector is enabled specifically for custom panels
        Required to be implemented by child classes
        :param domain_info: a DomainInfo object
        :return: True if yes, False otherwise
        )rKrJ�r)r]s  r-�panel_specific_selector_enabledz-CustomManager.panel_specific_selector_enabled�s���$�B�[�-B�)B�Br.�dom_infoc��|jS)z+
        Retrieve FPM service name
        )rJ)r)rbs  r-�fpm_service_namezCustomManager.fpm_service_name�s
���!�!r.rLrRc��|s|Stj�|��}t|��s:|j�d|��t
td��|z���tj	||��s"tj
tj|z|��r|Stj
tj|��stj
tj|��r:|j�d|��t
td��|z���	tj
|��j}n#t$r|cYSwxYw|dkr|S|j�d||��t
td��|z���)u�Owner-bind the vendor-supplied ini_path before it steers a root write.

        In non-phpinfo mode the custom integration reports ini_path verbatim and
        the only downstream guard is the broad is_allowed_ini_path prefix
        allowlist, which admits serverwide (/etc/php.d) and per-tenant
        (/var/cagefs/..., /etc/users/<user>) trees. Without owner-binding an
        allowlisted-but-foreign path would let the root xray.ini write land in
        another tenant's jail. Accept the path only when it is the owner's own
        subtree or an operator-controlled root-owned INI directory; reject a path
        that resolves outside the allowlist, into a foreign tenant's per-user
        tree, or onto a dir owned by a different unprivileged user.

        Returns the CANONICAL (realpath'd) directory, not the raw vendor string.
        The write-time owner binding (Task._ini_dir_validator / unified_write)
        classifies ini_location as per-tenant vs global from this value and then
        re-checks the PINNED inode against it, so it must be canonical here — a
        raw symlink path would misclassify and either over-reject a legitimate
        own-subtree symlink or fail to bind a per-tenant location.
        z.Rejected custom ini_path outside allowlist: %sz&ini_location outside allowed paths: %sz6Rejected custom ini_path bound to a foreign tenant: %srz7Rejected custom ini_path owned by uid %s (not root): %s)�os�path�realpathrrNrOrr(r�_is_own_cagefs_subtree�
_is_within�_USERS_INI_ROOT�_CAGEFS_ROOT�stat�st_uid�OSError)r)rLrR�resolvedrns     r-rXz CustomManager._validate_ini_path�s���(�	��O��7�#�#�H�-�-��"�8�,�,�	[��K��� P�RZ�[�[�[�"�1�%M�#N�#N�QY�#Y�Z�Z�Z��/��x�@�@�	�M�D\��)�E�1�8�E
�E
�	��O��#�M�$>��I�I�	[�]�Me��)�8�N
�N
�	[�
�K��� X�Zb�c�c�c�"�1�%M�#N�#N�QY�#Y�Z�Z�Z�	��W�X�&�&�-�F�F���	�	�	��O�O�O�	�����Q�;�;��O�����U�W]�_g�h�h�h��q�!I�J�J�X�U�V�V�Vs�D9�9E�Ec��|jS)zL
        Path to additional .ini files specific custom panel getter
        )rLr`s  r-�	_ini_pathzCustomManager._ini_path�s
���#�#r.c�j��|jr|jSt���|��}|�d��rm|j�d��sS|j}d|j��|_	|jp|}n#t$rYnwxYw||_|j�d|��|S)a�
        Resolve a path to directory for additional ini file.
        It depends on version set for domain and on selector
        NOTE:
        This method is overrided to manage php.d.location=selector resolving.
        In custom integration we do not know if PHP version is alt or not,
        it is set as just two digits.
        Thus, we only could rely on resolved path -- if it is '/opt/alt'.
        :param domain_info: a DomainInfo object
        :return: path to directory for ini files
        z/opt/altzalt-phpzIni path re-resolved as %s)	rGr"�get_ini_path�
startswithrF�phpd_location_ini_path�
ValueErrorrNrZ)r)r]rL�saved_panel_phpr,s    �r-rtzCustomManager.get_ini_path�s�����'�	0��/�/��7�7�'�'��4�4�����z�*�*�		E�;�3P�3[�3[�\e�3f�3f�		E�)�;�O�,U�k�6S�,U�,U�K�)�
�&�=�I������
�
�
���
����-<�K�)��K���9�8�D�D�D��s�7	B�
B�
B)�__name__�
__module__�__qualname__�__doc__r2r#rr4�propertyr%�dictr&rr�strrr^�boolrarrdrXrrrt�
__classcell__)r,s@r-rrs����������
����������������O�"X�X�X�X�X�=�H�=�=�=�=��	+�	+��X�	+�/��/�/�/�/� ��3�3�3�:�3�3�3��� ��3�jC�:�C�$�C�C�C�C�"��"���
�"�"�"�"�3W�3�3W�s�3W�s�3W�3W�3W�3W�j$�Z�$�C�$�$�$�$��
��s����������r.r)r|rf�collectionsr�typingr�clcommon.cpapi.plugins.vendorsrr6rr(�
xray.internalr�baser	�internal.constantsr�internal.exceptionsrr
�internal.typesr�internal.user_plugin_utilsrrr�r.r-�<module>r�s����

�	�	�	� � � � � � �������4�4�4�4�4�4�������'�'�'�'�'�'�������4�4�4�4�4�4�E�E�E�E�E�E�E�E�'�'�'�'�'�'�[�[�[�[�[�[�[�[�U�U�U�U�U�K�U�U�U�U�Ur.