From 531374049b29b377d73dd327af1fe287480c3cf3 Mon Sep 17 00:00:00 2001
From: root <root@raspberrypi.(none)>
Date: Wed, 24 Jun 2015 22:53:38 +0200
Subject: [PATCH] add security fix to lighttpd

---
 index.php                       | 7 ++-----
 install/lighttpd                | 1 +
 modules/login/denied.php        | 8 ++++++--
 modules/mail/html/mail_test.php | 3 ---
 modules/security/fw/html/fw.php | 6 ++++++
 5 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/index.php b/index.php
index ec0f5d0cf..14e7cfcf3 100755
--- a/index.php
+++ b/index.php
@@ -99,10 +99,10 @@
     <?php if(!isset($_SESSION["user"])) {?>
 	    <form action="" method="post" class="navbar-form navbar-right" >
             <div class="form-group">
-              <input type="text" name="username" placeholder="User" class="form-control input-sm">
+              <input type="text" name="username" placeholder="User" class="form-control input-sm" required="">
             </div>
             <div class="form-group">
-              <input type="password" name="password" placeholder="Password" class="form-control input-sm">
+              <input type="password" name="password" placeholder="Password" class="form-control input-sm" required="">
             </div>
 	    <input type="hidden" name="form_login" value="log">
             <button type="submit" class="btn-xs btn-primary">Sign in</button>
@@ -163,6 +163,3 @@
 <?php 
 }
 ?>
-
-
-
diff --git a/install/lighttpd b/install/lighttpd
index 4e184af0c..fb8c90e8d 100755
--- a/install/lighttpd
+++ b/install/lighttpd
@@ -9,6 +9,7 @@ sed -i -e 's/server.document-root        = \"\/var\/www\"/server.document-root
 # didable dir access
 sed -i '/url.access-deny/d' /etc/lighttpd/lighttpd.conf
 sed -i '$a url.access-deny = ( "~", ".inc", ".dbf", ".db", ".txt", ".rrd" )' /etc/lighttpd/lighttpd.conf
+sed -i '$a $HTTP["url"] =~ "^/modules"  { url.access-deny = ("") }' /etc/lighttpd/lighttpd.conf
 # set url rewrite
 if cat /etc/lighttpd/lighttpd.conf |grep url.rewrite-once 1> /dev/null; then
 echo -e "[ ${GREEN}ok${R} ] lighttpd: Url rewrite exist"
diff --git a/modules/login/denied.php b/modules/login/denied.php
index d3357b828..16a9a0aa3 100755
--- a/modules/login/denied.php
+++ b/modules/login/denied.php
@@ -1,3 +1,7 @@
-<span class="belka">&nbsp info<span class="okno">
+<div class="panel panel-danger">
+<div class="panel-heading">
+<h3 class="panel-title">Warning</h3>
+</div>
+<div class="panel-body">
 <h3>Please login!</h3>
-</span></span>
\ No newline at end of file
+</div></div>
\ No newline at end of file
diff --git a/modules/mail/html/mail_test.php b/modules/mail/html/mail_test.php
index 5f53779c3..c3c27570a 100755
--- a/modules/mail/html/mail_test.php
+++ b/modules/mail/html/mail_test.php
@@ -23,9 +23,6 @@
 <form class="form-horizontal" action="" method="post">
 <fieldset>
 
-<!-- Form Name -->
-<legend>Send test mail</legend>
-
 <!-- Text input-->
 <div class="form-group">
   <label class="col-md-4 control-label" for="user">@</label>  
diff --git a/modules/security/fw/html/fw.php b/modules/security/fw/html/fw.php
index 12d4abb95..18a47bc50 100755
--- a/modules/security/fw/html/fw.php
+++ b/modules/security/fw/html/fw.php
@@ -1,3 +1,9 @@
+<?php 
+if(!isset($_SESSION['user'])){
+header("Location: denied");
+}
+?>
+
 <?php
     $fw_onoff = isset($_POST['fw_onoff']) ? $_POST['fw_onoff'] : '';
     $onoff = isset($_POST['onoff']) ? $_POST['onoff'] : '';