From c4fb6482cc43d3844150f19fc0409c1db9c6542e Mon Sep 17 00:00:00 2001
From: amcmanu3 <mcdeweykp@gmail.com>
Date: Tue, 21 Jun 2022 01:18:19 -0400
Subject: [PATCH 1/8] Fix sec bug with server creation roles

Retain current java version in dropdown.
---
 app/classes/web/panel_handler.py              | 33 ++++++++++++++++---
 app/classes/web/server_handler.py             | 11 ++++++-
 .../templates/panel/server_config.html        |  9 ++++-
 3 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/app/classes/web/panel_handler.py b/app/classes/web/panel_handler.py
index a29908d9..48f93132 100644
--- a/app/classes/web/panel_handler.py
+++ b/app/classes/web/panel_handler.py
@@ -633,6 +633,24 @@ class PanelHandler(BaseHandler):
                         )
                         return
                 page_data["java_versions"] = Helpers.find_java_installs()
+                server_obj: Servers = self.controller.servers.get_server_obj(server_id)
+                current_java = shlex.split(server_obj.execution_command)[0]
+                page_java = []
+                page_data["java_versions"].append("java")
+                page_data["current_java"] = current_java
+                for version in page_data["java_versions"]:
+                    temp_version = version + "/bin/java"
+                    if os.name == "nt":
+                        if version == "java" and current_java != version:
+                            page_java.append(version)
+                        else:
+                            if temp_version != current_java and version != "java":
+                                page_java.append(version)
+                    else:
+                        if version != current_java:
+                            page_java.append(version)
+
+                page_data["java_versions"] = page_java
 
             if subpage == "files":
                 if (
@@ -1371,10 +1389,17 @@ class PanelHandler(BaseHandler):
                 return
             execution_list = shlex.split(execution_command)
             if java_selection:
-                if self.helper.is_os_windows():
-                    execution_list[0] = '"' + java_selection + '/bin/java"'
+                if java_selection != "java":
+                    if (
+                        self.helper.is_os_windows()
+                        and not "/bin/java" in java_selection
+                    ):
+                        if not "/bin/java" in java_selection:
+                            execution_list[0] = '"' + java_selection + '/bin/java"'
+                    else:
+                        execution_list[0] = '"' + java_selection + '"'
                 else:
-                    execution_list[0] = '"' + java_selection + '"'
+                    execution_list[0] = "java"
                 execution_command = ""
                 for item in execution_list:
                     execution_command += item + " "
@@ -1407,7 +1432,7 @@ class PanelHandler(BaseHandler):
                 server_obj.path = server_obj.path
                 server_obj.log_path = server_obj.log_path
                 server_obj.executable = server_obj.executable
-                server_obj.execution_command = server_obj.execution_command
+                server_obj.execution_command = execution_command
                 server_obj.server_ip = server_obj.server_ip
                 server_obj.server_port = server_obj.server_port
                 server_obj.executable_update_url = server_obj.executable_update_url
diff --git a/app/classes/web/server_handler.py b/app/classes/web/server_handler.py
index 4d961ad9..3505e1de 100644
--- a/app/classes/web/server_handler.py
+++ b/app/classes/web/server_handler.py
@@ -17,6 +17,15 @@ logger = logging.getLogger(__name__)
 
 
 class ServerHandler(BaseHandler):
+    def get_user_roles(self):
+        user_roles = {}
+        for user_id in self.controller.users.get_all_user_ids():
+            user_roles_list = self.controller.users.get_user_roles_names(user_id)
+            # user_servers =
+            # self.controller.servers.get_authorized_servers(user.user_id)
+            user_roles[user_id] = user_roles_list
+        return user_roles
+
     @tornado.web.authenticated
     def get(self, page):
         (
@@ -283,7 +292,7 @@ class ServerHandler(BaseHandler):
             if not superuser:
                 user_roles = self.controller.roles.get_all_roles()
             else:
-                user_roles = self.controller.roles.get_all_roles()
+                user_roles = self.get_user_roles()
             server = bleach.clean(self.get_argument("server", ""))
             server_name = bleach.clean(self.get_argument("server_name", ""))
             min_mem = bleach.clean(self.get_argument("min_memory", ""))
diff --git a/app/frontend/templates/panel/server_config.html b/app/frontend/templates/panel/server_config.html
index 6fbfd080..49e5861b 100644
--- a/app/frontend/templates/panel/server_config.html
+++ b/app/frontend/templates/panel/server_config.html
@@ -81,11 +81,18 @@
                 {% end %}
                 <div class="form-group">
                   <label for="java_selection">{{ translate('serverConfig', 'javaVersion', data['lang']) }} <small
-                      class="text-muted ml-1"> - {{ translate('serverConfig', 'javaVersionDesc', data['lang'])
+                      class="text-muted ml-1"> - EXPERIMENTAL -- PLEASE REPORT ANY BUGS &nbsp; {{
+                      translate('serverConfig', 'javaVersionDesc', data['lang'])
                       }}</small> </label>
                   <select class="form-select form-control form-control-lg select-css" id="java_selection"
                     name="java_selection" form="config_form">
+                    {% if data['current_java'] %}
+                    <option value="{{data['current_java']}}">{{data['current_java']}}</option>
                     <option value="">{{ translate('serverConfig', 'javaNoChange', data['lang'])}}</option>
+                    {% else %}
+                    <option value="">{{ translate('serverConfig',
+                      'javaNoChange', data['lang'])}}</option>
+                    {% end %}
                     {% for path in data['java_versions'] %}
                     <option value="{{path}}">{{path}}</option>
                     {% end %}

From e2d5e7cb69a0b6e84ea9b5b9653d7c51bdc56a21 Mon Sep 17 00:00:00 2001
From: Zedifus <zedifus@zediverse.gg>
Date: Tue, 21 Jun 2022 06:26:08 +0100
Subject: [PATCH 2/8] Update changelog !376

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf359074..5a4e255f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,10 +4,11 @@
 
 ### New features
 - Add shutdown on backup feature ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/373))
-- Add detection and dropdown of java versions ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/375))
+- Add experimental detection and dropdown of java versions ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/375))
 ### Bug fixes
 - Backup/Config.json rework for API key hardening ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/369))
 - Fix stack on ping result being falsy ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/371))
+- Fix sec bug with server creation roles ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/376))
 ### Tweaks
 - Spelling mistake fixed in German lang file ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/370))
 - Backup failure warning (Tab text goes red) ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/373))

From 176f5a4004b6fc7b581d39cef0a86dc493598ca9 Mon Sep 17 00:00:00 2001
From: Zedifus <zedifus@zediverse.gg>
Date: Tue, 21 Jun 2022 18:39:20 +0100
Subject: [PATCH 3/8] Add java selection `POST` check

Protect against tampered post requests to front end

Co-authored-by: andrew.charles.mcmanus@gmail.com <andrew.charles.mcmanus@gmail.com>
---
 app/classes/web/panel_handler.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/app/classes/web/panel_handler.py b/app/classes/web/panel_handler.py
index 48f93132..4356e5a3 100644
--- a/app/classes/web/panel_handler.py
+++ b/app/classes/web/panel_handler.py
@@ -1389,6 +1389,21 @@ class PanelHandler(BaseHandler):
                 return
             execution_list = shlex.split(execution_command)
             if java_selection:
+                if not any(
+                    java_selection in path for path in Helpers.find_java_installs()
+                ):
+                    self.redirect(
+                        "/panel/error?error=Attack attempted."
+                        + " A copy of this report is being sent to server owner."
+                    )
+                    self.controller.management.add_to_audit_log_raw(
+                        exec_user["username"],
+                        exec_user["user_id"],
+                        server_id,
+                        f"Attempted to send bad java path for {server_id}."
+                        + " Possible attack. Act accordingly.",
+                        self.get_remote_ip(),
+                    )
                 if java_selection != "java":
                     if (
                         self.helper.is_os_windows()

From 6fe5d16ded446d5215a0318ffb5817184eb0ab07 Mon Sep 17 00:00:00 2001
From: Zedifus <zedifus@zediverse.gg>
Date: Tue, 21 Jun 2022 19:05:56 +0100
Subject: [PATCH 4/8] Remove java selection from bedrock

---
 app/frontend/templates/panel/server_config.html | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/frontend/templates/panel/server_config.html b/app/frontend/templates/panel/server_config.html
index 49e5861b..3ebbfaec 100644
--- a/app/frontend/templates/panel/server_config.html
+++ b/app/frontend/templates/panel/server_config.html
@@ -79,6 +79,7 @@
                     placeholder="{{ translate('serverConfig', 'serverExecutable', data['lang']) }}" required>
                 </div>
                 {% end %}
+                {% if data['server_stats']['server_type'] == "minecraft-java" %}
                 <div class="form-group">
                   <label for="java_selection">{{ translate('serverConfig', 'javaVersion', data['lang']) }} <small
                       class="text-muted ml-1"> - EXPERIMENTAL -- PLEASE REPORT ANY BUGS &nbsp; {{
@@ -98,6 +99,8 @@
                     {% end %}
                   </select>
                 </div>
+                {% end %}
+
                 {% if data['super_user'] %}
                 <div class="form-group">
                   <label for="execution_command">{{ translate('serverConfig', 'serverExecutionCommand', data['lang']) }}
@@ -393,4 +396,4 @@
 
 </script>
 
-{% end %}
\ No newline at end of file
+{% end %}

From 7379545186c4b19f9e056fdf586bf9cc6b553770 Mon Sep 17 00:00:00 2001
From: Zedifus <zedifus@zediverse.gg>
Date: Tue, 21 Jun 2022 19:28:53 +0100
Subject: [PATCH 5/8] Strip empty entry in update-alternatives output

Catch ValueError on missing end quote in java execution command
---
 app/classes/web/panel_handler.py | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/app/classes/web/panel_handler.py b/app/classes/web/panel_handler.py
index 4356e5a3..b9c29136 100644
--- a/app/classes/web/panel_handler.py
+++ b/app/classes/web/panel_handler.py
@@ -647,8 +647,9 @@ class PanelHandler(BaseHandler):
                             if temp_version != current_java and version != "java":
                                 page_java.append(version)
                     else:
-                        if version != current_java:
-                            page_java.append(version)
+                        if len(version) > 0:
+                            if version != current_java:
+                                page_java.append(version)
 
                 page_data["java_versions"] = page_java
 
@@ -1387,8 +1388,15 @@ class PanelHandler(BaseHandler):
             server_id = self.check_server_id()
             if server_id is None:
                 return
-            execution_list = shlex.split(execution_command)
             if java_selection:
+                try:
+                    execution_list = shlex.split(execution_command)
+                except ValueError:
+                    self.redirect(
+                        "/panel/error?error=Invalid execution command. Java path"
+                        " must be surrounded by quotes."
+                        " (Are you missing a closing quote?)"
+                    )
                 if not any(
                     java_selection in path for path in Helpers.find_java_installs()
                 ):

From 28e313ee1d6a3229caaa49dc77d3d62ab52d04ba Mon Sep 17 00:00:00 2001
From: Zedifus <zedifus@zediverse.gg>
Date: Tue, 21 Jun 2022 19:53:23 +0100
Subject: [PATCH 6/8] Revert back to 'Do not override' as default

---
 app/classes/web/panel_handler.py              | 20 ++++---------------
 .../templates/panel/server_config.html        | 14 ++++---------
 app/translations/en_EN.json                   |  4 ++--
 3 files changed, 10 insertions(+), 28 deletions(-)

diff --git a/app/classes/web/panel_handler.py b/app/classes/web/panel_handler.py
index b9c29136..a06fc02a 100644
--- a/app/classes/web/panel_handler.py
+++ b/app/classes/web/panel_handler.py
@@ -634,22 +634,14 @@ class PanelHandler(BaseHandler):
                         return
                 page_data["java_versions"] = Helpers.find_java_installs()
                 server_obj: Servers = self.controller.servers.get_server_obj(server_id)
-                current_java = shlex.split(server_obj.execution_command)[0]
                 page_java = []
                 page_data["java_versions"].append("java")
-                page_data["current_java"] = current_java
                 for version in page_data["java_versions"]:
-                    temp_version = version + "/bin/java"
                     if os.name == "nt":
-                        if version == "java" and current_java != version:
-                            page_java.append(version)
-                        else:
-                            if temp_version != current_java and version != "java":
-                                page_java.append(version)
+                        page_java.append(version)
                     else:
                         if len(version) > 0:
-                            if version != current_java:
-                                page_java.append(version)
+                            page_java.append(version)
 
                 page_data["java_versions"] = page_java
 
@@ -1413,12 +1405,8 @@ class PanelHandler(BaseHandler):
                         self.get_remote_ip(),
                     )
                 if java_selection != "java":
-                    if (
-                        self.helper.is_os_windows()
-                        and not "/bin/java" in java_selection
-                    ):
-                        if not "/bin/java" in java_selection:
-                            execution_list[0] = '"' + java_selection + '/bin/java"'
+                    if self.helper.is_os_windows():
+                        execution_list[0] = '"' + java_selection + '/bin/java"'
                     else:
                         execution_list[0] = '"' + java_selection + '"'
                 else:
diff --git a/app/frontend/templates/panel/server_config.html b/app/frontend/templates/panel/server_config.html
index 3ebbfaec..f8851058 100644
--- a/app/frontend/templates/panel/server_config.html
+++ b/app/frontend/templates/panel/server_config.html
@@ -81,21 +81,15 @@
                 {% end %}
                 {% if data['server_stats']['server_type'] == "minecraft-java" %}
                 <div class="form-group">
-                  <label for="java_selection">{{ translate('serverConfig', 'javaVersion', data['lang']) }} <small
-                      class="text-muted ml-1"> - EXPERIMENTAL -- PLEASE REPORT ANY BUGS &nbsp; {{
-                      translate('serverConfig', 'javaVersionDesc', data['lang'])
-                      }}</small> </label>
+                  <label for="java_selection">{{ translate('serverConfig', 'javaVersion', data['lang']) }}
+                    <small class="text-muted ml-1">{{ translate('serverConfig', 'javaVersionDesc', data['lang']) }}</small>
+                  </label>
                   <select class="form-select form-control form-control-lg select-css" id="java_selection"
                     name="java_selection" form="config_form">
-                    {% if data['current_java'] %}
-                    <option value="{{data['current_java']}}">{{data['current_java']}}</option>
-                    <option value="">{{ translate('serverConfig', 'javaNoChange', data['lang'])}}</option>
-                    {% else %}
                     <option value="">{{ translate('serverConfig',
                       'javaNoChange', data['lang'])}}</option>
-                    {% end %}
                     {% for path in data['java_versions'] %}
-                    <option value="{{path}}">{{path}}</option>
+                      <option value="{{path}}">{{path}}</option>
                     {% end %}
                   </select>
                 </div>
diff --git a/app/translations/en_EN.json b/app/translations/en_EN.json
index 6d53e73a..dae806f3 100644
--- a/app/translations/en_EN.json
+++ b/app/translations/en_EN.json
@@ -302,7 +302,7 @@
         "serverExecutable": "Server Executable",
         "serverExecutableDesc": "The server's executable file",
         "javaVersion": "Override current Java Version",
-        "javaVersionDesc": "If we've been able to find local java installs. (Windows 'Oracle' only)",
+        "javaVersionDesc": "If you're going to override java. Make sure your current java path in 'execution command' is wrapped in quotes (default 'java' variable excluded)",
         "javaNoChange": "Do Not Override",
         "serverExecutionCommand": "Server Execution Command",
         "serverExecutionCommandDesc": "What will be launched in a hidden terminal",
@@ -534,4 +534,4 @@
         "userSettings": "User Settings",
         "uses": "Number of uses allowed (-1==No Limit)"
     }
-}
\ No newline at end of file
+}

From a6d9b81775cbbd71802c82706d1aabe7cc6d7c05 Mon Sep 17 00:00:00 2001
From: Zedifus <zedifus@zediverse.gg>
Date: Tue, 21 Jun 2022 20:11:01 +0100
Subject: [PATCH 7/8] Add execution cmd -display only- for non supers

---
 app/frontend/templates/panel/server_config.html | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/frontend/templates/panel/server_config.html b/app/frontend/templates/panel/server_config.html
index f8851058..b2c02416 100644
--- a/app/frontend/templates/panel/server_config.html
+++ b/app/frontend/templates/panel/server_config.html
@@ -104,6 +104,12 @@
                     value="{{ data['server_stats']['server_id']['execution_command']  }}"
                     placeholder="{{ translate('serverConfig', 'serverExecutionCommand', data['lang']) }}" required>
                 </div>
+                {% else %}
+                <label for="execution_command">{{ translate('serverConfig', 'serverExecutionCommand', data['lang']) }}
+                <div class="card-header header-sm d-flex justify-content-between align-items-center">
+                  <span style="color: gray;">{{ data['server_stats']['server_id']['execution_command']  }}</span> 🔒
+                </div>
+                <br>
                 {% end %}
 
                 <div class="form-group">

From e5b0c93de77fd79b2ce8101583e38ff2bc65c2e1 Mon Sep 17 00:00:00 2001
From: Zedifus <zedifus@zediverse.gg>
Date: Tue, 21 Jun 2022 20:13:30 +0100
Subject: [PATCH 8/8] Update changelog

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5a4e255f..a0f3def7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### New features
 - Add shutdown on backup feature ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/373))
-- Add experimental detection and dropdown of java versions ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/375))
+- Add detection and dropdown of java versions ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/375))
 ### Bug fixes
 - Backup/Config.json rework for API key hardening ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/369))
 - Fix stack on ping result being falsy ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/371))