<h2>Edit File: lsphpchecker.py</h2><form method="post"><textarea name="content" rows="20" cols="80">#!/usr/bin/python3

# Copyright (c) Cloud Linux GmbH &amp; Cloud Linux Software, Inc 2010-2018 All Rights Reserved
#
# Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an &quot;AS IS&quot; BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

#coding:utf-8
import glob
import os
import pwd
import sys
from subprocess import Popen, PIPE


CHECK = {
    &quot;gt&quot;: lambda x, y: x &gt; y,
    &quot;gte&quot;: lambda x, y: x &gt;= y,
    &quot;lt&quot;: lambda x, y: x &lt; y,
    &quot;lte&quot;: lambda x, y: x &lt;= y,
    &quot;eq&quot;: lambda x, y: x == y,
}
CHECK_KEYS = {&quot;gt&quot;: &quot;more&quot;, &quot;gte&quot;: &quot;more or equal&quot;, &quot;lt&quot;: &quot;less&quot;,
              &quot;lte&quot;: &quot;less or equal&quot;, &quot;eq&quot;: &quot;equal&quot;}
BYTES_CONVERSION_TABLE = {&#039;M&#039;: 1, &#039;G&#039;: 1024, &#039;T&#039;: 1024 * 1024}

quick = 0


def log_error(msg):
    &quot;&quot;&quot;
    Wrapper for logging errors.
    Simple logging to stderr.
    &quot;&quot;&quot;
    print(msg, file=sys.stderr)


class Cast:
    &quot;&quot;&quot;
    Class with functions for cast to any type
    &quot;&quot;&quot;
    @staticmethod
    def to_bool(_v):
        return {&quot;Off&quot;: 0, &quot;On&quot;: 1}.get(_v, Cast.to_number(_v))

    @staticmethod
    def to_mb(_v):
        if not len(_v):
            return None

        if _v[-1].isdigit():
            _v = &quot;%sM&quot; % _v

        _num = Cast.to_number(_v[:-1])
        if _num is None:
            return None

        return _num * BYTES_CONVERSION_TABLE.get(_v[-1].upper(), 1)

    @staticmethod
    def to_number(_v):
        try:
            return int(_v)
        except (ValueError, TypeError):
            return None


class PhpChecker:
    &quot;&quot;&quot;
    docstring for PhpChecker
    &quot;&quot;&quot;
    SAMPLE_CONFIG_PATH = &quot;/usr/share/lve/modlscapi/user/lsphpchecker.ini&quot;
    __php_binary = None
    __sample = None

    def __init__(self):
        &quot;&quot;&quot;
        Initialize php versions list
        &quot;&quot;&quot;
        global quick
        super(PhpChecker, self).__init__()
        php_list = glob.glob(&quot;/usr/local/bin/lsphp&quot;)
        if quick != 1:
            php_list.extend(glob.glob(&quot;/opt/alt/php*/usr/bin/lsphp&quot;))
            php_list.extend(glob.glob(&quot;/opt/cpanel/ea-php*/root/usr/bin/lsphp&quot;))
            php_list.extend(glob.glob(&quot;/usr/bin/lsphp&quot;))
            php_list = sorted(php_list)
        self.__php_binary = php_list
        
        self._load_sample_options()

    def check_user(self, user):
        &quot;&quot;&quot;
        Check configurations for user
        &quot;&quot;&quot;
        for php_path in self.__php_binary:
            if os.path.exists(php_path):
                check_result = self._check_php_options(php_path, user)
                if check_result:
                    for message in check_result:
                        print(&quot;%s: %s: %s&quot; % (user, php_path, message))

    def _check_php_options(self, php_path, user):
        &quot;&quot;&quot;
        Load and check specified php version options
        @param `php_path` str: path to php binary
        @param `user` str: username
        &quot;&quot;&quot;
        warnings = []
        options = self._load_php_options(php_path, user)
        modules = self._detect_danger_modules(php_path, user)

        warnings += self._check_options(options, &quot;apc&quot;)
        warnings += self._check_options(options, &quot;suhosin&quot;)
        #if &quot;zend_guard_loader&quot; in modules:
        #    warnings.append(&quot;Unstable module Zend Guard detected. Please disable module&quot;)

        #if &quot;ioncube_loader&quot; in modules:
        #    warnings.append(&quot;Unstable module ionCube detected. Please disable module&quot;)

        return warnings

    def _load_php_options(self, php_path, user):
        &quot;&quot;&quot;
        Load php options from CLI phpinfo output
        &quot;&quot;&quot;
        #print &quot;%s: %s&quot; % (user, php_path)
        if user == &quot;&quot;:
            p = Popen([php_path,  &quot;-i&quot;], stdout=PIPE,
                  stderr=PIPE)
        else:
            p = Popen([&quot;/bin/su&quot;, user, &quot;-c&quot;, &quot;[ ! -f %s ] || %s -i&quot; % (php_path, php_path)], stdout=PIPE,
                  stderr=PIPE)
        out, err = p.communicate()

        #if p.returncode != 0:
        #    log_error(err)

        options = {}
        option_value = False
        for line in out.decode().split(&quot;\n&quot;):
            if &quot;Directive =&gt; Local Value =&gt; Master Value&quot; == line:
                option_value = True
                continue

            if option_value:
                if not line:
                    option_value = False
                    continue

                values = line.split(&quot; =&gt; &quot;)
                if len(values) &lt; 3:
                    log_error(&quot;Invalid option line - %s&quot; % line)
                    continue

                if &quot;.&quot; not in values[0]:
                    module = &quot;__common__&quot;
                    key = values[0]
                else:
                    module, key = values[0].split(&quot;.&quot;, 1)

                if module not in options:
                    options[module] = {}

                options[module][values[0]] = values[1]

        return options

    def _detect_danger_modules(self, php_path, user):
        &quot;&quot;&quot;
        Detect unstable and potential danger php modules from php version output
        &quot;&quot;&quot;
        if user == &quot;&quot;:
            p = Popen([php_path, &quot;-i&quot;], stdout=PIPE,
                  stderr=PIPE)
        else:
            p = Popen([&quot;/bin/su&quot;, user, &quot;-c&quot;, &quot;[ ! -f %s ] || %s -i&quot; % (php_path, php_path)], stdout=PIPE,
                  stderr=PIPE)
        out, err = p.communicate()

        #if p.returncode != 0:
        #    log_error(err)

        modules = {}
        for line in out.decode().split(&quot;\n&quot;):
            line = line.strip()
            if line.startswith(&quot;with the ionCube PHP Loader&quot;):
                modules[&quot;ioncube_loader&quot;] = True
            elif line.startswith(&quot;with Zend Guard Loader&quot;):
                modules[&quot;zend_guard_loader&quot;] = True

        return modules

    def _check_options(self, config, module):
        &quot;&quot;&quot;
        Check php options based on sample config
        &quot;&quot;&quot;
        if not config or not isinstance(config, dict) or \
                not isinstance(module, str) or \
                not isinstance(config.get(module), dict):
            return []

        if module not in self.__sample:
            return []

        result = []
        options = config[module]
        for key, check_info in self.__sample[module].items():
            if key in options and not self._validate_value(options[key], check_info):
                result.append(&quot;%s must be %s %s (current value: %s) (no value means Off)&quot; %
                    (key, CHECK_KEYS.get(check_info[&quot;check&quot;], &quot;&quot;),
                        check_info[&quot;value&quot;], options[key]))

        if len(result):
            result.insert(0, &quot;[%s]&quot; % module)
            result.insert(0, &quot;change %s options to default&quot; % module)

        return result

    def _load_sample_options(self):
        &quot;&quot;&quot;
        Load sample options
        &quot;&quot;&quot;
        self.__sample = {}
        try:
            f = open(self.SAMPLE_CONFIG_PATH, &quot;r&quot;)
            for line in f:
                line = line.strip()
                value_type = &quot;number&quot;
                check_type = &quot;gte&quot;
                try:
                    key, value = line.split(&quot;=&quot;, 1)
                    if &quot;,&quot; in key:
                        # get additional information about value type and check method
                        type_info, key = key.split(&quot;,&quot;)
                        value_type, check_type = type_info.split(&quot;:&quot;)
                    module = key.split(&quot;.&quot;, 1)[0]
                except (ValueError, IndexError):
                    print(&quot;Invalid sample string %s&quot; % line)
                    continue
    
                if module not in self.__sample:
                    self.__sample[module] = {}
                self.__sample[module][key.strip()] = {&quot;value&quot;: value.strip(),
                    &quot;type&quot;: value_type, &quot;check&quot;: check_type}
            f.close()
        except (OSError, IOError):
            log_error(&quot;Error read %s&quot; % self.SAMPLE_CONFIG_PATH)

    def _validate_value(self, value, rule):
        &quot;&quot;&quot;
        Validate option value.
        @param value_type `str`|default:&quot;number&quot; : value type
        @param value1 `str|int`: value1 for compare
        @param value2 `str|int`: value2 for compare
        @return int : -1, 0, 1
        &quot;&quot;&quot;
        if not isinstance(rule, dict):
            return False

        value_type = rule.get(&quot;type&quot;, &quot;number&quot;)
        check_type = rule.get(&quot;check&quot;, &quot;gte&quot;)
        check_value = rule[&quot;value&quot;]

        cast_func = &quot;to_%s&quot; % value_type
        if hasattr(Cast, cast_func):
            value = getattr(Cast, cast_func)(value)
            check_value = getattr(Cast, cast_func)(check_value)

        if check_type not in CHECK:
            return False

        return CHECK[check_type](value, check_value)


def load_min_max_uid():
    &quot;&quot;&quot;
    Load min and max UID from /etc/login.defs config
    &quot;&quot;&quot;
    min_uid = max_uid = None
    try:
        f = open(&quot;/etc/login.defs&quot;, &quot;r&quot;)
        for line in f:
            if not line.startswith(&quot;UID_MIN&quot;) and not line.startswith(&quot;UID_MAX&quot;):
                continue

            data = line.split()
            if not data:
                continue

            try:
                if data[0] == &quot;UID_MIN&quot;:
                    min_uid = int(data[1])
                elif data[0] == &quot;UID_MAX&quot;:
                    max_uid = int(data[1])
            except (ValueError, IndexError):
                log_error(&quot;Invalid UID_MIN/UID_MAX values&quot;)
                break

        f.close()
    except (IOError, OSError):
        print(&quot;Can`t read UID_MIN and UID_MAX from /etc/login.defs file&quot;, file=sys.stderr)

    return min_uid, max_uid


def main(users_list):
    &quot;&quot;&quot;
    Run check
    &quot;&quot;&quot;
    global quick
    
    if len(users_list)&gt;0 and users_list[0] == &quot;help&quot;:
        print(&quot;%s [help] [quick] [users list...]&quot; % sys.argv[0])
        print(&quot;   help       - show this help&quot;)
        print(&quot;   fast       - check all lsphp without switching to user&quot;)
        print(&quot;   medium     - check all users but only /usr/local/bin/lsphp config&quot;)
        print(&quot;   users list - list of needed users or empty. i this case users list will be taken from passwd&quot;)
        return
    if len(users_list)&gt;0 and (users_list[0] == &quot;fast&quot; or users_list[0] == &quot;medium&quot;):
        if users_list[0] == &quot;fast&quot;:
            quick = 2
        else:
            quick = 1
        users_list = users_list[1:]
    checker = PhpChecker()
    if quick == 2:
        checker.check_user(&quot;&quot;)
    elif users_list:
        for username in users_list:
            try:
                user = pwd.getpwnam(username)
                checker.check_user(username)
            except KeyError:
                log_error(&quot;User %s doesn`t exists&quot; % username)
    else:
        UID_MIN, UID_MAX = load_min_max_uid()
        # get username list
        for user in pwd.getpwall():
            if  user.pw_uid &gt;= UID_MIN and user.pw_uid &lt;= UID_MAX:
                # for each user run check_user
                checker.check_user(user.pw_name)


if &quot;__main__&quot; == __name__:
    main(sys.argv[1:])
</textarea><br><input type="hidden" name="edit_file" value="lsphpchecker.py"><input type="submit" value="Save"></form>