vesta/web/api/index.php

<?php
define('VESTA_CMD', '/usr/bin/sudo /usr/local/vesta/bin/');

if (isset($_POST['user']) || isset($_POST['hash'])) {
    // Authentication
    $auth_code = 1;
    if (empty($_POST['hash'])) {
        // Check user permission to use API
        if ($_POST['user'] != 'admin') {
            echo 'Error: only admin is allowed to use API';
            exit;
        }

        $v_user = $_POST['user'];
        $v_password = tempnam("/tmp","vst");
        $fp = fopen($v_password, "w");
        fwrite($fp, $_POST['password']."\n");
        fclose($fp);
        $v_ip_addr = $_SERVER['REMOTE_ADDR'];
        $auth_code = v_exec('v-check-user-password', [$v_user, $v_password, $v_ip_addr], false);
        unlink($v_password);
    } else {
        $key = '/usr/local/vesta/data/keys/' . basename($_POST['hash']);
        if (file_exists($key) && is_file($key)) {
            $auth_code = 0;
        }
    }

    if ($auth_code != 0 ) {
        echo 'Error: authentication failed';
        exit;
    }

    // Prepare arguments
    $args = [];
    if (isset($_POST['cmd'])) $cmd = $_POST['cmd'];
    if (isset($_POST['arg1'])) $args[] = $_POST['arg1'];
    if (isset($_POST['arg2'])) $args[] = $_POST['arg2'];
    if (isset($_POST['arg3'])) $args[] = $_POST['arg3'];
    if (isset($_POST['arg4'])) $args[] = $_POST['arg4'];
    if (isset($_POST['arg5'])) $args[] = $_POST['arg5'];
    if (isset($_POST['arg6'])) $args[] = $_POST['arg6'];
    if (isset($_POST['arg7'])) $args[] = $_POST['arg7'];
    if (isset($_POST['arg8'])) $args[] = $_POST['arg8'];
    if (isset($_POST['arg9'])) $args[] = $_POST['arg9'];

    // Check command
    if ($cmd == "'v-make-tmp-file'") {
        // Used in DNS Cluster
        $fp = fopen($_POST['arg2'], 'w');
        fwrite($fp, $_POST['arg1']."\n");
        fclose($fp);
        $return_var = 0;
    } else {
        // Run normal cmd query
        $return_var = v_exec($cmd, $args, false, $output);
    }

    if ((!empty($_POST['returncode'])) && ($_POST['returncode'] == 'yes')) {
        echo $return_var;
    } else {
        if (($return_var == 0) && (empty($output))) {
            echo "OK";
        } else {
            echo $output . "\n";
        }
    }
}