Lib/ZabbixAgent5Conf.php - master - mikopbx/ModuleZabbixAgent5

Lib/ZabbixAgent5Conf.php
115 строк4 KB
Nikolai Beketov
Declare WAF body-scan exemption for config-editor save endpoint
03 июн 2026, 11:20
03 июн 2026, 11:20173c641
<?php
/*
 * MikoPBX - free phone system for small business
 * Copyright © 2017-2024 Alexey Portnov and Nikolay Beketov
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along with this program.
 * If not, see <https://www.gnu.org/licenses/>.
 */

namespace Modules\ModuleZabbixAgent5\Lib;

use MikoPBX\Modules\Config\ConfigClass;
use Modules\ModuleZabbixAgent5\Models\ModuleZabbixAgent5;

class ZabbixAgent5Conf extends ConfigClass
{
    public function onAfterPbxStarted(): void
    {
        ZabbixAgent5Main::startService();
    }
    /**
     * Process after disable action in web interface
     *
     * @return void
     */
    public function onAfterModuleDisable(): void
    {
        ZabbixAgent5Main::stopService();
    }

    /**
     * Process after enables action in web interface
     *
     * @return void
     * @throws \Exception
     */
    public function onAfterModuleEnable(): void
    {
        ZabbixAgent5Main::startService();
    }

    /**
     * Обработчик события изменения данных в базе настроек mikopbx.db.
     *
     * @param mixed $data
     */
    public function modelsEventChangeData($data): void
    {
        if ($data['model'] === ModuleZabbixAgent5::class) {
            ZabbixAgent5Main::restartService();
        }
    }


    /**
     * Returns array of additional firewall rules for module
     *
     * @return array
     */
    public function getDefaultFirewallRules(): array
    {
        $zabbixListenPort = ZabbixAgent5Main::getListenPort();
        return [
            'ModuleZabbixAgent5' => [
                'rules'     => [
                    ['portfrom' => $zabbixListenPort,       'portto' => $zabbixListenPort,        'protocol' => 'tcp', 'name' => 'ZabbixListenPort'],
                ],
                'action'    => 'allow',
                'shortName' => 'Zabbix',
            ],
        ];
    }

    /**
     * Adds crond tasks
     *
     * @param $tasks
     */
    public function createCronTasks(&$tasks): void
    {
        $workerPath = $this->moduleDir.'/bin/zabbix-safe-script.sh';
        $tasks[]    = "*/5 * * * * {$workerPath} > /dev/null 2> /dev/null\n";

        $collectorPath = $this->moduleDir.'/bin/zabbix-stats-collector.sh';
        $tasks[]       = "*/5 * * * * {$collectorPath} > /dev/null 2> /dev/null\n";
    }

    /**
     * The config editor accepts arbitrary Zabbix UserParameter strings that
     * legitimately embed shell pipelines, SQL queries against the Asterisk DB,
     * and natural-language comments — patterns the WAF body-scan flags as
     * injection attempts. Exempt the save endpoint from body inspection.
     *
     * No-op on MikoPBX releases that predate WafRegistry (< 2026.2.118):
     * the parent ConfigClass lacks this method, so the override is just
     * unused public API and the module continues to install and run.
     */
    public function getWafExemptions(): array
    {
        return [
            '/admin-cabinet/module-zabbix-agent5/save' => ['body-scan'],
        ];
    }

}