implement ptero 1.12.3 security fix

parser/helpers.go

@@ -193,7 +193,7 @@ func (cfr *ConfigurationFileReplacement) setValueWithSjson(jsonStr string, path
 }
 
 // Looks up a configuration value on the Daemon given a dot-notated syntax.
-func (f *ConfigurationFile) LookupConfigurationValue(cfr ConfigurationFileReplacement) (string, error) {
+func (f *ConfigurationFile) LookupConfigurationValue(cfr ConfigurationFileReplacement) (result string, err error) {
 	// If this is not something that we can do a regex lookup on then just continue
 	// on our merry way. If the value isn't a string, we're not going to be doing anything
 	// with it anyways.
@@ -204,9 +204,8 @@ func (f *ConfigurationFile) LookupConfigurationValue(cfr ConfigurationFileReplac
 	// If there is a match, lookup the value in the configuration for the Daemon. If no key
 	// is found, just return the string representation, otherwise use the value from the
 	// daemon configuration here.
-	var lookupErr error
-	result := configMatchRegex.ReplaceAllStringFunc(cfr.ReplaceWith.String(), func(placeholder string) string {
-		if lookupErr != nil {
+	result = configMatchRegex.ReplaceAllStringFunc(cfr.ReplaceWith.String(), func(placeholder string) string {
+		if err != nil {
 			return placeholder
 		}
 		keyPath := configMatchRegex.ReplaceAllString(placeholder, "$1")
@@ -217,17 +216,23 @@ func (f *ConfigurationFile) LookupConfigurationValue(cfr ConfigurationFileReplac
 		}
 
 		// Look for the key in the Wings configuration and substitute the placeholder.
-		match, _, _, err := jsonparser.Get(f.configuration, path...)
+		match, dataType, _, err := jsonparser.Get(f.configuration, path...)
 		if err != nil {
 			if err != jsonparser.KeyPathNotFoundError {
-				lookupErr = err
 				return placeholder
 			}
 			log.WithFields(log.Fields{"path": path, "filename": f.FileName}).Debug("attempted to load a configuration value that does not exist")
 			// Leave placeholder intact so the misconfiguration is visible.
 			return placeholder
 		}
+
+		// Only substitute scalar values, not whole objects or arrays.
+		if dataType == jsonparser.Object || dataType == jsonparser.Array {
+			return placeholder
+		}
+
 		return string(match)
 	})
-	return result, lookupErr
+
+	return result, err
 }

parser/parser.go

@@ -213,13 +213,29 @@ func (cfr *ConfigurationFileReplacement) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
+type templatableConfig struct {
+	Docker struct {
+		Interface string `json:"interface"`
+		Network   struct {
+			Interface string `json:"interface"`
+		} `json:"network"`
+	} `json:"docker"`
+}
+
+func newTemplatableConfig(c *config.Configuration) templatableConfig {
+	var t templatableConfig
+	t.Docker.Interface = c.Docker.Network.Interface
+	t.Docker.Network.Interface = c.Docker.Network.Interface
+	return t
+}
+
 // Parse parses a given configuration file and updates all the values within
 // as defined in the API response from the Panel.
 func (f *ConfigurationFile) Parse(file ufs.File) error {
 	//log.WithField("path", path).WithField("parser", f.Parser.String()).Debug("parsing server configuration file")
 
 	// What the fuck is going on here?
-	if mb, err := json.Marshal(config.Get()); err != nil {
+	if mb, err := json.Marshal(newTemplatableConfig(config.Get())); err != nil {
 		return err
 	} else {
 		f.configuration = mb