diff --git a/files/internals/functions b/files/internals/functions index acd3eaa..871d861 100644 --- a/files/internals/functions +++ b/files/internals/functions @@ -284,7 +284,9 @@ get_panel_contacts() { ;; "interworx") master_domain=$(/usr/local/interworx/bin/listaccounts.pex | grep "${user}" | awk '{print $2}') - contact_emails=$(/usr/bin/siteworx -un --login_domain ${master_domain} -c Users -a listUsers -o yaml | awk '/email:/{print $2}' | tr '\n' ',' | sed 's/,$//' | sed 's/,/, /') + if [[ -n $master_domain ]]; then + contact_emails=$(/usr/bin/siteworx -un --login_domain "${master_domain}" -c Users -a listUsers -o yaml | awk '/email:/{print $2}' | tr '\n' ',' | sed 's/,$//' | sed 's/,/, /') + fi ;; esac } @@ -443,7 +445,7 @@ EOF } usage_long() { -cat<"* ]]; then - quarantined_file=$(echo $hit_line | awk '{print $NF}') + while read -r hit; do + local signature hit_file quarantined_file + if [[ $hit =~ (.*)[[:blank:]]:[[:blank:]](.*)[[:blank:]]=\>[[:blank:]](.*) ]]; then + signature=${BASH_REMATCH[1]} + hit_file=${BASH_REMATCH[2]} + quarantined_file=${BASH_REMATCH[3]} + elif [[ $hit =~ (.*)[[:blank:]]:[[:blank:]](.*) ]]; then + signature=${BASH_REMATCH[1]} + hit_file=${BASH_REMATCH[2]} + fi + if [[ -f $hit_file ]]; then + file_owner=$(stat -c "%U" "$hit_file") + elif [[ -n $quarantined_file ]]; then file_owner=$(awk -F':' '/^[^#]/{print $1}' ${quarantined_file}.info) - fi - echo "$file_owner : $hit" >> $tmpdir/.panel_alert.hits - done + fi + echo "$file_owner : $signature : $hit_file" >> $tmpdir/.panel_alert.hits + done < <(awk '/FILE HIT LIST:/{flag=1;next}/^=======/{flag=0}flag{print $0}' $file) # Sort cleaned files too if [ "$quarantine_clean" == "1" ]; then for clean_file in $(cat $sessdir/clean.$$); do @@ -1552,12 +1560,12 @@ genalert() { # Determine control panel, noop if error or none detected eout "{panel} Detected control panel $control_panel. Will send alerts to control panel account contacts." 1 user_list=$(awk '{print $1}' $tmpdir/.panel_alert.hits | sort | uniq) - if [ -n "$user_list" ]; then + if [ -n "$user_list" ]; then for sys_user in $user_list; do contact_emails="" get_panel_contacts $control_panel $sys_user - grep "^$sys_user " $tmpdir/.panel_alert.hits | awk '{print $3}' > $tmpdir/.${sys_user}.hits + grep "^$sys_user " $tmpdir/.panel_alert.hits | awk -F' : ' '{print $2" : "$3}' > $tmpdir/.${sys_user}.hits user_tot_hits=$($wc -l $tmpdir/.${sys_user}.hits | awk '{print$1}') if [ -f $tmpdir/.panel_alert.clean ]; then grep "^$sys_user " $tmpdir/.panel_alert.clean | awk '{print $3}' > $tmpdir/.${sys_user}.clean @@ -1581,8 +1589,8 @@ genalert() { eout "{panel} No compatible \$sendmail or \$mail binaries found, control panel account alerts disabled." fi done - fi - rm -f $tmpdir/.panel_alert.hits $tmpdir/.panel_alert.clean $tmpdir/.${sys_user}.hits $tmpdir/.${sys_user}.clean $tmpf + fi + rm -f $tmpdir/.panel_alert.hits $tmpdir/.panel_alert.clean $tmpdir/.${sys_user}.hits $tmpdir/.${sys_user}.clean $tmpf fi elif [ "$type" == "daily" ] || [ "$type" == "digest" ]; then inotify_start_time=`ps -p $(ps -A -o 'pid cmd' | grep -E maldetect | grep -E inotifywait | awk '{print$1}' | head -n1) -o lstart= 2> /dev/null`