*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see .
*/
/**
* \file htdocs/admin/system/security.php
* \brief Page to show Security information
*/
require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/memory.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/events.class.php';
// Load translation files required by the page
$langs->loadLangs(array("install", "other", "admin"));
if (!$user->admin) {
accessforbidden();
}
if (GETPOST('action', 'aZ09') == 'donothing') {
exit;
}
/*
* View
*/
llxHeader();
print load_fiche_titre($langs->trans("Security"), '', 'title_setup');
print ''.$langs->trans("YouMayFindSecurityAdviceHere", 'hhttps://wiki.dolibarr.org/index.php/Security_information').' ('.$langs->trans("Reload").')
';
print '
';
print load_fiche_titre($langs->trans("PHPSetup"), '', 'folder');
// Get version of PHP
$phpversion = version_php();
print "PHP - ".$langs->trans("Version").": ".$phpversion."
\n";
// Get versionof web server
print "
Web server - ".$langs->trans("Version").": ".$_SERVER["SERVER_SOFTWARE"]."
\n";
print '
';
print "PHP safe_mode = ".(ini_get('safe_mode') ? ini_get('safe_mode') : yn(0))."
\n";
print "PHP open_basedir = ".(ini_get('open_basedir') ? ini_get('open_basedir') : yn(0))."
\n";
print '
';
// XDebug
print ''.$langs->trans("XDebug").': ';
$test = !function_exists('xdebug_is_enabled');
if ($test) {
print img_picto('', 'tick.png').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
} else {
print img_picto('', 'warning').' '.$langs->trans("ModuleActivatedMayExposeInformation", $langs->transnoentities("XDebug"));
print ' - '.$langs->trans("MoreInformation").' XDebug admin page';
}
print '
';
print '
';
print load_fiche_titre($langs->trans("ConfigurationFile"), '', 'folder');
print ''.$langs->trans("dolibarr_main_prod").': '.$dolibarr_main_prod;
if (empty($dolibarr_main_prod)) {
print ' '.img_picto('', 'warning').' '.$langs->trans("IfYouAreOnAProductionSetThis", 1);
}
print '
';
print ''.$langs->trans("dolibarr_nocsrfcheck").': '.$dolibarr_nocsrfcheck;
if (!empty($dolibarr_nocsrfcheck)) {
print img_picto('', 'warning').' '.$langs->trans("IfYouAreOnAProductionSetThis", 0);
}
print '
';
print ''.$langs->trans("dolibarr_main_restrict_ip").': '.$dolibarr_main_restrict_ip;
/*if (empty($dolibarr_main_restrict_ip)) {
print ' '.img_picto('', 'warning').' '.$langs->trans("IfYouAreOnAProductionSetThis", 1);
}*/
print '
';
print '
';
print '
';
print load_fiche_titre($langs->trans("Permissions"), '', 'folder');
print ''.$langs->trans("PermissionsOnFilesInWebRoot").': ';
// TODO Check permission are read only except for custom dir
print 'TODO';
print '
';
print ''.$langs->trans("PermissionsOnFile", $conffile).': '; // $conffile is defined into filefunc.inc.php
$perms = fileperms($dolibarr_main_document_root.'/'.$conffile);
if ($perms) {
if (($perms & 0x0004) || ($perms & 0x0002)) {
print img_warning().' '.$langs->trans("ConfFileIsReadableOrWritableByAnyUsers");
} else {
print img_picto('', 'tick');
}
} else {
print img_warning().' '.$langs->trans("FailedToReadFile", $conffile);
}
print '
';
print '
';
print '
';
print load_fiche_titre($langs->trans("Modules"), '', 'folder');
// Module log
print ''.$langs->trans("Syslog").': ';
$test = empty($conf->syslog->enabled);
if ($test) {
print img_picto('', 'tick.png').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
} else {
print img_picto('', 'warning').' '.$langs->trans("ModuleActivatedMayExposeInformation", $langs->transnoentities("Syslog"));
//print ' '.$langs->trans("MoreInformation").' XDebug admin page';
}
print '
';
// Module debugbar
print ''.$langs->trans("DebugBar").': ';
$test = empty($conf->debugbar->enabled);
if ($test) {
print img_picto('', 'tick.png').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
} else {
print img_picto('', 'error').' '.$langs->trans("ModuleActivatedDoNotUseInProduction", $langs->transnoentities("DebugBar"));
//print ' '.$langs->trans("MoreInformation").' XDebug admin page';
}
print '
';
print '
';
print '
';
print load_fiche_titre($langs->trans("Menu").' '.$langs->trans("SecuritySetup"), '', 'folder');
//print ''.$langs->trans("PasswordEncryption").': ';
print 'MAIN_SECURITY_HASH_ALGO = '.(empty($conf->global->MAIN_SECURITY_HASH_ALGO) ? $langs->trans("Undefined") : '')." ";
print ' If unset: \'md5\' ';
print ' - Recommanded value: \'password_hash\'
';
print 'MAIN_SECURITY_SALT = '.(empty($conf->global->MAIN_SECURITY_SALT) ? $langs->trans("Undefined") : '').'
';
print '
';
// TODO
print ''.$langs->trans("AntivirusEnabledOnUpload").': ';
print empty($conf->global->MAIN_ANTIVIRUS_COMMAND) ? '' : img_picto('', 'tick').' ';
print yn($conf->global->MAIN_ANTIVIRUS_COMMAND ? 1 : 0);
if (!empty($conf->global->MAIN_ANTIVIRUS_COMMAND)) {
print ' - '.$conf->global->MAIN_ANTIVIRUS_COMMAND;
if (defined('MAIN_ANTIVIRUS_COMMAND')) {
print ' - '.$langs->trans("ValueIsForcedBySystem").'';
}
}
print '
';
print '
';
$securityevent = new Events($db);
$eventstolog = $securityevent->eventstolog;
print ''.$langs->trans("LogEvents").': ';
// Loop on each event type
foreach ($eventstolog as $key => $arr) {
if ($arr['id']) {
$key = 'MAIN_LOGEVENTS_'.$arr['id'];
$value = empty($conf->global->$key) ? '' : $conf->global->$key;
if ($value) {
print $key.', ';
}
}
}
// End of page
llxFooter();
$db->close();