24 require
'../../main.inc.php';
25 require_once DOL_DOCUMENT_ROOT.
'/core/lib/memory.lib.php';
26 require_once DOL_DOCUMENT_ROOT.
'/core/lib/date.lib.php';
27 require_once DOL_DOCUMENT_ROOT.
'/core/lib/files.lib.php';
28 require_once DOL_DOCUMENT_ROOT.
'/core/lib/geturl.lib.php';
29 require_once DOL_DOCUMENT_ROOT.
'/core/lib/functions2.lib.php';
30 require_once DOL_DOCUMENT_ROOT.
'/core/lib/security2.lib.php';
31 require_once DOL_DOCUMENT_ROOT.
'/core/class/events.class.php';
34 $langs->loadLangs(array(
"install",
"other",
"admin",
"errors"));
40 if (
GETPOST(
'action',
'aZ09') ==
'donothing') {
51 $form =
new Form($db);
57 print
'<span class="opacitymedium">'.$langs->trans(
"YouMayFindSecurityAdviceHere",
'hhttps://wiki.dolibarr.org/index.php/Security_information').
'</span>';
58 print
' ';
59 print
'<a href="'.$_SERVER[
"PHP_SELF"].
'">';
60 print
img_picto($langs->trans(
"Reload"),
'refresh').
' ';
61 print $langs->trans(
"Reload");
73 print
'<div class="divsection wordbreak">';
77 print
"<strong>PHP</strong>: ".$langs->trans(
"Version").
": ".$phpversion;
78 if (function_exists(
'php_ini_loaded_file')) {
79 $inipath = php_ini_loaded_file();
80 print
" - <strong>INI</strong>: ".$inipath;
85 print
"<br><strong>Web server - ".$langs->trans(
"Version").
"</strong>: ".$_SERVER[
"SERVER_SOFTWARE"].
"<br>\n";
86 print
'<strong>'.$langs->trans(
"DataRootServer").
"</strong>: ".DOL_DATA_ROOT.
"<br>\n";
90 if ($labeluser && $labelgroup) {
91 print
'<strong>'.$langs->trans(
"WebUserGroup").
" (env vars)</strong> : ".$labeluser.
':'.$labelgroup;
92 if (function_exists(
'posix_geteuid') && function_exists(
'posix_getpwuid')) {
93 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
94 print
' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser[
'name'].
':'.$arrayofinfoofuser[
'gecos'].
':'.$arrayofinfoofuser[
'dir'].
':'.$arrayofinfoofuser[
'shell'].
')</span><br>'.
"\n";
98 if (function_exists(
'exec')) {
101 exec(
'id', $arrayout, $varout);
102 if (empty($varout)) {
103 print
'<strong>'.$langs->trans(
"WebUserGroup").
" (real, 'id' command)</strong> : ".implode(
',', $arrayout).
"<br>\n";
108 print
"<strong>PHP session.use_strict_mode</strong> = ".(ini_get(
'session.use_strict_mode') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.use_strict_mode') ? ini_get(
'session.use_strict_mode') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
109 print
"<strong>PHP session.use_only_cookies</strong> = ".(ini_get(
'session.use_only_cookies') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.use_only_cookies') ? ini_get(
'session.use_only_cookies') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
110 print
"<strong>PHP session.cookie_httponly</strong> = ".(ini_get(
'session.cookie_httponly') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.cookie_httponly') ? ini_get(
'session.cookie_httponly') :
'').
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
111 print
"<strong>PHP session.cookie_samesite</strong> = ".(ini_get(
'session.cookie_samesite') ?
img_picto(
'',
'tick').
' ' .ini_get(
'session.cookie_samesite') :
'None');
112 if (!ini_get(
'session.cookie_samesite') || ini_get(
'session.cookie_samesite') ==
'Lax') {
113 print
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'Lax').
")</span>";
114 } elseif (ini_get(
'session.cookie_samesite') ==
'Strict') {
115 print
' '.img_warning().
' <span class="opacitymedium">'.$langs->trans(
"WarningPaypalPaymentNotCompatibleWithStrict").
"</span>";
118 print
"<strong>PHP open_basedir</strong> = ".(ini_get(
'open_basedir') ?
img_picto(
'',
'tick').
' '.ini_get(
'open_basedir') :
img_warning().
' '.
yn(0).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"ARestrictedPath").
', '.$langs->transnoentitiesnoconv(
"Example").
': '.$_SERVER[
"DOCUMENT_ROOT"].
','.DOL_DATA_ROOT).
')</span>').
"<br>\n";
119 print
"<strong>PHP short_open_tag</strong> = ".((empty(ini_get(
'short_open_tag')) || ini_get(
'short_open_tag') ==
'Off') ?
img_picto(
'',
'tick').
' '.
yn(0) :
img_warning().
' '.
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
')</span>'.
"<br>\n";
120 print
"<strong>PHP allow_url_fopen</strong> = ".(ini_get(
'allow_url_fopen') ?
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' '.ini_get(
'allow_url_fopen') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
")</span><br>\n";
121 print
"<strong>PHP allow_url_include</strong> = ".(ini_get(
'allow_url_include') ?
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' '.ini_get(
'allow_url_include') :
img_picto(
'',
'tick').
' '.
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
")</span><br>\n";
123 print
"<strong>PHP disable_functions</strong> = ";
124 $arrayoffunctionsdisabled = explode(
',', ini_get(
'disable_functions'));
125 $arrayoffunctionstodisable = explode(
',',
'dl,apache_note,apache_setenv,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,show_source,virtual');
128 if ($execmethod == 1) {
129 $arrayoffunctionstodisable2 = explode(
',',
'passthru,shell_exec,system,proc_open,popen');
130 $functiontokeep =
'exec';
132 $arrayoffunctionstodisable2 = explode(
',',
'exec,passthru,shell_exec,system,proc_open');
133 $functiontokeep =
'popen';
136 foreach ($arrayoffunctionsdisabled as $functionkey) {
140 print
'<span class="opacitymedium">'.$functionkey.
'</span>';
146 foreach ($arrayoffunctionstodisable as $functiontodisable) {
147 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
149 $todisabletext .=
', ';
151 $todisabletext .=
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' <span class="opacitymedium">'.$functiontodisable.
'</span>';
155 if ($todisabletext) {
156 print $langs->trans(
"YouShouldDisablePHPFunctions").
': '.$todisabletext;
161 foreach ($arrayoffunctionstodisable2 as $functiontodisable) {
162 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
164 $todisabletext .=
', ';
166 $todisabletext .=
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' <span class="opacitymedium">'.$functiontodisable.
'</span>';
170 if ($todisabletext) {
171 print $langs->trans(
"IfCLINotRequiredYouShouldDisablePHPFunctions").
': '.$todisabletext;
175 print $langs->trans(
"PHPFunctionsRequiredForCLI").
': ';
176 if (in_array($functiontokeep, $arrayoffunctionsdisabled)) {
177 print
img_picto($langs->trans(
"PHPFunctionsRequiredForCLI"),
'warning');
179 print
'<span class="opacitymedium">'.$functiontokeep.
'</span>';
184 print
'<strong>'.$langs->trans(
"XDebug").
'</strong>: ';
185 $test = !function_exists(
'xdebug_is_enabled') && !extension_loaded(
'xdebug');
187 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
189 print
img_picto(
'',
'warning').
' '.$langs->trans(
"ModuleActivatedMayExposeInformation", $langs->transnoentities(
"XDebug"));
190 print
' - '.$langs->trans(
"MoreInformation").
' <a href="'.DOL_URL_ROOT.
'/admin/system/xdebug.php">XDebug admin page</a>';
201 print
load_fiche_titre($langs->trans(
"OSSetup").
' - '.$langs->trans(
"PermissionsOnFiles"),
'',
'folder');
203 print
'<div class="divsection wordbreak">';
205 print
'<strong>'.$langs->trans(
"PermissionsOnFilesInWebRoot").
'</strong>: ';
206 $arrayoffilesinroot =
dol_dir_list(DOL_DOCUMENT_ROOT,
'all', 1,
'', array(
'\/custom'),
'name', SORT_ASC, 4, 1,
'', 1);
207 $fileswithwritepermission = array();
208 foreach ($arrayoffilesinroot as $fileinroot) {
210 if (isset($fileinroot[
'perm']) && ($fileinroot[
'perm'] & 0222)) {
211 $fileswithwritepermission[] = $fileinroot[
'relativename'];
214 if (empty($fileswithwritepermission)) {
215 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NoWritableFilesFoundIntoRootDir");
217 print
img_warning().
' '.$langs->trans(
"SomeFilesOrDirInRootAreWritable");
218 print
'<br>'.$langs->trans(
"Example").
': ';
220 foreach ($fileswithwritepermission as $filewithwritepermission) {
224 print
'<span class="opacitymedium">'.$filewithwritepermission.
'</span>';
235 print
'<strong>'.$langs->trans(
"PermissionsOnFile", $conffile).
'</strong>: ';
236 $perms = fileperms($dolibarr_main_document_root.
'/'.$conffile);
238 if (($perms & 0x0004) || ($perms & 0x0002)) {
239 print
img_warning().
' '.$langs->trans(
"ConfFileIsReadableOrWritableByAnyUsers");
243 print
' '.$langs->trans(
"User").
': '.$labeluser.
':'.$labelgroup;
244 if (function_exists(
'posix_geteuid') && function_exists(
'posix_getpwuid')) {
245 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
246 print
' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser[
'name'].
':'.$arrayofinfoofuser[
'gecos'].
':'.$arrayofinfoofuser[
'dir'].
':'.$arrayofinfoofuser[
'shell'].
')</span>';
252 print
img_warning().
' '.$langs->trans(
"FailedToReadFile", $conffile);
257 $installlock = DOL_DATA_ROOT.
'/install.lock';
258 $upgradeunlock = DOL_DATA_ROOT.
'/upgrade.unlock';
259 $installmoduleslock = DOL_DATA_ROOT.
'/installmodules.lock';
262 print
'<strong>'.$langs->trans(
"DolibarrSetup").
'</strong>: ';
263 if (file_exists($installlock)) {
264 if (file_exists($upgradeunlock)) {
265 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallLockedBy", $installlock);
267 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallAndUpgradeLockedBy", $installlock);
270 print
img_warning().
' '.$langs->trans(
"WarningLockFileDoesNotExists", DOL_DATA_ROOT);
275 if (file_exists($installlock)) {
276 if (file_exists($upgradeunlock)) {
277 print
'<strong>'.$langs->trans(
"DolibarrUpgrade").
'</strong>: ';
278 print
img_warning().
' '.$langs->trans(
"WarningUpgradeHasBeenUnlocked", $upgradeunlock);
284 print
'<strong>'.$langs->trans(
"DolibarrAddonInstall").
'</strong>: ';
285 if (file_exists($installmoduleslock)) {
286 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallAndUpgradeLockedBy", $installmoduleslock);
288 print $langs->trans(
"InstallOfAddonIsNotBlocked", DOL_DATA_ROOT);
299 print
load_fiche_titre($langs->trans(
"ConfigurationFile").
' ('.$conffile.
')',
'',
'folder');
301 print
'<div class="divsection wordbreak">';
302 print
'<strong>$dolibarr_main_prod</strong>: '.($dolibarr_main_prod ? $dolibarr_main_prod :
'0');
303 if (empty($dolibarr_main_prod)) {
304 print
' '.img_picto(
'',
'warning').
' '.$langs->trans(
"IfYouAreOnAProductionSetThis", 1);
308 print
'<strong>$dolibarr_nocsrfcheck</strong>: '.(empty($dolibarr_nocsrfcheck) ?
'0' : $dolibarr_nocsrfcheck);
309 if (!empty($dolibarr_nocsrfcheck)) {
310 print
' '.img_picto(
'',
'error').
' '.$langs->trans(
"IfYouAreOnAProductionSetThis", 0);
312 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0)</span>';
316 print
'<strong>$dolibarr_main_restrict_ip</strong>: ';
317 if (empty($dolibarr_main_restrict_ip)) {
318 print
'<span class="opacitymedium">'.$langs->trans(
"None").
'</span>';
321 print $dolibarr_main_restrict_ip;
325 print
'<strong>$dolibarr_main_restrict_os_commands</strong>: ';
326 if (empty($dolibarr_main_restrict_os_commands)) {
327 print $langs->trans(
"None");
329 print $dolibarr_main_restrict_os_commands;
331 print
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'mysqldump, mysql, pg_dump, pgrestore, mariadb, mariadb-dump, clamdscan').
')</span>';
335 print
'<strong>$dolibarr_main_db_pass</strong>: ';
336 if (!empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) {
337 print
img_picto(
'',
'warning').
' '.$langs->trans(
"DatabasePasswordNotObfuscated").
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"SetOptionTo", $langs->transnoentitiesnoconv(
"MainDbPasswordFileConfEncrypted"),
yn(1)).
')</span>';
340 print
img_picto(
'',
'tick').
' '.$langs->trans(
"DatabasePasswordObfuscated");
346 print
'<strong>$dolibarr_main_stream_to_disable</strong>: ';
348 if (empty($dolibarr_main_stream_to_disable)) {
349 print
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' = '.implode(
', ', $arrayofstreamtodisable).
'</span>';
351 print implode(
', ', $dolibarr_main_stream_to_disable);
353 print
'<span class="bold"> -> Current PHP streams allowed = </span>';
354 $arrayofstreams = stream_get_wrappers();
355 if (!empty($arrayofstreams)) {
356 sort($arrayofstreams);
357 print(implode(
',', $arrayofstreams)).
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"TryToKeepOnly",
'file,http,https,php').
')</span>'.
"\n";
386 print
load_fiche_titre($langs->trans(
"Menu").
' '.$langs->trans(
"SecuritySetup"),
'',
'folder');
388 print
'<div class="divsection wordbreak">';
390 print
'<strong>'.$langs->trans(
"UseCaptchaCode").
'</strong>: ';
397 $sessiontimeout = ini_get(
"session.gc_maxlifetime");
399 $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
401 print
'<strong>'.$langs->trans(
"SessionTimeOut").
'</strong>';
402 if (!ini_get(
"session.gc_probability")) {
403 print $form->textwithpicto(
'', $langs->trans(
"SessionsPurgedByExternalSystem", ini_get(
"session.gc_maxlifetime")));
405 print $form->textwithpicto(
'', $langs->trans(
"SessionExplanation", ini_get(
"session.gc_probability"), ini_get(
"session.gc_divisor"), ini_get(
"session.gc_maxlifetime")));
407 print
': '.getDolGlobalInt(
'MAIN_SESSION_TIMEOUT').
' '.strtolower($langs->trans(
"Seconds"));
410 print
'<strong>'.$langs->trans(
"MaxNumberOfImagesInGetPost").
'</strong>: ';
411 print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT') ?
img_picto(
'',
'tick').
' ' :
'').getDolGlobalInt(
'MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').
' '.strtolower($langs->trans(
"Images"));
414 print
'<strong>'.$langs->trans(
"MaxNumberOfPostOnPublicPagesByIP").
'</strong>: ';
415 print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200) ?
img_picto(
'',
'tick').
' ' :
'').getDolGlobalInt(
'MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200).
' '.strtolower($langs->trans(
"Posts"));
418 print
'<strong>'.$langs->trans(
"MaxNumberOfAttachementOnForms").
'</strong>: ';
419 print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS', 10) ?
img_picto(
'',
'tick').
' ' :
'').getDolGlobalInt(
"MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).
' '.strtolower($langs->trans(
"Files"));
422 print
'<strong>'.$langs->trans(
"DoNotStoreClearPassword").
'</strong>: ';
426 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
' '.
yn(1).
')</span>';
463 print
'<strong>'.$langs->trans(
"AntivirusEnabledOnUpload").
'</strong>: ';
467 print
' - <span class="opacitymedium">'.$langs->trans(
"Recommended").
': '.$langs->trans(
"DefinedAPathForAntivirusCommandIntoSetup", $langs->transnoentitiesnoconv(
"Home").
" - ".$langs->transnoentitiesnoconv(
"Setup").
" - ".$langs->transnoentitiesnoconv(
"Security")).
'</span>';
470 if (defined(
'MAIN_ANTIVIRUS_COMMAND') && !defined(
'MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
471 print
' - <span class="opacitymedium">'.$langs->trans(
"ValueIsForcedBySystem").
'</span>';
479 print
'<strong>'.$langs->trans(
"UMask").
'</strong>: ';
480 if (! in_array($umask, array(
'600',
'660',
'0600',
'0660'))) {
484 if (! in_array($umask, array(
'600',
'660',
'0600',
'0660'))) {
485 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0600 | 0660)</span>';
491 $securityevent =
new Events($db);
492 $eventstolog = $securityevent->eventstolog;
494 print
'<strong>'.$langs->trans(
"AuditedSecurityEvents").
'</strong>: ';
496 if (!empty($eventstolog) && is_array($eventstolog)) {
499 foreach ($eventstolog as $key => $arr) {
501 $key =
'MAIN_LOGEVENTS_'.$arr[
'id'];
507 $out .=
'<span class="opacitymedium">'.$key.
'</span>';
516 print
img_warning().
' '.$langs->trans(
"NoSecurityEventsAreAduited", $langs->transnoentities(
"Home").
' - '.$langs->transnoentities(
"Setup").
' - '.$langs->transnoentities(
"Security").
' - '.$langs->transnoentities(
"Audit")).
'<br>';
518 $s = $langs->trans(
"SeeSetupPage",
'{s1}'.$langs->transnoentities(
"Home").
' - '.$langs->transnoentities(
"Setup").
' - '.$langs->transnoentities(
"Security").
' - '.$langs->transnoentities(
"Audit").
'{s2}');
519 print
' - '.str_replace(
'{s2}',
'</a>', str_replace(
'{s1}',
'<a href="'.DOL_URL_ROOT.
'/admin/events.php" target="_blank">', $s));
533 print
'<div class="divsection wordbreak">';
536 print
'<strong>'.$langs->trans(
"Syslog").
'</strong>: ';
539 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
542 print
img_picto(
'',
'warning').
' '.$langs->trans(
"ModuleActivatedWithTooHighLogLevel", $langs->transnoentities(
"Syslog"));
544 print
img_picto(
'',
'tick').
' '.$langs->trans(
"ModuleSyslogActivatedButLevelNotTooVerbose", $langs->transnoentities(
"Syslog"),
getDolGlobalInt(
'SYSLOG_LEVEL'));
553 print
'<strong>'.$langs->trans(
"DebugBar").
'</strong>: ';
556 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
558 print
img_picto(
'',
'error').
' '.$langs->trans(
"ModuleActivatedDoNotUseInProduction", $langs->transnoentities(
"DebugBar"));
568 print
'<strong>'.$langs->trans(
"Stripe").
'</strong>: ';
570 print
img_picto(
'',
'error').
' '.$langs->trans(
"OptionXShouldBeEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Stripe"));
572 print
img_picto(
'',
'tick').
' '.$langs->trans(
"OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Stripe"));
578 print
'<strong>'.$langs->trans(
"Paypal").
'</strong>: ';
580 print
img_picto(
'',
'error').
' '.$langs->trans(
"OptionXShouldBeEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Paypal"));
582 print
img_picto(
'',
'tick').
' '.$langs->trans(
"OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Paypal"));
597 print
'<div class="divsection wordbreak">';
600 print $langs->trans(
"APIsAreNotEnabled");
603 print
img_picto(
'',
'warning').
' '.$langs->trans(
'YouEnableDeprecatedWSAPIsUseRESTAPIsInstead').
"<br>\n";
607 print
'<strong>API_ENDPOINT_RULES</strong> = '.getDolGlobalString(
'API_ENDPOINT_RULES',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Example").
': login:0,users:0,setup:1,status:1,tickets:1,...)</span>').
"<br>\n";
620 print
'<div class="divsection wordbreak">';
622 print
'<strong>MAIN_ALLOW_SVG_FILES_AS_IMAGES</strong> = '.getDolGlobalString(
'MAIN_ALLOW_SVG_FILES_AS_IMAGES',
'0').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0)</span><br>';
625 print
'<strong>MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE</strong> = '.getDolGlobalString(
'MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 1)</span><br>';
629 print
'<strong>MAIN_SECURITY_HASH_ALGO</strong> = '.getDolGlobalString(
'MAIN_SECURITY_HASH_ALGO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
" ";
631 print
'<span class="opacitymedium"> If unset: \'md5\'</span>';
634 print
'<br><strong>MAIN_SECURITY_SALT</strong> = '.getDolGlobalString(
'MAIN_SECURITY_SALT',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
'<br>';
636 print
'<span class="opacitymedium">('.$langs->trans(
"Recommended").
': password_hash)</span>';
640 print
'<div class="info">The recommended value for MAIN_SECURITY_HASH_ALGO is now \'password_hash\' but setting it now will make ALL existing passwords of all users not valid, so update is not possible.<br>';
641 print
'If you really want to switch, you must:<br>';
642 print
'- Go on home - setup - other and add constant MAIN_SECURITY_HASH_ALGO to value \'password_hash\'<br>';
643 print
'- In same session, WITHOUT LOGGING OUT, go into your admin user record and set a new password<br>';
644 print
'- You can now logout and login with this new password. You must now reset password of all other users.<br>';
649 print
'<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_ANTI_SSRF_SERVER_IP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span> <span class="opacitymedium">('.$langs->trans(
"Recommended").
': List of static IPs of server separated with coma - '.$langs->trans(
"Note").
': common loopback ip like 127.*.*.*, [::1] are already added)</span>').
"<br>";
652 print
'<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString(
'MAIN_SECURITY_CSRF_WITH_TOKEN',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 2)</span>'.
"<br>";
663 print
load_fiche_titre($langs->trans(
"OtherSetup").
' ('.$langs->trans(
"Experimental").
')',
'',
'folder');
665 print
'<div class="divsection wordbreak">';
666 print
'<strong>MAIN_EXEC_USE_POPEN</strong> = ';
668 print
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>';
670 print $conf->global->MAIN_EXEC_USE_POPEN;
672 if ($execmethod == 1) {
673 print
'<span class="opacitymedium"> "exec" PHP method will be used for shell commands';
674 print
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 1)';
677 if ($execmethod == 2) {
678 print
'<span class="opacitymedium"> "popen" PHP method will be used for shell commands';
679 print
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 1)';
685 print
'<strong>MAIN_SECURITY_MAXFILESIZE_DOWNLOADED</strong> = '.getDolGlobalString(
'MAIN_SECURITY_MAXFILESIZE_DOWNLOADED',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': 100000000)</span>').
"<br>";
688 print
'<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
689 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1 - does not work on HTML5 with some old libxml libs)</span>";
690 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
691 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 1;
692 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0;
693 $result=
dol_htmlwithnojs(
'<img onerror<=alert(document.domain)> src=>0xbeefed');
694 if ($result ==
'InvalidHTMLStringCantBeCleaned') {
695 print
' - '.img_warning().
' Your libxml seems to old to work correctly with this option. Disable it !';
697 print
' - Test of compatibility with this option seems ok';
703 print
'<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
704 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 1)</span> - Module "php-tidy" must be enabled (currently: '.((extension_loaded(
'tidy') && class_exists(
"tidy")) ?
'Enabled' :
img_picto(
'',
'warning').
' Not available').
")";
705 if (extension_loaded(
'tidy') && class_exists(
"tidy")) {
706 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
707 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0;
708 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
709 $result=
dol_htmlwithnojs(
'<img onerror<=alert(document.domain)> src=>0xbeefed');
710 if ($result ==
'InvalidHTMLStringCantBeCleaned') {
711 print
' - '.img_warning().
' Your libxml seems to old to work correctly with this option. Disable it !';
713 print
' - Test of compatibility with this option seems ok';
720 print
'<strong>MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
721 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1 - does not work on HTML5 with some old libxml libs)</span><br>";
726 print
'<strong>MAIN_DISALLOW_URL_INTO_DESCRIPTIONS</strong> = '.getDolGlobalString(
'MAIN_DISALLOW_URL_INTO_DESCRIPTIONS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': 1=only local links allowed or 2=no links at all)</span>').
"<br>";
729 print
'<strong>MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS</strong> = '.getDolGlobalString(
'MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
734 print
'<strong>MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL</strong> = '.getDolGlobalString(
'MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
737 print
'<strong>MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED</strong> = '.getDolGlobalString(
'MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
740 $examplecsprule =
"frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
741 print
'<strong>MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCECSPRO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "'.$examplecsprule.
'")</span><br>';
744 $examplecsprule =
"frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
745 print
'<strong>MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCECSP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "'.$examplecsprule.
'")</span><br>';
748 print
'<strong>MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCERP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
" \"strict-origin-when-cross-origin\" so browser doesn't send any referrer when going into another web site domain)</span><br>";
751 print
'<strong>MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1)</span><br>";
756 print
'<strong>WEBSITE_MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCECSPRO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
757 print
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "';
758 $examplecsprule =
"default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER[
"SERVER_NAME"], 1).
" *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
759 print $examplecsprule;
760 print
'")</span><br>';
763 print
'<strong>WEBSITE_MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCECSP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
764 print
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "';
765 $examplecsprule =
"default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER[
"SERVER_NAME"], 1).
" *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
766 print $examplecsprule;
767 print
'")</span><br>';
770 print
'<strong>WEBSITE_MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCERP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' "strict-origin-when-cross-origin")</span><br>';
773 print
'<strong>WEBSITE_MAIN_SECURITY_FORCESTS</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCESTS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
": \"max-age=31536000; includeSubDomains\")</span><br>";
776 print
'<strong>WEBSITE_MAIN_SECURITY_FORCEPP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCEPP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
": \"camera=(), microphone=(), geolocation=*\")</span><br>";
786 print
'<div class="divsection wordbreak">';
788 print
'<span class="opacitymedium">';
789 print $langs->trans(
"RecommendMitigationOnURL").
'<br>';
793 $urlexamplebase =
'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/fail2ban/filter.d/';
794 print
'<span class="fas fa-shield-alt"></span> Login or API authentication (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-rulesbruteforce.conf">fail2ban example on GitHub</a>)<br>';
795 print
'<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.
'/passwordforgotten.php (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-rulespassforgotten.conf">fail2ban example on GitHub</a>)<br>';
796 print
'<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.
'/public/* (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-limitpublic.conf">fail2ban example on GitHub</a>)<br>';
798 $urlexamplebase =
'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/apache/';
799 print
'<span class="fas fa-shield-alt"></span> You can also protect the application using a HTTP Basic authentication layer (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'virtualhost">apache2 virtualhost example on GitHub</a>)<br>';
if(!defined('NOREQUIRESOC')) if(!defined('NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined('NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined('NOREQUIREAJAX')) llxHeader()
Empty header.
dol_dir_list($utf8_path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0, $nbsecondsold=0)
Scan a directory and return a list of files/directories.
version_php()
Return PHP version.
load_fiche_titre($title, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
img_warning($titlealt='default', $moreatt='', $morecss='pictowarning')
Show warning logo.
img_picto($titlealt, $picto, $moreatt='', $pictoisfullpath=0, $srconly=0, $notitle=0, $alt='', $morecss='', $marginleftonlyshort=2)
Show picto whatever it's its name (generic function)
yn($yesno, $case=1, $color=0)
Return yes or no in current language.
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox=0, $check='restricthtml')
Sanitize a HTML to remove js, dangerous content and external link.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
isModEnabled($module)
Is Dolibarr module enabled.
dol_getwebuser($mode)
Return user/group account of web server.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.