dolibarr  9.0.0
security_file.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2004-2017 Laurent Destailleur <eldy@users.sourceforge.net>
3  * Copyright (C) 2005-2017 Regis Houssin <regis.houssin@inodbox.com>
4  * Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program. If not, see <http://www.gnu.org/licenses/>.
18  */
19 
26 require '../main.inc.php';
27 require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
28 require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
29 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
30 
31 // Load translation files required by the page
32 $langs->loadLangs(array('users', 'admin', 'other'));
33 
34 if (! $user->admin)
36 
37 $action=GETPOST('action','alpha');
38 
39 $upload_dir=$conf->admin->dir_temp;
40 
41 
42 /*
43  * Actions
44  */
45 
46 if (GETPOST('sendit') && ! empty($conf->global->MAIN_UPLOAD_DOC))
47 {
48  require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
49 
50  dol_add_file_process($upload_dir, 0, 0, 'userfile');
51 }
52 
53 if ($action == 'updateform')
54 {
55  $antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND','none'); // Use GETPOST none because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe
56  $antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM','none'); // Use GETPOST none because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib"
57  $antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&")); // Sanitize command
58  $antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&")); // Sanitize params
59 
60  $res3=dolibarr_set_const($db, 'MAIN_UPLOAD_DOC',GETPOST('MAIN_UPLOAD_DOC','alpha'),'chaine',0,'',$conf->entity);
61  $res4=dolibarr_set_const($db, "MAIN_UMASK", GETPOST('MAIN_UMASK','alpha'),'chaine',0,'',$conf->entity);
62  $res5=dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand),'chaine',0,'',$conf->entity);
63  $res6=dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam),'chaine',0,'',$conf->entity);
64  if ($res3 && $res4 && $res5 && $res6) setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
65 }
66 
67 
68 
69 // Delete file
70 else if ($action == 'delete')
71 {
72  $langs->load("other");
73  $file = $conf->admin->dir_temp . '/' . GETPOST('urlfile','alpha'); // Do not use urldecode here ($_GET and $_REQUEST are already decoded by PHP).
74  $ret=dol_delete_file($file);
75  if ($ret) setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile','alpha')), null, 'mesgs');
76  else setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile','alpha')), null, 'errors');
77  Header('Location: '.$_SERVER["PHP_SELF"]);
78  exit;
79 }
80 
81 
82 /*
83  * View
84  */
85 
86 $form = new Form($db);
87 
88 $wikihelp='EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad';
89 llxHeader('',$langs->trans("Files"),$wikihelp);
90 
91 print load_fiche_titre($langs->trans("SecuritySetup"),'','title_setup');
92 
93 print $langs->trans("SecurityFilesDesc")."<br>\n";
94 print "<br>\n";
95 
96 
97 print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
98 print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
99 print '<input type="hidden" name="action" value="updateform">';
100 
101 $head=security_prepare_head();
102 
103 dol_fiche_head($head, 'file', $langs->trans("Security"), -1);
104 
105 
106 // Upload options
107 $var=false;
108 
109 print '<div class="div-table-responsive-no-min">';
110 print '<table class="noborder" width="100%">';
111 print '<tr class="liste_titre">';
112 print '<td colspan="2">'.$langs->trans("Parameters").'</td>';
113 print '<td>'.$langs->trans("Value").'</td>';
114 print '</tr>';
115 
116 print '<tr class="oddeven">';
117 print '<td colspan="2">'.$langs->trans("MaxSizeForUploadedFiles").'.';
118 $max=@ini_get('upload_max_filesize');
119 if ($max) print ' '.$langs->trans("MustBeLowerThanPHPLimit",$max*1024,$langs->trans("Kb")).'.';
120 else print ' '.$langs->trans("NoMaxSizeByPHPLimit").'.';
121 print '</td>';
122 print '<td class="nowrap">';
123 print '<input class="flat" name="MAIN_UPLOAD_DOC" type="text" size="6" value="'.htmlentities($conf->global->MAIN_UPLOAD_DOC).'"> '.$langs->trans("Kb");
124 print '</td>';
125 print '</tr>';
126 
127 
128 print '<tr class="oddeven">';
129 print '<td>'.$langs->trans("UMask").'</td><td align="right">';
130 print $form->textwithpicto('',$langs->trans("UMaskExplanation"));
131 print '</td>';
132 print '<td class="nowrap">';
133 print '<input class="flat" name="MAIN_UMASK" type="text" size="6" value="'.htmlentities($conf->global->MAIN_UMASK).'">';
134 print '</td>';
135 print '</tr>';
136 
137 // Use anti virus
138 
139 print '<tr class="oddeven">';
140 print '<td colspan="2">'.$langs->trans("AntiVirusCommand").'<br>';
141 print $langs->trans("AntiVirusCommandExample");
142 // Check command in inside safe_mode
143 print '</td>';
144 print '<td>';
145 if (ini_get('safe_mode') && ! empty($conf->global->MAIN_ANTIVIRUS_COMMAND))
146 {
147  $langs->load("errors");
148  $basedir=preg_replace('/"/','',dirname($conf->global->MAIN_ANTIVIRUS_COMMAND));
149  $listdir=explode(';',ini_get('safe_mode_exec_dir'));
150  if (! in_array($basedir,$listdir))
151  {
152  print img_warning($langs->trans('WarningSafeModeOnCheckExecDir'));
153  dol_syslog("safe_mode is on, basedir is ".$basedir.", safe_mode_exec_dir is ".ini_get('safe_mode_exec_dir'), LOG_WARNING);
154  }
155 }
156 print '<input type="text" name="MAIN_ANTIVIRUS_COMMAND" class="minwidth500imp" value="'.(! empty($conf->global->MAIN_ANTIVIRUS_COMMAND)?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_COMMAND):'').'">';
157 print "</td>";
158 print '</tr>';
159 
160 // Use anti virus
161 
162 print '<tr class="oddeven">';
163 print '<td colspan="2">'.$langs->trans("AntiVirusParam").'<br>';
164 print $langs->trans("AntiVirusParamExample");
165 print '</td>';
166 print '<td>';
167 print '<input type="text" name="MAIN_ANTIVIRUS_PARAM" class="minwidth500imp" value="'.(! empty($conf->global->MAIN_ANTIVIRUS_PARAM)?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_PARAM):'').'">';
168 print "</td>";
169 print '</tr>';
170 
171 print '</table>';
172 print '</div>';
173 
174 dol_fiche_end();
175 
176 print '<div class="center"><input type="submit" class="button" name="button" value="'.$langs->trans("Modify").'"></div>';
177 
178 print '</form>';
179 
180 
181 // Form to test upload
182 print '<br>';
183 $formfile=new FormFile($db);
184 $formfile->form_attach_new_file($_SERVER['PHP_SELF'], $langs->trans("FormToTestFileUploadForm"), 0, 0, 1, 50, '', '', 1, '', 0);
185 
186 // List of document
187 $filearray=dol_dir_list($upload_dir, "files", 0, '', '', 'name', SORT_ASC, 1);
188 $formfile->list_of_documents($filearray, null, 'admin_temp', '');
189 
190 // End of page
191 llxFooter();
192 $db->close();
img_warning($titlealt='default', $moreatt='')
Show warning logo.
llxFooter()
Empty footer.
Definition: wrapper.php:56
load_fiche_titre($titre, $morehtmlright='', $picto='title_generic.png', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
GETPOST($paramname, $check='none', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
print
Draft customers invoices.
Definition: index.php:91
setEventMessages($mesg, $mesgs, $style='mesgs')
Set event messages in dol_events session object.
dolibarr_set_const($db, $name, $value, $type='chaine', $visible=0, $note='', $entity=1)
Insert a parameter (key,value) into database (delete old key then insert it again).
Definition: admin.lib.php:510
dol_escape_htmltag($stringtoescape, $keepb=0, $keepn=0)
Returns text escaped for inclusion in HTML alt or title tags, or into values of HTML input fields...
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0)
Show a message to say access is forbidden and stop program Calling this function terminate execution ...
Class to manage generation of HTML components Only common components must be here.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='')
Write log message into outputs.
dol_add_file_process($upload_dir, $allowoverwrite=0, $donotupdatesession=0, $varfiles='addedfile', $savingdocmask='', $link=null, $trackid='', $generatethumbs=1)
Get and save an upload file (for example after submitting a new file a mail form).
Definition: files.lib.php:1519
dol_fiche_end($notab=0)
Show tab footer of a card.
llxHeader()
Empty header.
Definition: wrapper.php:44
dol_delete_file($file, $disableglob=0, $nophperrors=0, $nohook=0, $object=null, $allowdotdot=false, $indexdatabase=1)
Remove a file or several files with a mask.
Definition: files.lib.php:1139
security_prepare_head()
Prepare array with list of tabs.
Definition: admin.lib.php:606
dol_dir_list($path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0)
Scan a directory and return a list of files/directories.
Definition: files.lib.php:59
Class to offer components to list and upload files.
dol_string_nospecial($str, $newstr='_', $badcharstoreplace='')
Clean a string from all punctuation characters to use it as a ref or login.
dol_fiche_head($links=array(), $active='0', $title='', $notab=0, $picto='', $pictoisfullpath=0, $morehtmlright='', $morecss='')
Show tab header of a card.
if(GETPOST('button_removefilter_x', 'alpha')||GETPOST('button_removefilter.x', 'alpha')||GETPOST('button_removefilter', 'alpha')) if(GETPOST('button_search_x', 'alpha')||GETPOST('button_search.x', 'alpha')||GETPOST('button_search', 'alpha')) if($action=="save" &&empty($cancel)) $wikihelp
View.
Definition: agenda.php:120