dolibarr 20.0.0
security.php
Go to the documentation of this file.
1<?php
2/* Copyright (C) 2013-2022 Laurent Destailleur <eldy@users.sourceforge.net>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 3 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program. If not, see <https://www.gnu.org/licenses/>.
16 */
17
23// Load Dolibarr environment
24require '../../main.inc.php';
25require_once DOL_DOCUMENT_ROOT.'/core/lib/memory.lib.php';
26require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
27require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
28require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
29require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
30require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
31require_once DOL_DOCUMENT_ROOT.'/core/class/events.class.php';
32
33// Load translation files required by the page
34$langs->loadLangs(array("install", "other", "admin", "errors"));
35
36if (!$user->admin) {
38}
39
40if (GETPOST('action', 'aZ09') == 'donothing') {
41 exit;
42}
43
44$execmethod = getDolGlobalInt('MAIN_EXEC_USE_POPEN', 1);
45
46
47/*
48 * View
49 */
50
51$form = new Form($db);
52
53llxHeader('', '', '', '', 0, 0, '', '', '', 'mod-admin page-system_security');
54
55print load_fiche_titre($langs->trans("Security"), '', 'title_setup');
56
57print '<span class="opacitymedium">'.$langs->trans("YouMayFindSecurityAdviceHere", 'hhttps://wiki.dolibarr.org/index.php/Security_information').'</span>';
58print ' &nbsp; &nbsp; ';
59print '<a href="'.$_SERVER["PHP_SELF"].'">';
60print img_picto($langs->trans("Reload"), 'refresh').' ';
61print $langs->trans("Reload");
62print '</a>';
63print '<br>';
64print '<br>';
65
66
67print '<br>';
68
69
70print load_fiche_titre($langs->trans("PHPSetup"), '', 'folder');
71
72
73print '<div class="divsection wordbreak">';
74
75// Get version of PHP
76$phpversion = version_php();
77print "<strong>PHP</strong>: ".$langs->trans("Version").": ".$phpversion;
78if (function_exists('php_ini_loaded_file')) {
79 $inipath = php_ini_loaded_file();
80 print " - <strong>INI</strong>: ".$inipath;
81}
82print "<br>\n";
83
84// Get version of web server
85print "<br><strong>Web server - ".$langs->trans("Version")."</strong>: ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";
86print '<strong>'.$langs->trans("DataRootServer")."</strong>: ".DOL_DATA_ROOT."<br>\n";
87// Web user group by default
88$labeluser = dol_getwebuser('user');
89$labelgroup = dol_getwebuser('group');
90if ($labeluser && $labelgroup) {
91 print '<strong>'.$langs->trans("WebUserGroup")." (env vars)</strong> : ".$labeluser.':'.$labelgroup;
92 if (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) {
93 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
94 print ' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser['name'].':'.$arrayofinfoofuser['gecos'].':'.$arrayofinfoofuser['dir'].':'.$arrayofinfoofuser['shell'].')</span><br>'."\n";
95 }
96}
97// Web user group real (detected by 'id' external command)
98if (function_exists('exec')) {
99 $arrayout = array();
100 $varout = 0;
101 exec('id', $arrayout, $varout);
102 if (empty($varout)) { // Test command is ok. Work only on Linux OS.
103 print '<strong>'.$langs->trans("WebUserGroup")." (real, 'id' command)</strong> : ".implode(',', $arrayout)."<br>\n";
104 }
105}
106print '<br>';
107
108print "<strong>PHP session.use_strict_mode</strong> = ".(ini_get('session.use_strict_mode') ? img_picto('', 'tick').' ' : img_warning().' ').(ini_get('session.use_strict_mode') ? ini_get('session.use_strict_mode') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
109print "<strong>PHP session.use_only_cookies</strong> = ".(ini_get('session.use_only_cookies') ? img_picto('', 'tick').' ' : img_warning().' ').(ini_get('session.use_only_cookies') ? ini_get('session.use_only_cookies') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
110print "<strong>PHP session.cookie_httponly</strong> = ".(ini_get('session.cookie_httponly') ? img_picto('', 'tick').' ' : img_warning().' ').(ini_get('session.cookie_httponly') ? ini_get('session.cookie_httponly') : '').' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
111print "<strong>PHP session.cookie_samesite</strong> = ".(ini_get('session.cookie_samesite') ? img_picto('', 'tick').' ' .ini_get('session.cookie_samesite') : 'None');
112if (!ini_get('session.cookie_samesite') || ini_get('session.cookie_samesite') == 'Lax') {
113 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'Lax').")</span>";
114} elseif (ini_get('session.cookie_samesite') == 'Strict') {
115 print ' &nbsp; '.img_warning().' <span class="opacitymedium">'.$langs->trans("WarningPaypalPaymentNotCompatibleWithStrict")."</span>";
116}
117print "<br>\n";
118
119print "<strong>PHP open_basedir</strong> = ".(ini_get('open_basedir') ? img_picto('', 'tick').' '.ini_get('open_basedir') : img_warning().' '.yn(0).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("ARestrictedPath").', '.$langs->transnoentitiesnoconv("Example").': '.$_SERVER["DOCUMENT_ROOT"].','.DOL_DATA_ROOT).')</span>')."<br>\n";
120
121print "<strong>PHP short_open_tag</strong> = ".((empty(ini_get('short_open_tag')) || ini_get('short_open_tag') == 'Off') ? img_picto('', 'tick').' '.yn(0) : img_warning().' '.yn(1)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).')</span>'."<br>\n";
122
123print "<strong>PHP allow_url_fopen</strong> = ".(ini_get('allow_url_fopen') ? img_picto($langs->trans("YouShouldSetThisToOff"), 'warning').' '.ini_get('allow_url_fopen') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No"))." but may be required by some external modules)</span><br>\n";
124
125print "<strong>PHP allow_url_include</strong> = ".(ini_get('allow_url_include') ? img_picto($langs->trans("YouShouldSetThisToOff"), 'warning').' '.ini_get('allow_url_include') : img_picto('', 'tick').' '.yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).")</span><br>\n";
126//print "<strong>PHP safe_mode</strong> = ".(ini_get('safe_mode') ? ini_get('safe_mode') : yn(0)).' &nbsp; <span class="opacitymedium">'.$langs->trans("Deprecated")." (removed in PHP 5.4)</span><br>\n";
127
128if (getDolGlobalString('MAIN_SECURITY_SHOW_MORE_INFO')) {
129 print "<strong>PHP auto_prepend_file</strong> = ".(ini_get('auto_prepend_file') ? ini_get('auto_prepend_file') : '')."</span><br>\n";
130
131 print "<strong>PHP sendmail_path</strong> = ".(ini_get('sendmail_path') ? ini_get('sendmail_path') : '')."</span><br>\n";
132}
133
134print "<strong>PHP disable_functions</strong> = ";
135$arrayoffunctionsdisabled = explode(',', ini_get('disable_functions'));
136$arrayoffunctionstodisable = explode(',', 'dl,apache_note,apache_setenv,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,show_source,virtual');
137//$arrayoffunctionstodisable[] = 'stream_wrapper_restore';
138//$arrayoffunctionstodisable[] = 'stream_wrapper_register';
139if ($execmethod == 1) {
140 $arrayoffunctionstodisable2 = explode(',', 'passthru,shell_exec,system,proc_open,popen');
141 $functiontokeep = 'exec';
142} else {
143 $arrayoffunctionstodisable2 = explode(',', 'exec,passthru,shell_exec,system,proc_open');
144 $functiontokeep = 'popen';
145}
146$i = 0;
147foreach ($arrayoffunctionsdisabled as $functionkey) {
148 if ($i > 0) {
149 print ', ';
150 }
151 print '<span class="opacitymedium">'.$functionkey.'</span>';
152 $i++;
153}
154print "<br>\n";
155$todisabletext = '';
156$i = 0;
157foreach ($arrayoffunctionstodisable as $functiontodisable) {
158 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
159 if ($i > 0) {
160 $todisabletext .= ', ';
161 }
162 $todisabletext .= img_picto($langs->trans("YouShouldSetThisToOff"), 'warning').' <span class="opacitymedium">'.$functiontodisable.'</span>';
163 $i++;
164 }
165}
166if ($todisabletext) {
167 print $langs->trans("YouShouldDisablePHPFunctions").': '.$todisabletext;
168 print '<br>';
169}
170$todisabletext = '';
171$i = 0;
172foreach ($arrayoffunctionstodisable2 as $functiontodisable) {
173 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
174 if ($i > 0) {
175 $todisabletext .= ', ';
176 }
177 $todisabletext .= img_picto($langs->trans("YouShouldSetThisToOff"), 'warning').' <span class="opacitymedium">'.$functiontodisable.'</span>';
178 $i++;
179 }
180}
181if ($todisabletext) {
182 print $langs->trans("IfCLINotRequiredYouShouldDisablePHPFunctions").': '.$todisabletext;
183 print '<br>';
184}
185
186print $langs->trans("PHPFunctionsRequiredForCLI").': ';
187if (in_array($functiontokeep, $arrayoffunctionsdisabled)) {
188 print img_picto($langs->trans("PHPFunctionsRequiredForCLI"), 'warning');
189}
190print '<span class="opacitymedium">'.$functiontokeep.'</span>';
191print '<br>';
192
193print '<br>';
194
195// JSON
196print '<strong>JSON</strong>: ';
197$loadedExtensions = array_map('strtolower', get_loaded_extensions(false));
198$test = !in_array('json', $loadedExtensions);
199if ($test || function_exists('dol_json_decode')) {
200 print img_picto('', 'error').' '.$langs->trans("NotInstalled").' - '.$langs->trans("VulnerableToRCEAttack");
201} else {
202 print img_picto('', 'tick').' '.$langs->trans("Available").' <span class="opacitymedium">(PHP native so not emulated, safe)</span>';
203}
204print '<br>';
205
206// XDebug
207print '<strong>XDebug</strong>: ';
208$test = !function_exists('xdebug_is_enabled') && !extension_loaded('xdebug');
209if ($test) {
210 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
211} else {
212 print img_picto('', 'warning').' '.$langs->trans("ModuleActivatedMayExposeInformation", $langs->transnoentities("XDebug"));
213 print ' - '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php">XDebug admin page</a>';
214}
215
216print '</div>';
217
218print '<br>';
219
220
221// OS Permissions
222
223print '<br>';
224print load_fiche_titre($langs->trans("OSSetup").' - '.$langs->trans("PermissionsOnFiles"), '', 'folder');
225
226print '<div class="divsection wordbreak">';
227
228print '<strong>'.$langs->trans("PermissionsOnFilesInWebRoot").'</strong>: ';
229$arrayoffilesinroot = dol_dir_list(DOL_DOCUMENT_ROOT, 'all', 1, '', array('\/custom'), 'name', SORT_ASC, 4, 1, '', 1);
230$fileswithwritepermission = array();
231foreach ($arrayoffilesinroot as $fileinroot) {
232 // Test if there is at least one write permission file. If yes, add the entry into array $fileswithwritepermission
233 if (isset($fileinroot['perm']) && ($fileinroot['perm'] & 0222)) {
234 $fileswithwritepermission[] = $fileinroot['relativename'];
235 }
236}
237if (empty($fileswithwritepermission)) {
238 print img_picto('', 'tick').' '.$langs->trans("NoWritableFilesFoundIntoRootDir");
239} else {
240 print img_warning().' '.$langs->trans("SomeFilesOrDirInRootAreWritable");
241 print '<br>'.$langs->trans("Example").': ';
242 $i = 0;
243 foreach ($fileswithwritepermission as $filewithwritepermission) {
244 if ($i > 0) {
245 print ', ';
246 }
247 print '<span class="opacitymedium">'.$filewithwritepermission.'</span>';
248 if ($i > 20) {
249 print ' ...';
250 break;
251 }
252 $i++;
253 }
254}
255print '<br>';
256print '<br>';
257
258print '<strong>'.$langs->trans("PermissionsOnFile", $conffile).'</strong>: '; // $conffile is defined into filefunc.inc.php
259$perms = fileperms($dolibarr_main_document_root.'/'.$conffile);
260if ($perms) {
261 if (($perms & 0x0004) || ($perms & 0x0002)) {
262 print img_warning().' '.$langs->trans("ConfFileIsReadableOrWritableByAnyUsers");
263 // Web user group by default
264 $labeluser = dol_getwebuser('user');
265 $labelgroup = dol_getwebuser('group');
266 print ' '.$langs->trans("User").': '.$labeluser.':'.$labelgroup;
267 if (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) {
268 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
269 print ' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser['name'].':'.$arrayofinfoofuser['gecos'].':'.$arrayofinfoofuser['dir'].':'.$arrayofinfoofuser['shell'].')</span>';
270 }
271 } else {
272 print img_picto('', 'tick');
273 }
274} else {
275 print img_warning().' '.$langs->trans("FailedToReadFile", $conffile);
276}
277print '<br>';
278print '<br>';
279
280$installlock = DOL_DATA_ROOT.'/install.lock';
281$upgradeunlock = DOL_DATA_ROOT.'/upgrade.unlock';
282$installmoduleslock = DOL_DATA_ROOT.'/installmodules.lock';
283
284// Is install (upgrade) locked
285print '<strong>'.$langs->trans("DolibarrSetup").'</strong>: ';
286if (file_exists($installlock)) {
287 if (file_exists($upgradeunlock)) {
288 print img_picto('', 'tick').' '.$langs->trans("InstallLockedBy", $installlock);
289 } else {
290 print img_picto('', 'tick').' '.$langs->trans("InstallAndUpgradeLockedBy", $installlock);
291 }
292} else {
293 print img_warning().' '.$langs->trans("WarningLockFileDoesNotExists", DOL_DATA_ROOT);
294}
295
296print '<br>';
297print '<br>';
298
299// Is upgrade unlocked
300if (file_exists($installlock)) { // If install not locked, no need to show this.
301 if (file_exists($upgradeunlock)) {
302 print '<strong>'.$langs->trans("DolibarrUpgrade").'</strong>: ';
303 print img_warning().' '.$langs->trans("WarningUpgradeHasBeenUnlocked", $upgradeunlock);
304 print '<br>';
305 print '<br>';
306 }
307}
308
309// Is addon install locked ?
310print '<strong>'.$langs->trans("DolibarrAddonInstall").'</strong>: ';
311if (file_exists($installmoduleslock)) {
312 print img_picto('', 'tick').' '.$langs->trans("InstallAndUpgradeLockedBy", $installmoduleslock);
313} else {
314 print $langs->trans("InstallOfAddonIsNotBlocked", DOL_DATA_ROOT);
315}
316
317print '</div>';
318
319
320
321// File conf.php
322
323print '<br>';
324print '<br>';
325print load_fiche_titre($langs->trans("ConfigurationFile").' ('.$conffile.')', '', 'folder');
326
327print '<div class="divsection wordbreak">';
328print '<strong>$dolibarr_main_prod</strong>: '.($dolibarr_main_prod ? $dolibarr_main_prod : '0');
329if (empty($dolibarr_main_prod)) {
330 print ' &nbsp; &nbsp; '.img_picto('', 'warning').' '.$langs->trans("IfYouAreOnAProductionSetThis", 1);
331}
332print '<br>';
333
334print '<strong>$dolibarr_nocsrfcheck</strong>: '.(empty($dolibarr_nocsrfcheck) ? '0' : $dolibarr_nocsrfcheck);
335if (!empty($dolibarr_nocsrfcheck)) {
336 print ' &nbsp; &nbsp;'.img_picto('', 'error').' '.$langs->trans("IfYouAreOnAProductionSetThis", 0);
337} else {
338 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0)</span>';
339}
340print '<br>';
341
342print '<strong>$dolibarr_main_restrict_ip</strong>: ';
343if (empty($dolibarr_main_restrict_ip)) {
344 print '<span class="opacitymedium">'.$langs->trans("None").'</span>';
345 //print ' <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("IPsOfUsers")).')</span>';
346} else {
347 print $dolibarr_main_restrict_ip;
348}
349print '<br>';
350
351print '<strong>$dolibarr_main_restrict_os_commands</strong>: ';
352if (empty($dolibarr_main_restrict_os_commands)) {
353 print $langs->trans("None");
354} else {
355 print $dolibarr_main_restrict_os_commands;
356}
357print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'mysqldump, mysql, pg_dump, pg_restore, mariadb, mariadb-dump, clamdscan').')</span>';
358print '<br>';
359
360if (!getDolGlobalString('SECURITY_DISABLE_TEST_ON_OBFUSCATED_CONF')) {
361 print '<strong>$dolibarr_main_db_pass</strong>: ';
362 if (!empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) {
363 print img_picto('', 'warning').' '.$langs->trans("DatabasePasswordNotObfuscated").' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("SetOptionTo", $langs->transnoentitiesnoconv("MainDbPasswordFileConfEncrypted"), yn(1)).')</span>';
364 //print ' <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("IPsOfUsers")).')</span>';
365 } else {
366 print img_picto('', 'tick').' '.$langs->trans("DatabasePasswordObfuscated");
367 }
368
369 print '<br>';
370}
371
372print '<strong>$dolibarr_main_stream_to_disable</strong>: ';
373// $arrayofstreamtodisable is defined into filefunc.inc.php
374if (empty($dolibarr_main_stream_to_disable)) {
375 print '<span class="opacitymedium">'.$langs->trans("Undefined").' = '.implode(', ', $arrayofstreamtodisable).'</span>';
376} else {
377 print implode(', ', $dolibarr_main_stream_to_disable);
378}
379print '<span class="bold"> &nbsp; -> Current PHP streams allowed = </span>';
380$arrayofstreams = stream_get_wrappers();
381if (!empty($arrayofstreams)) {
382 sort($arrayofstreams);
383 print '<span class="wordbreakall">'.implode(',', $arrayofstreams).'</span>';
384 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("TryToKeepOnly", 'file,http,https,php').')</span>'."\n";
385}
386print '</div>';
387
388
389/*
390if (!empty($dolibarr_main_stream_do_not_disable)) {
391 print '<strong>$dolibarr_main_stream_do_not_disable</strong>: ';
392 if (empty($dolibarr_main_stream_do_not_disable)) {
393 print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>';
394 } else {
395 print join(', ', $dolibarr_main_stream_do_not_disable);
396 }
397 print ' -> PHP stream allowed = ';
398 $arrayofstreams = stream_get_wrappers();
399 if (!empty($arrayofstreams)) {
400 sort($arrayofstreams);
401 print (join(',', $arrayofstreams)).' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'Undefined').')</span>'."\n";
402 }
403
404 print '<br>';
405}
406*/
407
408// Menu Home - Setup - Security
409
410print '<br>';
411print '<br>';
412
413print load_fiche_titre($langs->trans("Menu").' '.$langs->trans("SecuritySetup"), '', 'folder');
414
415print '<div class="divsection wordbreak">';
416
417print '<strong>'.$langs->trans("UseCaptchaCode").'</strong>: ';
418print !getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA') ? '' : img_picto('', 'tick').' ';
419print yn(!getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA') ? 0 : 1);
420print '<br>';
421print '<br>';
422
423
424$sessiontimeout = ini_get("session.gc_maxlifetime");
425if (!getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
426 $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
427}
428print '<strong>'.$langs->trans("SessionTimeOut").'</strong>';
429if (!ini_get("session.gc_probability")) {
430 print $form->textwithpicto('', $langs->trans("SessionsPurgedByExternalSystem", ini_get("session.gc_maxlifetime")));
431} else {
432 print $form->textwithpicto('', $langs->trans("SessionExplanation", ini_get("session.gc_probability"), ini_get("session.gc_divisor"), ini_get("session.gc_maxlifetime")));
433}
434print ': '.getDolGlobalInt('MAIN_SESSION_TIMEOUT').' '.strtolower($langs->trans("Seconds"));
435print '<br><br>';
436
437print '<strong>'.$langs->trans("MaxNumberOfImagesInGetPost").'</strong>: ';
438print(getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT') ? img_picto('', 'tick').' ' : '').getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').' '.strtolower($langs->trans("Images"));
439print '<br><br>';
440
441print '<strong>'.$langs->trans("MaxNumberOfPostOnPublicPagesByIP").'</strong>: ';
442print(getDolGlobalInt('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200) ? img_picto('', 'tick').' ' : '').getDolGlobalInt('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200).' '.strtolower($langs->trans("Posts"));
443print '<br><br>';
444
445print '<strong>'.$langs->trans("MaxNumberOfAttachementOnForms").'</strong>: ';
446print(getDolGlobalInt('MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS', 10) ? img_picto('', 'tick').' ' : '').getDolGlobalInt("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).' '.strtolower($langs->trans("Files"));
447print '<br><br>';
448
449print '<strong>'.$langs->trans("DoNotStoreClearPassword").'</strong>: ';
450print !getDolGlobalString('DATABASE_PWD_ENCRYPTED') ? '' : img_picto('', 'tick').' ';
451print yn(!getDolGlobalString('DATABASE_PWD_ENCRYPTED') ? 0 : 1);
452if (!getDolGlobalString('DATABASE_PWD_ENCRYPTED')) {
453 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
454}
455print '<br>';
456print '<br>';
457
458/* Already into section conf file */
459/*
460$usepassinconfencrypted = 0;
461global $dolibarr_main_db_pass, $dolibarr_main_db_encrypted_pass;
462if (preg_match('/crypted:/i', $dolibarr_main_db_pass) || !empty($dolibarr_main_db_encrypted_pass)) {
463 $usepassinconfencrypted = 1;
464}
465print '<strong>'.$langs->trans("MainDbPasswordFileConfEncrypted").'</strong>: ';
466print $usepassinconfencrypted ? img_picto('', 'tick').' ' : img_warning().' ';
467print yn($usepassinconfencrypted);
468if (empty($usepassinconfencrypted)) {
469 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
470}
471print '<br>';
472print '<br>';
473*/
474
475/* Password length
476
477// Stored into $tabconf[0] if module generator is "Perso" or specific to the module generator.
478$tabConf = explode(";", getDolGlobalString('USER_PASSWORD_PATTERN'));
479
480print '<strong>'.$langs->trans("PasswordLength").'</strong>: ';
481print empty($conf->global->DATABASE_PWD_ENCRYPTED) ? '' : img_picto('', 'tick').' ';
482print yn(empty($conf->global->DATABASE_PWD_ENCRYPTED) ? 0 : 1);
483if (empty($conf->global->DATABASE_PWD_ENCRYPTED)) {
484 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
485}
486print '<br>';
487print '<br>';
488*/
489
490print '<strong>'.$langs->trans("AntivirusEnabledOnUpload").'</strong>: ';
491print !getDolGlobalString('MAIN_ANTIVIRUS_COMMAND') ? img_warning().' ' : img_picto('', 'tick').' ';
492print yn(!getDolGlobalString('MAIN_ANTIVIRUS_COMMAND') ? 0 : 1);
493if (!getDolGlobalString('MAIN_ANTIVIRUS_COMMAND')) {
494 print ' - <span class="opacitymedium">'.$langs->trans("Recommended").': '.$langs->trans("DefinedAPathForAntivirusCommandIntoSetup", $langs->transnoentitiesnoconv("Home")." - ".$langs->transnoentitiesnoconv("Setup")." - ".$langs->transnoentitiesnoconv("Security")).'</span>';
495} else {
496 print ' &nbsp; - ' . getDolGlobalString('MAIN_ANTIVIRUS_COMMAND');
497 if (defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
498 print ' - <span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
499 }
500}
501print '<br>';
502print '<br>';
503
504$umask = getDolGlobalString('MAIN_UMASK');
505
506print '<strong>'.$langs->trans("UMask").'</strong>: ';
507if (! in_array($umask, array('600', '660', '0600', '0660'))) {
508 print img_warning().' ';
509}
510print $umask;
511if (! in_array($umask, array('600', '660', '0600', '0660'))) {
512 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0600 | 0660)</span>';
513}
514print '<br>';
515print '<br>';
516
517
518$securityevent = new Events($db);
519$eventstolog = $securityevent->eventstolog;
520
521print '<strong>'.$langs->trans("AuditedSecurityEvents").'</strong>: ';
522$out = '';
523if (!empty($eventstolog) && is_array($eventstolog)) {
524 // Loop on each event type
525 $i = 0;
526 foreach ($eventstolog as $key => $arr) {
527 if ($arr['id']) {
528 $key = 'MAIN_LOGEVENTS_'.$arr['id'];
529 $value = getDolGlobalString($key);
530 if ($value) {
531 if ($i > 0) {
532 $out .= ', ';
533 }
534 $out .= '<span class="opacitymedium">'.$key.'</span>';
535 $i++;
536 }
537 }
538 }
539 print $out;
540}
541
542if (empty($out)) {
543 print img_warning().' '.$langs->trans("NoSecurityEventsAreAduited", $langs->transnoentities("Home").' - '.$langs->transnoentities("Setup").' - '.$langs->transnoentities("Security").' - '.$langs->transnoentities("Audit")).'<br>';
544} else {
545 $s = $langs->trans("SeeSetupPage", '{s1}'.$langs->transnoentities("Home").' - '.$langs->transnoentities("Setup").' - '.$langs->transnoentities("Security").' - '.$langs->transnoentities("Audit").'{s2}');
546 print ' - '.str_replace('{s2}', '</a>', str_replace('{s1}', '<a href="'.DOL_URL_ROOT.'/admin/events.php" target="_blank">', $s));
547}
548
549print '</div>';
550
551print '<br>';
552
553
554// Modules/Applications
555
556print '<br>';
557print '<br>';
558print load_fiche_titre($langs->trans("Modules"), '', 'folder');
559
560print '<div class="divsection wordbreak">';
561
562// Module log
563print '<strong>'.$langs->trans("Syslog").'</strong>: ';
564$test = isModEnabled('syslog');
565if (!$test) {
566 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
567} else {
568 if (getDolGlobalInt('SYSLOG_LEVEL') > LOG_NOTICE) {
569 print img_picto('', 'warning').' '.$langs->trans("ModuleActivatedWithTooHighLogLevel", $langs->transnoentities("Syslog"));
570 } else {
571 print img_picto('', 'tick').' '.$langs->trans("ModuleSyslogActivatedButLevelNotTooVerbose", $langs->transnoentities("Syslog"), getDolGlobalInt('SYSLOG_LEVEL'));
572 }
573 //print ' '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php'.'">XDebug admin page</a>';
574}
575print '<br>';
576
577print '<br>';
578
579// Module debugbar
580print '<strong>'.$langs->trans("DebugBar").'</strong>: ';
581$test = isModEnabled('debugbar');
582if (!$test) {
583 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
584} else {
585 print img_picto('', 'error').' '.$langs->trans("ModuleActivatedDoNotUseInProduction", $langs->transnoentities("DebugBar"));
586 //print ' '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php'.'">XDebug admin page</a>';
587}
588print '<br>';
589
590
591// Modules for Payments
592$test = isModEnabled('stripe');
593if ($test) {
594 print '<br>';
595
596 print '<strong>'.$langs->trans("Stripe").'</strong>: ';
597 if (!getDolGlobalString('PAYMENT_SECURITY_TOKEN_UNIQUE')) {
598 print img_picto('', 'error').' '.$langs->trans("OptionXShouldBeEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Stripe"));
599 } else {
600 print img_picto('', 'tick').' '.$langs->trans("OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Stripe"));
601 }
602 print '<br>';
603} else {
604 $test = isModEnabled('paypal');
605 if ($test) {
606 print '<br>';
607
608 print '<strong>'.$langs->trans("Paypal").'</strong>: ';
609 if (!getDolGlobalString('PAYMENT_SECURITY_TOKEN_UNIQUE')) {
610 print img_picto('', 'error').' '.$langs->trans("OptionXShouldBeEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Paypal"));
611 } else {
612 print img_picto('', 'tick').' '.$langs->trans("OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Paypal"));
613 }
614 print '<br>';
615 }
616}
617
618print '</div>';
619
620
621// APIs
622
623print '<br>';
624print '<br>';
625print load_fiche_titre($langs->trans("API"), '', 'folder');
626
627print '<div class="divsection wordbreak">';
628
629if (!isModEnabled('api') && !isModEnabled('webservices')) {
630 print $langs->trans("APIsAreNotEnabled");
631} else {
632 if (isModEnabled('webservices')) {
633 print img_picto('', 'warning').' '.$langs->trans('YouEnableDeprecatedWSAPIsUseRESTAPIsInstead')."<br>\n";
634 print '<br>';
635 }
636 if (isModEnabled('api')) {
637 print '<strong>API_ENDPOINT_RULES</strong> = '.getDolGlobalString('API_ENDPOINT_RULES', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Example").': login:0,users:0,setup:1,status:1,tickets:1,...)</span>')."<br>\n";
638 }
639}
640
641print '<br>';
642
643print '<strong>API_DISABLE_LOGIN_API</strong> = '.getDolGlobalString('API_DISABLE_LOGIN_API', '0').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span><br>';
644
645print '</div>';
646
647
648print '<br>';
649print '<br>';
650
651
652print load_fiche_titre($langs->trans("OtherSetup"), '', 'folder');
653
654print '<div class="divsection wordbreak">';
655
656print '<strong>MAIN_ALLOW_SVG_FILES_AS_IMAGES</strong> = '.getDolGlobalString('MAIN_ALLOW_SVG_FILES_AS_IMAGES', '0').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0)</span><br>';
657print '<br>';
658
659print '<strong>MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE</strong> = '.getDolGlobalString('MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span><br>';
660print '<br>';
661
662//print '<strong>'.$langs->trans("PasswordEncryption").'</strong>: ';
663print '<strong>MAIN_SECURITY_HASH_ALGO</strong> = '.getDolGlobalString('MAIN_SECURITY_HASH_ALGO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>')." &nbsp; ";
664if (!getDolGlobalString('MAIN_SECURITY_HASH_ALGO')) {
665 print '<span class="opacitymedium"> &nbsp; &nbsp; If unset: \'md5\'</span>';
666}
667if (getDolGlobalString('MAIN_SECURITY_HASH_ALGO') != 'password_hash') {
668 print '<br><strong>MAIN_SECURITY_SALT</strong> = '.getDolGlobalString('MAIN_SECURITY_SALT', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').'<br>';
669} else {
670 print '<span class="opacitymedium">('.$langs->trans("Recommended").': password_hash)</span>';
671 print '<br>';
672}
673if (getDolGlobalString('MAIN_SECURITY_HASH_ALGO') != 'password_hash') {
674 print '<div class="info">The recommended value for MAIN_SECURITY_HASH_ALGO is now \'password_hash\' but setting it now will make ALL existing passwords of all users not valid, so update is not possible.<br>';
675 print 'If you really want to switch, you must:<br>';
676 print '- Go on home - setup - other and add constant MAIN_SECURITY_HASH_ALGO to value \'password_hash\'<br>';
677 print '- In same session, WITHOUT LOGGING OUT, go into your admin user record and set a new password<br>';
678 print '- You can now logout and login with this new password. You must now reset password of all other users.<br>';
679 print '</div><br>';
680}
681print '<br>';
682
683print '<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span> &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': List of static IPs of server separated with coma - '.$langs->trans("Note").': common loopback ip like 127.*.*.*, [::1] are already added)</span>')."<br>";
684print '<br>';
685
686print '<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 2)</span>'."<br>";
687
688print '</div>';
689
690
691print '<br>';
692print '<br>';
693
694
695// Other - experimental
696
697print load_fiche_titre($langs->trans("OtherSetup").' ('.$langs->trans("Experimental").')', '', 'folder');
698
699print '<div class="divsection wordbreak">';
700print '<strong>MAIN_EXEC_USE_POPEN</strong> = ';
701if (!getDolGlobalString('MAIN_EXEC_USE_POPEN')) {
702 print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>';
703} else {
704 print $conf->global->MAIN_EXEC_USE_POPEN;
705}
706if ($execmethod == 1) {
707 print '<span class="opacitymedium"> &nbsp; &nbsp; "exec" PHP method will be used for shell commands';
708 print ' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 1)';
709 print '</span>';
710}
711if ($execmethod == 2) {
712 print '<span class="opacitymedium"> &nbsp; &nbsp; "popen" PHP method will be used for shell commands';
713 print ' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 1)';
714 print '</span>';
715}
716print '<br>';
717print '<br>';
718
719print '<strong>MAIN_SECURITY_MAXFILESIZE_DOWNLOADED</strong> = '.getDolGlobalString('MAIN_SECURITY_MAXFILESIZE_DOWNLOADED', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': 100000000)</span>')."<br>";
720print '<br>';
721
722print '<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
723print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - does not work on HTML5 with some old libxml libs)</span>";
724
725// Test compatibility of MAIN_RESTRICTHTML_ONLY_VALID_HTML
726$savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
727$savMAIN_RESTRICTHTML_ONLY_VALID_HTML = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML');
728$savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
729$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
730$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 1;
731$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0;
732$result=dol_htmlwithnojs('<img onerror<=alert(document.domain)> src=>0xbeefed');
733$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
734$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
735$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
736
737if ($result == 'InvalidHTMLStringCantBeCleaned') {
738 print ' &nbsp; - &nbsp; '.img_warning().' Your libxml seems to old to work correctly with this option. Disable it !';
739} else {
740 print ' &nbsp; - &nbsp; Test of compatibility with this option seems ok';
741}
742print '<br>';
743
744print '<br>';
745
746print '<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
747print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span> &nbsp; - &nbsp; Module "php-tidy" must be enabled (currently: '.((extension_loaded('tidy') && class_exists("tidy")) ? 'Enabled' : img_picto('', 'warning').' Not available').")";
748if (extension_loaded('tidy') && class_exists("tidy")) {
749 // Test compatibility of MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY
750 $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
751 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML');
752 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
753 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
754 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0;
755 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
756 $result=dol_htmlwithnojs('<img onerror<=alert(document.domain)> src=>0xbeefed');
757 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
758 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
759 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
760
761 if ($result == 'InvalidHTMLStringCantBeCleaned') {
762 print ' &nbsp; - &nbsp; '.img_warning().' Your libxml seems to old to work correctly with this option. Disable it !';
763 } else {
764 print ' &nbsp; - &nbsp; Test of compatibility with this option seems ok';
765 }
766}
767print '<br>';
768
769print '<br>';
770
771print '<strong>MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
772print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - does not work on HTML5 with some old libxml libs)</span><br>";
773print '<br>';
774
775// MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = 1, disallow url links except if on /medias
776// MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = 2, disallow all external urls link
777print '<strong>MAIN_DISALLOW_URL_INTO_DESCRIPTIONS</strong> = '.getDolGlobalString('MAIN_DISALLOW_URL_INTO_DESCRIPTIONS', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': 1=only local links allowed or 2=no links at all)</span>')."<br>";
778print '<br>';
779
780print '<strong>MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS</strong> = '.getDolGlobalString('MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
781print '<br>';
782
783// MAIN_ALLOW_LOCAL_LINKS_AS_EXTERNAL_LINKS
784
785print '<strong>MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
786print '<br>';
787
788print '<strong>MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED</strong> = '.getDolGlobalString('MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
789print '<br>';
790
791$examplecsprule = "frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
792print '<strong>MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCECSPRO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "'.$examplecsprule.'")</span><br>';
793print '<br>';
794
795$examplecsprule = "frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
796print '<strong>MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCECSP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "'.$examplecsprule.'")</span><br>';
797print '<br>';
798
799print '<strong>MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or")." \"strict-origin-when-cross-origin\" so browser doesn't send any referrer when going into another web site domain)</span><br>";
800print '<br>';
801
802print '<strong>MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1)</span><br>";
803print '<br>';
804
805// For websites
806
807print '<strong>WEBSITE_MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCECSPRO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
808print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
809$examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
810print $examplecsprule;
811print '")</span><br>';
812print '<br>';
813
814print '<strong>WEBSITE_MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCECSP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
815print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
816$examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
817print $examplecsprule;
818print '")</span><br>';
819print '<br>';
820
821print '<strong>WEBSITE_MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").'="strict-origin-when-cross-origin" '.$langs->trans("or").' "same-origin"=more secured)</span><br>';
822print '<br>';
823
824print '<strong>WEBSITE_MAIN_SECURITY_FORCESTS</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCESTS', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"max-age=31536000; includeSubDomains\")</span><br>";
825print '<br>';
826
827print '<strong>WEBSITE_MAIN_SECURITY_FORCEPP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCEPP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"camera=(), microphone=(), geolocation=*\")</span><br>";
828
829print '</div>';
830
831
832print '<br>';
833
834
835print load_fiche_titre($langs->trans("LimitsAndMitigation"), '', 'folder');
836
837print '<div class="divsection wordbreak">';
838
839print '<span class="opacitymedium">';
840print $langs->trans("RecommendMitigationOnURL").'<br>';
841print '</span>';
842
843print '<br>';
844$urlexamplebase = 'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/fail2ban/filter.d/';
845print '<span class="fas fa-shield-alt"></span> Login or API authentication (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulesbruteforce.conf">fail2ban example on GitHub</a>)<br>';
846print '<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.'/passwordforgotten.php (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulespassforgotten.conf">fail2ban example on GitHub</a>)<br>';
847print '<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.'/public/* (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-limitpublic.conf">fail2ban example on GitHub</a>)<br>';
848print '<br>';
849$urlexamplebase = 'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/apache/';
850print '<span class="fas fa-shield-alt"></span> You can also protect the application using a HTTP Basic authentication layer (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'virtualhost">apache2 virtualhost example on GitHub</a>)<br>';
851
852print '</div>';
853
854// End of page
855llxFooter();
856$db->close();
if(!defined('NOREQUIRESOC')) if(!defined( 'NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined( 'NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined( 'NOREQUIREAJAX')) llxHeader()
Empty header.
Definition wrapper.php:55
llxFooter()
Empty footer.
Definition wrapper.php:69
Events class.
Class to manage generation of HTML components Only common components must be here.
dol_dir_list($utf8_path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0, $nbsecondsold=0)
Scan a directory and return a list of files/directories.
Definition files.lib.php:63
version_php()
Return PHP version.
load_fiche_titre($title, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
img_warning($titlealt='default', $moreatt='', $morecss='pictowarning')
Show warning logo.
img_picto($titlealt, $picto, $moreatt='', $pictoisfullpath=0, $srconly=0, $notitle=0, $alt='', $morecss='', $marginleftonlyshort=2)
Show picto whatever it's its name (generic function)
yn($yesno, $case=1, $color=0)
Return yes or no in current language.
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox=0, $check='restricthtml')
Sanitize a HTML to remove js, dangerous content and external link.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
dol_getwebuser($mode)
Return user/group account of web server.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.