24require
'../../main.inc.php';
25require_once DOL_DOCUMENT_ROOT.
'/core/lib/memory.lib.php';
26require_once DOL_DOCUMENT_ROOT.
'/core/lib/date.lib.php';
27require_once DOL_DOCUMENT_ROOT.
'/core/lib/files.lib.php';
28require_once DOL_DOCUMENT_ROOT.
'/core/lib/geturl.lib.php';
29require_once DOL_DOCUMENT_ROOT.
'/core/lib/functions2.lib.php';
30require_once DOL_DOCUMENT_ROOT.
'/core/lib/security2.lib.php';
31require_once DOL_DOCUMENT_ROOT.
'/core/class/events.class.php';
34$langs->loadLangs(array(
"install",
"other",
"admin",
"errors"));
40if (
GETPOST(
'action',
'aZ09') ==
'donothing') {
53llxHeader(
'',
'',
'',
'', 0, 0,
'',
'',
'',
'mod-admin page-system_security');
57print
'<span class="opacitymedium">'.$langs->trans(
"YouMayFindSecurityAdviceHere",
'hhttps://wiki.dolibarr.org/index.php/Security_information').
'</span>';
58print
' ';
59print
'<a href="'.$_SERVER[
"PHP_SELF"].
'">';
60print
img_picto($langs->trans(
"Reload"),
'refresh').
' ';
61print $langs->trans(
"Reload");
73print
'<div class="divsection wordbreak">';
77print
"<strong>PHP</strong>: ".$langs->trans(
"Version").
": ".$phpversion;
78if (function_exists(
'php_ini_loaded_file')) {
79 $inipath = php_ini_loaded_file();
80 print
" - <strong>INI</strong>: ".$inipath;
85print
"<br><strong>Web server - ".$langs->trans(
"Version").
"</strong>: ".$_SERVER[
"SERVER_SOFTWARE"].
"<br>\n";
86print
'<strong>'.$langs->trans(
"DataRootServer").
"</strong>: ".DOL_DATA_ROOT.
"<br>\n";
90if ($labeluser && $labelgroup) {
91 print
'<strong>'.$langs->trans(
"WebUserGroup").
" (env vars)</strong> : ".$labeluser.
':'.$labelgroup;
92 if (function_exists(
'posix_geteuid') && function_exists(
'posix_getpwuid')) {
93 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
94 print
' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser[
'name'].
':'.$arrayofinfoofuser[
'gecos'].
':'.$arrayofinfoofuser[
'dir'].
':'.$arrayofinfoofuser[
'shell'].
')</span><br>'.
"\n";
98if (function_exists(
'exec')) {
101 exec(
'id', $arrayout, $varout);
102 if (empty($varout)) {
103 print
'<strong>'.$langs->trans(
"WebUserGroup").
" (real, 'id' command)</strong> : ".implode(
',', $arrayout).
"<br>\n";
108print
"<strong>PHP session.use_strict_mode</strong> = ".(ini_get(
'session.use_strict_mode') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.use_strict_mode') ? ini_get(
'session.use_strict_mode') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
109print
"<strong>PHP session.use_only_cookies</strong> = ".(ini_get(
'session.use_only_cookies') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.use_only_cookies') ? ini_get(
'session.use_only_cookies') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
110print
"<strong>PHP session.cookie_httponly</strong> = ".(ini_get(
'session.cookie_httponly') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.cookie_httponly') ? ini_get(
'session.cookie_httponly') :
'').
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
111print
"<strong>PHP session.cookie_samesite</strong> = ".(ini_get(
'session.cookie_samesite') ?
img_picto(
'',
'tick').
' ' .ini_get(
'session.cookie_samesite') :
'None');
112if (!ini_get(
'session.cookie_samesite') || ini_get(
'session.cookie_samesite') ==
'Lax') {
113 print
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'Lax').
")</span>";
114} elseif (ini_get(
'session.cookie_samesite') ==
'Strict') {
115 print
' '.img_warning().
' <span class="opacitymedium">'.$langs->trans(
"WarningPaypalPaymentNotCompatibleWithStrict").
"</span>";
119print
"<strong>PHP open_basedir</strong> = ".(ini_get(
'open_basedir') ?
img_picto(
'',
'tick').
' '.ini_get(
'open_basedir') :
img_warning().
' '.
yn(0).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"ARestrictedPath").
', '.$langs->transnoentitiesnoconv(
"Example").
': '.$_SERVER[
"DOCUMENT_ROOT"].
','.DOL_DATA_ROOT).
')</span>').
"<br>\n";
121print
"<strong>PHP short_open_tag</strong> = ".((empty(ini_get(
'short_open_tag')) || ini_get(
'short_open_tag') ==
'Off') ?
img_picto(
'',
'tick').
' '.
yn(0) :
img_warning().
' '.
yn(1)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
')</span>'.
"<br>\n";
123print
"<strong>PHP allow_url_fopen</strong> = ".(ini_get(
'allow_url_fopen') ?
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' '.ini_get(
'allow_url_fopen') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
" but may be required by some external modules)</span><br>\n";
125print
"<strong>PHP allow_url_include</strong> = ".(ini_get(
'allow_url_include') ?
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' '.ini_get(
'allow_url_include') :
img_picto(
'',
'tick').
' '.
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
")</span><br>\n";
129 print
"<strong>PHP auto_prepend_file</strong> = ".(ini_get(
'auto_prepend_file') ? ini_get(
'auto_prepend_file') :
'').
"</span><br>\n";
131 print
"<strong>PHP sendmail_path</strong> = ".(ini_get(
'sendmail_path') ? ini_get(
'sendmail_path') :
'').
"</span><br>\n";
134print
"<strong>PHP disable_functions</strong> = ";
135$arrayoffunctionsdisabled = explode(
',', ini_get(
'disable_functions'));
136$arrayoffunctionstodisable = explode(
',',
'dl,apache_note,apache_setenv,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,show_source,virtual');
139if ($execmethod == 1) {
140 $arrayoffunctionstodisable2 = explode(
',',
'passthru,shell_exec,system,proc_open,popen');
141 $functiontokeep =
'exec';
143 $arrayoffunctionstodisable2 = explode(
',',
'exec,passthru,shell_exec,system,proc_open');
144 $functiontokeep =
'popen';
147foreach ($arrayoffunctionsdisabled as $functionkey) {
151 print
'<span class="opacitymedium">'.$functionkey.
'</span>';
157foreach ($arrayoffunctionstodisable as $functiontodisable) {
158 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
160 $todisabletext .=
', ';
162 $todisabletext .=
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' <span class="opacitymedium">'.$functiontodisable.
'</span>';
167 print $langs->trans(
"YouShouldDisablePHPFunctions").
': '.$todisabletext;
172foreach ($arrayoffunctionstodisable2 as $functiontodisable) {
173 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
175 $todisabletext .=
', ';
177 $todisabletext .=
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' <span class="opacitymedium">'.$functiontodisable.
'</span>';
182 print $langs->trans(
"IfCLINotRequiredYouShouldDisablePHPFunctions").
': '.$todisabletext;
186print $langs->trans(
"PHPFunctionsRequiredForCLI").
': ';
187if (in_array($functiontokeep, $arrayoffunctionsdisabled)) {
188 print
img_picto($langs->trans(
"PHPFunctionsRequiredForCLI"),
'warning');
190print
'<span class="opacitymedium">'.$functiontokeep.
'</span>';
196print
'<strong>JSON</strong>: ';
197$loadedExtensions = array_map(
'strtolower', get_loaded_extensions(
false));
198$test = !in_array(
'json', $loadedExtensions);
199if ($test || function_exists(
'dol_json_decode')) {
200 print
img_picto(
'',
'error').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"VulnerableToRCEAttack");
202 print
img_picto(
'',
'tick').
' '.$langs->trans(
"Available").
' <span class="opacitymedium">(PHP native so not emulated, safe)</span>';
207print
'<strong>XDebug</strong>: ';
208$test = !function_exists(
'xdebug_is_enabled') && !extension_loaded(
'xdebug');
210 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
212 print
img_picto(
'',
'warning').
' '.$langs->trans(
"ModuleActivatedMayExposeInformation", $langs->transnoentities(
"XDebug"));
213 print
' - '.$langs->trans(
"MoreInformation").
' <a href="'.DOL_URL_ROOT.
'/admin/system/xdebug.php">XDebug admin page</a>';
224print
load_fiche_titre($langs->trans(
"OSSetup").
' - '.$langs->trans(
"PermissionsOnFiles"),
'',
'folder');
226print
'<div class="divsection wordbreak">';
228print
'<strong>'.$langs->trans(
"PermissionsOnFilesInWebRoot").
'</strong>: ';
229$arrayoffilesinroot =
dol_dir_list(DOL_DOCUMENT_ROOT,
'all', 1,
'', array(
'\/custom'),
'name', SORT_ASC, 4, 1,
'', 1);
230$fileswithwritepermission = array();
231foreach ($arrayoffilesinroot as $fileinroot) {
233 if (isset($fileinroot[
'perm']) && ($fileinroot[
'perm'] & 0222)) {
234 $fileswithwritepermission[] = $fileinroot[
'relativename'];
237if (empty($fileswithwritepermission)) {
238 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NoWritableFilesFoundIntoRootDir");
240 print
img_warning().
' '.$langs->trans(
"SomeFilesOrDirInRootAreWritable");
241 print
'<br>'.$langs->trans(
"Example").
': ';
243 foreach ($fileswithwritepermission as $filewithwritepermission) {
247 print
'<span class="opacitymedium">'.$filewithwritepermission.
'</span>';
258print
'<strong>'.$langs->trans(
"PermissionsOnFile", $conffile).
'</strong>: ';
259$perms = fileperms($dolibarr_main_document_root.
'/'.$conffile);
261 if (($perms & 0x0004) || ($perms & 0x0002)) {
262 print
img_warning().
' '.$langs->trans(
"ConfFileIsReadableOrWritableByAnyUsers");
266 print
' '.$langs->trans(
"User").
': '.$labeluser.
':'.$labelgroup;
267 if (function_exists(
'posix_geteuid') && function_exists(
'posix_getpwuid')) {
268 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
269 print
' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser[
'name'].
':'.$arrayofinfoofuser[
'gecos'].
':'.$arrayofinfoofuser[
'dir'].
':'.$arrayofinfoofuser[
'shell'].
')</span>';
275 print
img_warning().
' '.$langs->trans(
"FailedToReadFile", $conffile);
280$installlock = DOL_DATA_ROOT.
'/install.lock';
281$upgradeunlock = DOL_DATA_ROOT.
'/upgrade.unlock';
282$installmoduleslock = DOL_DATA_ROOT.
'/installmodules.lock';
285print
'<strong>'.$langs->trans(
"DolibarrSetup").
'</strong>: ';
286if (file_exists($installlock)) {
287 if (file_exists($upgradeunlock)) {
288 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallLockedBy", $installlock);
290 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallAndUpgradeLockedBy", $installlock);
293 print
img_warning().
' '.$langs->trans(
"WarningLockFileDoesNotExists", DOL_DATA_ROOT);
300if (file_exists($installlock)) {
301 if (file_exists($upgradeunlock)) {
302 print
'<strong>'.$langs->trans(
"DolibarrUpgrade").
'</strong>: ';
303 print
img_warning().
' '.$langs->trans(
"WarningUpgradeHasBeenUnlocked", $upgradeunlock);
310print
'<strong>'.$langs->trans(
"DolibarrAddonInstall").
'</strong>: ';
311if (file_exists($installmoduleslock)) {
312 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallAndUpgradeLockedBy", $installmoduleslock);
314 print $langs->trans(
"InstallOfAddonIsNotBlocked", DOL_DATA_ROOT);
325print
load_fiche_titre($langs->trans(
"ConfigurationFile").
' ('.$conffile.
')',
'',
'folder');
327print
'<div class="divsection wordbreak">';
328print
'<strong>$dolibarr_main_prod</strong>: '.($dolibarr_main_prod ? $dolibarr_main_prod :
'0');
329if (empty($dolibarr_main_prod)) {
330 print
' '.img_picto(
'',
'warning').
' '.$langs->trans(
"IfYouAreOnAProductionSetThis", 1);
334print
'<strong>$dolibarr_nocsrfcheck</strong>: '.(empty($dolibarr_nocsrfcheck) ?
'0' : $dolibarr_nocsrfcheck);
335if (!empty($dolibarr_nocsrfcheck)) {
336 print
' '.img_picto(
'',
'error').
' '.$langs->trans(
"IfYouAreOnAProductionSetThis", 0);
338 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0)</span>';
342print
'<strong>$dolibarr_main_restrict_ip</strong>: ';
343if (empty($dolibarr_main_restrict_ip)) {
344 print
'<span class="opacitymedium">'.$langs->trans(
"None").
'</span>';
347 print $dolibarr_main_restrict_ip;
351print
'<strong>$dolibarr_main_restrict_os_commands</strong>: ';
352if (empty($dolibarr_main_restrict_os_commands)) {
353 print $langs->trans(
"None");
355 print $dolibarr_main_restrict_os_commands;
357print
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'mysqldump, mysql, pg_dump, pg_restore, mariadb, mariadb-dump, clamdscan').
')</span>';
361 print
'<strong>$dolibarr_main_db_pass</strong>: ';
362 if (!empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) {
363 print
img_picto(
'',
'warning').
' '.$langs->trans(
"DatabasePasswordNotObfuscated").
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"SetOptionTo", $langs->transnoentitiesnoconv(
"MainDbPasswordFileConfEncrypted"),
yn(1)).
')</span>';
366 print
img_picto(
'',
'tick').
' '.$langs->trans(
"DatabasePasswordObfuscated");
372print
'<strong>$dolibarr_main_stream_to_disable</strong>: ';
374if (empty($dolibarr_main_stream_to_disable)) {
375 print
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' = '.implode(
', ', $arrayofstreamtodisable).
'</span>';
377 print implode(
', ', $dolibarr_main_stream_to_disable);
379print
'<span class="bold"> -> Current PHP streams allowed = </span>';
380$arrayofstreams = stream_get_wrappers();
381if (!empty($arrayofstreams)) {
382 sort($arrayofstreams);
383 print
'<span class="wordbreakall">'.implode(
',', $arrayofstreams).
'</span>';
384 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"TryToKeepOnly",
'file,http,https,php').
')</span>'.
"\n";
413print
load_fiche_titre($langs->trans(
"Menu").
' '.$langs->trans(
"SecuritySetup"),
'',
'folder');
415print
'<div class="divsection wordbreak">';
417print
'<strong>'.$langs->trans(
"UseCaptchaCode").
'</strong>: ';
424$sessiontimeout = ini_get(
"session.gc_maxlifetime");
426 $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
428print
'<strong>'.$langs->trans(
"SessionTimeOut").
'</strong>';
429if (!ini_get(
"session.gc_probability")) {
430 print $form->textwithpicto(
'', $langs->trans(
"SessionsPurgedByExternalSystem", ini_get(
"session.gc_maxlifetime")));
432 print $form->textwithpicto(
'', $langs->trans(
"SessionExplanation", ini_get(
"session.gc_probability"), ini_get(
"session.gc_divisor"), ini_get(
"session.gc_maxlifetime")));
434print
': '.getDolGlobalInt(
'MAIN_SESSION_TIMEOUT').
' '.strtolower($langs->trans(
"Seconds"));
437print
'<strong>'.$langs->trans(
"MaxNumberOfImagesInGetPost").
'</strong>: ';
438print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT') ?
img_picto(
'',
'tick').
' ' :
'').
getDolGlobalInt(
'MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').
' '.strtolower($langs->trans(
"Images"));
441print
'<strong>'.$langs->trans(
"MaxNumberOfPostOnPublicPagesByIP").
'</strong>: ';
442print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200) ?
img_picto(
'',
'tick').
' ' :
'').
getDolGlobalInt(
'MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200).
' '.strtolower($langs->trans(
"Posts"));
445print
'<strong>'.$langs->trans(
"MaxNumberOfAttachementOnForms").
'</strong>: ';
446print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS', 10) ?
img_picto(
'',
'tick').
' ' :
'').
getDolGlobalInt(
"MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).
' '.strtolower($langs->trans(
"Files"));
449print
'<strong>'.$langs->trans(
"DoNotStoreClearPassword").
'</strong>: ';
453 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
' '.
yn(1).
')</span>';
490print
'<strong>'.$langs->trans(
"AntivirusEnabledOnUpload").
'</strong>: ';
494 print
' - <span class="opacitymedium">'.$langs->trans(
"Recommended").
': '.$langs->trans(
"DefinedAPathForAntivirusCommandIntoSetup", $langs->transnoentitiesnoconv(
"Home").
" - ".$langs->transnoentitiesnoconv(
"Setup").
" - ".$langs->transnoentitiesnoconv(
"Security")).
'</span>';
497 if (defined(
'MAIN_ANTIVIRUS_COMMAND') && !defined(
'MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
498 print
' - <span class="opacitymedium">'.$langs->trans(
"ValueIsForcedBySystem").
'</span>';
506print
'<strong>'.$langs->trans(
"UMask").
'</strong>: ';
507if (! in_array($umask, array(
'600',
'660',
'0600',
'0660'))) {
511if (! in_array($umask, array(
'600',
'660',
'0600',
'0660'))) {
512 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0600 | 0660)</span>';
518$securityevent =
new Events($db);
519$eventstolog = $securityevent->eventstolog;
521print
'<strong>'.$langs->trans(
"AuditedSecurityEvents").
'</strong>: ';
523if (!empty($eventstolog) && is_array($eventstolog)) {
526 foreach ($eventstolog as $key => $arr) {
528 $key =
'MAIN_LOGEVENTS_'.$arr[
'id'];
534 $out .=
'<span class="opacitymedium">'.$key.
'</span>';
543 print
img_warning().
' '.$langs->trans(
"NoSecurityEventsAreAduited", $langs->transnoentities(
"Home").
' - '.$langs->transnoentities(
"Setup").
' - '.$langs->transnoentities(
"Security").
' - '.$langs->transnoentities(
"Audit")).
'<br>';
545 $s = $langs->trans(
"SeeSetupPage",
'{s1}'.$langs->transnoentities(
"Home").
' - '.$langs->transnoentities(
"Setup").
' - '.$langs->transnoentities(
"Security").
' - '.$langs->transnoentities(
"Audit").
'{s2}');
546 print
' - '.str_replace(
'{s2}',
'</a>', str_replace(
'{s1}',
'<a href="'.DOL_URL_ROOT.
'/admin/events.php" target="_blank">', $s));
560print
'<div class="divsection wordbreak">';
563print
'<strong>'.$langs->trans(
"Syslog").
'</strong>: ';
564$test = isModEnabled(
'syslog');
566 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
569 print
img_picto(
'',
'warning').
' '.$langs->trans(
"ModuleActivatedWithTooHighLogLevel", $langs->transnoentities(
"Syslog"));
571 print
img_picto(
'',
'tick').
' '.$langs->trans(
"ModuleSyslogActivatedButLevelNotTooVerbose", $langs->transnoentities(
"Syslog"),
getDolGlobalInt(
'SYSLOG_LEVEL'));
580print
'<strong>'.$langs->trans(
"DebugBar").
'</strong>: ';
581$test = isModEnabled(
'debugbar');
583 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
585 print
img_picto(
'',
'error').
' '.$langs->trans(
"ModuleActivatedDoNotUseInProduction", $langs->transnoentities(
"DebugBar"));
592$test = isModEnabled(
'stripe');
596 print
'<strong>'.$langs->trans(
"Stripe").
'</strong>: ';
598 print
img_picto(
'',
'error').
' '.$langs->trans(
"OptionXShouldBeEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Stripe"));
600 print
img_picto(
'',
'tick').
' '.$langs->trans(
"OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Stripe"));
604 $test = isModEnabled(
'paypal');
608 print
'<strong>'.$langs->trans(
"Paypal").
'</strong>: ';
610 print
img_picto(
'',
'error').
' '.$langs->trans(
"OptionXShouldBeEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Paypal"));
612 print
img_picto(
'',
'tick').
' '.$langs->trans(
"OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Paypal"));
627print
'<div class="divsection wordbreak">';
629if (!isModEnabled(
'api') && !isModEnabled(
'webservices')) {
630 print $langs->trans(
"APIsAreNotEnabled");
632 if (isModEnabled(
'webservices')) {
633 print
img_picto(
'',
'warning').
' '.$langs->trans(
'YouEnableDeprecatedWSAPIsUseRESTAPIsInstead').
"<br>\n";
636 if (isModEnabled(
'api')) {
637 print
'<strong>API_ENDPOINT_RULES</strong> = '.getDolGlobalString(
'API_ENDPOINT_RULES',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Example").
': login:0,users:0,setup:1,status:1,tickets:1,...)</span>').
"<br>\n";
643print
'<strong>API_DISABLE_LOGIN_API</strong> = '.getDolGlobalString(
'API_DISABLE_LOGIN_API',
'0').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 1)</span><br>';
654print
'<div class="divsection wordbreak">';
656print
'<strong>MAIN_ALLOW_SVG_FILES_AS_IMAGES</strong> = '.getDolGlobalString(
'MAIN_ALLOW_SVG_FILES_AS_IMAGES',
'0').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0)</span><br>';
659print
'<strong>MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE</strong> = '.getDolGlobalString(
'MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 1)</span><br>';
663print
'<strong>MAIN_SECURITY_HASH_ALGO</strong> = '.getDolGlobalString(
'MAIN_SECURITY_HASH_ALGO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
" ";
665 print
'<span class="opacitymedium"> If unset: \'md5\'</span>';
668 print
'<br><strong>MAIN_SECURITY_SALT</strong> = '.getDolGlobalString(
'MAIN_SECURITY_SALT',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
'<br>';
670 print
'<span class="opacitymedium">('.$langs->trans(
"Recommended").
': password_hash)</span>';
674 print
'<div class="info">The recommended value for MAIN_SECURITY_HASH_ALGO is now \'password_hash\' but setting it now will make ALL existing passwords of all users not valid, so update is not possible.<br>';
675 print
'If you really want to switch, you must:<br>';
676 print
'- Go on home - setup - other and add constant MAIN_SECURITY_HASH_ALGO to value \'password_hash\'<br>';
677 print
'- In same session, WITHOUT LOGGING OUT, go into your admin user record and set a new password<br>';
678 print
'- You can now logout and login with this new password. You must now reset password of all other users.<br>';
683print
'<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_ANTI_SSRF_SERVER_IP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span> <span class="opacitymedium">('.$langs->trans(
"Recommended").
': List of static IPs of server separated with coma - '.$langs->trans(
"Note").
': common loopback ip like 127.*.*.*, [::1] are already added)</span>').
"<br>";
686print
'<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString(
'MAIN_SECURITY_CSRF_WITH_TOKEN',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 2)</span>'.
"<br>";
697print
load_fiche_titre($langs->trans(
"OtherSetup").
' ('.$langs->trans(
"Experimental").
')',
'',
'folder');
699print
'<div class="divsection wordbreak">';
700print
'<strong>MAIN_EXEC_USE_POPEN</strong> = ';
702 print
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>';
704 print $conf->global->MAIN_EXEC_USE_POPEN;
706if ($execmethod == 1) {
707 print
'<span class="opacitymedium"> "exec" PHP method will be used for shell commands';
708 print
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 1)';
711if ($execmethod == 2) {
712 print
'<span class="opacitymedium"> "popen" PHP method will be used for shell commands';
713 print
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 1)';
719print
'<strong>MAIN_SECURITY_MAXFILESIZE_DOWNLOADED</strong> = '.getDolGlobalString(
'MAIN_SECURITY_MAXFILESIZE_DOWNLOADED',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': 100000000)</span>').
"<br>";
722print
'<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
723print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1 - does not work on HTML5 with some old libxml libs)</span>";
726$savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES =
getDolGlobalString(
'MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
727$savMAIN_RESTRICTHTML_ONLY_VALID_HTML =
getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML');
728$savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY =
getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
729$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
730$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 1;
731$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0;
732$result=
dol_htmlwithnojs(
'<img onerror<=alert(document.domain)> src=>0xbeefed');
733$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
734$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
735$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
737if ($result ==
'InvalidHTMLStringCantBeCleaned') {
738 print
' - '.img_warning().
' Your libxml seems to old to work correctly with this option. Disable it !';
740 print
' - Test of compatibility with this option seems ok';
746print
'<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
747print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 1)</span> - Module "php-tidy" must be enabled (currently: '.((extension_loaded(
'tidy') && class_exists(
"tidy")) ?
'Enabled' :
img_picto(
'',
'warning').
' Not available').
")";
748if (extension_loaded(
'tidy') && class_exists(
"tidy")) {
750 $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES =
getDolGlobalString(
'MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
751 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML =
getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML');
752 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY =
getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
753 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
754 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0;
755 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
756 $result=
dol_htmlwithnojs(
'<img onerror<=alert(document.domain)> src=>0xbeefed');
757 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
758 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
759 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
761 if ($result ==
'InvalidHTMLStringCantBeCleaned') {
762 print
' - '.img_warning().
' Your libxml seems to old to work correctly with this option. Disable it !';
764 print
' - Test of compatibility with this option seems ok';
771print
'<strong>MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
772print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1 - does not work on HTML5 with some old libxml libs)</span><br>";
777print
'<strong>MAIN_DISALLOW_URL_INTO_DESCRIPTIONS</strong> = '.getDolGlobalString(
'MAIN_DISALLOW_URL_INTO_DESCRIPTIONS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': 1=only local links allowed or 2=no links at all)</span>').
"<br>";
780print
'<strong>MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS</strong> = '.getDolGlobalString(
'MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
785print
'<strong>MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL</strong> = '.getDolGlobalString(
'MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
788print
'<strong>MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED</strong> = '.getDolGlobalString(
'MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
791$examplecsprule =
"frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
792print
'<strong>MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCECSPRO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "'.$examplecsprule.
'")</span><br>';
795$examplecsprule =
"frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
796print
'<strong>MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCECSP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "'.$examplecsprule.
'")</span><br>';
799print
'<strong>MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCERP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
" \"strict-origin-when-cross-origin\" so browser doesn't send any referrer when going into another web site domain)</span><br>";
802print
'<strong>MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1)</span><br>";
807print
'<strong>WEBSITE_MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCECSPRO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
808print
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "';
809$examplecsprule =
"default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER[
"SERVER_NAME"], 1).
" *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
810print $examplecsprule;
811print
'")</span><br>';
814print
'<strong>WEBSITE_MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCECSP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
815print
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "';
816$examplecsprule =
"default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER[
"SERVER_NAME"], 1).
" *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
817print $examplecsprule;
818print
'")</span><br>';
821print
'<strong>WEBSITE_MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCERP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
'="strict-origin-when-cross-origin" '.$langs->trans(
"or").
' "same-origin"=more secured)</span><br>';
824print
'<strong>WEBSITE_MAIN_SECURITY_FORCESTS</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCESTS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
": \"max-age=31536000; includeSubDomains\")</span><br>";
827print
'<strong>WEBSITE_MAIN_SECURITY_FORCEPP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCEPP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
": \"camera=(), microphone=(), geolocation=*\")</span><br>";
837print
'<div class="divsection wordbreak">';
839print
'<span class="opacitymedium">';
840print $langs->trans(
"RecommendMitigationOnURL").
'<br>';
844$urlexamplebase =
'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/fail2ban/filter.d/';
845print
'<span class="fas fa-shield-alt"></span> Login or API authentication (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-rulesbruteforce.conf">fail2ban example on GitHub</a>)<br>';
846print
'<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.
'/passwordforgotten.php (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-rulespassforgotten.conf">fail2ban example on GitHub</a>)<br>';
847print
'<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.
'/public/* (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-limitpublic.conf">fail2ban example on GitHub</a>)<br>';
849$urlexamplebase =
'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/apache/';
850print
'<span class="fas fa-shield-alt"></span> You can also protect the application using a HTTP Basic authentication layer (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'virtualhost">apache2 virtualhost example on GitHub</a>)<br>';
if(!defined('NOREQUIRESOC')) if(!defined( 'NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined( 'NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined( 'NOREQUIREAJAX')) llxHeader()
Empty header.
dol_dir_list($utf8_path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0, $nbsecondsold=0)
Scan a directory and return a list of files/directories.
version_php()
Return PHP version.
load_fiche_titre($title, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
img_warning($titlealt='default', $moreatt='', $morecss='pictowarning')
Show warning logo.
img_picto($titlealt, $picto, $moreatt='', $pictoisfullpath=0, $srconly=0, $notitle=0, $alt='', $morecss='', $marginleftonlyshort=2)
Show picto whatever it's its name (generic function)
yn($yesno, $case=1, $color=0)
Return yes or no in current language.
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox=0, $check='restricthtml')
Sanitize a HTML to remove js, dangerous content and external link.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
dol_getwebuser($mode)
Return user/group account of web server.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.