dolibarr 22.0.5
security.php
Go to the documentation of this file.
1<?php
2/* Copyright (C) 2013-2022 Laurent Destailleur <eldy@users.sourceforge.net>
3 * Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
4 * Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program. If not, see <https://www.gnu.org/licenses/>.
18 */
19
25// Load Dolibarr environment
26require '../../main.inc.php';
27require_once DOL_DOCUMENT_ROOT.'/core/lib/memory.lib.php';
28require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
29require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
30require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
31require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
32require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
33require_once DOL_DOCUMENT_ROOT.'/core/class/events.class.php';
34
48// Load translation files required by the page
49$langs->loadLangs(array("install", "other", "admin", "errors"));
50
51if (!$user->admin) {
52 accessforbidden();
53}
54
55if (GETPOST('action', 'aZ09') == 'donothing') {
56 exit;
57}
58
59$execmethod = getDolGlobalInt('MAIN_EXEC_USE_POPEN', 1);
60
61
62/*
63 * View
64 */
65
66$form = new Form($db);
67
68llxHeader('', '', '', '', 0, 0, '', '', '', 'mod-admin page-system_security');
69
70print load_fiche_titre($langs->trans("Security"), '', 'title_setup');
71
72print '<span class="opacitymedium">'.$langs->trans("YouMayFindSecurityAdviceHere", 'hhttps://wiki.dolibarr.org/index.php/Security_information').'</span>';
73print ' &nbsp; &nbsp; ';
74print '<a href="'.$_SERVER["PHP_SELF"].'">';
75print img_picto($langs->trans("Reload"), 'refresh').' ';
76print $langs->trans("Reload");
77print '</a>';
78print '<br>';
79print '<br>';
80
81
82print '<br>';
83
84
85print load_fiche_titre($langs->trans("PHPSetup"), '', 'folder');
86
87
88print '<div class="divsection wordbreak">';
89
90// Get version of PHP
91$phpversion = version_php();
92print "<strong>PHP</strong>: ".$langs->trans("Version").": ".$phpversion;
93if (function_exists('php_ini_loaded_file')) {
94 $inipath = php_ini_loaded_file();
95 print " - <strong>INI</strong>: ".$inipath;
96}
97print "<br>\n";
98
99// Get version of web server
100print "<br><strong>Web server - ".$langs->trans("Version")."</strong>: ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";
101print '<strong>'.$langs->trans("DataRootServer")."</strong>: ".DOL_DATA_ROOT."<br>\n";
102// Web user group by default
103$labeluser = dol_getwebuser('user');
104$labelgroup = dol_getwebuser('group');
105if ($labeluser && $labelgroup) {
106 print '<strong>'.$langs->trans("WebUserGroup")." (env vars)</strong> : ".$labeluser.':'.$labelgroup;
107 if (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) {
108 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
109 print ' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser['name'].':'.$arrayofinfoofuser['gecos'].':'.$arrayofinfoofuser['dir'].':'.$arrayofinfoofuser['shell'].')</span><br>'."\n";
110 }
111}
112// Web user group real (detected by 'id' external command)
113if (function_exists('exec')) {
114 $arrayout = array();
115 $varout = 0;
116 exec('id', $arrayout, $varout);
117 if (empty($varout)) { // Test command is ok. Work only on Linux OS.
118 print '<strong>'.$langs->trans("WebUserGroup")." (real, 'id' command)</strong> : ".implode(',', $arrayout)."<br>\n";
119 }
120}
121print '<br>';
122
123print (ini_get('session.use_strict_mode') ? img_picto('', 'tick', 'class="pictofixedwidth"') : img_warning('', '', 'pictofixedwidth nopaddingleft'))."<strong>PHP session.use_strict_mode</strong> = ".(ini_get('session.use_strict_mode') ? ini_get('session.use_strict_mode') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
124print (ini_get('session.use_only_cookies') ? img_picto('', 'tick', 'class="pictofixedwidth"') : img_warning('', '', 'pictofixedwidth nopaddingleft'))."<strong>PHP session.use_only_cookies</strong> = ".(ini_get('session.use_only_cookies') ? ini_get('session.use_only_cookies') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
125print (ini_get('session.cookie_httponly') ? img_picto('', 'tick', 'class="pictofixedwidth"') : img_warning('', '', 'pictofixedwidth nopaddingleft'))."<strong>PHP session.cookie_httponly</strong> = ".(ini_get('session.cookie_httponly') ? ini_get('session.cookie_httponly') : '').' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
126print (ini_get('session.cookie_samesite') ? img_picto('', 'tick', 'class="pictofixedwidth"') : img_warning('', '', 'pictofixedwidth nopaddingleft'))."<strong>PHP session.cookie_samesite</strong> = ".(ini_get('session.cookie_samesite') ? ini_get('session.cookie_samesite') : 'None');
127if (!ini_get('session.cookie_samesite') || ini_get('session.cookie_samesite') == 'Lax') {
128 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'Lax').")</span>";
129} elseif (ini_get('session.cookie_samesite') == 'Strict') {
130 print ' &nbsp; '.img_warning().' <span class="opacitymedium">'.$langs->trans("WarningPaypalPaymentNotCompatibleWithStrict")."</span>";
131}
132print "<br>\n";
133
134print (ini_get('open_basedir') ? img_picto('', 'tick', 'class="pictofixedwidth"') : img_warning('', '', 'pictofixedwidth nopaddingleft'))."<strong>PHP open_basedir</strong> = ".(ini_get('open_basedir') ? ini_get('open_basedir') : yn(0).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("ARestrictedPath").', '.$langs->transnoentitiesnoconv("Example").': '.$_SERVER["DOCUMENT_ROOT"].','.DOL_DATA_ROOT).')</span>')."<br>\n";
135
136print ((empty(ini_get('short_open_tag')) || ini_get('short_open_tag') == 'Off') ? img_picto('', 'tick', 'class="pictofixedwidth"') : img_warning('', '', 'pictofixedwidth nopaddingleft'))."<strong>PHP short_open_tag</strong> = ".((empty(ini_get('short_open_tag')) || ini_get('short_open_tag') == 'Off') ? yn(0) : yn(1)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).')</span>'."<br>\n";
137
138print (ini_get('allow_url_fopen') ? img_picto($langs->trans("YouShouldSetThisToOff"), 'warning', 'class="pictofixedwidth nopaddingleft"') : img_picto('', 'tick', 'class="pictofixedwidth"'))."<strong>PHP allow_url_fopen</strong> = ".(ini_get('allow_url_fopen') ? ini_get('allow_url_fopen') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).", except if Yes is required by some external modules)</span><br>\n";
139
140print (ini_get('allow_url_include') ? img_picto($langs->trans("YouShouldSetThisToOff"), 'warning', 'class="pictofixedwidth nopaddingleft"') : img_picto('', 'tick', 'class="pictofixedwidth"')). "<strong>PHP allow_url_include</strong> = ".(ini_get('allow_url_include') ? ini_get('allow_url_include') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).")</span><br>\n";
141//print "<strong>PHP safe_mode</strong> = ".(ini_get('safe_mode') ? ini_get('safe_mode') : yn(0)).' &nbsp; <span class="opacitymedium">'.$langs->trans("Deprecated")." (removed in PHP 5.4)</span><br>\n";
142
143if (getDolGlobalString('MAIN_SECURITY_SHOW_MORE_INFO')) {
144 print "<strong>PHP auto_prepend_file</strong> = ".(ini_get('auto_prepend_file') ? ini_get('auto_prepend_file') : '')."</span><br>\n";
145
146 print "<strong>PHP sendmail_path</strong> = ".(ini_get('sendmail_path') ? ini_get('sendmail_path') : '')."</span><br>\n";
147}
148
149print '<br>';
150print "<strong>PHP disable_functions</strong>: ";
151$arrayoffunctionsdisabled = explode(',', ini_get('disable_functions'));
152$arrayoffunctionstodisable = explode(',', 'dl,apache_note,apache_setenv,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,show_source,virtual');
153//$arrayoffunctionstodisable[] = 'stream_wrapper_restore';
154//$arrayoffunctionstodisable[] = 'stream_wrapper_register';
155if ($execmethod == 1) {
156 $arrayoffunctionstodisable2 = explode(',', 'passthru,shell_exec,system,proc_open,popen');
157 $functiontokeep = 'exec';
158} else {
159 $arrayoffunctionstodisable2 = explode(',', 'exec,passthru,shell_exec,system,proc_open');
160 $functiontokeep = 'popen';
161}
162$i = 0;
163foreach ($arrayoffunctionsdisabled as $functionkey) {
164 if ($i > 0) {
165 print ', ';
166 }
167 print '<span class="opacitymedium">'.$functionkey.'</span>';
168 $i++;
169}
170print "<br>\n";
171$todisabletext = '';
172$i = 0;
173foreach ($arrayoffunctionstodisable as $functiontodisable) {
174 if (\function_exists($functiontodisable)) {
175 if ($i > 0) {
176 $todisabletext .= ', ';
177 }
178 $todisabletext .= ' <span class="opacitymedium">'.$functiontodisable.'</span>';
179 $i++;
180 }
181}
182if ($todisabletext) {
183 print img_picto('', 'warning', 'class="pictofixedwidth nopaddingleft"').$langs->trans("YouShouldDisablePHPFunctions").': '.$todisabletext;
184 print '<br>';
185}
186$todisabletext = '';
187$i = 0;
188foreach ($arrayoffunctionstodisable2 as $functiontodisable) {
189 if (\function_exists($functiontodisable)) {
190 if ($i > 0) {
191 $todisabletext .= ', ';
192 }
193 $todisabletext .= ' <span class="opacitymedium">'.$functiontodisable.'</span>';
194 $i++;
195 }
196}
197if ($todisabletext) {
198 print img_picto('', 'warning', 'class="pictofixedwidth nopaddingleft"').$langs->trans("IfCLINotRequiredYouShouldDisablePHPFunctions").': '.$todisabletext;
199 print '<br>';
200}
201if (!\function_exists($functiontokeep)) {
202 print img_picto($langs->trans("PHPFunctionsRequiredForCLI"), 'warning', 'class="pictofixedwidth"');
203} else {
204 print img_picto('', 'tick', 'class="pictofixedwidth"');
205}
206print $langs->trans("PHPFunctionsRequiredForCLI").': ';
207print '<span class="opacitymedium">'.$functiontokeep.'</span>';
208print '<br>';
209
210print '<br>';
211
212// JSON
213$loadedExtensions = array_map('strtolower', get_loaded_extensions(false));
214$test = !in_array('json', $loadedExtensions);
215if ($test || function_exists('dol_json_decode')) {
216 print img_picto('', 'error', 'class="pictofixedwidth nopaddingleft"');
217} else {
218 print img_picto('', 'tick', 'class="pictofixedwidth"');
219}
220print '<strong>JSON</strong>: ';
221if ($test || function_exists('dol_json_decode')) {
222 print $langs->trans("NotInstalled").' - '.$langs->trans("VulnerableToRCEAttack");
223} else {
224 print $langs->trans("Available").' <span class="opacitymedium">(PHP native so not emulated, safe)</span>';
225}
226print '<br>';
227
228// XDebug
229$test = !function_exists('xdebug_is_enabled') && !extension_loaded('xdebug');
230if ($test) {
231 print img_picto('', 'tick', 'class="pictofixedwidth"');
232} else {
233 print img_picto('', 'warning', 'class="pictofixedwidth nopaddingleft"');
234}
235print '<strong>XDebug</strong>: ';
236if ($test) {
237 print $langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
238} else {
239 print $langs->trans("ModuleActivatedMayExposeInformation", $langs->transnoentities("XDebug"));
240 print ' - '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php">XDebug admin page</a>';
241}
242
243print '</div>';
244
245print '<br>';
246
247
248// OS Setup - Permissions on files
249
250print '<br>';
251print load_fiche_titre($langs->trans("OSSetup").' - '.$langs->trans("PermissionsOnFiles"), '', 'folder');
252
253print '<div class="divsection wordbreak">';
254
255print '<strong>'.$langs->trans("PermissionsOnFilesInWebRoot").'</strong>: ';
256$arrayoffilesinroot = dol_dir_list(DOL_DOCUMENT_ROOT, 'all', 1, '', array('\/custom'), 'name', SORT_ASC, 4, 1, '', 1);
257$fileswithwritepermission = array();
258foreach ($arrayoffilesinroot as $fileinroot) {
259 // Test if there is at least one write permission file. If yes, add the entry into array $fileswithwritepermission
260 if (isset($fileinroot['perm']) && ($fileinroot['perm'] & 0222)) {
261 $fileswithwritepermission[] = $fileinroot['relativename'];
262 }
263}
264if (empty($fileswithwritepermission)) {
265 print img_picto('', 'tick').' '.$langs->trans("NoWritableFilesFoundIntoRootDir");
266} else {
267 print img_warning().' '.$langs->trans("SomeFilesOrDirInRootAreWritable");
268 print ' &nbsp; - &nbsp; <span class="classlink cursorpointer" onclick="javascript: console.log(\'Toggle examples\'); jQuery(\'#examplewritablefiles\').toggle();">'.$langs->trans("Examples").'</span>';
269 print '<span id="examplewritablefiles" class="hideobject"><br>'.$langs->trans("Example").': ';
270 $i = 0;
271 foreach ($fileswithwritepermission as $filewithwritepermission) {
272 if ($i > 0) {
273 print ', ';
274 }
275 print '<span class="opacitymedium">'.$filewithwritepermission.'</span>';
276 if ($i > 20) {
277 print ' ...';
278 break;
279 }
280 $i++;
281 }
282 print '</span>';
283}
284print '<br>';
285print '<br>';
286
287print '<strong>'.$langs->trans("PermissionsOnFile", $conffile).'</strong>: '; // $conffile is defined into filefunc.inc.php
288$perms = fileperms($dolibarr_main_document_root.'/'.$conffile);
289if ($perms) {
290 if (($perms & 0x0004) || ($perms & 0x0002)) {
291 print img_warning().' '.$langs->trans("ConfFileIsReadableOrWritableByAnyUsers");
292 // Web user group by default
293 $labeluser = dol_getwebuser('user');
294 $labelgroup = dol_getwebuser('group');
295 print ' '.$langs->trans("User").': '.$labeluser.':'.$labelgroup;
296 if (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) {
297 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
298 print ' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser['name'].':'.$arrayofinfoofuser['gecos'].':'.$arrayofinfoofuser['dir'].':'.$arrayofinfoofuser['shell'].')</span>';
299 }
300 } else {
301 print img_picto('', 'tick');
302 }
303} else {
304 print img_warning().' '.$langs->trans("FailedToReadFile", $conffile);
305}
306print '<br>';
307print '<br>';
308
309$installlock = DOL_DATA_ROOT.'/install.lock';
310$upgradeunlock = DOL_DATA_ROOT.'/upgrade.unlock';
311$installmoduleslock = DOL_DATA_ROOT.'/installmodules.lock';
312
313// Is install (upgrade) locked
314$test = file_exists($installlock);
315print '<strong>'.$langs->trans("DolibarrSetup").'</strong>: ';
316if ($test) {
317 if (file_exists($upgradeunlock)) {
318 print img_picto('', 'tick').' '.$langs->trans("InstallLockedBy", $installlock);
319 } else {
320 print img_picto('', 'tick').' '.$langs->trans("InstallAndUpgradeLockedBy", $installlock);
321 }
322} else {
323 print img_warning().' '.$langs->trans("WarningLockFileDoesNotExists", DOL_DATA_ROOT);
324}
325
326print '<br>';
327print '<br>';
328
329// Is upgrade unlocked
330if (file_exists($installlock)) { // If install not locked, no need to show this.
331 if (file_exists($upgradeunlock)) {
332 print '<strong>'.$langs->trans("DolibarrUpgrade").'</strong>: ';
333 print img_warning().' '.$langs->trans("WarningUpgradeHasBeenUnlocked", $upgradeunlock);
334 print '<br>';
335 print '<br>';
336 }
337}
338
339// Is addon install locked ?
340$test = file_exists($installmoduleslock);
341print '<strong>'.$langs->trans("DolibarrAddonInstall").'</strong>: ';
342if ($test) {
343 print img_picto('', 'tick').' '.$langs->trans("InstallAndUpgradeLockedBy", $installmoduleslock);
344} else {
345 print $langs->trans("InstallOfAddonIsNotBlocked", DOL_DATA_ROOT);
346}
347
348print '</div>';
349
350
351
352// File conf.php
353
354print '<br>';
355print '<br>';
356print load_fiche_titre($langs->trans("ConfigurationFile").' ('.$conffile.')', '', 'folder');
357
358print '<div class="divsection wordbreak">';
359print '<strong>$dolibarr_main_prod</strong>: '.($dolibarr_main_prod ? $dolibarr_main_prod : '0');
360if (empty($dolibarr_main_prod)) {
361 print ' &nbsp; &nbsp; '.img_picto('', 'warning').' '.$langs->trans("IfYouAreOnAProductionSetThis", 1);
362}
363print '<br>';
364
365print '<strong>$dolibarr_nocsrfcheck</strong>: '.(empty($dolibarr_nocsrfcheck) ? '0' : $dolibarr_nocsrfcheck);
366if (!empty($dolibarr_nocsrfcheck)) {
367 print ' &nbsp; &nbsp;'.img_picto('', 'error').' '.$langs->trans("IfYouAreOnAProductionSetThis", 0);
368} else {
369 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0)</span>';
370}
371print '<br>';
372
373print '<strong>$dolibarr_main_restrict_ip</strong>: ';
374if (empty($dolibarr_main_restrict_ip)) {
375 print $langs->trans("None");
376 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("StaticIPsOfUsers")).')</span>';
377} else {
378 print $dolibarr_main_restrict_ip;
379}
380print '<br>';
381
382print '<strong>$dolibarr_main_restrict_os_commands</strong>: ';
383if (empty($dolibarr_main_restrict_os_commands)) {
384 print $langs->trans("None");
385} else {
386 print $dolibarr_main_restrict_os_commands;
387}
388print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'mysqldump, mysql, pg_dump, pg_restore, mariadb, mariadb-dump, clamdscan').')</span>';
389print '<br>';
390
391if (!getDolGlobalString('SECURITY_DISABLE_TEST_ON_OBFUSCATED_CONF')) {
392 print '<strong>$dolibarr_main_db_pass</strong>: ';
393 if (!empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) {
394 print img_picto('', 'warning').' '.$langs->trans("DatabasePasswordNotObfuscated").' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("SetOptionTo", $langs->transnoentitiesnoconv("MainDbPasswordFileConfEncrypted"), yn(1)).')</span>';
395 //print ' <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("IPsOfUsers")).')</span>';
396 } else {
397 print img_picto('', 'tick').' '.$langs->trans("DatabasePasswordObfuscated");
398 }
399
400 print '<br>';
401}
402
403print '<strong>$dolibarr_main_stream_to_disable</strong>: ';
404// $arrayofstreamtodisable is defined into filefunc.inc.php
405'@phan-var-force string[] $arrayofstreamtodisable';
406if (empty($dolibarr_main_stream_to_disable)) {
407 print '<span class="opacitymedium">'.$langs->trans("Undefined").' = '.implode(', ', $arrayofstreamtodisable).'</span>';
408} else {
409 print implode(', ', $dolibarr_main_stream_to_disable);
410}
411print '<span class="bold"> &nbsp; -> Current PHP streams allowed = </span>';
412$arrayofstreams = stream_get_wrappers();
413if (!empty($arrayofstreams)) {
414 sort($arrayofstreams);
415 print '<span class="wordbreak">'.implode(',', $arrayofstreams).'</span>';
416 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("TryToKeepOnly", 'file,http,https,php,zip').')</span>'."\n";
417}
418print '</div>';
419
420
421/*
422if (!empty($dolibarr_main_stream_do_not_disable)) {
423 print '<strong>$dolibarr_main_stream_do_not_disable</strong>: ';
424 if (empty($dolibarr_main_stream_do_not_disable)) {
425 print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>';
426 } else {
427 print join(', ', $dolibarr_main_stream_do_not_disable);
428 }
429 print ' -> PHP stream allowed = ';
430 $arrayofstreams = stream_get_wrappers();
431 if (!empty($arrayofstreams)) {
432 sort($arrayofstreams);
433 print (join(',', $arrayofstreams)).' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'Undefined').')</span>'."\n";
434 }
435
436 print '<br>';
437}
438*/
439
440// Menu Home - Setup - Security
441
442print '<br>';
443print '<br>';
444
445print load_fiche_titre($langs->trans("Menu").' '.$langs->trans("SecuritySetup"), '', 'folder');
446
447print '<div class="divsection wordbreak">';
448
449print '<strong>'.$langs->trans("UseCaptchaCode").' - Login</strong>: ';
450print !getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA') ? '' : img_picto('', 'tick').' ';
451print yn(!getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA') ? 0 : 1);
452print '<br>';
453print '<br>';
454
455print '<strong>'.$langs->trans("UseCaptchaCode").' - Ticket</strong>: ';
456print !getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA_TICKET') ? '' : img_picto('', 'tick').' ';
457print yn(!getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA_TICKET') ? 0 : 1);
458print '<br>';
459print '<br>';
460
461print '<strong>'.$langs->trans("UseCaptchaCode").' - Thirdparty public contact form</strong>: ';
462print !getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA_THIRPARTY') ? '' : img_picto('', 'tick').' ';
463print yn(!getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA_THIRPARTY') ? 0 : 1);
464print '<br>';
465print '<br>';
466
467print '<strong>'.$langs->trans("UseCaptchaCode").' - Membership subscription</strong>: ';
468print !getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA_MEMBER') ? '' : img_picto('', 'tick').' ';
469print yn(!getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA_MEMBER') ? 0 : 1);
470print '<br>';
471print '<br>';
472
473$sessiontimeout = ini_get("session.gc_maxlifetime");
474if (!getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
475 $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
476}
477print '<strong>'.$langs->trans("SessionTimeOut").'</strong>';
478if (!ini_get("session.gc_probability")) {
479 print $form->textwithpicto('', $langs->trans("SessionsPurgedByExternalSystem", ini_get("session.gc_maxlifetime")));
480} else {
481 print $form->textwithpicto('', $langs->trans("SessionExplanation", ini_get("session.gc_probability"), ini_get("session.gc_divisor"), ini_get("session.gc_maxlifetime")));
482}
483print ': '.getDolGlobalInt('MAIN_SESSION_TIMEOUT').' '.strtolower($langs->trans("Seconds"));
484print '<br><br>';
485
486print '<strong>'.$langs->trans("MaxNumberOfImagesInGetPost").'</strong>: ';
487print(getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT') ? img_picto('', 'tick').' ' : '').getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').' '.strtolower($langs->trans("Images"));
488print '<br><br>';
489
490print '<strong>'.$langs->trans("MaxNumberOfPostOnPublicPagesByIP").'</strong>: ';
491print(getDolGlobalInt('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200) ? img_picto('', 'tick').' ' : '').getDolGlobalInt('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200).' '.strtolower($langs->trans("Posts"));
492print '<br><br>';
493
494print '<strong>'.$langs->trans("MaxNumberOfAttachementOnForms").'</strong>: ';
495print(getDolGlobalInt('MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS', 10) ? img_picto('', 'tick').' ' : '').getDolGlobalInt("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).' '.strtolower($langs->trans("Files"));
496print '<br><br>';
497
498
499// Clear password ?
500
501print '<strong>'.$langs->trans("DoNotStoreClearPassword").'</strong>: ';
502print !getDolGlobalString('DATABASE_PWD_ENCRYPTED') ? '' : img_picto('', 'tick').' ';
503print yn(!getDolGlobalString('DATABASE_PWD_ENCRYPTED') ? 0 : 1);
504if (!getDolGlobalString('DATABASE_PWD_ENCRYPTED')) {
505 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
506}
507print '<br>';
508print '<br>';
509
510
511// Mask by default in upload
512$umask = getDolGlobalString('MAIN_UMASK');
513
514print '<strong>'.$langs->trans("UMask").'</strong>: ';
515if (! in_array($umask, array('600', '660', '0600', '0660'))) {
516 print img_warning().' ';
517}
518print $umask;
519if (! in_array($umask, array('600', '660', '0600', '0660'))) {
520 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0600 | 0660)</span>';
521}
522print '<br>';
523print '<br>';
524
525
526/* Already into section conf file */
527/*
528$usepassinconfencrypted = 0;
529global $dolibarr_main_db_pass, $dolibarr_main_db_encrypted_pass;
530if (preg_match('/(crypted|dolcrypt):/i', $dolibarr_main_db_pass) || !empty($dolibarr_main_db_encrypted_pass)) {
531 $usepassinconfencrypted = 1;
532}
533print '<strong>'.$langs->trans("MainDbPasswordFileConfEncrypted").'</strong>: ';
534print $usepassinconfencrypted ? img_picto('', 'tick').' ' : img_warning().' ';
535print yn($usepassinconfencrypted);
536if (empty($usepassinconfencrypted)) {
537 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
538}
539print '<br>';
540print '<br>';
541*/
542
543/* Password length
544
545// Stored into $tabconf[0] if module generator is "Perso" or specific to the module generator.
546$tabConf = explode(";", getDolGlobalString('USER_PASSWORD_PATTERN'));
547
548print '<strong>'.$langs->trans("PasswordLength").'</strong>: ';
549print empty($conf->global->DATABASE_PWD_ENCRYPTED) ? '' : img_picto('', 'tick').' ';
550print yn(empty($conf->global->DATABASE_PWD_ENCRYPTED) ? 0 : 1);
551if (empty($conf->global->DATABASE_PWD_ENCRYPTED)) {
552 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
553}
554print '<br>';
555print '<br>';
556*/
557
558print '<strong>'.$langs->trans("AntivirusEnabledOnUpload").'</strong>: ';
559print !getDolGlobalString('MAIN_ANTIVIRUS_COMMAND') ? img_warning().' ' : img_picto('', 'tick').' ';
560print yn(!getDolGlobalString('MAIN_ANTIVIRUS_COMMAND') ? 0 : 1);
561if (!getDolGlobalString('MAIN_ANTIVIRUS_COMMAND')) {
562 print ' - <span class="opacitymedium">'.$langs->trans("Recommended").': '.$langs->trans("DefinedAPathForAntivirusCommandIntoSetup", $langs->transnoentitiesnoconv("Home")." - ".$langs->transnoentitiesnoconv("Setup")." - ".$langs->transnoentitiesnoconv("Security")).'</span>';
563} else {
564 print ' &nbsp; - ' . getDolGlobalString('MAIN_ANTIVIRUS_COMMAND');
565 if (defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
566 print ' - <span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
567 }
568}
569print '<br>';
570print '<br>';
571
572// File extension locked in upload by default
573
574print '<strong>'.$langs->trans("UploadExtensionRestriction").'</strong>: ';
575print implode(', ', explode(',', getDolGlobalString('MAIN_FILE_EXTENSION_UPLOAD_RESTRICTION')));
576print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.implode(', ', getExecutableContent()).')</span>';
577print '<br>';
578print '<br>';
579
580
581print '<strong>'.$langs->trans("MAIN_SECURITY_MAXFILESIZE_DOWNLOADED").'</strong> = '.getDolGlobalString('MAIN_SECURITY_MAXFILESIZE_DOWNLOADED', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': < 100000)</span>')."<br>";
582print '<br>';
583
584
585
586$securityevent = new Events($db);
587$eventstolog = $securityevent->eventstolog;
588
589print '<strong>'.$langs->trans("AuditedSecurityEvents").'</strong>: ';
590$out = '';
591if (!empty($eventstolog) && is_array($eventstolog)) {
592 // Loop on each event type
593 $i = 0;
594 foreach ($eventstolog as $key => $arr) {
595 if ($arr['id']) {
596 $key = 'MAIN_LOGEVENTS_'.$arr['id'];
597 $value = getDolGlobalString($key);
598 if ($value) {
599 if ($i > 0) {
600 $out .= ', ';
601 }
602 $out .= '<span class="opacitymedium">'.$key.'</span>';
603 $i++;
604 }
605 }
606 }
607 print $out;
608}
609
610if (empty($out)) {
611 print img_warning().' '.$langs->trans("NoSecurityEventsAreAduited", $langs->transnoentities("Home").' - '.$langs->transnoentities("Setup").' - '.$langs->transnoentities("Security").' - '.$langs->transnoentities("Audit")).'<br>';
612} else {
613 $s = $langs->trans("SeeSetupPage", ' {s1}'.$langs->transnoentities("Home").' - '.$langs->transnoentities("Setup").' - '.$langs->transnoentities("Security").' - '.$langs->transnoentities("Audit").'{s2}');
614 print ' - '.str_replace('{s2}', '</a>', str_replace('{s1}', '<a href="'.DOL_URL_ROOT.'/admin/events.php" target="_blank">'.img_picto('', 'url', 'class="pictofixedwidth"'), $s));
615}
616
617print '</div>';
618
619print '<br>';
620
621
622// Modules/Applications
623
624print '<br>';
625print '<br>';
626print load_fiche_titre($langs->trans("Modules"), '', 'folder');
627
628print '<div class="divsection wordbreak">';
629
630// Module log
631print '<strong>'.$langs->trans("Syslog").'</strong>: ';
632$test = isModEnabled('syslog');
633if (!$test) {
634 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
635} else {
636 if (getDolGlobalInt('SYSLOG_LEVEL') > LOG_NOTICE) {
637 print img_picto('', 'warning').' '.$langs->trans("ModuleActivatedWithTooHighLogLevel", $langs->transnoentities("Syslog"));
638 } else {
639 print img_picto('', 'tick').' '.$langs->trans("ModuleSyslogActivatedButLevelNotTooVerbose", $langs->transnoentities("Syslog"), getDolGlobalInt('SYSLOG_LEVEL'));
640 }
641 //print ' '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php'.'">XDebug admin page</a>';
642}
643print '<br>';
644
645print '<br>';
646
647// Module debugbar
648print '<strong>'.$langs->trans("DebugBar").'</strong>: ';
649$test = isModEnabled('debugbar');
650if (!$test) {
651 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
652} else {
653 print img_picto('', 'error').' '.$langs->trans("ModuleActivatedDoNotUseInProduction", $langs->transnoentities("DebugBar"));
654 //print ' '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php'.'">XDebug admin page</a>';
655}
656print '<br>';
657
658// Modules for Payments
659$test = isModEnabled('stripe');
660if ($test) {
661 print '<br>';
662
663 print '<strong>'.$langs->trans("Stripe").'</strong>: ';
664 if (!getDolGlobalString('PAYMENT_SECURITY_TOKEN_UNIQUE')) {
665 print img_picto('', 'error').' '.$langs->trans("OptionXShouldBeEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Stripe"));
666 } else {
667 print img_picto('', 'tick').' '.$langs->trans("OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Stripe"));
668 }
669 print '<br>';
670} else {
671 $test = isModEnabled('paypal');
672 if ($test) {
673 print '<br>';
674
675 print '<strong>'.$langs->trans("Paypal").'</strong>: ';
676 if (!getDolGlobalString('PAYMENT_SECURITY_TOKEN_UNIQUE')) {
677 print img_picto('', 'error').' '.$langs->trans("OptionXShouldBeEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Paypal"));
678 } else {
679 print img_picto('', 'tick').' '.$langs->trans("OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Paypal"));
680 }
681 print '<br>';
682 }
683}
684
685print '</div>';
686
687
688// APIs
689
690print '<br>';
691print '<br>';
692print load_fiche_titre($langs->trans("API"), '', 'folder');
693
694print '<div class="divsection wordbreak">';
695
696if (!isModEnabled('api') && !isModEnabled('webservices')) {
697 print $langs->trans("APIsAreNotEnabled");
698} else {
699 if (isModEnabled('webservices')) {
700 print img_picto('', 'warning').' '.$langs->trans('YouEnableDeprecatedWSAPIsUseRESTAPIsInstead')."<br>\n";
701 print '<br>';
702 }
703 if (isModEnabled('api')) {
704 print '<strong>API_ENDPOINT_RULES</strong> = '.getDolGlobalString('API_ENDPOINT_RULES', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Example").': login:0,users:0,setup:1,status:1,tickets:1,...)</span>')."<br>\n";
705
706 print '<br>';
707
708 print '<strong>API_DISABLE_LOGIN_API</strong> = '.getDolGlobalString('API_DISABLE_LOGIN_API', '0').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span><br>';
709 }
710}
711
712
713print '</div>';
714
715
716print '<br>';
717print '<br>';
718
719
720// Other setup
721
722print load_fiche_titre($langs->trans("OtherSetup"), '', 'folder');
723
724print '<div class="divsection wordbreak">';
725
726print '<strong>MAIN_ALLOW_SVG_FILES_AS_IMAGES</strong> = '.getDolGlobalString('MAIN_ALLOW_SVG_FILES_AS_IMAGES', '0').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0)</span><br>';
727print '<br>';
728
729print '<strong>MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE</strong> = '.getDolGlobalString('MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span><br>';
730print '<br>';
731
732print '<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span> &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': List of static IPs of server separated with coma - '.$langs->trans("Note").': common loopback ip like 127.*.*.*, [::1] are already added)</span>')."<br>";
733print '<br>';
734
735print '<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 2)</span>'."<br>";
736
737print '</div>';
738
739print '<br>';
740print '<br>';
741
742
743
744// Database encryption
745
746print load_fiche_titre($langs->trans("DatabaseEncryption"), '', 'folder');
747
748print '<div class="divsection wordbreak">';
749
750//print '<strong>'.$langs->trans("PasswordEncryption").'</strong>: ';
751print '<strong>'.$langs->trans("AlgorithmFor", $langs->transnoentitiesnoconv("Passwords"));
752print $form->textwithpicto('', 'non reversible encryption, defined into MAIN_SECURITY_HASH_ALGO');
753print '</strong> = '.getDolGlobalString('MAIN_SECURITY_HASH_ALGO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>')." &nbsp; ";
754if (!getDolGlobalString('MAIN_SECURITY_HASH_ALGO')) {
755 print '<span class="opacitymedium"> &nbsp; &nbsp; (If unset: \'md5\')</span>';
756}
757if (getDolGlobalString('MAIN_SECURITY_HASH_ALGO') != 'password_hash') {
758 print '<br><strong>MAIN_SECURITY_SALT</strong> = '.getDolGlobalString('MAIN_SECURITY_SALT', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').'<br>';
759} else {
760 print '<span class="opacitymedium">('.$langs->trans("Recommended").': password_hash)</span>';
761 print '<br>';
762}
763if (getDolGlobalString('MAIN_SECURITY_HASH_ALGO') != 'password_hash') {
764 print '<div class="info">The recommended value for MAIN_SECURITY_HASH_ALGO is now \'password_hash\' but setting it now will make ALL existing passwords of all users not valid, so update is not possible.<br>';
765 print 'If you really want to switch, you must:<br>';
766 print '- Go on home - setup - other and add constant MAIN_SECURITY_HASH_ALGO to value \'password_hash\'<br>';
767 print '- In same session, WITHOUT LOGGING OUT, go into your admin user record and set a new password<br>';
768 print '- You can now logout and login with this new password. You must now reset password of all other users.<br>';
769 print '</div>';
770}
771print '<br>';
772
773$action = GETPOST('action');
774$exampletodecrypt = GETPOST('exampletodecrypt', 'password');
775
776print '<strong>'.$langs->trans("AlgorithmFor", $langs->transnoentitiesnoconv("SensitiveData"));
777print $form->textwithpicto('', 'reversible encryption done with dolEncrypt/dolDecrypt');
778print '</strong> = '.constant('MAIN_SECURITY_REVERSIBLE_ALGO').' with key defined into conf.php file in $dolibarr_main_dolcrypt_key (or $dolibarr_main_instance_unique_id)<br>';
779print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
780print '<input type="hidden" name="action" value="doldecrypt">';
781print '<input type="hidden" name="token" value="'.newToken().'">';
782print '<input type="hidden" name="page_y" value="">';
783print $langs->trans("ToolToDecryptAString").': ';
784print '<input type="text" class="minwidth300" name="exampletodecrypt" placeholder="dolcrypt:ALGOXXXX:ABCDFEF1234" value="'.$exampletodecrypt.'">';
785print '<input type="submit" class="reposition button small smallpaddingimp" name="submit" value="'.$langs->transnoentitiesnoconv("Decrypt").'">';
786if ($action == 'doldecrypt' && $user->admin && $exampletodecrypt) {
787 usleep(200);
788 print ' => <textarea rows="'.ROWS_1.'" class="valignmiddle">'.dolPrintHTMLForTextArea(dolDecrypt($exampletodecrypt)).'</textarea>';
789}
790print '</form>';
791
792print '</div>';
793
794
795print '<br>';
796print '<br>';
797
798
799// Websites
800
801if (isModEnabled('website')) {
802 print load_fiche_titre($langs->trans("Website"), '', 'website');
803 print '<div class="divsection wordbreak">';
804
805 $sql = "SELECT w.rowid as id, w.ref";
806 $sql .= " FROM ".MAIN_DB_PREFIX."website as w";
807 $sql .= " WHERE w.entity = ".((int) $conf->entity);
808 $sql .= " AND w.status = 1";
809
810 $resql = $db->query($sql);
811 if ($resql) {
812 $num_rows = $db->num_rows($resql);
813 if ($num_rows > 0) {
814 $i = 0;
815 while ($obj = $db->fetch_object($resql)) {
816 print "<strong>".$langs->trans("RefWebsite").": ".$obj->ref."</strong>";
817 print'<br><br>';
818 print '<strong>WEBSITE_'.$obj->id.'_SECURITY_FORCERP</strong> = '.getDolGlobalString('WEBSITE_'.$obj->id.'_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
819 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
820 $examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
821 print $examplecsprule;
822 print '")</span><br>';
823
824 print '<strong>WEBSITE_'.$obj->id.'_SECURITY_FORCECSP</strong> = '.getDolGlobalString('WEBSITE_'.$obj->id.'_SECURITY_FORCECSP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
825 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
826 $examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
827 print $examplecsprule;
828 print '")</span><br>';
829
830 print '<strong>WEBSITE_'.$obj->id.'_SECURITY_FORCERP</strong> = '.getDolGlobalString('WEBSITE_'.$obj->id.'_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").'="strict-origin-when-cross-origin" '.$langs->trans("or").' "same-origin"=more secured)</span><br>';
831
832 print '<strong>WEBSITE_'.$obj->id.'_SECURITY_FORCESTS</strong> = '.getDolGlobalString('WEBSITE_'.$obj->id.'_SECURITY_FORCESTS', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"max-age=31536000; includeSubDomains\")</span><br>";
833
834 print '<strong>WEBSITE_'.$obj->id.'_SECURITY_FORCEPP</strong> = '.getDolGlobalString('WEBSITE_'.$obj->id.'_SECURITY_FORCEPP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"camera=(), microphone=(), geolocation=*\")</span><br>";
835 $i++;
836 if ($i != $num_rows) {
837 print '<br>';
838 }
839 }
840 } else {
841 print '<span class="opacity">'.$langs->trans("NoWebsite").'</span>';
842 }
843 } else {
844 dol_print_error($db);
845 }
846 print '</div>';
847
848
849 print '<br>';
850}
851
852
853// Other - experimental
854
855print load_fiche_titre($langs->trans("OtherSetup").' ('.$langs->trans("Experimental").')', '', 'folder');
856
857print '<div class="divsection wordbreak">';
858print '<strong>MAIN_EXEC_USE_POPEN</strong> = ';
859if (!getDolGlobalString('MAIN_EXEC_USE_POPEN')) {
860 print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>';
861} else {
862 print getDolGlobalString('MAIN_EXEC_USE_POPEN');
863}
864if ($execmethod == 1) {
865 print '<span class="opacitymedium"> &nbsp; &nbsp; "exec" PHP method will be used for shell commands';
866 print ' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 1)';
867 print '</span>';
868}
869if ($execmethod == 2) {
870 print '<span class="opacitymedium"> &nbsp; &nbsp; "popen" PHP method will be used for shell commands';
871 print ' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 1)';
872 print '</span>';
873}
874print '<br>';
875print '<br>';
876
877print '<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
878print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - does not work on HTML5 with some old libxml libs)</span>";
879
880// Test compatibility of MAIN_RESTRICTHTML_ONLY_VALID_HTML
881$savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
882$savMAIN_RESTRICTHTML_ONLY_VALID_HTML = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML');
883$savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
884$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
885$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 1;
886$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0;
887$result = dol_htmlwithnojs('<img onerror<=alert(document.domain)> src=>0xbeefed');
888$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
889$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
890$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
891
892if ($result == 'InvalidHTMLStringCantBeCleaned') {
893 print ' &nbsp; - &nbsp; '.img_warning().' Your libxml seems to old to work correctly with this option. Disable it !';
894} else {
895 print ' &nbsp; - &nbsp; Test of compatibility with this option seems ok';
896}
897print '<br>';
898
899print '<br>';
900
901print '<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
902print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span> &nbsp; - &nbsp; Module "php-tidy" must be enabled (currently: '.((extension_loaded('tidy') && class_exists("tidy")) ? 'Enabled' : img_picto('', 'warning').' Not available').")";
903if (extension_loaded('tidy') && class_exists("tidy")) {
904 // Test compatibility of MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY
905 $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
906 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML');
907 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
908 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
909 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0;
910 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
911 $result = dol_htmlwithnojs('<img onerror<=alert(document.domain)> src=>0xbeefed');
912 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
913 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
914 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
915
916 if ($result == 'InvalidHTMLStringCantBeCleaned') {
917 print ' &nbsp; - &nbsp; '.img_warning().' Your libxml seems to old to work correctly with this option. Disable it !';
918 } else {
919 print ' &nbsp; - &nbsp; Test of compatibility with this option seems ok';
920 }
921}
922print '<br>';
923
924print '<br>';
925
926print '<strong>MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
927print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - does not work on HTML5 with some old libxml libs)</span><br>";
928print '<br>';
929
930// MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = 1, disallow url links except if on /medias
931// MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = 2, disallow all external urls link
932print '<strong>MAIN_DISALLOW_URL_INTO_DESCRIPTIONS</strong> = '.getDolGlobalString('MAIN_DISALLOW_URL_INTO_DESCRIPTIONS', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': 1=only local links allowed or 2=no links at all)</span>')."<br>";
933print '<br>';
934
935print '<strong>MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS</strong> = '.getDolGlobalString('MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
936print '<br>';
937
938print '<strong>MAIN_DISALLOW_STRING_OBFUSCATION_IN_DOL_EVAL</strong> = '.(getDolGlobalString('MAIN_DISALLOW_STRING_OBFUSCATION_IN_DOL_EVAL') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
939print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - may break use of concatenation function like . or dol_concatdesc into extra fields conditions or formula)</span><br>";
940print '<br>';
941
942print '<strong>MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER</strong> = '.getDolGlobalString('MAIN_DISALLOW_UNSECURED_SELECT_INTO_EXTRAFIELDS_FILTER', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
943print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - The value 0 allows the use of subrequests into extrafields conditions. It remains not possible in API filters to avoid bind SQL injections whatever is this value)</span><br>";
944print '<br>';
945
946
947// MAIN_ALLOW_LOCAL_LINKS_AS_EXTERNAL_LINKS
948
949print '<strong>MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
950print '<br>';
951
952print '<strong>MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED</strong> = '.getDolGlobalString('MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
953print '<br>';
954
955$examplecsprule = "frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com *.dolistore.com *.githubusercontent.com";
956print '<strong>MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCECSPRO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "'.$examplecsprule.'")</span><br>';
957print '<br>';
958
959$examplecsprule = "frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com *.dolistore.com *.githubusercontent.com";
960print '<strong>MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCECSP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "'.$examplecsprule.'")</span><br>';
961print '<br>';
962
963print '<strong>MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or")." \"strict-origin-when-cross-origin\" so browser doesn't send any referrer when going into another web site domain)</span><br>";
964print '<br>';
965
966print '<strong>MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1)</span><br>";
967
968
969/* Removed, already in the dedicated section Websites.
970print '<br>';
971
972print '<strong>WEBSITE_MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCECSPRO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
973print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
974$examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
975print $examplecsprule;
976print '")</span><br>';
977print '<br>';
978
979print '<strong>WEBSITE_MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCECSP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
980print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
981$examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
982print $examplecsprule;
983print '")</span><br>';
984print '<br>';
985
986print '<strong>WEBSITE_MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").'="strict-origin-when-cross-origin" '.$langs->trans("or").' "same-origin"=more secured)</span><br>';
987print '<br>';
988
989print '<strong>WEBSITE_MAIN_SECURITY_FORCESTS</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCESTS', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"max-age=31536000; includeSubDomains\")</span><br>";
990print '<br>';
991
992print '<strong>WEBSITE_MAIN_SECURITY_FORCEPP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCEPP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"camera=(), microphone=(), geolocation=*\")</span><br>";
993*/
994
995print '</div>';
996
997
998print '<br>';
999print '<br>';
1000
1001
1002print load_fiche_titre($langs->trans("LimitsAndMitigation"), '', 'folder');
1003
1004print '<div class="divsection wordbreak">';
1005
1006print '<span class="opacitymedium">';
1007print $langs->trans("RecommendMitigationOnURL").'<br>';
1008print '</span>';
1009
1010print '<br>';
1011$urlexamplebase = 'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/fail2ban/filter.d/';
1012print '<span class="fas fa-shield-alt"></span> Login or API authentication (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulesbruteforce.conf">fail2ban example on GitHub</a>)<br>';
1013print '<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.'/passwordforgotten.php (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulespassforgotten.conf">fail2ban example on GitHub</a>)<br>';
1014print '<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.'/public/* (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-limitpublic.conf">fail2ban example on GitHub</a>)<br>';
1015print '<br>';
1016$urlexamplebase = 'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/apache/';
1017print '<span class="fas fa-shield-alt"></span> You can also protect the application using a HTTP Basic authentication layer (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'virtualhost">apache2 virtualhost example on GitHub</a>)<br>';
1018
1019print '</div>';
1020
1021// End of page
1022llxFooter();
1023$db->close();
llxFooter
llxFooter($comment='', $zone='private', $disabledoutputofmessages=0)
Empty footer.
Definition wrapper.php:91
llxHeader
if(!defined('NOREQUIRESOC')) if(!defined( 'NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined( 'NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined( 'NOREQUIREAJAX')) llxHeader($head='', $title='', $help_url='', $target='', $disablejs=0, $disablehead=0, $arrayofjs='', $arrayofcss='', $morequerystring='', $morecssonbody='', $replacemainareaby='', $disablenofollow=0, $disablenoindex=0)
Empty header.
Definition wrapper.php:73
Events
Events class.
Definition events.class.php:33
Form
Class to manage generation of HTML components Only common components must be here.
Definition html.form.class.php:57
dol_dir_list
dol_dir_list($utf8_path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0, $nbsecondsold=0)
Scan a directory and return a list of files/directories.
Definition files.lib.php:63
version_php
version_php()
Return PHP version.
Definition functions2.lib.php:1918
getExecutableContent
getExecutableContent()
Return array of extension for executable files of text files that can contains executable code.
Definition functions.lib.php:14306
load_fiche_titre
load_fiche_titre($title, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
Definition functions.lib.php:6698
img_picto
img_picto($titlealt, $picto, $moreatt='', $pictoisfullpath=0, $srconly=0, $notitle=0, $alt='', $morecss='', $marginleftonlyshort=2, $allowothertags=array())
Show picto whatever it's its name (generic function)
Definition functions.lib.php:5291
img_warning
img_warning($titlealt='default', $moreatt='', $morecss='pictowarning')
Show warning logo.
Definition functions.lib.php:5999
dolPrintHTMLForTextArea
dolPrintHTMLForTextArea($s, $allowiframe=0)
Return a string ready to be output on input textarea.
Definition functions.lib.php:2246
getDolGlobalInt
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
Definition functions.lib.php:244
yn
yn($yesno, $format=1, $color=0)
Return yes or no in current language.
Definition functions.lib.php:8154
GETPOST
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
Definition functions.lib.php:851
dol_print_error
dol_print_error($db=null, $error='', $errors=null)
Displays error message system with all the information to facilitate the diagnosis and the escalation...
Definition functions.lib.php:6329
dol_htmlwithnojs
dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox=0, $check='restricthtml')
Sanitize a HTML to remove js, dangerous content and external links.
Definition functions.lib.php:8786
getDolGlobalString
getDolGlobalString($key, $default='')
Return a Dolibarr global constant string value.
Definition functions.lib.php:229
$conf
global $conf
The following vars must be defined: $type2label $form $conf, $lang, The following vars may also be de...
Definition member.php:79
dol_getwebuser
dol_getwebuser($mode)
Return user/group account of web server.
Definition security2.lib.php:37
dolDecrypt
dolDecrypt($chain, $key='')
Decode a string with a symmetric encryption.
Definition security.lib.php:186
accessforbidden
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.
Definition security.lib.php:1314
Generated on Sun Jun 7 2026 01:00:19 for dolibarr by Doxygen 1.11.0