dolibarr  19.0.0-dev
security_other.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2004-2013 Laurent Destailleur <eldy@users.sourceforge.net>
3  * Copyright (C) 2005-2012 Regis Houssin <regis.houssin@inodbox.com>
4  * Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program. If not, see <https://www.gnu.org/licenses/>.
18  */
19 
26 // Load Dolibarr environment
27 require '../main.inc.php';
28 require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
29 require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
30 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
31 
32 // Load translation files required by the page
33 $langs->loadLangs(array("users", "admin", "other"));
34 
35 if (!$user->admin) {
37 }
38 
39 $action = GETPOST('action', 'aZ09');
40 
41 
42 
43 /*
44  * Actions
45  */
46 
47 if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
48  $code = $reg[1];
49  $value = (GETPOST($code, 'alpha') ? GETPOST($code, 'alpha') : 1);
50  if (dolibarr_set_const($db, $code, $value, 'chaine', 0, '', $conf->entity) > 0) {
51  Header("Location: ".$_SERVER["PHP_SELF"]);
52  exit;
53  } else {
54  dol_print_error($db);
55  }
56 } elseif (preg_match('/del_([a-z0-9_\-]+)/i', $action, $reg)) {
57  $code = $reg[1];
58  if (dolibarr_del_const($db, $code, $conf->entity) > 0) {
59  Header("Location: ".$_SERVER["PHP_SELF"]);
60  exit;
61  } else {
62  dol_print_error($db);
63  }
64 } elseif ($action == 'updateform') {
65  $res1 = 1; $res2 = 1; $res3 = 1; $res4 = 1; $res5 = 1;
66  if (GETPOSTISSET('MAIN_APPLICATION_TITLE')) {
67  $res1 = dolibarr_set_const($db, "MAIN_APPLICATION_TITLE", GETPOST("MAIN_APPLICATION_TITLE", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
68  }
69  if (GETPOSTISSET('MAIN_SESSION_TIMEOUT')) {
70  $res2 = dolibarr_set_const($db, "MAIN_SESSION_TIMEOUT", GETPOST("MAIN_SESSION_TIMEOUT", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
71  }
72  if (GETPOSTISSET('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT')) {
73  $res3 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", GETPOST("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 'alphanohtml'), 'int', 0, '', $conf->entity);
74  }
75  if (GETPOSTISSET('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS')) {
76  $res4 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", GETPOST("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 'alphanohtml'), 'int', 0, '', $conf->entity);
77  }
78  if (GETPOSTISSET('MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS')) {
79  $res5 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", GETPOST("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 'alphanohtml'), 'int', 0, '', $conf->entity);
80  }
81  if ($res1 && $res2 && $res3 && $res4 && $res5) {
82  setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
83  }
84 }
85 
86 
87 
88 /*
89  * View
90  */
91 
92 $form = new Form($db);
93 
94 $wikihelp = 'EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad';
95 llxHeader('', $langs->trans("Miscellaneous"), $wikihelp);
96 
97 print load_fiche_titre($langs->trans("SecuritySetup"), '', 'title_setup');
98 
99 print '<span class="opacitymedium">'.$langs->trans("MiscellaneousDesc")."</span><br>\n";
100 print "<br>\n";
101 
102 
103 
104 print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
105 print '<input type="hidden" name="token" value="'.newToken().'">';
106 print '<input type="hidden" name="action" value="updateform">';
107 
108 $head = security_prepare_head();
109 
110 print dol_get_fiche_head($head, 'misc', '', -1);
111 
112 print '<br>';
113 
114 // Other Options
115 print '<table class="noborder centpercent">';
116 print '<tr class="liste_titre">';
117 print '<td colspan="3">'.$langs->trans("Parameters").'</td>';
118 print '<td class="right" width="100">'.$langs->trans("Status").'</td>';
119 print '</tr>';
120 
121 // Enable Captcha code
122 print '<tr class="oddeven">';
123 print '<td colspan="3">'.$langs->trans("UseCaptchaCode").'</td>';
124 print '<td class="right">';
125 if (function_exists("imagecreatefrompng")) {
126  if (!empty($conf->use_javascript_ajax)) {
127  print ajax_constantonoff('MAIN_SECURITY_ENABLECAPTCHA');
128  } else {
129  if (empty($conf->global->MAIN_SECURITY_ENABLECAPTCHA)) {
130  print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_SECURITY_ENABLECAPTCHA&token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
131  } else {
132  print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_SECURITY_ENABLECAPTCHA&token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
133  }
134  }
135 } else {
136  $desc = $form->textwithpicto('', $langs->transnoentities("EnableGDLibraryDesc"), 1, 'warning');
137  print $desc;
138 }
139 print '</td></tr>';
140 
141 // Enable advanced perms
142 print '<tr class="oddeven">';
143 print '<td colspan="3">'.$langs->trans("UseAdvancedPerms").'</td>';
144 print '<td class="right">';
145 if (!empty($conf->use_javascript_ajax)) {
146  print ajax_constantonoff('MAIN_USE_ADVANCED_PERMS');
147 } else {
148  if (empty($conf->global->MAIN_USE_ADVANCED_PERMS)) {
149  print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_USE_ADVANCED_PERMS&token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
150  } else {
151  print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_USE_ADVANCED_PERMS&token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
152  }
153 }
154 print "</td></tr>";
155 
156 print '</table>';
157 
158 
159 print '<br>';
160 
161 
162 // Timeout
163 print '<table width="100%" class="noborder">';
164 print '<tr class="liste_titre">';
165 print '<td colspan="2">'.$langs->trans("Parameters").'</td>';
166 print '<td>'.$langs->trans("Value").'</td>';
167 print "</tr>\n";
168 
169 
170 $sessiontimeout = ini_get("session.gc_maxlifetime");
171 if (empty($conf->global->MAIN_SESSION_TIMEOUT)) {
172  $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
173 }
174 print '<tr class="oddeven">';
175 print '<td>'.$langs->trans("SessionTimeOut").'</td><td class="right">';
176 if (ini_get("session.gc_probability") == 0) {
177  print $form->textwithpicto('', $langs->trans("SessionsPurgedByExternalSystem", ini_get("session.gc_maxlifetime")));
178 } else {
179  print $form->textwithpicto('', $langs->trans("SessionExplanation", ini_get("session.gc_probability"), ini_get("session.gc_divisor"), ini_get("session.gc_maxlifetime")));
180 }
181 print '</td>';
182 print '<td class="nowrap">';
183 print '<input class="flat right width50" name="MAIN_SESSION_TIMEOUT" type="text" value="'.getDolGlobalInt('MAIN_SESSION_TIMEOUT').'"> '.strtolower($langs->trans("Seconds"));
184 print '</td>';
185 print '</tr>';
186 
187 print '<tr class="oddeven">';
188 print '<td>'.$langs->trans("MaxNumberOfImagesInGetPost").'</td><td class="right">';
189 print '</td>';
190 print '<td class="nowrap">';
191 print '<input class="flat right width50" name="MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT" type="text" value="'.getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').'"> '.strtolower($langs->trans("Images"));
192 print '</td>';
193 print '</tr>';
194 
195 print '<tr class="oddeven">';
196 print '<td>'.$langs->trans("MaxNumberOfPostOnPublicPagesByIP").'</td><td class="right">';
197 print '</td>';
198 print '<td class="nowrap">';
199 print '<input class="flat right width50" name="MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 200).'"> '.strtolower($langs->trans("Posts"));
200 print '</td>';
201 print '</tr>';
202 
203 print '<tr class="oddeven">';
204 print '<td>'.$langs->trans("MaxNumberOfAttachementOnForms").'</td><td class="right">';
205 print '</td>';
206 print '<td class="nowrap">';
207 print '<input class="flat right width50" name="MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).'"> '.strtolower($langs->trans("Files"));
208 print '</td>';
209 print '</tr>';
210 
211 print '<tr class="oddeven">';
212 print '<td>'.$langs->trans("MaxNumberOfFailedAuth").'</td><td class="right">';
213 print '</td>';
214 print '<td class="nowrap">';
215 print '<input class="flat right width50" name="MAIN_SECURITY_MAX_NUMBER_FAILED_AUTH" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_NUMBER_FAILED_AUTH", 100).'"> '.$langs->trans("FailedAuth");
216 print '</td>';
217 print '</tr>';
218 
219 /*
220 if (empty($conf->global->MAIN_APPLICATION_TITLE)) {
221  $conf->global->MAIN_APPLICATION_TITLE = "";
222 }
223 print '<tr class="oddeven">';
224 print '<td>'.$langs->trans("MAIN_APPLICATION_TITLE").'</td><td class="right">';
225 print '</td>';
226 print '<td class="nowrap">';
227 print '<input class="flat" name="MAIN_APPLICATION_TITLE" type="text" size="20" value="'.dol_escape_htmltag($conf->global->MAIN_APPLICATION_TITLE).'"> ';
228 print '</td>';
229 print '</tr>';
230 */
231 
232 print '</table>';
233 
234 print $form->buttonsSaveCancel("Modify", '');
235 
236 print dol_get_fiche_end();
237 
238 print '</form>';
239 
240 // End of page
241 llxFooter();
242 $db->close();
security_prepare_head()
Prepare array with list of tabs.
Definition: admin.lib.php:800
dolibarr_set_const($db, $name, $value, $type='chaine', $visible=0, $note='', $entity=1)
Insert a parameter (key,value) into database (delete old key then insert it again).
Definition: admin.lib.php:638
dolibarr_del_const($db, $name, $entity=1)
Delete a constant.
Definition: admin.lib.php:562
if(GETPOSTISSET('MAIN_AGENDA_XCAL_EXPORTKEY')) if(GETPOSTISSET('MAIN_AGENDA_EXPORT_PAST_DELAY')) if(GETPOSTISSET('MAIN_AGENDA_EXPORT_CACHE')) if(GETPOSTISSET('AGENDA_EXPORT_FIX_TZ')) if($actionsave) if(!isset($conf->global->MAIN_AGENDA_EXPORT_PAST_DELAY)) $wikihelp
View.
Definition: agenda_xcal.php:90
ajax_constantonoff($code, $input=array(), $entity=null, $revertonoff=0, $strict=0, $forcereload=0, $marginleftonlyshort=2, $forcenoajax=0, $setzeroinsteadofdel=0, $suffix='', $mode='', $morecss='inline-block')
On/off button for constant.
Definition: ajax.lib.php:630
if(!defined('NOREQUIRESOC')) if(!defined('NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined('NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined('NOREQUIREAJAX')) llxHeader()
Empty header.
Definition: wrapper.php:56
llxFooter()
Empty footer.
Definition: wrapper.php:70
Class to manage generation of HTML components Only common components must be here.
if($cancel &&! $id) if($action=='add' &&! $cancel) if($action=='delete') if($id) $form
Actions.
Definition: card.php:143
load_fiche_titre($titre, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
dol_get_fiche_head($links=array(), $active='', $title='', $notab=0, $picto='', $pictoisfullpath=0, $morehtmlright='', $morecss='', $limittoshow=0, $moretabssuffix='', $dragdropfile=0)
Show tabs of a record.
dol_print_error($db='', $error='', $errors=null)
Displays error message system with all the information to facilitate the diagnosis and the escalation...
dol_get_fiche_end($notab=0)
Return tab footer of a card.
img_picto($titlealt, $picto, $moreatt='', $pictoisfullpath=false, $srconly=0, $notitle=0, $alt='', $morecss='', $marginleftonlyshort=2)
Show picto whatever it's its name (generic function)
newToken()
Return the value of token currently saved into session with name 'newtoken'.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
setEventMessages($mesg, $mesgs, $style='mesgs', $messagekey='', $noduplicate=0)
Set event messages in dol_events session object.
GETPOSTISSET($paramname)
Return true if we are in a context of submitting the parameter $paramname from a POST of a form.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.