dolibarr  21.0.0-alpha
security_file.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2004-2017 Laurent Destailleur <eldy@users.sourceforge.net>
3  * Copyright (C) 2005-2017 Regis Houssin <regis.houssin@inodbox.com>
4  * Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es>
5  * Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License as published by
9  * the Free Software Foundation; either version 3 of the License, or
10  * (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program. If not, see <https://www.gnu.org/licenses/>.
19  */
20 
27 // Load Dolibarr environment
28 require '../main.inc.php';
29 require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
30 require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
31 require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
32 
33 // Load translation files required by the page
34 $langs->loadLangs(array('users', 'admin', 'other'));
35 
36 $action = GETPOST('action', 'aZ09');
37 $sortfield = GETPOST('sortfield', 'aZ09');
38 $sortorder = GETPOST('sortorder', 'aZ09');
39 if (empty($sortfield)) {
40  $sortfield = 'date';
41 }
42 if (empty($sortorder)) {
43  $sortorder = 'desc';
44 }
45 
46 $upload_dir = $conf->admin->dir_temp;
47 
48 if (!$user->admin) {
50 }
51 
52 $error = 0;
53 
54 
55 /*
56  * Actions
57  */
58 
59 if (GETPOST('sendit') && getDolGlobalString('MAIN_UPLOAD_DOC')) {
60  require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
61 
62  dol_add_file_process($upload_dir, 1, 0, 'userfile');
63 }
64 
65 if ($action == 'updateform') {
66  $antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe
67  $antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib"
68  $antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&", "+")); // Sanitize command
69  $antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&", "+")); // Sanitize params
70 
71  if ($antivircommand && !empty($dolibarr_main_restrict_os_commands)) {
72  $arrayofallowedcommand = explode(',', $dolibarr_main_restrict_os_commands);
73  $arrayofallowedcommand = array_map('trim', $arrayofallowedcommand);
74  dol_syslog("Command are restricted to ".$dolibarr_main_restrict_os_commands.". We check that one of this command is inside ".$antivircommand);
75  $basenamecmddump = basename(str_replace('\\', '/', $antivircommand));
76  if (!in_array($basenamecmddump, $arrayofallowedcommand)) { // the provided command $cmddump must be an allowed command
77  $errormsg = $langs->trans('CommandIsNotInsideAllowedCommands');
78  setEventMessages($errormsg, null, 'errors');
79  $error++;
80  }
81  }
82 
83  if (!$error) {
84  $tmpumask = GETPOST('MAIN_UMASK', 'alpha');
85  $tmpumask = (octdec($tmpumask) & 0666);
86  $tmpumask = decoct($tmpumask);
87  if (!preg_match('/^0/', $tmpumask)) {
88  $tmpumask = '0'.$tmpumask;
89  }
90  if (empty($tmpumask)) { // Also matches '0'
91  $tmpumask = '0664';
92  }
93 
94  $res3 = dolibarr_set_const($db, 'MAIN_UPLOAD_DOC', GETPOST('MAIN_UPLOAD_DOC', 'alpha'), 'chaine', 0, '', $conf->entity);
95  $res4 = dolibarr_set_const($db, "MAIN_UMASK", $tmpumask, 'chaine', 0, '', $conf->entity);
96  $res5 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand), 'chaine', 0, '', $conf->entity);
97  $res6 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam), 'chaine', 0, '', $conf->entity);
98  if ($res3 && $res4 && $res5 && $res6) {
99  setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
100  }
101  }
102 } elseif ($action == 'deletefile') {
103  // Delete file
104  $langs->load("other");
105  $file = $conf->admin->dir_temp.'/'.GETPOST('urlfile', 'alpha');
106  $ret = dol_delete_file($file);
107  if ($ret) {
108  setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile', 'alpha')), null, 'mesgs');
109  } else {
110  setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile', 'alpha')), null, 'errors');
111  }
112 }
113 
114 
115 /*
116  * View
117  */
118 
119 $form = new Form($db);
120 
121 $wikihelp = 'EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad';
122 llxHeader('', $langs->trans("Files"), $wikihelp, '', 0, 0, '', '', '', 'mod-admin page-security_file');
123 
124 print load_fiche_titre($langs->trans("SecuritySetup"), '', 'title_setup');
125 
126 print '<span class="opacitymedium">'.$langs->trans("SecurityFilesDesc")."</span><br>\n";
127 print "<br>\n";
128 
129 
130 print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
131 print '<input type="hidden" name="token" value="'.newToken().'">';
132 print '<input type="hidden" name="action" value="updateform">';
133 
134 $head = security_prepare_head();
135 
136 print dol_get_fiche_head($head, 'file', '', -1);
137 
138 print '<br>';
139 
140 // Upload options
141 
142 print '<div class="div-table-responsive-no-min">';
143 print '<table class="noborder centpercent nomarginbottom">';
144 print '<tr class="liste_titre">';
145 print '<td>'.$langs->trans("Parameters").'</td>';
146 print '<td>'.$langs->trans("Value").'</td>';
147 print '</tr>';
148 
149 print '<tr class="oddeven">';
150 print '<td>'.$langs->trans("MaxSizeForUploadedFiles").'.';
151 $max = @ini_get('upload_max_filesize');
152 if (isset($max)) {
153  print '<br><span class="opacitymedium">'.$langs->trans("MustBeLowerThanPHPLimit", ((int) $max) * 1024, $langs->trans("Kb")).'.</span>';
154 } else {
155  print ' '.$langs->trans("NoMaxSizeByPHPLimit").'.';
156 }
157 print '</td>';
158 print '<td class="nowrap">';
159 print '<input class="flat" name="MAIN_UPLOAD_DOC" type="text" size="6" value="'.dol_escape_htmltag(getDolGlobalString('MAIN_UPLOAD_DOC')).'"> '.$langs->trans("Kb");
160 print '</td>';
161 print '</tr>';
162 
163 
164 print '<tr class="oddeven">';
165 print '<td>';
166 print $form->textwithpicto($langs->trans("UMask"), $langs->trans("UMaskExplanation"));
167 print '</td>';
168 print '<td class="nowrap">';
169 print '<input class="flat" name="MAIN_UMASK" type="text" size="6" value="'.dol_escape_htmltag(getDolGlobalString('MAIN_UMASK')).'">';
170 print '</td>';
171 print '</tr>';
172 
173 // Use anti virus
174 
175 print '<tr class="oddeven">';
176 print '<td>'.$langs->trans("AntiVirusCommand").'<br>';
177 print '<span class="opacitymedium">'.$langs->trans("AntiVirusCommandExample").'</span>';
178 // Check command in inside safe_mode
179 print '</td>';
180 print '<td>';
181 if (ini_get('safe_mode') && getDolGlobalString('MAIN_ANTIVIRUS_COMMAND')) {
182  $langs->load("errors");
183  $basedir = preg_replace('/"/', '', dirname($conf->global->MAIN_ANTIVIRUS_COMMAND));
184  $listdir = explode(';', ini_get('safe_mode_exec_dir'));
185  if (!in_array($basedir, $listdir)) {
186  print img_warning($langs->trans('WarningSafeModeOnCheckExecDir'));
187  dol_syslog("safe_mode is on, basedir is ".$basedir.", safe_mode_exec_dir is ".ini_get('safe_mode_exec_dir'), LOG_WARNING);
188  }
189 }
190 print '<input type="text" '.((defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_COMMAND" class="minwidth500imp" value="'.dol_escape_htmltag(GETPOSTISSET('MAIN_ANTIVIRUS_COMMAND') ? GETPOST('MAIN_ANTIVIRUS_COMMAND') : getDolGlobalString('MAIN_ANTIVIRUS_COMMAND')).'">';
191 if (defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
192  print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
193 }
194 print "</td>";
195 print '</tr>';
196 
197 // Use anti virus
198 
199 print '<tr class="oddeven">';
200 print '<td>'.$langs->trans("AntiVirusParam").'<br>';
201 print '<span class="opacitymedium">'.$langs->trans("AntiVirusParamExample").'</span>';
202 print '</td>';
203 print '<td>';
204 print '<input type="text" '.(defined('MAIN_ANTIVIRUS_PARAM') ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_PARAM" class="minwidth500imp" value="'.(getDolGlobalString('MAIN_ANTIVIRUS_PARAM') ? dol_escape_htmltag(getDolGlobalString('MAIN_ANTIVIRUS_PARAM')) : '').'">';
205 if (defined('MAIN_ANTIVIRUS_PARAM')) {
206  print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
207 }
208 print "</td>";
209 print '</tr>';
210 
211 print '</table>';
212 print '</div>';
213 
214 print dol_get_fiche_end();
215 
216 print $form->buttonsSaveCancel("Modify", '');
217 
218 print '</form>';
219 
220 
221 // Form to test upload
222 print '<br>';
223 $formfile = new FormFile($db);
224 $formfile->form_attach_new_file($_SERVER['PHP_SELF'], $langs->trans("FormToTestFileUploadForm"), 0, 0, 1, 50, '', '', 1, '', 0);
225 
226 // List of document
227 $filearray = dol_dir_list($upload_dir, "files", 0, '', '', $sortfield, $sortorder == 'desc' ? SORT_DESC : SORT_ASC, 1);
228 if (count($filearray) > 0) {
229  $formfile->list_of_documents($filearray, null, 'admin_temp', '');
230 }
231 
232 // End of page
233 llxFooter();
234 $db->close();
security_prepare_head()
Prepare array with list of tabs.
Definition: admin.lib.php:818
dolibarr_set_const($db, $name, $value, $type='chaine', $visible=0, $note='', $entity=1)
Insert a parameter (key,value) into database (delete old key then insert it again).
Definition: admin.lib.php:656
if(GETPOSTISSET('MAIN_AGENDA_XCAL_EXPORTKEY')) if(GETPOSTISSET('MAIN_AGENDA_EXPORT_PAST_DELAY')) if(GETPOSTISSET('MAIN_AGENDA_EXPORT_CACHE')) if(GETPOSTISSET('AGENDA_EXPORT_FIX_TZ')) if($actionsave) if(!isset($conf->global->MAIN_AGENDA_EXPORT_PAST_DELAY)) $wikihelp
View.
Definition: agenda_xcal.php:90
if(!defined('NOREQUIRESOC')) if(!defined('NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined('NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined('NOREQUIREAJAX')) llxHeader()
Empty header.
Definition: wrapper.php:55
llxFooter()
Empty footer.
Definition: wrapper.php:69
Class to offer components to list and upload files.
Class to manage generation of HTML components Only common components must be here.
dol_delete_file($file, $disableglob=0, $nophperrors=0, $nohook=0, $object=null, $allowdotdot=false, $indexdatabase=1, $nolog=0)
Remove a file or several files with a mask.
Definition: files.lib.php:1469
dol_add_file_process($upload_dir, $allowoverwrite=0, $updatesessionordb=0, $varfiles='addedfile', $savingdocmask='', $link=null, $trackid='', $generatethumbs=1, $object=null)
Get and save an upload file (for example after submitting a new file a mail form).
Definition: files.lib.php:1873
dol_dir_list($utf8_path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0, $nbsecondsold=0)
Scan a directory and return a list of files/directories.
Definition: files.lib.php:63
load_fiche_titre($title, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
img_warning($titlealt='default', $moreatt='', $morecss='pictowarning')
Show warning logo.
dol_get_fiche_head($links=array(), $active='', $title='', $notab=0, $picto='', $pictoisfullpath=0, $morehtmlright='', $morecss='', $limittoshow=0, $moretabssuffix='', $dragdropfile=0)
Show tabs of a record.
dol_get_fiche_end($notab=0)
Return tab footer of a card.
dol_string_nospecial($str, $newstr='_', $badcharstoreplace='', $badcharstoremove='', $keepspaces=0)
Clean a string from all punctuation characters to use it as a ref or login.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
setEventMessages($mesg, $mesgs, $style='mesgs', $messagekey='', $noduplicate=0)
Set event messages in dol_events session object.
GETPOSTISSET($paramname)
Return true if we are in a context of submitting the parameter $paramname from a POST of a form.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
dol_escape_htmltag($stringtoescape, $keepb=0, $keepn=0, $noescapetags='', $escapeonlyhtmltags=0, $cleanalsojavascript=0)
Returns text escaped for inclusion in HTML alt or title or value tags, or into values of HTML input f...
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.