24require
'../../main.inc.php';
25require_once DOL_DOCUMENT_ROOT.
'/core/lib/memory.lib.php';
26require_once DOL_DOCUMENT_ROOT.
'/core/lib/date.lib.php';
27require_once DOL_DOCUMENT_ROOT.
'/core/lib/files.lib.php';
28require_once DOL_DOCUMENT_ROOT.
'/core/lib/geturl.lib.php';
29require_once DOL_DOCUMENT_ROOT.
'/core/lib/functions2.lib.php';
30require_once DOL_DOCUMENT_ROOT.
'/core/lib/security2.lib.php';
31require_once DOL_DOCUMENT_ROOT.
'/core/class/events.class.php';
34$langs->loadLangs(array(
"install",
"other",
"admin",
"errors"));
40if (
GETPOST(
'action',
'aZ09') ==
'donothing') {
53llxHeader(
'',
'',
'',
'', 0, 0,
'',
'',
'',
'mod-admin page-system_security');
57print
'<span class="opacitymedium">'.$langs->trans(
"YouMayFindSecurityAdviceHere",
'hhttps://wiki.dolibarr.org/index.php/Security_information').
'</span>';
58print
' ';
59print
'<a href="'.$_SERVER[
"PHP_SELF"].
'">';
60print
img_picto($langs->trans(
"Reload"),
'refresh').
' ';
61print $langs->trans(
"Reload");
73print
'<div class="divsection wordbreak">';
77print
"<strong>PHP</strong>: ".$langs->trans(
"Version").
": ".$phpversion;
78if (function_exists(
'php_ini_loaded_file')) {
79 $inipath = php_ini_loaded_file();
80 print
" - <strong>INI</strong>: ".$inipath;
85print
"<br><strong>Web server - ".$langs->trans(
"Version").
"</strong>: ".$_SERVER[
"SERVER_SOFTWARE"].
"<br>\n";
86print
'<strong>'.$langs->trans(
"DataRootServer").
"</strong>: ".DOL_DATA_ROOT.
"<br>\n";
90if ($labeluser && $labelgroup) {
91 print
'<strong>'.$langs->trans(
"WebUserGroup").
" (env vars)</strong> : ".$labeluser.
':'.$labelgroup;
92 if (function_exists(
'posix_geteuid') && function_exists(
'posix_getpwuid')) {
93 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
94 print
' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser[
'name'].
':'.$arrayofinfoofuser[
'gecos'].
':'.$arrayofinfoofuser[
'dir'].
':'.$arrayofinfoofuser[
'shell'].
')</span><br>'.
"\n";
98if (function_exists(
'exec')) {
101 exec(
'id', $arrayout, $varout);
102 if (empty($varout)) {
103 print
'<strong>'.$langs->trans(
"WebUserGroup").
" (real, 'id' command)</strong> : ".implode(
',', $arrayout).
"<br>\n";
108print
"<strong>PHP session.use_strict_mode</strong> = ".(ini_get(
'session.use_strict_mode') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.use_strict_mode') ? ini_get(
'session.use_strict_mode') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
109print
"<strong>PHP session.use_only_cookies</strong> = ".(ini_get(
'session.use_only_cookies') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.use_only_cookies') ? ini_get(
'session.use_only_cookies') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
110print
"<strong>PHP session.cookie_httponly</strong> = ".(ini_get(
'session.cookie_httponly') ?
img_picto(
'',
'tick').
' ' :
img_warning().
' ').(ini_get(
'session.cookie_httponly') ? ini_get(
'session.cookie_httponly') :
'').
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'1').
")</span><br>\n";
111print
"<strong>PHP session.cookie_samesite</strong> = ".(ini_get(
'session.cookie_samesite') ?
img_picto(
'',
'tick').
' ' .ini_get(
'session.cookie_samesite') :
'None');
112if (!ini_get(
'session.cookie_samesite') || ini_get(
'session.cookie_samesite') ==
'Lax') {
113 print
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'Lax').
")</span>";
114} elseif (ini_get(
'session.cookie_samesite') ==
'Strict') {
115 print
' '.img_warning().
' <span class="opacitymedium">'.$langs->trans(
"WarningPaypalPaymentNotCompatibleWithStrict").
"</span>";
119print
"<strong>PHP open_basedir</strong> = ".(ini_get(
'open_basedir') ?
img_picto(
'',
'tick').
' '.ini_get(
'open_basedir') :
img_warning().
' '.
yn(0).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"ARestrictedPath").
', '.$langs->transnoentitiesnoconv(
"Example").
': '.$_SERVER[
"DOCUMENT_ROOT"].
','.DOL_DATA_ROOT).
')</span>').
"<br>\n";
121print
"<strong>PHP short_open_tag</strong> = ".((empty(ini_get(
'short_open_tag')) || ini_get(
'short_open_tag') ==
'Off') ?
img_picto(
'',
'tick').
' '.
yn(0) :
img_warning().
' '.
yn(1)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
')</span>'.
"<br>\n";
123print
"<strong>PHP allow_url_fopen</strong> = ".(ini_get(
'allow_url_fopen') ?
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' '.ini_get(
'allow_url_fopen') :
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
" but may be required by some external modules)</span><br>\n";
125print
"<strong>PHP allow_url_include</strong> = ".(ini_get(
'allow_url_include') ?
img_picto($langs->trans(
"YouShouldSetThisToOff"),
'warning').
' '.ini_get(
'allow_url_include') :
img_picto(
'',
'tick').
' '.
yn(0)).
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"No")).
")</span><br>\n";
128print
"<strong>PHP disable_functions</strong> = ";
129$arrayoffunctionsdisabled = explode(
',', ini_get(
'disable_functions'));
130$arrayoffunctionstodisable = explode(
',',
'dl,apache_note,apache_setenv,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,show_source,virtual');
133if ($execmethod == 1) {
134 $arrayoffunctionstodisable2 = explode(
',',
'passthru,shell_exec,system,proc_open,popen');
135 $functiontokeep =
'exec';
137 $arrayoffunctionstodisable2 = explode(
',',
'exec,passthru,shell_exec,system,proc_open');
138 $functiontokeep =
'popen';
141foreach ($arrayoffunctionsdisabled as $functionkey) {
145 print
'<span class="opacitymedium">'.$functionkey.
'</span>';
151foreach ($arrayoffunctionstodisable as $functiontodisable) {
152 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
154 $todisabletext .=
', ';
156 $todisabletext .=
' <span class="opacitymedium">'.$functiontodisable.
'</span>';
161 print
img_picto(
'',
'warning',
'class="pictofixedwidth"').$langs->trans(
"YouShouldDisablePHPFunctions").
': '.$todisabletext;
166foreach ($arrayoffunctionstodisable2 as $functiontodisable) {
167 if (! in_array($functiontodisable, $arrayoffunctionsdisabled)) {
169 $todisabletext .=
', ';
171 $todisabletext .=
' <span class="opacitymedium">'.$functiontodisable.
'</span>';
176 print
img_picto(
'',
'warning',
'class="pictofixedwidth"').$langs->trans(
"IfCLINotRequiredYouShouldDisablePHPFunctions").
': '.$todisabletext;
180if (in_array($functiontokeep, $arrayoffunctionsdisabled)) {
181 print
img_picto($langs->trans(
"PHPFunctionsRequiredForCLI"),
'warning',
'class="pictofixedwidth"');
183 print
img_picto(
'',
'tick',
'class="pictofixedwidth"');
185print $langs->trans(
"PHPFunctionsRequiredForCLI").
': ';
186print
'<span class="opacitymedium">'.$functiontokeep.
'</span>';
192print
'<strong>JSON</strong>: ';
193$loadedExtensions = array_map(
'strtolower', get_loaded_extensions(
false));
194$test = !in_array(
'json', $loadedExtensions);
195if ($test || function_exists(
'dol_json_decode')) {
196 print
img_picto(
'',
'error').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"VulnerableToRCEAttack");
198 print
img_picto(
'',
'tick').
' '.$langs->trans(
"Available").
' <span class="opacitymedium">(PHP native so not emulated, safe)</span>';
203print
'<strong>XDebug</strong>: ';
204$test = !function_exists(
'xdebug_is_enabled') && !extension_loaded(
'xdebug');
206 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
208 print
img_picto(
'',
'warning').
' '.$langs->trans(
"ModuleActivatedMayExposeInformation", $langs->transnoentities(
"XDebug"));
209 print
' - '.$langs->trans(
"MoreInformation").
' <a href="'.DOL_URL_ROOT.
'/admin/system/xdebug.php">XDebug admin page</a>';
220print
load_fiche_titre($langs->trans(
"OSSetup").
' - '.$langs->trans(
"PermissionsOnFiles"),
'',
'folder');
222print
'<div class="divsection wordbreak">';
224print
'<strong>'.$langs->trans(
"PermissionsOnFilesInWebRoot").
'</strong>: ';
225$arrayoffilesinroot =
dol_dir_list(DOL_DOCUMENT_ROOT,
'all', 1,
'', array(
'\/custom'),
'name', SORT_ASC, 4, 1,
'', 1);
226$fileswithwritepermission = array();
227foreach ($arrayoffilesinroot as $fileinroot) {
229 if (isset($fileinroot[
'perm']) && ($fileinroot[
'perm'] & 0222)) {
230 $fileswithwritepermission[] = $fileinroot[
'relativename'];
233if (empty($fileswithwritepermission)) {
234 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NoWritableFilesFoundIntoRootDir");
236 print
img_warning().
' '.$langs->trans(
"SomeFilesOrDirInRootAreWritable");
237 print
'<br>'.$langs->trans(
"Example").
': ';
239 foreach ($fileswithwritepermission as $filewithwritepermission) {
243 print
'<span class="opacitymedium">'.$filewithwritepermission.
'</span>';
254print
'<strong>'.$langs->trans(
"PermissionsOnFile", $conffile).
'</strong>: ';
255$perms = fileperms($dolibarr_main_document_root.
'/'.$conffile);
257 if (($perms & 0x0004) || ($perms & 0x0002)) {
258 print
img_warning().
' '.$langs->trans(
"ConfFileIsReadableOrWritableByAnyUsers");
262 print
' '.$langs->trans(
"User").
': '.$labeluser.
':'.$labelgroup;
263 if (function_exists(
'posix_geteuid') && function_exists(
'posix_getpwuid')) {
264 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
265 print
' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser[
'name'].
':'.$arrayofinfoofuser[
'gecos'].
':'.$arrayofinfoofuser[
'dir'].
':'.$arrayofinfoofuser[
'shell'].
')</span>';
271 print
img_warning().
' '.$langs->trans(
"FailedToReadFile", $conffile);
276$installlock = DOL_DATA_ROOT.
'/install.lock';
277$upgradeunlock = DOL_DATA_ROOT.
'/upgrade.unlock';
278$installmoduleslock = DOL_DATA_ROOT.
'/installmodules.lock';
281print
'<strong>'.$langs->trans(
"DolibarrSetup").
'</strong>: ';
282if (file_exists($installlock)) {
283 if (file_exists($upgradeunlock)) {
284 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallLockedBy", $installlock);
286 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallAndUpgradeLockedBy", $installlock);
289 print
img_warning().
' '.$langs->trans(
"WarningLockFileDoesNotExists", DOL_DATA_ROOT);
294if (file_exists($installlock)) {
295 if (file_exists($upgradeunlock)) {
296 print
'<strong>'.$langs->trans(
"DolibarrUpgrade").
'</strong>: ';
297 print
img_warning().
' '.$langs->trans(
"WarningUpgradeHasBeenUnlocked", $upgradeunlock);
303print
'<strong>'.$langs->trans(
"DolibarrAddonInstall").
'</strong>: ';
304if (file_exists($installmoduleslock)) {
305 print
img_picto(
'',
'tick').
' '.$langs->trans(
"InstallAndUpgradeLockedBy", $installmoduleslock);
307 print $langs->trans(
"InstallOfAddonIsNotBlocked", DOL_DATA_ROOT);
318print
load_fiche_titre($langs->trans(
"ConfigurationFile").
' ('.$conffile.
')',
'',
'folder');
320print
'<div class="divsection wordbreak">';
321print
'<strong>$dolibarr_main_prod</strong>: '.($dolibarr_main_prod ? $dolibarr_main_prod :
'0');
322if (empty($dolibarr_main_prod)) {
323 print
' '.img_picto(
'',
'warning').
' '.$langs->trans(
"IfYouAreOnAProductionSetThis", 1);
327print
'<strong>$dolibarr_nocsrfcheck</strong>: '.(empty($dolibarr_nocsrfcheck) ?
'0' : $dolibarr_nocsrfcheck);
328if (!empty($dolibarr_nocsrfcheck)) {
329 print
' '.img_picto(
'',
'error').
' '.$langs->trans(
"IfYouAreOnAProductionSetThis", 0);
331 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0)</span>';
335print
'<strong>$dolibarr_main_restrict_ip</strong>: ';
336if (empty($dolibarr_main_restrict_ip)) {
337 print $langs->trans(
"None");
338 print
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs", $langs->transnoentitiesnoconv(
"StaticIPsOfUsers")).
')</span>';
340 print $dolibarr_main_restrict_ip;
344print
'<strong>$dolibarr_main_restrict_os_commands</strong>: ';
345if (empty($dolibarr_main_restrict_os_commands)) {
346 print $langs->trans(
"None");
348 print $dolibarr_main_restrict_os_commands;
350print
' <span class="opacitymedium">('.$langs->trans(
"RecommendedValueIs",
'mysqldump, mysql, pg_dump, pg_restore, mariadb, mariadb-dump, clamdscan').
')</span>';
354 print
'<strong>$dolibarr_main_db_pass</strong>: ';
355 if (!empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) {
356 print
img_picto(
'',
'warning').
' '.$langs->trans(
"DatabasePasswordNotObfuscated").
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"SetOptionTo", $langs->transnoentitiesnoconv(
"MainDbPasswordFileConfEncrypted"),
yn(1)).
')</span>';
359 print
img_picto(
'',
'tick').
' '.$langs->trans(
"DatabasePasswordObfuscated");
365print
'<strong>$dolibarr_main_stream_to_disable</strong>: ';
367if (empty($dolibarr_main_stream_to_disable)) {
368 print
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' = '.implode(
', ', $arrayofstreamtodisable).
'</span>';
370 print implode(
', ', $dolibarr_main_stream_to_disable);
372print
'<span class="bold"> -> Current PHP streams allowed = </span>';
373$arrayofstreams = stream_get_wrappers();
374if (!empty($arrayofstreams)) {
375 sort($arrayofstreams);
376 print(implode(
',', $arrayofstreams)).
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"TryToKeepOnly",
'file,http,https,php,zip').
')</span>'.
"\n";
405print
load_fiche_titre($langs->trans(
"Menu").
' '.$langs->trans(
"SecuritySetup"),
'',
'folder');
407print
'<div class="divsection wordbreak">';
409print
'<strong>'.$langs->trans(
"UseCaptchaCode").
'</strong>: ';
416$sessiontimeout = ini_get(
"session.gc_maxlifetime");
418 $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
420print
'<strong>'.$langs->trans(
"SessionTimeOut").
'</strong>';
421if (!ini_get(
"session.gc_probability")) {
422 print $form->textwithpicto(
'', $langs->trans(
"SessionsPurgedByExternalSystem", ini_get(
"session.gc_maxlifetime")));
424 print $form->textwithpicto(
'', $langs->trans(
"SessionExplanation", ini_get(
"session.gc_probability"), ini_get(
"session.gc_divisor"), ini_get(
"session.gc_maxlifetime")));
426print
': '.getDolGlobalInt(
'MAIN_SESSION_TIMEOUT').
' '.strtolower($langs->trans(
"Seconds"));
429print
'<strong>'.$langs->trans(
"MaxNumberOfImagesInGetPost").
'</strong>: ';
430print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT') ?
img_picto(
'',
'tick').
' ' :
'').
getDolGlobalInt(
'MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').
' '.strtolower($langs->trans(
"Images"));
433print
'<strong>'.$langs->trans(
"MaxNumberOfPostOnPublicPagesByIP").
'</strong>: ';
434print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200) ?
img_picto(
'',
'tick').
' ' :
'').
getDolGlobalInt(
'MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200).
' '.strtolower($langs->trans(
"Posts"));
437print
'<strong>'.$langs->trans(
"MaxNumberOfAttachementOnForms").
'</strong>: ';
438print(
getDolGlobalInt(
'MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS', 10) ?
img_picto(
'',
'tick').
' ' :
'').
getDolGlobalInt(
"MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).
' '.strtolower($langs->trans(
"Files"));
441print
'<strong>'.$langs->trans(
"DoNotStoreClearPassword").
'</strong>: ';
445 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
' '.
yn(1).
')</span>';
482print
'<strong>'.$langs->trans(
"AntivirusEnabledOnUpload").
'</strong>: ';
486 print
' - <span class="opacitymedium">'.$langs->trans(
"Recommended").
': '.$langs->trans(
"DefinedAPathForAntivirusCommandIntoSetup", $langs->transnoentitiesnoconv(
"Home").
" - ".$langs->transnoentitiesnoconv(
"Setup").
" - ".$langs->transnoentitiesnoconv(
"Security")).
'</span>';
489 if (defined(
'MAIN_ANTIVIRUS_COMMAND') && !defined(
'MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
490 print
' - <span class="opacitymedium">'.$langs->trans(
"ValueIsForcedBySystem").
'</span>';
498print
'<strong>'.$langs->trans(
"UMask").
'</strong>: ';
499if (! in_array($umask, array(
'600',
'660',
'0600',
'0660'))) {
503if (! in_array($umask, array(
'600',
'660',
'0600',
'0660'))) {
504 print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0600 | 0660)</span>';
510$securityevent =
new Events($db);
511$eventstolog = $securityevent->eventstolog;
513print
'<strong>'.$langs->trans(
"AuditedSecurityEvents").
'</strong>: ';
515if (!empty($eventstolog) && is_array($eventstolog)) {
518 foreach ($eventstolog as $key => $arr) {
520 $key =
'MAIN_LOGEVENTS_'.$arr[
'id'];
526 $out .=
'<span class="opacitymedium">'.$key.
'</span>';
535 print
img_warning().
' '.$langs->trans(
"NoSecurityEventsAreAduited", $langs->transnoentities(
"Home").
' - '.$langs->transnoentities(
"Setup").
' - '.$langs->transnoentities(
"Security").
' - '.$langs->transnoentities(
"Audit")).
'<br>';
537 $s = $langs->trans(
"SeeSetupPage",
'{s1}'.$langs->transnoentities(
"Home").
' - '.$langs->transnoentities(
"Setup").
' - '.$langs->transnoentities(
"Security").
' - '.$langs->transnoentities(
"Audit").
'{s2}');
538 print
' - '.str_replace(
'{s2}',
'</a>', str_replace(
'{s1}',
'<a href="'.DOL_URL_ROOT.
'/admin/events.php" target="_blank">', $s));
552print
'<div class="divsection wordbreak">';
555print
'<strong>'.$langs->trans(
"Syslog").
'</strong>: ';
556$test = isModEnabled(
'syslog');
558 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
561 print
img_picto(
'',
'warning').
' '.$langs->trans(
"ModuleActivatedWithTooHighLogLevel", $langs->transnoentities(
"Syslog"));
563 print
img_picto(
'',
'tick').
' '.$langs->trans(
"ModuleSyslogActivatedButLevelNotTooVerbose", $langs->transnoentities(
"Syslog"),
getDolGlobalInt(
'SYSLOG_LEVEL'));
572print
'<strong>'.$langs->trans(
"DebugBar").
'</strong>: ';
573$test = isModEnabled(
'debugbar');
575 print
img_picto(
'',
'tick').
' '.$langs->trans(
"NotInstalled").
' - '.$langs->trans(
"NotRiskOfLeakWithThis");
577 print
img_picto(
'',
'error').
' '.$langs->trans(
"ModuleActivatedDoNotUseInProduction", $langs->transnoentities(
"DebugBar"));
585$test = isModEnabled(
'stripe');
587 print
'<strong>'.$langs->trans(
"Stripe").
'</strong>: ';
589 print
img_picto(
'',
'error').
' '.$langs->trans(
"OptionXShouldBeEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Stripe"));
591 print
img_picto(
'',
'tick').
' '.$langs->trans(
"OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Stripe"));
595 $test = isModEnabled(
'paypal');
597 print
'<strong>'.$langs->trans(
"Paypal").
'</strong>: ';
599 print
img_picto(
'',
'error').
' '.$langs->trans(
"OptionXShouldBeEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Paypal"));
601 print
img_picto(
'',
'tick').
' '.$langs->trans(
"OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities(
"SecurityTokenIsUnique"), $langs->transnoentities(
"Paypal"));
616print
'<div class="divsection wordbreak">';
618if (!isModEnabled(
'api') && !isModEnabled(
'webservices')) {
619 print $langs->trans(
"APIsAreNotEnabled");
621 if (isModEnabled(
'webservices')) {
622 print
img_picto(
'',
'warning').
' '.$langs->trans(
'YouEnableDeprecatedWSAPIsUseRESTAPIsInstead').
"<br>\n";
625 if (isModEnabled(
'api')) {
626 print
'<strong>API_ENDPOINT_RULES</strong> = '.getDolGlobalString(
'API_ENDPOINT_RULES',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Example").
': login:0,users:0,setup:1,status:1,tickets:1,...)</span>').
"<br>\n";
639print
'<div class="divsection wordbreak">';
641print
'<strong>MAIN_ALLOW_SVG_FILES_AS_IMAGES</strong> = '.getDolGlobalString(
'MAIN_ALLOW_SVG_FILES_AS_IMAGES',
'0').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 0)</span><br>';
644print
'<strong>MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE</strong> = '.getDolGlobalString(
'MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 1)</span><br>';
648print
'<strong>MAIN_SECURITY_HASH_ALGO</strong> = '.getDolGlobalString(
'MAIN_SECURITY_HASH_ALGO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
" ";
650 print
'<span class="opacitymedium"> (If unset: \'md5\')</span>';
653 print
'<br><strong>MAIN_SECURITY_SALT</strong> = '.getDolGlobalString(
'MAIN_SECURITY_SALT',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
'<br>';
655 print
'<span class="opacitymedium">('.$langs->trans(
"Recommended").
': password_hash)</span>';
659 print
'<div class="info">The recommended value for MAIN_SECURITY_HASH_ALGO is now \'password_hash\' but setting it now will make ALL existing passwords of all users not valid, so update is not possible.<br>';
660 print
'If you really want to switch, you must:<br>';
661 print
'- Go on home - setup - other and add constant MAIN_SECURITY_HASH_ALGO to value \'password_hash\'<br>';
662 print
'- In same session, WITHOUT LOGGING OUT, go into your admin user record and set a new password<br>';
663 print
'- You can now logout and login with this new password. You must now reset password of all other users.<br>';
668print
'<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_ANTI_SSRF_SERVER_IP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span> <span class="opacitymedium">('.$langs->trans(
"Recommended").
': List of static IPs of server separated with coma - '.$langs->trans(
"Note").
': common loopback ip like 127.*.*.*, [::1] are already added)</span>').
"<br>";
671print
'<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString(
'MAIN_SECURITY_CSRF_WITH_TOKEN',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 2)</span>'.
"<br>";
682print
load_fiche_titre($langs->trans(
"OtherSetup").
' ('.$langs->trans(
"Experimental").
')',
'',
'folder');
684print
'<div class="divsection wordbreak">';
685print
'<strong>MAIN_EXEC_USE_POPEN</strong> = ';
687 print
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>';
689 print $conf->global->MAIN_EXEC_USE_POPEN;
691if ($execmethod == 1) {
692 print
'<span class="opacitymedium"> "exec" PHP method will be used for shell commands';
693 print
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 1)';
696if ($execmethod == 2) {
697 print
'<span class="opacitymedium"> "popen" PHP method will be used for shell commands';
698 print
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 1)';
704print
'<strong>MAIN_SECURITY_MAXFILESIZE_DOWNLOADED</strong> = '.getDolGlobalString(
'MAIN_SECURITY_MAXFILESIZE_DOWNLOADED',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': 100000000)</span>').
"<br>";
707print
'<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
708print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1 - does not work on HTML5 with some old libxml libs)</span>";
709$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
710$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 1;
711$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0;
712$result=
dol_htmlwithnojs(
'<img onerror<=alert(document.domain)> src=>0xbeefed');
713if ($result ==
'InvalidHTMLStringCantBeCleaned') {
714 print
' - '.img_warning().
' Your libxml seems to old to work correctly with this option. Disable it !';
716 print
' - Test of compatibility with this option seems ok';
722print
'<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
723print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': 1)</span> - Module "php-tidy" must be enabled (currently: '.((extension_loaded(
'tidy') && class_exists(
"tidy")) ?
'Enabled' :
img_picto(
'',
'warning').
' Not available').
")";
724if (extension_loaded(
'tidy') && class_exists(
"tidy")) {
725 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
726 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0;
727 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
728 $result=
dol_htmlwithnojs(
'<img onerror<=alert(document.domain)> src=>0xbeefed');
729 if ($result ==
'InvalidHTMLStringCantBeCleaned') {
730 print
' - '.img_warning().
' Your libxml seems to old to work correctly with this option. Disable it !';
732 print
' - Test of compatibility with this option seems ok';
739print
'<strong>MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES</strong> = '.(getDolGlobalString(
'MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES') ?
'1' :
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
740print
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1 - does not work on HTML5 with some old libxml libs)</span><br>";
745print
'<strong>MAIN_DISALLOW_URL_INTO_DESCRIPTIONS</strong> = '.getDolGlobalString(
'MAIN_DISALLOW_URL_INTO_DESCRIPTIONS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': 1=only local links allowed or 2=no links at all)</span>').
"<br>";
748print
'<strong>MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS</strong> = '.getDolGlobalString(
'MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
753print
'<strong>MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL</strong> = '.getDolGlobalString(
'MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
756print
'<strong>MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED</strong> = '.getDolGlobalString(
'MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
' ('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
' 0)</span>').
"<br>";
759$examplecsprule =
"frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
760print
'<strong>MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCECSPRO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "'.$examplecsprule.
'")</span><br>';
763$examplecsprule =
"frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
764print
'<strong>MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCECSP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "'.$examplecsprule.
'")</span><br>';
767print
'<strong>MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCERP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
' '.$langs->trans(
"or").
" \"strict-origin-when-cross-origin\" so browser doesn't send any referrer when going into another web site domain)</span><br>";
770print
'<strong>MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN</strong> = '.getDolGlobalString(
'MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
": 1)</span><br>";
775print
'<strong>WEBSITE_MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCECSPRO',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
776print
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "';
777$examplecsprule =
"default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER[
"SERVER_NAME"], 1).
" *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
778print $examplecsprule;
779print
'")</span><br>';
782print
'<strong>WEBSITE_MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCECSP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>');
783print
' <span class="opacitymedium">('.$langs->trans(
"Example").
': "';
784$examplecsprule =
"default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER[
"SERVER_NAME"], 1).
" *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
785print $examplecsprule;
786print
'")</span><br>';
789print
'<strong>WEBSITE_MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCERP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Recommended").
': '.$langs->trans(
"Undefined").
'="strict-origin-when-cross-origin" '.$langs->trans(
"or").
' "same-origin"=more secured)</span><br>';
792print
'<strong>WEBSITE_MAIN_SECURITY_FORCESTS</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCESTS',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
": \"max-age=31536000; includeSubDomains\")</span><br>";
795print
'<strong>WEBSITE_MAIN_SECURITY_FORCEPP</strong> = '.getDolGlobalString(
'WEBSITE_MAIN_SECURITY_FORCEPP',
'<span class="opacitymedium">'.$langs->trans(
"Undefined").
'</span>').
' <span class="opacitymedium">('.$langs->trans(
"Example").
": \"camera=(), microphone=(), geolocation=*\")</span><br>";
805print
'<div class="divsection wordbreak">';
807print
'<span class="opacitymedium">';
808print $langs->trans(
"RecommendMitigationOnURL").
'<br>';
812$urlexamplebase =
'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/fail2ban/filter.d/';
813print
'<span class="fas fa-shield-alt"></span> Login or API authentication (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-rulesbruteforce.conf">fail2ban example on GitHub</a>)<br>';
814print
'<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.
'/passwordforgotten.php (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-rulespassforgotten.conf">fail2ban example on GitHub</a>)<br>';
815print
'<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.
'/public/* (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'web-dolibarr-limitpublic.conf">fail2ban example on GitHub</a>)<br>';
817$urlexamplebase =
'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/apache/';
818print
'<span class="fas fa-shield-alt"></span> You can also protect the application using a HTTP Basic authentication layer (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.
'virtualhost">apache2 virtualhost example on GitHub</a>)<br>';
if(!defined('NOREQUIRESOC')) if(!defined( 'NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined( 'NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined( 'NOREQUIREAJAX')) llxHeader($head='', $title='', $help_url='', $target='', $disablejs=0, $disablehead=0, $arrayofjs='', $arrayofcss='', $morequerystring='', $morecssonbody='', $replacemainareaby='', $disablenofollow=0, $disablenoindex=0)
Empty header.
dol_dir_list($utf8_path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0, $nbsecondsold=0)
Scan a directory and return a list of files/directories.
version_php()
Return PHP version.
load_fiche_titre($title, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
img_warning($titlealt='default', $moreatt='', $morecss='pictowarning')
Show warning logo.
img_picto($titlealt, $picto, $moreatt='', $pictoisfullpath=0, $srconly=0, $notitle=0, $alt='', $morecss='', $marginleftonlyshort=2)
Show picto whatever it's its name (generic function)
yn($yesno, $case=1, $color=0)
Return yes or no in current language.
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox=0, $check='restricthtml')
Sanitize a HTML to remove js, dangerous content and external link.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
dol_getwebuser($mode)
Return user/group account of web server.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.