dolibarr 21.0.0-beta
security.php
Go to the documentation of this file.
1<?php
2/* Copyright (C) 2013-2022 Laurent Destailleur <eldy@users.sourceforge.net>
3 * Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
4 * Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program. If not, see <https://www.gnu.org/licenses/>.
18 */
19
25// Load Dolibarr environment
26require '../../main.inc.php';
27require_once DOL_DOCUMENT_ROOT.'/core/lib/memory.lib.php';
28require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
29require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
30require_once DOL_DOCUMENT_ROOT.'/core/lib/geturl.lib.php';
31require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
32require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
33require_once DOL_DOCUMENT_ROOT.'/core/class/events.class.php';
34
46// Load translation files required by the page
47$langs->loadLangs(array("install", "other", "admin", "errors"));
48
49if (!$user->admin) {
50 accessforbidden();
51}
52
53if (GETPOST('action', 'aZ09') == 'donothing') {
54 exit;
55}
56
57$execmethod = getDolGlobalInt('MAIN_EXEC_USE_POPEN', 1);
58
59
60/*
61 * View
62 */
63
64$form = new Form($db);
65
66llxHeader('', '', '', '', 0, 0, '', '', '', 'mod-admin page-system_security');
67
68print load_fiche_titre($langs->trans("Security"), '', 'title_setup');
69
70print '<span class="opacitymedium">'.$langs->trans("YouMayFindSecurityAdviceHere", 'hhttps://wiki.dolibarr.org/index.php/Security_information').'</span>';
71print ' &nbsp; &nbsp; ';
72print '<a href="'.$_SERVER["PHP_SELF"].'">';
73print img_picto($langs->trans("Reload"), 'refresh').' ';
74print $langs->trans("Reload");
75print '</a>';
76print '<br>';
77print '<br>';
78
79
80print '<br>';
81
82
83print load_fiche_titre($langs->trans("PHPSetup"), '', 'folder');
84
85
86print '<div class="divsection wordbreak">';
87
88// Get version of PHP
89$phpversion = version_php();
90print "<strong>PHP</strong>: ".$langs->trans("Version").": ".$phpversion;
91if (function_exists('php_ini_loaded_file')) {
92 $inipath = php_ini_loaded_file();
93 print " - <strong>INI</strong>: ".$inipath;
94}
95print "<br>\n";
96
97// Get version of web server
98print "<br><strong>Web server - ".$langs->trans("Version")."</strong>: ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";
99print '<strong>'.$langs->trans("DataRootServer")."</strong>: ".DOL_DATA_ROOT."<br>\n";
100// Web user group by default
101$labeluser = dol_getwebuser('user');
102$labelgroup = dol_getwebuser('group');
103if ($labeluser && $labelgroup) {
104 print '<strong>'.$langs->trans("WebUserGroup")." (env vars)</strong> : ".$labeluser.':'.$labelgroup;
105 if (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) {
106 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
107 print ' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser['name'].':'.$arrayofinfoofuser['gecos'].':'.$arrayofinfoofuser['dir'].':'.$arrayofinfoofuser['shell'].')</span><br>'."\n";
108 }
109}
110// Web user group real (detected by 'id' external command)
111if (function_exists('exec')) {
112 $arrayout = array();
113 $varout = 0;
114 exec('id', $arrayout, $varout);
115 if (empty($varout)) { // Test command is ok. Work only on Linux OS.
116 print '<strong>'.$langs->trans("WebUserGroup")." (real, 'id' command)</strong> : ".implode(',', $arrayout)."<br>\n";
117 }
118}
119print '<br>';
120
121print "<strong>PHP session.use_strict_mode</strong> = ".(ini_get('session.use_strict_mode') ? img_picto('', 'tick').' ' : img_warning().' ').(ini_get('session.use_strict_mode') ? ini_get('session.use_strict_mode') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
122print "<strong>PHP session.use_only_cookies</strong> = ".(ini_get('session.use_only_cookies') ? img_picto('', 'tick').' ' : img_warning().' ').(ini_get('session.use_only_cookies') ? ini_get('session.use_only_cookies') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
123print "<strong>PHP session.cookie_httponly</strong> = ".(ini_get('session.cookie_httponly') ? img_picto('', 'tick').' ' : img_warning().' ').(ini_get('session.cookie_httponly') ? ini_get('session.cookie_httponly') : '').' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", '1').")</span><br>\n";
124print "<strong>PHP session.cookie_samesite</strong> = ".(ini_get('session.cookie_samesite') ? img_picto('', 'tick').' ' .ini_get('session.cookie_samesite') : 'None');
125if (!ini_get('session.cookie_samesite') || ini_get('session.cookie_samesite') == 'Lax') {
126 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'Lax').")</span>";
127} elseif (ini_get('session.cookie_samesite') == 'Strict') {
128 print ' &nbsp; '.img_warning().' <span class="opacitymedium">'.$langs->trans("WarningPaypalPaymentNotCompatibleWithStrict")."</span>";
129}
130print "<br>\n";
131
132print "<strong>PHP open_basedir</strong> = ".(ini_get('open_basedir') ? img_picto('', 'tick').' '.ini_get('open_basedir') : img_warning().' '.yn(0).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("ARestrictedPath").', '.$langs->transnoentitiesnoconv("Example").': '.$_SERVER["DOCUMENT_ROOT"].','.DOL_DATA_ROOT).')</span>')."<br>\n";
133
134print "<strong>PHP short_open_tag</strong> = ".((empty(ini_get('short_open_tag')) || ini_get('short_open_tag') == 'Off') ? img_picto('', 'tick').' '.yn(0) : img_warning().' '.yn(1)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).')</span>'."<br>\n";
135
136print "<strong>PHP allow_url_fopen</strong> = ".(ini_get('allow_url_fopen') ? img_picto($langs->trans("YouShouldSetThisToOff"), 'warning').' '.ini_get('allow_url_fopen') : yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).", except if Yes is required by some external modules)</span><br>\n";
137
138print "<strong>PHP allow_url_include</strong> = ".(ini_get('allow_url_include') ? img_picto($langs->trans("YouShouldSetThisToOff"), 'warning').' '.ini_get('allow_url_include') : img_picto('', 'tick').' '.yn(0)).' &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("No")).")</span><br>\n";
139//print "<strong>PHP safe_mode</strong> = ".(ini_get('safe_mode') ? ini_get('safe_mode') : yn(0)).' &nbsp; <span class="opacitymedium">'.$langs->trans("Deprecated")." (removed in PHP 5.4)</span><br>\n";
140
141if (getDolGlobalString('MAIN_SECURITY_SHOW_MORE_INFO')) {
142 print "<strong>PHP auto_prepend_file</strong> = ".(ini_get('auto_prepend_file') ? ini_get('auto_prepend_file') : '')."</span><br>\n";
143
144 print "<strong>PHP sendmail_path</strong> = ".(ini_get('sendmail_path') ? ini_get('sendmail_path') : '')."</span><br>\n";
145}
146
147print "<strong>PHP disable_functions</strong> = ";
148$arrayoffunctionsdisabled = explode(',', ini_get('disable_functions'));
149$arrayoffunctionstodisable = explode(',', 'dl,apache_note,apache_setenv,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,show_source,virtual');
150//$arrayoffunctionstodisable[] = 'stream_wrapper_restore';
151//$arrayoffunctionstodisable[] = 'stream_wrapper_register';
152if ($execmethod == 1) {
153 $arrayoffunctionstodisable2 = explode(',', 'passthru,shell_exec,system,proc_open,popen');
154 $functiontokeep = 'exec';
155} else {
156 $arrayoffunctionstodisable2 = explode(',', 'exec,passthru,shell_exec,system,proc_open');
157 $functiontokeep = 'popen';
158}
159$i = 0;
160foreach ($arrayoffunctionsdisabled as $functionkey) {
161 if ($i > 0) {
162 print ', ';
163 }
164 print '<span class="opacitymedium">'.$functionkey.'</span>';
165 $i++;
166}
167print "<br>\n";
168$todisabletext = '';
169$i = 0;
170foreach ($arrayoffunctionstodisable as $functiontodisable) {
171 if (\function_exists($functiontodisable)) {
172 if ($i > 0) {
173 $todisabletext .= ', ';
174 }
175 $todisabletext .= ' <span class="opacitymedium">'.$functiontodisable.'</span>';
176 $i++;
177 }
178}
179if ($todisabletext) {
180 print img_picto('', 'warning', 'class="pictofixedwidth"').$langs->trans("YouShouldDisablePHPFunctions").': '.$todisabletext;
181 print '<br>';
182}
183$todisabletext = '';
184$i = 0;
185foreach ($arrayoffunctionstodisable2 as $functiontodisable) {
186 if (\function_exists($functiontodisable)) {
187 if ($i > 0) {
188 $todisabletext .= ', ';
189 }
190 $todisabletext .= ' <span class="opacitymedium">'.$functiontodisable.'</span>';
191 $i++;
192 }
193}
194if ($todisabletext) {
195 print img_picto('', 'warning', 'class="pictofixedwidth"').$langs->trans("IfCLINotRequiredYouShouldDisablePHPFunctions").': '.$todisabletext;
196 print '<br>';
197}
198if (!\function_exists($functiontokeep)) {
199 print img_picto($langs->trans("PHPFunctionsRequiredForCLI"), 'warning', 'class="pictofixedwidth"');
200} else {
201 print img_picto('', 'tick', 'class="pictofixedwidth"');
202}
203print $langs->trans("PHPFunctionsRequiredForCLI").': ';
204print '<span class="opacitymedium">'.$functiontokeep.'</span>';
205print '<br>';
206
207print '<br>';
208
209// JSON
210print '<strong>JSON</strong>: ';
211$loadedExtensions = array_map('strtolower', get_loaded_extensions(false));
212$test = !in_array('json', $loadedExtensions);
213if ($test || function_exists('dol_json_decode')) {
214 print img_picto('', 'error').' '.$langs->trans("NotInstalled").' - '.$langs->trans("VulnerableToRCEAttack");
215} else {
216 print img_picto('', 'tick').' '.$langs->trans("Available").' <span class="opacitymedium">(PHP native so not emulated, safe)</span>';
217}
218print '<br>';
219
220// XDebug
221print '<strong>XDebug</strong>: ';
222$test = !function_exists('xdebug_is_enabled') && !extension_loaded('xdebug');
223if ($test) {
224 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
225} else {
226 print img_picto('', 'warning').' '.$langs->trans("ModuleActivatedMayExposeInformation", $langs->transnoentities("XDebug"));
227 print ' - '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php">XDebug admin page</a>';
228}
229
230print '</div>';
231
232print '<br>';
233
234
235// OS Permissions
236
237print '<br>';
238print load_fiche_titre($langs->trans("OSSetup").' - '.$langs->trans("PermissionsOnFiles"), '', 'folder');
239
240print '<div class="divsection wordbreak">';
241
242print '<strong>'.$langs->trans("PermissionsOnFilesInWebRoot").'</strong>: ';
243$arrayoffilesinroot = dol_dir_list(DOL_DOCUMENT_ROOT, 'all', 1, '', array('\/custom'), 'name', SORT_ASC, 4, 1, '', 1);
244$fileswithwritepermission = array();
245foreach ($arrayoffilesinroot as $fileinroot) {
246 // Test if there is at least one write permission file. If yes, add the entry into array $fileswithwritepermission
247 if (isset($fileinroot['perm']) && ($fileinroot['perm'] & 0222)) {
248 $fileswithwritepermission[] = $fileinroot['relativename'];
249 }
250}
251if (empty($fileswithwritepermission)) {
252 print img_picto('', 'tick').' '.$langs->trans("NoWritableFilesFoundIntoRootDir");
253} else {
254 print img_warning().' '.$langs->trans("SomeFilesOrDirInRootAreWritable");
255 print '<br>'.$langs->trans("Example").': ';
256 $i = 0;
257 foreach ($fileswithwritepermission as $filewithwritepermission) {
258 if ($i > 0) {
259 print ', ';
260 }
261 print '<span class="opacitymedium">'.$filewithwritepermission.'</span>';
262 if ($i > 20) {
263 print ' ...';
264 break;
265 }
266 $i++;
267 }
268}
269print '<br>';
270print '<br>';
271
272print '<strong>'.$langs->trans("PermissionsOnFile", $conffile).'</strong>: '; // $conffile is defined into filefunc.inc.php
273$perms = fileperms($dolibarr_main_document_root.'/'.$conffile);
274if ($perms) {
275 if (($perms & 0x0004) || ($perms & 0x0002)) {
276 print img_warning().' '.$langs->trans("ConfFileIsReadableOrWritableByAnyUsers");
277 // Web user group by default
278 $labeluser = dol_getwebuser('user');
279 $labelgroup = dol_getwebuser('group');
280 print ' '.$langs->trans("User").': '.$labeluser.':'.$labelgroup;
281 if (function_exists('posix_geteuid') && function_exists('posix_getpwuid')) {
282 $arrayofinfoofuser = posix_getpwuid(posix_geteuid());
283 print ' <span class="opacitymedium">(POSIX '.$arrayofinfoofuser['name'].':'.$arrayofinfoofuser['gecos'].':'.$arrayofinfoofuser['dir'].':'.$arrayofinfoofuser['shell'].')</span>';
284 }
285 } else {
286 print img_picto('', 'tick');
287 }
288} else {
289 print img_warning().' '.$langs->trans("FailedToReadFile", $conffile);
290}
291print '<br>';
292print '<br>';
293
294$installlock = DOL_DATA_ROOT.'/install.lock';
295$upgradeunlock = DOL_DATA_ROOT.'/upgrade.unlock';
296$installmoduleslock = DOL_DATA_ROOT.'/installmodules.lock';
297
298// Is install (upgrade) locked
299print '<strong>'.$langs->trans("DolibarrSetup").'</strong>: ';
300if (file_exists($installlock)) {
301 if (file_exists($upgradeunlock)) {
302 print img_picto('', 'tick').' '.$langs->trans("InstallLockedBy", $installlock);
303 } else {
304 print img_picto('', 'tick').' '.$langs->trans("InstallAndUpgradeLockedBy", $installlock);
305 }
306} else {
307 print img_warning().' '.$langs->trans("WarningLockFileDoesNotExists", DOL_DATA_ROOT);
308}
309
310print '<br>';
311print '<br>';
312
313// Is upgrade unlocked
314if (file_exists($installlock)) { // If install not locked, no need to show this.
315 if (file_exists($upgradeunlock)) {
316 print '<strong>'.$langs->trans("DolibarrUpgrade").'</strong>: ';
317 print img_warning().' '.$langs->trans("WarningUpgradeHasBeenUnlocked", $upgradeunlock);
318 print '<br>';
319 print '<br>';
320 }
321}
322
323// Is addon install locked ?
324print '<strong>'.$langs->trans("DolibarrAddonInstall").'</strong>: ';
325if (file_exists($installmoduleslock)) {
326 print img_picto('', 'tick').' '.$langs->trans("InstallAndUpgradeLockedBy", $installmoduleslock);
327} else {
328 print $langs->trans("InstallOfAddonIsNotBlocked", DOL_DATA_ROOT);
329}
330
331print '</div>';
332
333
334
335// File conf.php
336
337print '<br>';
338print '<br>';
339print load_fiche_titre($langs->trans("ConfigurationFile").' ('.$conffile.')', '', 'folder');
340
341print '<div class="divsection wordbreak">';
342print '<strong>$dolibarr_main_prod</strong>: '.($dolibarr_main_prod ? $dolibarr_main_prod : '0');
343if (empty($dolibarr_main_prod)) {
344 print ' &nbsp; &nbsp; '.img_picto('', 'warning').' '.$langs->trans("IfYouAreOnAProductionSetThis", 1);
345}
346print '<br>';
347
348print '<strong>$dolibarr_nocsrfcheck</strong>: '.(empty($dolibarr_nocsrfcheck) ? '0' : $dolibarr_nocsrfcheck);
349if (!empty($dolibarr_nocsrfcheck)) {
350 print ' &nbsp; &nbsp;'.img_picto('', 'error').' '.$langs->trans("IfYouAreOnAProductionSetThis", 0);
351} else {
352 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0)</span>';
353}
354print '<br>';
355
356print '<strong>$dolibarr_main_restrict_ip</strong>: ';
357if (empty($dolibarr_main_restrict_ip)) {
358 print $langs->trans("None");
359 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("StaticIPsOfUsers")).')</span>';
360} else {
361 print $dolibarr_main_restrict_ip;
362}
363print '<br>';
364
365print '<strong>$dolibarr_main_restrict_os_commands</strong>: ';
366if (empty($dolibarr_main_restrict_os_commands)) {
367 print $langs->trans("None");
368} else {
369 print $dolibarr_main_restrict_os_commands;
370}
371print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'mysqldump, mysql, pg_dump, pg_restore, mariadb, mariadb-dump, clamdscan').')</span>';
372print '<br>';
373
374if (!getDolGlobalString('SECURITY_DISABLE_TEST_ON_OBFUSCATED_CONF')) {
375 print '<strong>$dolibarr_main_db_pass</strong>: ';
376 if (!empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) {
377 print img_picto('', 'warning').' '.$langs->trans("DatabasePasswordNotObfuscated").' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("SetOptionTo", $langs->transnoentitiesnoconv("MainDbPasswordFileConfEncrypted"), yn(1)).')</span>';
378 //print ' <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", $langs->transnoentitiesnoconv("IPsOfUsers")).')</span>';
379 } else {
380 print img_picto('', 'tick').' '.$langs->trans("DatabasePasswordObfuscated");
381 }
382
383 print '<br>';
384}
385
386print '<strong>$dolibarr_main_stream_to_disable</strong>: ';
387// $arrayofstreamtodisable is defined into filefunc.inc.php
388'@phan-var-force string[] $arrayofstreamtodisable';
389if (empty($dolibarr_main_stream_to_disable)) {
390 print '<span class="opacitymedium">'.$langs->trans("Undefined").' = '.implode(', ', $arrayofstreamtodisable).'</span>';
391} else {
392 print implode(', ', $dolibarr_main_stream_to_disable);
393}
394print '<span class="bold"> &nbsp; -> Current PHP streams allowed = </span>';
395$arrayofstreams = stream_get_wrappers();
396if (!empty($arrayofstreams)) {
397 sort($arrayofstreams);
398 print '<span class="wordbreakall">'.implode(',', $arrayofstreams).'</span>';
399 print ' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("TryToKeepOnly", 'file,http,https,php,zip').')</span>'."\n";
400}
401print '</div>';
402
403
404/*
405if (!empty($dolibarr_main_stream_do_not_disable)) {
406 print '<strong>$dolibarr_main_stream_do_not_disable</strong>: ';
407 if (empty($dolibarr_main_stream_do_not_disable)) {
408 print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>';
409 } else {
410 print join(', ', $dolibarr_main_stream_do_not_disable);
411 }
412 print ' -> PHP stream allowed = ';
413 $arrayofstreams = stream_get_wrappers();
414 if (!empty($arrayofstreams)) {
415 sort($arrayofstreams);
416 print (join(',', $arrayofstreams)).' &nbsp; &nbsp; <span class="opacitymedium">('.$langs->trans("RecommendedValueIs", 'Undefined').')</span>'."\n";
417 }
418
419 print '<br>';
420}
421*/
422
423// Menu Home - Setup - Security
424
425print '<br>';
426print '<br>';
427
428print load_fiche_titre($langs->trans("Menu").' '.$langs->trans("SecuritySetup"), '', 'folder');
429
430print '<div class="divsection wordbreak">';
431
432print '<strong>'.$langs->trans("UseCaptchaCode").'</strong>: ';
433print !getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA') ? '' : img_picto('', 'tick').' ';
434print yn(!getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA') ? 0 : 1);
435print '<br>';
436print '<br>';
437
438
439$sessiontimeout = ini_get("session.gc_maxlifetime");
440if (!getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
441 $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
442}
443print '<strong>'.$langs->trans("SessionTimeOut").'</strong>';
444if (!ini_get("session.gc_probability")) {
445 print $form->textwithpicto('', $langs->trans("SessionsPurgedByExternalSystem", ini_get("session.gc_maxlifetime")));
446} else {
447 print $form->textwithpicto('', $langs->trans("SessionExplanation", ini_get("session.gc_probability"), ini_get("session.gc_divisor"), ini_get("session.gc_maxlifetime")));
448}
449print ': '.getDolGlobalInt('MAIN_SESSION_TIMEOUT').' '.strtolower($langs->trans("Seconds"));
450print '<br><br>';
451
452print '<strong>'.$langs->trans("MaxNumberOfImagesInGetPost").'</strong>: ';
453print(getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT') ? img_picto('', 'tick').' ' : '').getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').' '.strtolower($langs->trans("Images"));
454print '<br><br>';
455
456print '<strong>'.$langs->trans("MaxNumberOfPostOnPublicPagesByIP").'</strong>: ';
457print(getDolGlobalInt('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200) ? img_picto('', 'tick').' ' : '').getDolGlobalInt('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS', 200).' '.strtolower($langs->trans("Posts"));
458print '<br><br>';
459
460print '<strong>'.$langs->trans("MaxNumberOfAttachementOnForms").'</strong>: ';
461print(getDolGlobalInt('MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS', 10) ? img_picto('', 'tick').' ' : '').getDolGlobalInt("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).' '.strtolower($langs->trans("Files"));
462print '<br><br>';
463
464print '<strong>'.$langs->trans("DoNotStoreClearPassword").'</strong>: ';
465print !getDolGlobalString('DATABASE_PWD_ENCRYPTED') ? '' : img_picto('', 'tick').' ';
466print yn(!getDolGlobalString('DATABASE_PWD_ENCRYPTED') ? 0 : 1);
467if (!getDolGlobalString('DATABASE_PWD_ENCRYPTED')) {
468 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
469}
470print '<br>';
471print '<br>';
472
473/* Already into section conf file */
474/*
475$usepassinconfencrypted = 0;
476global $dolibarr_main_db_pass, $dolibarr_main_db_encrypted_pass;
477if (preg_match('/crypted:/i', $dolibarr_main_db_pass) || !empty($dolibarr_main_db_encrypted_pass)) {
478 $usepassinconfencrypted = 1;
479}
480print '<strong>'.$langs->trans("MainDbPasswordFileConfEncrypted").'</strong>: ';
481print $usepassinconfencrypted ? img_picto('', 'tick').' ' : img_warning().' ';
482print yn($usepassinconfencrypted);
483if (empty($usepassinconfencrypted)) {
484 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
485}
486print '<br>';
487print '<br>';
488*/
489
490/* Password length
491
492// Stored into $tabconf[0] if module generator is "Perso" or specific to the module generator.
493$tabConf = explode(";", getDolGlobalString('USER_PASSWORD_PATTERN'));
494
495print '<strong>'.$langs->trans("PasswordLength").'</strong>: ';
496print empty($conf->global->DATABASE_PWD_ENCRYPTED) ? '' : img_picto('', 'tick').' ';
497print yn(empty($conf->global->DATABASE_PWD_ENCRYPTED) ? 0 : 1);
498if (empty($conf->global->DATABASE_PWD_ENCRYPTED)) {
499 print ' <span class="opacitymedium">('.$langs->trans("Recommended").' '.yn(1).')</span>';
500}
501print '<br>';
502print '<br>';
503*/
504
505print '<strong>'.$langs->trans("AntivirusEnabledOnUpload").'</strong>: ';
506print !getDolGlobalString('MAIN_ANTIVIRUS_COMMAND') ? img_warning().' ' : img_picto('', 'tick').' ';
507print yn(!getDolGlobalString('MAIN_ANTIVIRUS_COMMAND') ? 0 : 1);
508if (!getDolGlobalString('MAIN_ANTIVIRUS_COMMAND')) {
509 print ' - <span class="opacitymedium">'.$langs->trans("Recommended").': '.$langs->trans("DefinedAPathForAntivirusCommandIntoSetup", $langs->transnoentitiesnoconv("Home")." - ".$langs->transnoentitiesnoconv("Setup")." - ".$langs->transnoentitiesnoconv("Security")).'</span>';
510} else {
511 print ' &nbsp; - ' . getDolGlobalString('MAIN_ANTIVIRUS_COMMAND');
512 if (defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
513 print ' - <span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
514 }
515}
516print '<br>';
517print '<br>';
518
519$umask = getDolGlobalString('MAIN_UMASK');
520
521print '<strong>'.$langs->trans("UMask").'</strong>: ';
522if (! in_array($umask, array('600', '660', '0600', '0660'))) {
523 print img_warning().' ';
524}
525print $umask;
526if (! in_array($umask, array('600', '660', '0600', '0660'))) {
527 print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0600 | 0660)</span>';
528}
529print '<br>';
530print '<br>';
531
532
533$securityevent = new Events($db);
534$eventstolog = $securityevent->eventstolog;
535
536print '<strong>'.$langs->trans("AuditedSecurityEvents").'</strong>: ';
537$out = '';
538if (!empty($eventstolog) && is_array($eventstolog)) {
539 // Loop on each event type
540 $i = 0;
541 foreach ($eventstolog as $key => $arr) {
542 if ($arr['id']) {
543 $key = 'MAIN_LOGEVENTS_'.$arr['id'];
544 $value = getDolGlobalString($key);
545 if ($value) {
546 if ($i > 0) {
547 $out .= ', ';
548 }
549 $out .= '<span class="opacitymedium">'.$key.'</span>';
550 $i++;
551 }
552 }
553 }
554 print $out;
555}
556
557if (empty($out)) {
558 print img_warning().' '.$langs->trans("NoSecurityEventsAreAduited", $langs->transnoentities("Home").' - '.$langs->transnoentities("Setup").' - '.$langs->transnoentities("Security").' - '.$langs->transnoentities("Audit")).'<br>';
559} else {
560 $s = $langs->trans("SeeSetupPage", '{s1}'.$langs->transnoentities("Home").' - '.$langs->transnoentities("Setup").' - '.$langs->transnoentities("Security").' - '.$langs->transnoentities("Audit").'{s2}');
561 print ' - '.str_replace('{s2}', '</a>', str_replace('{s1}', '<a href="'.DOL_URL_ROOT.'/admin/events.php" target="_blank">', $s));
562}
563
564print '</div>';
565
566print '<br>';
567
568
569// Modules/Applications
570
571print '<br>';
572print '<br>';
573print load_fiche_titre($langs->trans("Modules"), '', 'folder');
574
575print '<div class="divsection wordbreak">';
576
577// Module log
578print '<strong>'.$langs->trans("Syslog").'</strong>: ';
579$test = isModEnabled('syslog');
580if (!$test) {
581 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
582} else {
583 if (getDolGlobalInt('SYSLOG_LEVEL') > LOG_NOTICE) {
584 print img_picto('', 'warning').' '.$langs->trans("ModuleActivatedWithTooHighLogLevel", $langs->transnoentities("Syslog"));
585 } else {
586 print img_picto('', 'tick').' '.$langs->trans("ModuleSyslogActivatedButLevelNotTooVerbose", $langs->transnoentities("Syslog"), getDolGlobalInt('SYSLOG_LEVEL'));
587 }
588 //print ' '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php'.'">XDebug admin page</a>';
589}
590print '<br>';
591
592print '<br>';
593
594// Module debugbar
595print '<strong>'.$langs->trans("DebugBar").'</strong>: ';
596$test = isModEnabled('debugbar');
597if (!$test) {
598 print img_picto('', 'tick').' '.$langs->trans("NotInstalled").' - '.$langs->trans("NotRiskOfLeakWithThis");
599} else {
600 print img_picto('', 'error').' '.$langs->trans("ModuleActivatedDoNotUseInProduction", $langs->transnoentities("DebugBar"));
601 //print ' '.$langs->trans("MoreInformation").' <a href="'.DOL_URL_ROOT.'/admin/system/xdebug.php'.'">XDebug admin page</a>';
602}
603print '<br>';
604
605
606// Modules for Payments
607$test = isModEnabled('stripe');
608if ($test) {
609 print '<br>';
610
611 print '<strong>'.$langs->trans("Stripe").'</strong>: ';
612 if (!getDolGlobalString('PAYMENT_SECURITY_TOKEN_UNIQUE')) {
613 print img_picto('', 'error').' '.$langs->trans("OptionXShouldBeEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Stripe"));
614 } else {
615 print img_picto('', 'tick').' '.$langs->trans("OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Stripe"));
616 }
617 print '<br>';
618} else {
619 $test = isModEnabled('paypal');
620 if ($test) {
621 print '<br>';
622
623 print '<strong>'.$langs->trans("Paypal").'</strong>: ';
624 if (!getDolGlobalString('PAYMENT_SECURITY_TOKEN_UNIQUE')) {
625 print img_picto('', 'error').' '.$langs->trans("OptionXShouldBeEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Paypal"));
626 } else {
627 print img_picto('', 'tick').' '.$langs->trans("OptionXIsCorrectlyEnabledInModuleY", $langs->transnoentities("SecurityTokenIsUnique"), $langs->transnoentities("Paypal"));
628 }
629 print '<br>';
630 }
631}
632
633print '</div>';
634
635
636// APIs
637
638print '<br>';
639print '<br>';
640print load_fiche_titre($langs->trans("API"), '', 'folder');
641
642print '<div class="divsection wordbreak">';
643
644if (!isModEnabled('api') && !isModEnabled('webservices')) {
645 print $langs->trans("APIsAreNotEnabled");
646} else {
647 if (isModEnabled('webservices')) {
648 print img_picto('', 'warning').' '.$langs->trans('YouEnableDeprecatedWSAPIsUseRESTAPIsInstead')."<br>\n";
649 print '<br>';
650 }
651 if (isModEnabled('api')) {
652 print '<strong>API_ENDPOINT_RULES</strong> = '.getDolGlobalString('API_ENDPOINT_RULES', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Example").': login:0,users:0,setup:1,status:1,tickets:1,...)</span>')."<br>\n";
653 }
654}
655
656print '<br>';
657
658print '<strong>API_DISABLE_LOGIN_API</strong> = '.getDolGlobalString('API_DISABLE_LOGIN_API', '0').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span><br>';
659
660print '</div>';
661
662
663print '<br>';
664print '<br>';
665
666
667print load_fiche_titre($langs->trans("OtherSetup"), '', 'folder');
668
669print '<div class="divsection wordbreak">';
670
671print '<strong>MAIN_ALLOW_SVG_FILES_AS_IMAGES</strong> = '.getDolGlobalString('MAIN_ALLOW_SVG_FILES_AS_IMAGES', '0').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 0)</span><br>';
672print '<br>';
673
674print '<strong>MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE</strong> = '.getDolGlobalString('MAIN_ALWAYS_CREATE_LOCK_AFTER_LAST_UPGRADE', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span><br>';
675print '<br>';
676
677print '<strong>MAIN_SECURITY_ANTI_SSRF_SERVER_IP</strong> = '.getDolGlobalString('MAIN_SECURITY_ANTI_SSRF_SERVER_IP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span> &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': List of static IPs of server separated with coma - '.$langs->trans("Note").': common loopback ip like 127.*.*.*, [::1] are already added)</span>')."<br>";
678print '<br>';
679
680print '<strong>MAIN_SECURITY_CSRF_WITH_TOKEN</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 2)</span>'."<br>";
681
682print '</div>';
683
684
685print '<br>';
686print '<br>';
687
688
689print load_fiche_titre($langs->trans("DatabaseEncryption"), '', 'folder');
690
691print '<div class="divsection wordbreak">';
692
693//print '<strong>'.$langs->trans("PasswordEncryption").'</strong>: ';
694print '<strong>'.$langs->trans("AlgorithmFor", $langs->transnoentitiesnoconv("Passwords")).' (non reversible encryption, defined into MAIN_SECURITY_HASH_ALGO)</strong> = '.getDolGlobalString('MAIN_SECURITY_HASH_ALGO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>')." &nbsp; ";
695if (!getDolGlobalString('MAIN_SECURITY_HASH_ALGO')) {
696 print '<span class="opacitymedium"> &nbsp; &nbsp; (If unset: \'md5\')</span>';
697}
698if (getDolGlobalString('MAIN_SECURITY_HASH_ALGO') != 'password_hash') {
699 print '<br><strong>MAIN_SECURITY_SALT</strong> = '.getDolGlobalString('MAIN_SECURITY_SALT', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').'<br>';
700} else {
701 print '<span class="opacitymedium">('.$langs->trans("Recommended").': password_hash)</span>';
702 print '<br>';
703}
704if (getDolGlobalString('MAIN_SECURITY_HASH_ALGO') != 'password_hash') {
705 print '<div class="info">The recommended value for MAIN_SECURITY_HASH_ALGO is now \'password_hash\' but setting it now will make ALL existing passwords of all users not valid, so update is not possible.<br>';
706 print 'If you really want to switch, you must:<br>';
707 print '- Go on home - setup - other and add constant MAIN_SECURITY_HASH_ALGO to value \'password_hash\'<br>';
708 print '- In same session, WITHOUT LOGGING OUT, go into your admin user record and set a new password<br>';
709 print '- You can now logout and login with this new password. You must now reset password of all other users.<br>';
710 print '</div>';
711}
712print '<br>';
713
714$action = GETPOST('action');
715$exampletodecrypt = GETPOST('exampletodecrypt', 'password');
716
717print '<strong>'.$langs->trans("AlgorithmFor", $langs->transnoentitiesnoconv("SensitiveData")).' (reversible encryption done with dolEncrypt/dolDecrypt)</strong> = '.constant('MAIN_SECURITY_REVERSIBLE_ALGO').' with key defined into conf.php file in $dolibarr_main_instance_unique_id<br>';
718print '<form method="POST" action="'.$_SERVER["PHP_SELF"].'">';
719print '<input type="hidden" name="action" value="doldecrypt">';
720print '<input type="hidden" name="token" value="'.newToken().'">';
721print '<input type="hidden" name="page_y" value="">';
722print $langs->trans("ToolToDecryptAString").': ';
723print '<input type="text" name="exampletodecrypt" placeholder="dolcrypt:ALGOXXXX:ABCDFEF1234" value="'.$exampletodecrypt.'">';
724print '<input type="submit" class="reposition button small smallpaddingimp" name="submit" value="'.$langs->transnoentitiesnoconv("Decrypt").'">';
725if ($action == 'doldecrypt' && $user->admin && $exampletodecrypt) {
726 usleep(200);
727 print ' => <textarea rows="'.ROWS_1.'" class="valignmiddle">'.dolPrintHTMLForTextArea(dolDecrypt($exampletodecrypt)).'</textarea>';
728}
729print '</form>';
730
731print '</div>';
732
733
734print '<br>';
735print '<br>';
736
737
738// Other - experimental
739
740print load_fiche_titre($langs->trans("OtherSetup").' ('.$langs->trans("Experimental").')', '', 'folder');
741
742print '<div class="divsection wordbreak">';
743print '<strong>MAIN_EXEC_USE_POPEN</strong> = ';
744if (!getDolGlobalString('MAIN_EXEC_USE_POPEN')) {
745 print '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>';
746} else {
747 print $conf->global->MAIN_EXEC_USE_POPEN;
748}
749if ($execmethod == 1) {
750 print '<span class="opacitymedium"> &nbsp; &nbsp; "exec" PHP method will be used for shell commands';
751 print ' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 1)';
752 print '</span>';
753}
754if ($execmethod == 2) {
755 print '<span class="opacitymedium"> &nbsp; &nbsp; "popen" PHP method will be used for shell commands';
756 print ' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 1)';
757 print '</span>';
758}
759print '<br>';
760print '<br>';
761
762print '<strong>MAIN_SECURITY_MAXFILESIZE_DOWNLOADED</strong> = '.getDolGlobalString('MAIN_SECURITY_MAXFILESIZE_DOWNLOADED', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': 100000000)</span>')."<br>";
763print '<br>';
764
765print '<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
766print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - does not work on HTML5 with some old libxml libs)</span>";
767
768// Test compatibility of MAIN_RESTRICTHTML_ONLY_VALID_HTML
769$savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
770$savMAIN_RESTRICTHTML_ONLY_VALID_HTML = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML');
771$savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
772$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
773$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 1;
774$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 0;
775$result = dol_htmlwithnojs('<img onerror<=alert(document.domain)> src=>0xbeefed');
776$conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
777$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
778$conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
779
780if ($result == 'InvalidHTMLStringCantBeCleaned') {
781 print ' &nbsp; - &nbsp; '.img_warning().' Your libxml seems to old to work correctly with this option. Disable it !';
782} else {
783 print ' &nbsp; - &nbsp; Test of compatibility with this option seems ok';
784}
785print '<br>';
786
787print '<br>';
788
789print '<strong>MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
790print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': 1)</span> &nbsp; - &nbsp; Module "php-tidy" must be enabled (currently: '.((extension_loaded('tidy') && class_exists("tidy")) ? 'Enabled' : img_picto('', 'warning').' Not available').")";
791if (extension_loaded('tidy') && class_exists("tidy")) {
792 // Test compatibility of MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY
793 $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES');
794 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML');
795 $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = getDolGlobalString('MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY');
796 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = 0;
797 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = 0;
798 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = 1;
799 $result = dol_htmlwithnojs('<img onerror<=alert(document.domain)> src=>0xbeefed');
800 $conf->global->MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES = $savMAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES;
801 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML;
802 $conf->global->MAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY = $savMAIN_RESTRICTHTML_ONLY_VALID_HTML_TIDY;
803
804 if ($result == 'InvalidHTMLStringCantBeCleaned') {
805 print ' &nbsp; - &nbsp; '.img_warning().' Your libxml seems to old to work correctly with this option. Disable it !';
806 } else {
807 print ' &nbsp; - &nbsp; Test of compatibility with this option seems ok';
808 }
809}
810print '<br>';
811
812print '<br>';
813
814print '<strong>MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES</strong> = '.(getDolGlobalString('MAIN_RESTRICTHTML_REMOVE_ALSO_BAD_ATTRIBUTES') ? '1' : '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
815print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1 - does not work on HTML5 with some old libxml libs)</span><br>";
816print '<br>';
817
818// MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = 1, disallow url links except if on /medias
819// MAIN_DISALLOW_URL_INTO_DESCRIPTIONS = 2, disallow all external urls link
820print '<strong>MAIN_DISALLOW_URL_INTO_DESCRIPTIONS</strong> = '.getDolGlobalString('MAIN_DISALLOW_URL_INTO_DESCRIPTIONS', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': 1=only local links allowed or 2=no links at all)</span>')."<br>";
821print '<br>';
822
823print '<strong>MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS</strong> = '.getDolGlobalString('MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
824print '<br>';
825
826// MAIN_ALLOW_LOCAL_LINKS_AS_EXTERNAL_LINKS
827
828print '<strong>MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL</strong> = '.getDolGlobalString('MAIN_SECURITY_CSRF_TOKEN_RENEWAL_ON_EACH_CALL', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
829print '<br>';
830
831print '<strong>MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED</strong> = '.getDolGlobalString('MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED', '<span class="opacitymedium">'.$langs->trans("Undefined").' &nbsp; ('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or").' 0)</span>')."<br>";
832print '<br>';
833
834$examplecsprule = "frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
835print '<strong>MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCECSPRO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "'.$examplecsprule.'")</span><br>';
836print '<br>';
837
838$examplecsprule = "frame-ancestors 'self'; img-src * data:; font-src *; default-src 'self' 'unsafe-inline' 'unsafe-eval' *.paypal.com *.stripe.com *.google.com *.googleapis.com *.google-analytics.com *.googletagmanager.com;";
839print '<strong>MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCECSP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "'.$examplecsprule.'")</span><br>';
840print '<br>';
841
842print '<strong>MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").' '.$langs->trans("or")." \"strict-origin-when-cross-origin\" so browser doesn't send any referrer when going into another web site domain)</span><br>";
843print '<br>';
844
845print '<strong>MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN</strong> = '.getDolGlobalString('MAIN_SECURITY_FORCE_ACCESS_CONTROL_ALLOW_ORIGIN', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").": 1)</span><br>";
846print '<br>';
847
848// For websites
849
850print '<strong>WEBSITE_MAIN_SECURITY_FORCECSPRO</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCECSPRO', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
851print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
852$examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
853print $examplecsprule;
854print '")</span><br>';
855print '<br>';
856
857print '<strong>WEBSITE_MAIN_SECURITY_FORCECSP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCECSP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>');
858print ' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").': "';
859$examplecsprule = "default-src 'self' 'unsafe-inline' matomo.".getDomainFromURL($_SERVER["SERVER_NAME"], 1)." *.transifex.net *.transifex.com *.cloudflare.com *.cloudflareinsights.com *.google-analytics.com *.googletagmanager.com *.google.com *.gstatic.com *.googleapis.com *.googleadservices.com *.ads-twitter.com *.doubleclick.net; frame-ancestors 'self'; object-src *.youtube.com; frame-src 'self' *.twitter.com *.facebook.com *.youtube.com; img-src * data:;";
860print $examplecsprule;
861print '")</span><br>';
862print '<br>';
863
864print '<strong>WEBSITE_MAIN_SECURITY_FORCERP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCERP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Recommended").': '.$langs->trans("Undefined").'="strict-origin-when-cross-origin" '.$langs->trans("or").' "same-origin"=more secured)</span><br>';
865print '<br>';
866
867print '<strong>WEBSITE_MAIN_SECURITY_FORCESTS</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCESTS', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"max-age=31536000; includeSubDomains\")</span><br>";
868print '<br>';
869
870print '<strong>WEBSITE_MAIN_SECURITY_FORCEPP</strong> = '.getDolGlobalString('WEBSITE_MAIN_SECURITY_FORCEPP', '<span class="opacitymedium">'.$langs->trans("Undefined").'</span>').' &nbsp; <span class="opacitymedium">('.$langs->trans("Example").": \"camera=(), microphone=(), geolocation=*\")</span><br>";
871
872print '</div>';
873
874
875print '<br>';
876
877
878print load_fiche_titre($langs->trans("LimitsAndMitigation"), '', 'folder');
879
880print '<div class="divsection wordbreak">';
881
882print '<span class="opacitymedium">';
883print $langs->trans("RecommendMitigationOnURL").'<br>';
884print '</span>';
885
886print '<br>';
887$urlexamplebase = 'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/fail2ban/filter.d/';
888print '<span class="fas fa-shield-alt"></span> Login or API authentication (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulesbruteforce.conf">fail2ban example on GitHub</a>)<br>';
889print '<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.'/passwordforgotten.php (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulespassforgotten.conf">fail2ban example on GitHub</a>)<br>';
890print '<span class="fas fa-shield-alt"></span> '.DOL_URL_ROOT.'/public/* (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-limitpublic.conf">fail2ban example on GitHub</a>)<br>';
891print '<br>';
892$urlexamplebase = 'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/apache/';
893print '<span class="fas fa-shield-alt"></span> You can also protect the application using a HTTP Basic authentication layer (see <a target="_blank" rel="noopener" href="'.$urlexamplebase.'virtualhost">apache2 virtualhost example on GitHub</a>)<br>';
894
895print '</div>';
896
897// End of page
898llxFooter();
899$db->close();
llxFooter
llxFooter($comment='', $zone='private', $disabledoutputofmessages=0)
Empty footer.
Definition wrapper.php:87
llxHeader
if(!defined('NOREQUIRESOC')) if(!defined( 'NOREQUIRETRAN')) if(!defined('NOTOKENRENEWAL')) if(!defined( 'NOREQUIREMENU')) if(!defined('NOREQUIREHTML')) if(!defined( 'NOREQUIREAJAX')) llxHeader($head='', $title='', $help_url='', $target='', $disablejs=0, $disablehead=0, $arrayofjs='', $arrayofcss='', $morequerystring='', $morecssonbody='', $replacemainareaby='', $disablenofollow=0, $disablenoindex=0)
Empty header.
Definition wrapper.php:71
Events
Events class.
Definition events.class.php:33
Form
Class to manage generation of HTML components Only common components must be here.
Definition html.form.class.php:57
dol_dir_list
dol_dir_list($utf8_path, $types="all", $recursive=0, $filter="", $excludefilter=null, $sortcriteria="name", $sortorder=SORT_ASC, $mode=0, $nohook=0, $relativename="", $donotfollowsymlinks=0, $nbsecondsold=0)
Scan a directory and return a list of files/directories.
Definition files.lib.php:63
version_php
version_php()
Return PHP version.
Definition functions2.lib.php:1874
load_fiche_titre
load_fiche_titre($title, $morehtmlright='', $picto='generic', $pictoisfullpath=0, $id='', $morecssontable='', $morehtmlcenter='')
Load a title with picto.
Definition functions.lib.php:6400
img_warning
img_warning($titlealt='default', $moreatt='', $morecss='pictowarning')
Show warning logo.
Definition functions.lib.php:5696
img_picto
img_picto($titlealt, $picto, $moreatt='', $pictoisfullpath=0, $srconly=0, $notitle=0, $alt='', $morecss='', $marginleftonlyshort=2)
Show picto whatever it's its name (generic function)
Definition functions.lib.php:5013
dolPrintHTMLForTextArea
dolPrintHTMLForTextArea($s, $allowiframe=0)
Return a string ready to be output on input textarea.
Definition functions.lib.php:2045
getDolGlobalInt
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
Definition functions.lib.php:243
yn
yn($yesno, $format=1, $color=0)
Return yes or no in current language.
Definition functions.lib.php:7816
GETPOST
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
Definition functions.lib.php:803
dol_htmlwithnojs
dol_htmlwithnojs($stringtoencode, $nouseofiframesandbox=0, $check='restricthtml')
Sanitize a HTML to remove js, dangerous content and external link.
Definition functions.lib.php:8437
getDolGlobalString
getDolGlobalString($key, $default='')
Return a Dolibarr global constant string value.
Definition functions.lib.php:228
$conf
global $conf
The following vars must be defined: $type2label $form $conf, $lang, The following vars may also be de...
Definition member.php:79
dol_getwebuser
dol_getwebuser($mode)
Return user/group account of web server.
Definition security2.lib.php:37
dolDecrypt
dolDecrypt($chain, $key='')
Decode a string with a symmetric encryption.
Definition security.lib.php:185
accessforbidden
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.
Definition security.lib.php:1233
Generated on Wed Jan 1 2025 01:00:22 for dolibarr by Doxygen 1.11.0