security.php 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501
  1. <?php
  2. /* Copyright (C) 2004-2022 Laurent Destailleur <eldy@users.sourceforge.net>
  3. * Copyright (C) 2005-2007 Regis Houssin <regis.houssin@inodbox.com>
  4. * Copyright (C) 2013-2015 Juanjo Menent <jmenent@2byte.es>
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation; either version 3 of the License, or
  9. * (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with this program. If not, see <https://www.gnu.org/licenses/>.
  18. */
  19. /**
  20. * \file htdocs/admin/security.php
  21. * \ingroup setup
  22. * \brief Page de configuration du module securite
  23. */
  24. // Load Dolibarr environment
  25. require '../main.inc.php';
  26. require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
  27. require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
  28. $action = GETPOST('action', 'aZ09');
  29. // Load translation files required by the page
  30. $langs->loadLangs(array("users", "admin", "other"));
  31. if (!$user->admin) {
  32. accessforbidden();
  33. }
  34. // Allow/Disallow change to clear passwords once passwords are crypted
  35. $allow_disable_encryption = true;
  36. /*
  37. * Actions
  38. */
  39. if ($action == 'setgeneraterule') {
  40. if (!dolibarr_set_const($db, 'USER_PASSWORD_GENERATED', GETPOST("value", "alphanohtml"), 'chaine', 0, '', $conf->entity)) {
  41. dol_print_error($db);
  42. }
  43. }
  44. if ($action == 'activate_encrypt') {
  45. $error = 0;
  46. $db->begin();
  47. // On old version, a bug created the constant into user entity, so we delete it to be sure such entry won't exists. We want it in entity 0 or nowhere.
  48. dolibarr_del_const($db, "DATABASE_PWD_ENCRYPTED", $conf->entity);
  49. // We set entity=0 (all) because DATABASE_PWD_ENCRYPTED is a setup into conf file, so always shared for everybody
  50. $entityforall = 0;
  51. dolibarr_set_const($db, "DATABASE_PWD_ENCRYPTED", "1", 'chaine', 0, '', $entityforall);
  52. $sql = "SELECT u.rowid, u.pass, u.pass_crypted";
  53. $sql .= " FROM ".MAIN_DB_PREFIX."user as u";
  54. $sql .= " WHERE u.pass IS NOT NULL AND LENGTH(u.pass) < 32"; // Not a MD5 value
  55. $resql = $db->query($sql);
  56. if ($resql) {
  57. $numrows = $db->num_rows($resql);
  58. $i = 0;
  59. while ($i < $numrows) {
  60. $obj = $db->fetch_object($resql);
  61. if (dol_hash($obj->pass)) {
  62. $sql = "UPDATE ".MAIN_DB_PREFIX."user";
  63. $sql .= " SET pass_crypted = '".dol_hash($obj->pass)."', pass = NULL";
  64. $sql .= " WHERE rowid=".((int) $obj->rowid);
  65. //print $sql;
  66. $resql2 = $db->query($sql);
  67. if (!$resql2) {
  68. dol_print_error($db);
  69. $error++;
  70. break;
  71. }
  72. $i++;
  73. }
  74. }
  75. } else {
  76. dol_print_error($db);
  77. }
  78. //print $error." ".$sql;
  79. //exit;
  80. if (!$error) {
  81. $db->commit();
  82. } else {
  83. $db->rollback();
  84. dol_print_error($db, '');
  85. }
  86. } elseif ($action == 'disable_encrypt') {
  87. //On n'autorise pas l'annulation de l'encryption car les mots de passe ne peuvent pas etre decodes
  88. //Do not allow "disable encryption" as passwords cannot be decrypted
  89. if ($allow_disable_encryption) {
  90. dolibarr_del_const($db, "DATABASE_PWD_ENCRYPTED", $conf->entity);
  91. }
  92. }
  93. if ($action == 'activate_encryptdbpassconf') {
  94. $result = encodedecode_dbpassconf(1);
  95. if ($result > 0) {
  96. sleep(3); // Don't know why but we need to wait file is completely saved before making the reload. Even with flush and clearstatcache, we need to wait.
  97. // database value not required
  98. //dolibarr_set_const($db, "MAIN_DATABASE_PWD_CONFIG_ENCRYPTED", "1");
  99. header("Location: security.php");
  100. exit;
  101. } else {
  102. setEventMessages($langs->trans('InstrucToEncodePass', dol_encode($dolibarr_main_db_pass)), null, 'warnings');
  103. }
  104. } elseif ($action == 'disable_encryptdbpassconf') {
  105. $result = encodedecode_dbpassconf(0);
  106. if ($result > 0) {
  107. sleep(3); // Don't know why but we need to wait file is completely saved before making the reload. Even with flush and clearstatcache, we need to wait.
  108. // database value not required
  109. //dolibarr_del_const($db, "MAIN_DATABASE_PWD_CONFIG_ENCRYPTED",$conf->entity);
  110. header("Location: security.php");
  111. exit;
  112. } else {
  113. //setEventMessages($langs->trans('InstrucToClearPass', $dolibarr_main_db_pass), null, 'warnings');
  114. setEventMessages($langs->trans('InstrucToClearPass', $langs->transnoentitiesnoconv("DatabasePassword")), null, 'warnings');
  115. }
  116. }
  117. if ($action == 'activate_MAIN_SECURITY_DISABLEFORGETPASSLINK') {
  118. dolibarr_set_const($db, "MAIN_SECURITY_DISABLEFORGETPASSLINK", '1', 'chaine', 0, '', $conf->entity);
  119. } elseif ($action == 'disable_MAIN_SECURITY_DISABLEFORGETPASSLINK') {
  120. dolibarr_del_const($db, "MAIN_SECURITY_DISABLEFORGETPASSLINK", $conf->entity);
  121. }
  122. if ($action == 'updatepattern') {
  123. $pattern = GETPOST("pattern", "alpha");
  124. $explodePattern = explode(';', $pattern);
  125. $patternInError = false;
  126. if ($explodePattern[0] < 1 || $explodePattern[4] < 0) {
  127. $patternInError = true;
  128. }
  129. if ($explodePattern[0] < $explodePattern[1] + $explodePattern[2] + $explodePattern[3]) {
  130. $patternInError = true;
  131. }
  132. if (!$patternInError) {
  133. dolibarr_set_const($db, "USER_PASSWORD_PATTERN", $pattern, 'chaine', 0, '', $conf->entity);
  134. setEventMessages($langs->trans("SetupSaved"), null, 'mesgs');
  135. header("Location: security.php");
  136. exit;
  137. }
  138. }
  139. /*
  140. * View
  141. */
  142. $form = new Form($db);
  143. $wikihelp = 'EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad';
  144. llxHeader('', $langs->trans("Passwords"), $wikihelp);
  145. print load_fiche_titre($langs->trans("SecuritySetup"), '', 'title_setup');
  146. print '<span class="opacitymedium">'.$langs->trans("GeneratedPasswordDesc")."</span><br>\n";
  147. print "<br>\n";
  148. $head = security_prepare_head();
  149. print dol_get_fiche_head($head, 'passwords', '', -1);
  150. print '<br>';
  151. // Select manager to generate passwords
  152. print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
  153. print '<input type="hidden" name="token" value="'.newToken().'">';
  154. print '<input type="hidden" name="action" value="update">';
  155. print '<input type="hidden" name="constname" value="USER_PASSWORD_GENERATED">';
  156. print '<input type="hidden" name="consttype" value="yesno">';
  157. // Charge tableau des modules generation
  158. $dir = "../core/modules/security/generate";
  159. clearstatcache();
  160. $handle = opendir($dir);
  161. $i = 1;
  162. if (is_resource($handle)) {
  163. while (($file = readdir($handle)) !== false) {
  164. if (preg_match('/(modGeneratePass[a-z]+)\.class\.php$/i', $file, $reg)) {
  165. // Charging the numbering class
  166. $classname = $reg[1];
  167. require_once $dir.'/'.$file;
  168. $obj = new $classname($db, $conf, $langs, $user);
  169. $arrayhandler[$obj->id] = $obj;
  170. $i++;
  171. }
  172. }
  173. closedir($handle);
  174. }
  175. asort($arrayhandler);
  176. print '<div class="div-table-responsive-no-min">';
  177. print '<table class="noborder centpercent">';
  178. print '<tr class="liste_titre">';
  179. print '<td colspan="2">'.$langs->trans("RuleForGeneratedPasswords").'</td>';
  180. print '<td>'.$langs->trans("Example").'</td>';
  181. print '<td class="center">'.$langs->trans("Activated").'</td>';
  182. print '</tr>';
  183. $tabConf = explode(";", getDolGlobalString('USER_PASSWORD_PATTERN'));
  184. foreach ($arrayhandler as $key => $module) {
  185. // Show modules according to features level
  186. if (!empty($module->version) && $module->version == 'development' && $conf->global->MAIN_FEATURES_LEVEL < 2) {
  187. continue;
  188. }
  189. if (!empty($module->version) && $module->version == 'experimental' && $conf->global->MAIN_FEATURES_LEVEL < 1) {
  190. continue;
  191. }
  192. if ($module->isEnabled()) {
  193. print '<tr class="oddeven"><td>';
  194. print img_picto('', $module->picto, 'class="width25 size15x"').' ';
  195. print ucfirst($key);
  196. print "</td><td>\n";
  197. print $module->getDescription().'<br>';
  198. print $langs->trans("MinLength").': <span class="opacitymedium">'.$module->length.'</span>';
  199. print '</td>';
  200. // Show example of numbering module
  201. print '<td class="nowraponall">';
  202. $tmp = $module->getExample();
  203. if (preg_match('/^Error/', $tmp)) {
  204. $langs->load("errors");
  205. print '<div class="error">'.$langs->trans($tmp).'</div>';
  206. } elseif ($tmp == 'NotConfigured') {
  207. print '<span class="opacitymedium">'.$langs->trans($tmp).'</span>';
  208. } else {
  209. print '<span class="opacitymedium">'.$tmp.'</span>';
  210. }
  211. print '</td>'."\n";
  212. print '<td class="center">';
  213. if ($conf->global->USER_PASSWORD_GENERATED == $key) {
  214. //print img_picto('', 'tick');
  215. print img_picto($langs->trans("Enabled"), 'switch_on');
  216. } else {
  217. print '<a href="'.$_SERVER['PHP_SELF'].'?action=setgeneraterule&token='.newToken().'&value='.$key.'">';
  218. //print $langs->trans("Activate");
  219. print img_picto($langs->trans("Disabled"), 'switch_off');
  220. print '</a>';
  221. }
  222. print "</td></tr>\n";
  223. }
  224. }
  225. print '</table>';
  226. print '</div>';
  227. print '</form>';
  228. // Pattern for Password Perso
  229. if (getDolGlobalString('USER_PASSWORD_GENERATED') == "Perso") {
  230. print '<br>';
  231. print '<div class="div-table-responsive-no-min">';
  232. print '<table class="noborder centpercent">';
  233. print '<tr class="liste_titre">';
  234. print '<td colspan="2"> '.$langs->trans("PasswordPatternDesc").'</td>';
  235. print '</tr>';
  236. print '<tr class="oddeven">';
  237. print '<td>'.$langs->trans("MinLength")."</td>";
  238. print '<td><input type="number" value="'.$tabConf[0].'" id="minlenght" min="1"></td>';
  239. print '</tr>';
  240. print '<tr class="oddeven">';
  241. print '<td>'.$langs->trans("NbMajMin")."</td>";
  242. print '<td><input type="number" value="'.$tabConf[1].'" id="NbMajMin" min="0"></td>';
  243. print '</tr>';
  244. print '<tr class="oddeven">';
  245. print '<td>'.$langs->trans("NbNumMin")."</td>";
  246. print '<td><input type="number" value="'.$tabConf[2].'" id="NbNumMin" min="0"></td>';
  247. print '</tr>';
  248. print '<tr class="oddeven">';
  249. print '<td>'.$langs->trans("NbSpeMin")."</td>";
  250. print '<td><input type="number" value="'.$tabConf[3].'" id="NbSpeMin" min="0"></td>';
  251. print '</tr>';
  252. print '<tr class="oddeven">';
  253. print '<td>'.$langs->trans("NbIteConsecutive")."</td>";
  254. print '<td><input type="number" value="'.$tabConf[4].'" id="NbIteConsecutive" min="0"></td>';
  255. print '</tr>';
  256. print '<tr class="oddeven">';
  257. print '<td>'.$langs->trans("NoAmbiCaracAutoGeneration")."</td>";
  258. print '<td><input type="checkbox" id="NoAmbiCaracAutoGeneration" '.($tabConf[5] ? "checked" : "").' min="0"> <label for="NoAmbiCaracAutoGeneration" id="textcheckbox">'.($tabConf[5] ? $langs->trans("Activated") : $langs->trans("Disabled")).'</label></td>';
  259. print '</tr>';
  260. print '</table>';
  261. print '<div class="center">';
  262. print '<a class="button button-save" id="linkChangePattern">'.$langs->trans("Save").'</a>';
  263. print '</div>';
  264. print '<br><br>';
  265. print '<script type="text/javascript">';
  266. print ' function getStringArg(){';
  267. print ' var pattern = "";';
  268. print ' pattern += $("#minlenght").val() + ";";';
  269. print ' pattern += $("#NbMajMin").val() + ";";';
  270. print ' pattern += $("#NbNumMin").val() + ";";';
  271. print ' pattern += $("#NbSpeMin").val() + ";";';
  272. print ' pattern += $("#NbIteConsecutive").val() + ";";';
  273. print ' pattern += $("#NoAmbiCaracAutoGeneration")[0].checked ? "1" : "0";';
  274. print ' return pattern;';
  275. print ' }';
  276. print ' function valuePossible(){';
  277. print ' var fields = ["#minlenght", "#NbMajMin", "#NbNumMin", "#NbSpeMin", "#NbIteConsecutive"];';
  278. print ' for(var i = 0 ; i < fields.length ; i++){';
  279. print ' if($(fields[i]).val() < $(fields[i]).attr("min")){';
  280. print ' return false;';
  281. print ' }';
  282. print ' }';
  283. print ' ';
  284. print ' var length = parseInt($("#minlenght").val());';
  285. print ' var length_mini = parseInt($("#NbMajMin").val()) + parseInt($("#NbNumMin").val()) + parseInt($("#NbSpeMin").val());';
  286. print ' return length >= length_mini;';
  287. print ' }';
  288. print ' function generatelink(){';
  289. print ' return "security.php?action=updatepattern&token='.newToken().'&pattern="+getStringArg();';
  290. print ' }';
  291. print ' function valuePatternChange(){';
  292. print ' console.log("valuePatternChange");';
  293. print ' var lang_save = "'.$langs->trans("Save").'";';
  294. print ' var lang_error = "'.$langs->trans("Error").'";';
  295. print ' var lang_Disabled = "'.$langs->trans("Disabled").'";';
  296. print ' var lang_Activated = "'.$langs->trans("Activated").'";';
  297. print ' $("#textcheckbox").html($("#NoAmbiCaracAutoGeneration")[0].checked ? unescape(lang_Activated) : unescape(lang_Disabled));';
  298. print ' if(valuePossible()){';
  299. print ' $("#linkChangePattern").attr("href",generatelink()).text(lang_save);';
  300. print ' }';
  301. print ' else{';
  302. print ' $("#linkChangePattern").attr("href", null).text(lang_error);';
  303. print ' }';
  304. print ' }';
  305. print ' $("#minlenght").change(function(){valuePatternChange();});';
  306. print ' $("#NbMajMin").change(function(){valuePatternChange();});';
  307. print ' $("#NbNumMin").change(function(){valuePatternChange();});';
  308. print ' $("#NbSpeMin").change(function(){valuePatternChange();});';
  309. print ' $("#NbIteConsecutive").change(function(){valuePatternChange();});';
  310. print ' $("#NoAmbiCaracAutoGeneration").change(function(){valuePatternChange();});';
  311. print '</script>';
  312. }
  313. // Crypt passwords in database
  314. print '<br>';
  315. print '<form method="post" action="'.$_SERVER["PHP_SELF"].'">';
  316. print '<input type="hidden" name="token" value="'.newToken().'">';
  317. print '<input type="hidden" name="action" value="encrypt">';
  318. print '<table class="noborder centpercent">';
  319. print '<tr class="liste_titre">';
  320. print '<td colspan="3">'.$langs->trans("Parameters").'</td>';
  321. print '<td class="center">'.$langs->trans("Activated").'</td>';
  322. print '<td class="center"></td>';
  323. print '</tr>';
  324. // Disable clear password in database
  325. print '<tr class="oddeven">';
  326. print '<td colspan="3">'.$langs->trans("DoNotStoreClearPassword").'</td>';
  327. print '<td class="center" width="60">';
  328. if (getDolGlobalString('DATABASE_PWD_ENCRYPTED')) {
  329. print img_picto($langs->trans("Active"), 'tick');
  330. }
  331. print '</td>';
  332. if (!getDolGlobalString('DATABASE_PWD_ENCRYPTED')) {
  333. print '<td class="center" width="100">';
  334. print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=activate_encrypt&token='.newToken().'">'.$langs->trans("Activate").'</a>';
  335. print "</td>";
  336. }
  337. // Database conf file encryption
  338. if (getDolGlobalString('DATABASE_PWD_ENCRYPTED')) {
  339. print '<td class="center" width="100">';
  340. if ($allow_disable_encryption) {
  341. //On n'autorise pas l'annulation de l'encryption car les mots de passe ne peuvent pas etre decodes
  342. //Do not allow "disable encryption" as passwords cannot be decrypted
  343. print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=disable_encrypt&token='.newToken().'">'.$langs->trans("Disable").'</a>';
  344. } else {
  345. print '-';
  346. }
  347. print "</td>";
  348. }
  349. print "</td>";
  350. print '</tr>';
  351. // Crypt password into config file conf.php
  352. print '<tr class="oddeven">';
  353. print '<td colspan="3">'.$langs->trans("MainDbPasswordFileConfEncrypted").'</td>';
  354. print '<td align="center" width="60">';
  355. if (preg_match('/crypted:/i', $dolibarr_main_db_pass) || !empty($dolibarr_main_db_encrypted_pass)) {
  356. print img_picto($langs->trans("Active"), 'tick');
  357. }
  358. print '</td>';
  359. print '<td class="center" width="100">';
  360. if (empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass)) {
  361. $langs->load("errors");
  362. print img_warning($langs->trans("WarningPassIsEmpty"));
  363. } else {
  364. if (empty($dolibarr_main_db_encrypted_pass)) {
  365. print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=activate_encryptdbpassconf&token='.newToken().'">'.$langs->trans("Activate").'</a>';
  366. }
  367. if (!empty($dolibarr_main_db_encrypted_pass)) {
  368. print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=disable_encryptdbpassconf&token='.newToken().'">'.$langs->trans("Disable").'</a>';
  369. }
  370. }
  371. print "</td>";
  372. print "</td>";
  373. print '</tr>';
  374. // Disable link "Forget password" on logon
  375. print '<tr class="oddeven">';
  376. print '<td colspan="3">'.$langs->trans("DisableForgetPasswordLinkOnLogonPage").'</td>';
  377. print '<td class="center" width="60">';
  378. if (getDolGlobalString('MAIN_SECURITY_DISABLEFORGETPASSLINK')) {
  379. print img_picto($langs->trans("Active"), 'tick');
  380. }
  381. print '</td>';
  382. if (!getDolGlobalString('MAIN_SECURITY_DISABLEFORGETPASSLINK')) {
  383. print '<td class="center" width="100">';
  384. print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=activate_MAIN_SECURITY_DISABLEFORGETPASSLINK&token='.newToken().'">'.$langs->trans("Activate").'</a>';
  385. print "</td>";
  386. }
  387. if (getDolGlobalString('MAIN_SECURITY_DISABLEFORGETPASSLINK')) {
  388. print '<td center="center" width="100">';
  389. print '<a class="reposition" href="'.$_SERVER["PHP_SELF"].'?action=disable_MAIN_SECURITY_DISABLEFORGETPASSLINK&token='.newToken().'">'.$langs->trans("Disable").'</a>';
  390. print "</td>";
  391. }
  392. print "</td>";
  393. print '</tr>';
  394. print '</table>';
  395. print '</form>';
  396. print '<br>';
  397. if (GETPOST('info', 'int') > 0) {
  398. if (function_exists('password_hash')) {
  399. print $langs->trans("Note: The function password_hash exists on your PHP")."<br>\n";
  400. } else {
  401. print $langs->trans("Note: The function password_hash does not exists on your PHP")."<br>\n";
  402. }
  403. print 'MAIN_SECURITY_HASH_ALGO = '.getDolGlobalString('MAIN_SECURITY_HASH_ALGO')."<br>\n";
  404. print 'MAIN_SECURITY_SALT = '.getDolGlobalString('MAIN_SECURITY_SALT')."<br>\n";
  405. }
  406. print '</div>';
  407. // End of page
  408. llxFooter();
  409. $db->close();