security_other.php 8.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246
  1. <?php
  2. /* Copyright (C) 2004-2013 Laurent Destailleur <eldy@users.sourceforge.net>
  3. * Copyright (C) 2005-2012 Regis Houssin <regis.houssin@inodbox.com>
  4. * Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es>
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation; either version 3 of the License, or
  9. * (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with this program. If not, see <https://www.gnu.org/licenses/>.
  18. */
  19. /**
  20. * \file htdocs/admin/security_other.php
  21. * \ingroup core
  22. * \brief Security options setup
  23. */
  24. // Load Dolibarr environment
  25. require '../main.inc.php';
  26. require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
  27. require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
  28. require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
  29. // Load translation files required by the page
  30. $langs->loadLangs(array("users", "admin", "other"));
  31. if (!$user->admin) {
  32. accessforbidden();
  33. }
  34. $action = GETPOST('action', 'aZ09');
  35. /*
  36. * Actions
  37. */
  38. if (preg_match('/set_([a-z0-9_\-]+)/i', $action, $reg)) {
  39. $code = $reg[1];
  40. $value = (GETPOST($code, 'alpha') ? GETPOST($code, 'alpha') : 1);
  41. if (dolibarr_set_const($db, $code, $value, 'chaine', 0, '', $conf->entity) > 0) {
  42. Header("Location: ".$_SERVER["PHP_SELF"]);
  43. exit;
  44. } else {
  45. dol_print_error($db);
  46. }
  47. } elseif (preg_match('/del_([a-z0-9_\-]+)/i', $action, $reg)) {
  48. $code = $reg[1];
  49. if (dolibarr_del_const($db, $code, $conf->entity) > 0) {
  50. Header("Location: ".$_SERVER["PHP_SELF"]);
  51. exit;
  52. } else {
  53. dol_print_error($db);
  54. }
  55. } elseif ($action == 'updateform') {
  56. $res1 = 1;
  57. $res2 = 1;
  58. $res3 = 1;
  59. $res4 = 1;
  60. $res5 = 1;
  61. if (GETPOSTISSET('MAIN_APPLICATION_TITLE')) {
  62. $res1 = dolibarr_set_const($db, "MAIN_APPLICATION_TITLE", GETPOST("MAIN_APPLICATION_TITLE", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
  63. }
  64. if (GETPOSTISSET('MAIN_SESSION_TIMEOUT')) {
  65. $res2 = dolibarr_set_const($db, "MAIN_SESSION_TIMEOUT", GETPOST("MAIN_SESSION_TIMEOUT", 'alphanohtml'), 'chaine', 0, '', $conf->entity);
  66. }
  67. if (GETPOSTISSET('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT')) {
  68. $res3 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", GETPOST("MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT", 'alphanohtml'), 'int', 0, '', $conf->entity);
  69. }
  70. if (GETPOSTISSET('MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS')) {
  71. $res4 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", GETPOST("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 'alphanohtml'), 'int', 0, '', $conf->entity);
  72. }
  73. if (GETPOSTISSET('MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS')) {
  74. $res5 = dolibarr_set_const($db, "MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", GETPOST("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 'alphanohtml'), 'int', 0, '', $conf->entity);
  75. }
  76. if ($res1 && $res2 && $res3 && $res4 && $res5) {
  77. setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
  78. }
  79. }
  80. /*
  81. * View
  82. */
  83. $form = new Form($db);
  84. $wikihelp = 'EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad';
  85. llxHeader('', $langs->trans("Miscellaneous"), $wikihelp);
  86. print load_fiche_titre($langs->trans("SecuritySetup"), '', 'title_setup');
  87. print '<span class="opacitymedium">'.$langs->trans("MiscellaneousDesc")."</span><br>\n";
  88. print "<br>\n";
  89. print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
  90. print '<input type="hidden" name="token" value="'.newToken().'">';
  91. print '<input type="hidden" name="action" value="updateform">';
  92. $head = security_prepare_head();
  93. print dol_get_fiche_head($head, 'misc', '', -1);
  94. print '<br>';
  95. // Other Options
  96. print '<table class="noborder centpercent">';
  97. print '<tr class="liste_titre">';
  98. print '<td colspan="3">'.$langs->trans("Parameters").'</td>';
  99. print '<td class="right" width="100">'.$langs->trans("Status").'</td>';
  100. print '</tr>';
  101. // Enable Captcha code
  102. print '<tr class="oddeven">';
  103. print '<td colspan="3">'.$langs->trans("UseCaptchaCode").'</td>';
  104. print '<td class="right">';
  105. if (function_exists("imagecreatefrompng")) {
  106. if (!empty($conf->use_javascript_ajax)) {
  107. print ajax_constantonoff('MAIN_SECURITY_ENABLECAPTCHA');
  108. } else {
  109. if (!getDolGlobalString('MAIN_SECURITY_ENABLECAPTCHA')) {
  110. print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_SECURITY_ENABLECAPTCHA&token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
  111. } else {
  112. print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_SECURITY_ENABLECAPTCHA&token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
  113. }
  114. }
  115. } else {
  116. $desc = $form->textwithpicto('', $langs->transnoentities("EnableGDLibraryDesc"), 1, 'warning');
  117. print $desc;
  118. }
  119. print '</td></tr>';
  120. // Enable advanced perms
  121. print '<tr class="oddeven">';
  122. print '<td colspan="3">'.$langs->trans("UseAdvancedPerms").'</td>';
  123. print '<td class="right">';
  124. if (!empty($conf->use_javascript_ajax)) {
  125. print ajax_constantonoff('MAIN_USE_ADVANCED_PERMS');
  126. } else {
  127. if (!getDolGlobalString('MAIN_USE_ADVANCED_PERMS')) {
  128. print '<a href="'.$_SERVER['PHP_SELF'].'?action=set_MAIN_USE_ADVANCED_PERMS&token='.newToken().'">'.img_picto($langs->trans("Disabled"), 'off').'</a>';
  129. } else {
  130. print '<a href="'.$_SERVER['PHP_SELF'].'?action=del_MAIN_USE_ADVANCED_PERMS&token='.newToken().'">'.img_picto($langs->trans("Enabled"), 'on').'</a>';
  131. }
  132. }
  133. print "</td></tr>";
  134. print '</table>';
  135. print '<br>';
  136. // Timeout
  137. print '<table width="100%" class="noborder">';
  138. print '<tr class="liste_titre">';
  139. print '<td colspan="2">'.$langs->trans("Parameters").'</td>';
  140. print '<td>'.$langs->trans("Value").'</td>';
  141. print "</tr>\n";
  142. $sessiontimeout = ini_get("session.gc_maxlifetime");
  143. if (!getDolGlobalString('MAIN_SESSION_TIMEOUT')) {
  144. $conf->global->MAIN_SESSION_TIMEOUT = $sessiontimeout;
  145. }
  146. print '<tr class="oddeven">';
  147. print '<td>'.$langs->trans("SessionTimeOut").'</td><td class="right">';
  148. if (ini_get("session.gc_probability") == 0) {
  149. print $form->textwithpicto('', $langs->trans("SessionsPurgedByExternalSystem", ini_get("session.gc_maxlifetime")));
  150. } else {
  151. print $form->textwithpicto('', $langs->trans("SessionExplanation", ini_get("session.gc_probability"), ini_get("session.gc_divisor"), ini_get("session.gc_maxlifetime")));
  152. }
  153. print '</td>';
  154. print '<td class="nowrap">';
  155. print '<input class="flat right width50" name="MAIN_SESSION_TIMEOUT" type="text" value="'.getDolGlobalInt('MAIN_SESSION_TIMEOUT').'"> '.strtolower($langs->trans("Seconds"));
  156. print '</td>';
  157. print '</tr>';
  158. print '<tr class="oddeven">';
  159. print '<td>'.$langs->trans("MaxNumberOfImagesInGetPost").'</td><td class="right">';
  160. print '</td>';
  161. print '<td class="nowrap">';
  162. print '<input class="flat right width50" name="MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT" type="text" value="'.getDolGlobalInt('MAIN_SECURITY_MAX_IMG_IN_HTML_CONTENT').'"> '.strtolower($langs->trans("Images"));
  163. print '</td>';
  164. print '</tr>';
  165. print '<tr class="oddeven">';
  166. print '<td>'.$langs->trans("MaxNumberOfPostOnPublicPagesByIP").'</td><td class="right">';
  167. print '</td>';
  168. print '<td class="nowrap">';
  169. print '<input class="flat right width50" name="MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_POST_ON_PUBLIC_PAGES_BY_IP_ADDRESS", 200).'"> '.strtolower($langs->trans("Posts"));
  170. print '</td>';
  171. print '</tr>';
  172. print '<tr class="oddeven">';
  173. print '<td>'.$langs->trans("MaxNumberOfAttachementOnForms").'</td><td class="right">';
  174. print '</td>';
  175. print '<td class="nowrap">';
  176. print '<input class="flat right width50" name="MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_ATTACHMENT_ON_FORMS", 10).'"> '.strtolower($langs->trans("Files"));
  177. print '</td>';
  178. print '</tr>';
  179. print '<tr class="oddeven">';
  180. print '<td>'.$langs->trans("MaxNumberOfFailedAuth").'</td><td class="right">';
  181. print '</td>';
  182. print '<td class="nowrap">';
  183. print '<input class="flat right width50" name="MAIN_SECURITY_MAX_NUMBER_FAILED_AUTH" type="text" value="'.getDolGlobalInt("MAIN_SECURITY_MAX_NUMBER_FAILED_AUTH", 100).'"> '.$langs->trans("FailedAuth");
  184. print '</td>';
  185. print '</tr>';
  186. /*
  187. if (empty($conf->global->MAIN_APPLICATION_TITLE)) {
  188. $conf->global->MAIN_APPLICATION_TITLE = "";
  189. }
  190. print '<tr class="oddeven">';
  191. print '<td>'.$langs->trans("MAIN_APPLICATION_TITLE").'</td><td class="right">';
  192. print '</td>';
  193. print '<td class="nowrap">';
  194. print '<input class="flat" name="MAIN_APPLICATION_TITLE" type="text" size="20" value="'.dol_escape_htmltag($conf->global->MAIN_APPLICATION_TITLE).'"> ';
  195. print '</td>';
  196. print '</tr>';
  197. */
  198. print '</table>';
  199. print $form->buttonsSaveCancel("Modify", '');
  200. print dol_get_fiche_end();
  201. print '</form>';
  202. // End of page
  203. llxFooter();
  204. $db->close();