security_file.php 7.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204
  1. <?php
  2. /* Copyright (C) 2004-2017 Laurent Destailleur <eldy@users.sourceforge.net>
  3. * Copyright (C) 2005-2017 Regis Houssin <regis.houssin@inodbox.com>
  4. * Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es>
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation; either version 3 of the License, or
  9. * (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with this program. If not, see <https://www.gnu.org/licenses/>.
  18. */
  19. /**
  20. * \file htdocs/admin/security_file.php
  21. * \ingroup core
  22. * \brief Security options setup
  23. */
  24. require '../main.inc.php';
  25. require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
  26. require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
  27. require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
  28. // Load translation files required by the page
  29. $langs->loadLangs(array('users', 'admin', 'other'));
  30. if (!$user->admin) {
  31. accessforbidden();
  32. }
  33. $action = GETPOST('action', 'aZ09');
  34. $sortfield = GETPOST('sortfield', 'aZ09');
  35. $sortorder = GETPOST('sortorder', 'aZ09');
  36. if (empty($sortfield)) {
  37. $sortfield = 'date';
  38. }
  39. if (empty($sortorder)) {
  40. $sortorder = 'desc';
  41. }
  42. $upload_dir = $conf->admin->dir_temp;
  43. /*
  44. * Actions
  45. */
  46. if (GETPOST('sendit') && !empty($conf->global->MAIN_UPLOAD_DOC)) {
  47. require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
  48. dol_add_file_process($upload_dir, 1, 0, 'userfile');
  49. }
  50. if ($action == 'updateform') {
  51. $antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe
  52. $antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib"
  53. $antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&")); // Sanitize command
  54. $antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&")); // Sanitize params
  55. $res3 = dolibarr_set_const($db, 'MAIN_UPLOAD_DOC', GETPOST('MAIN_UPLOAD_DOC', 'alpha'), 'chaine', 0, '', $conf->entity);
  56. $res4 = dolibarr_set_const($db, "MAIN_UMASK", GETPOST('MAIN_UMASK', 'alpha'), 'chaine', 0, '', $conf->entity);
  57. $res5 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand), 'chaine', 0, '', $conf->entity);
  58. $res6 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam), 'chaine', 0, '', $conf->entity);
  59. if ($res3 && $res4 && $res5 && $res6) {
  60. setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
  61. }
  62. } elseif ($action == 'deletefile') {
  63. // Delete file
  64. $langs->load("other");
  65. $file = $conf->admin->dir_temp.'/'.GETPOST('urlfile', 'alpha');
  66. $ret = dol_delete_file($file);
  67. if ($ret) {
  68. setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile', 'alpha')), null, 'mesgs');
  69. } else {
  70. setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile', 'alpha')), null, 'errors');
  71. }
  72. }
  73. /*
  74. * View
  75. */
  76. $form = new Form($db);
  77. $wikihelp = 'EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad';
  78. llxHeader('', $langs->trans("Files"), $wikihelp);
  79. print load_fiche_titre($langs->trans("SecuritySetup"), '', 'title_setup');
  80. print '<span class="opacitymedium">'.$langs->trans("SecurityFilesDesc")."</span><br>\n";
  81. print "<br>\n";
  82. print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
  83. print '<input type="hidden" name="token" value="'.newToken().'">';
  84. print '<input type="hidden" name="action" value="updateform">';
  85. $head = security_prepare_head();
  86. print dol_get_fiche_head($head, 'file', '', -1);
  87. print '<br>';
  88. // Upload options
  89. print '<div class="div-table-responsive-no-min">';
  90. print '<table class="noborder centpercent">';
  91. print '<tr class="liste_titre">';
  92. print '<td colspan="2">'.$langs->trans("Parameters").'</td>';
  93. print '<td>'.$langs->trans("Value").'</td>';
  94. print '</tr>';
  95. print '<tr class="oddeven">';
  96. print '<td colspan="2">'.$langs->trans("MaxSizeForUploadedFiles").'.';
  97. $max = @ini_get('upload_max_filesize');
  98. if (isset($max)) {
  99. print ' '.$langs->trans("MustBeLowerThanPHPLimit", ((int) $max) * 1024, $langs->trans("Kb")).'.';
  100. } else {
  101. print ' '.$langs->trans("NoMaxSizeByPHPLimit").'.';
  102. }
  103. print '</td>';
  104. print '<td class="nowrap">';
  105. print '<input class="flat" name="MAIN_UPLOAD_DOC" type="text" size="6" value="'.dol_escape_htmltag($conf->global->MAIN_UPLOAD_DOC).'"> '.$langs->trans("Kb");
  106. print '</td>';
  107. print '</tr>';
  108. print '<tr class="oddeven">';
  109. print '<td>'.$langs->trans("UMask").'</td><td class="right">';
  110. print $form->textwithpicto('', $langs->trans("UMaskExplanation"));
  111. print '</td>';
  112. print '<td class="nowrap">';
  113. print '<input class="flat" name="MAIN_UMASK" type="text" size="6" value="'.dol_escape_htmltag($conf->global->MAIN_UMASK).'">';
  114. print '</td>';
  115. print '</tr>';
  116. // Use anti virus
  117. print '<tr class="oddeven">';
  118. print '<td colspan="2">'.$langs->trans("AntiVirusCommand").'<br>';
  119. print '<span class="opacitymedium">'.$langs->trans("AntiVirusCommandExample").'</span>';
  120. // Check command in inside safe_mode
  121. print '</td>';
  122. print '<td>';
  123. if (ini_get('safe_mode') && !empty($conf->global->MAIN_ANTIVIRUS_COMMAND)) {
  124. $langs->load("errors");
  125. $basedir = preg_replace('/"/', '', dirname($conf->global->MAIN_ANTIVIRUS_COMMAND));
  126. $listdir = explode(';', ini_get('safe_mode_exec_dir'));
  127. if (!in_array($basedir, $listdir)) {
  128. print img_warning($langs->trans('WarningSafeModeOnCheckExecDir'));
  129. dol_syslog("safe_mode is on, basedir is ".$basedir.", safe_mode_exec_dir is ".ini_get('safe_mode_exec_dir'), LOG_WARNING);
  130. }
  131. }
  132. print '<input type="text" '.((defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_COMMAND" class="minwidth500imp" value="'.(!empty($conf->global->MAIN_ANTIVIRUS_COMMAND) ?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_COMMAND) : '').'">';
  133. if (defined('MAIN_ANTIVIRUS_COMMAND') && !defined('MAIN_ANTIVIRUS_BYPASS_COMMAND_AND_PARAM')) {
  134. print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
  135. }
  136. print "</td>";
  137. print '</tr>';
  138. // Use anti virus
  139. print '<tr class="oddeven">';
  140. print '<td colspan="2">'.$langs->trans("AntiVirusParam").'<br>';
  141. print '<span class="opacitymedium">'.$langs->trans("AntiVirusParamExample").'</span>';
  142. print '</td>';
  143. print '<td>';
  144. print '<input type="text" '.(defined('MAIN_ANTIVIRUS_PARAM') ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_PARAM" class="minwidth500imp" value="'.(!empty($conf->global->MAIN_ANTIVIRUS_PARAM) ?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_PARAM) : '').'">';
  145. if (defined('MAIN_ANTIVIRUS_PARAM')) {
  146. print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
  147. }
  148. print "</td>";
  149. print '</tr>';
  150. print '</table>';
  151. print '</div>';
  152. print dol_get_fiche_end();
  153. print $form->buttonsSaveCancel("Modify", '');
  154. print '</form>';
  155. // Form to test upload
  156. print '<br>';
  157. $formfile = new FormFile($db);
  158. $formfile->form_attach_new_file($_SERVER['PHP_SELF'], $langs->trans("FormToTestFileUploadForm"), 0, 0, 1, 50, '', '', 1, '', 0);
  159. // List of document
  160. $filearray = dol_dir_list($upload_dir, "files", 0, '', '', $sortfield, $sortorder == 'desc' ? SORT_DESC : SORT_ASC, 1);
  161. $formfile->list_of_documents($filearray, null, 'admin_temp', '');
  162. // End of page
  163. llxFooter();
  164. $db->close();