1<?php 2/* Copyright (C) 2004-2017 Laurent Destailleur <eldy@users.sourceforge.net> 3 * Copyright (C) 2005-2017 Regis Houssin <regis.houssin@inodbox.com> 4 * Copyright (C) 2013 Juanjo Menent <jmenent@2byte.es> 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 3 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program. If not, see <https://www.gnu.org/licenses/>. 18 */ 19 20/** 21 * \file htdocs/admin/security_file.php 22 * \ingroup core 23 * \brief Security options setup 24 */ 25 26require '../main.inc.php'; 27require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php'; 28require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; 29require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php'; 30 31// Load translation files required by the page 32$langs->loadLangs(array('users', 'admin', 'other')); 33 34if (!$user->admin) 35 accessforbidden(); 36 37$action = GETPOST('action', 'aZ09'); 38 39$upload_dir = $conf->admin->dir_temp; 40 41 42/* 43 * Actions 44 */ 45 46if (GETPOST('sendit') && !empty($conf->global->MAIN_UPLOAD_DOC)) 47{ 48 require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; 49 50 dol_add_file_process($upload_dir, 1, 0, 'userfile'); 51} 52 53if ($action == 'updateform') 54{ 55 $antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe 56 $antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib" 57 $antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&")); // Sanitize command 58 $antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&")); // Sanitize params 59 60 $res3 = dolibarr_set_const($db, 'MAIN_UPLOAD_DOC', GETPOST('MAIN_UPLOAD_DOC', 'alpha'), 'chaine', 0, '', $conf->entity); 61 $res4 = dolibarr_set_const($db, "MAIN_UMASK", GETPOST('MAIN_UMASK', 'alpha'), 'chaine', 0, '', $conf->entity); 62 $res5 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand), 'chaine', 0, '', $conf->entity); 63 $res6 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam), 'chaine', 0, '', $conf->entity); 64 if ($res3 && $res4 && $res5 && $res6) setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs'); 65} 66 67 68 69// Delete file 70elseif ($action == 'delete') 71{ 72 $langs->load("other"); 73 $file = $conf->admin->dir_temp.'/'.GETPOST('urlfile', 'alpha'); // Do not use urldecode here ($_GET and $_REQUEST are already decoded by PHP). 74 $ret = dol_delete_file($file); 75 if ($ret) setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile', 'alpha')), null, 'mesgs'); 76 else setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile', 'alpha')), null, 'errors'); 77 Header('Location: '.$_SERVER["PHP_SELF"]); 78 exit; 79} 80 81 82/* 83 * View 84 */ 85 86$form = new Form($db); 87 88$wikihelp = 'EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad'; 89llxHeader('', $langs->trans("Files"), $wikihelp); 90 91print load_fiche_titre($langs->trans("SecuritySetup"), '', 'title_setup'); 92 93print '<span class="opacitymedium">'.$langs->trans("SecurityFilesDesc")."</span><br>\n"; 94print "<br>\n"; 95 96 97print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">'; 98print '<input type="hidden" name="token" value="'.newToken().'">'; 99print '<input type="hidden" name="action" value="updateform">'; 100 101$head = security_prepare_head(); 102 103print dol_get_fiche_head($head, 'file', '', -1); 104 105 106// Upload options 107$var = false; 108 109print '<div class="div-table-responsive-no-min">'; 110print '<table class="noborder centpercent">'; 111print '<tr class="liste_titre">'; 112print '<td colspan="2">'.$langs->trans("Parameters").'</td>'; 113print '<td>'.$langs->trans("Value").'</td>'; 114print '</tr>'; 115 116print '<tr class="oddeven">'; 117print '<td colspan="2">'.$langs->trans("MaxSizeForUploadedFiles").'.'; 118$max = @ini_get('upload_max_filesize'); 119if ($max) print ' '.$langs->trans("MustBeLowerThanPHPLimit", $max * 1024, $langs->trans("Kb")).'.'; 120else print ' '.$langs->trans("NoMaxSizeByPHPLimit").'.'; 121print '</td>'; 122print '<td class="nowrap">'; 123print '<input class="flat" name="MAIN_UPLOAD_DOC" type="text" size="6" value="'.htmlentities($conf->global->MAIN_UPLOAD_DOC).'"> '.$langs->trans("Kb"); 124print '</td>'; 125print '</tr>'; 126 127 128print '<tr class="oddeven">'; 129print '<td>'.$langs->trans("UMask").'</td><td class="right">'; 130print $form->textwithpicto('', $langs->trans("UMaskExplanation")); 131print '</td>'; 132print '<td class="nowrap">'; 133print '<input class="flat" name="MAIN_UMASK" type="text" size="6" value="'.htmlentities($conf->global->MAIN_UMASK).'">'; 134print '</td>'; 135print '</tr>'; 136 137// Use anti virus 138 139print '<tr class="oddeven">'; 140print '<td colspan="2">'.$langs->trans("AntiVirusCommand").'<br>'; 141print '<span class="opacitymedium">'.$langs->trans("AntiVirusCommandExample").'</span>'; 142// Check command in inside safe_mode 143print '</td>'; 144print '<td>'; 145if (ini_get('safe_mode') && !empty($conf->global->MAIN_ANTIVIRUS_COMMAND)) 146{ 147 $langs->load("errors"); 148 $basedir = preg_replace('/"/', '', dirname($conf->global->MAIN_ANTIVIRUS_COMMAND)); 149 $listdir = explode(';', ini_get('safe_mode_exec_dir')); 150 if (!in_array($basedir, $listdir)) 151 { 152 print img_warning($langs->trans('WarningSafeModeOnCheckExecDir')); 153 dol_syslog("safe_mode is on, basedir is ".$basedir.", safe_mode_exec_dir is ".ini_get('safe_mode_exec_dir'), LOG_WARNING); 154 } 155} 156print '<input type="text" '.(defined('MAIN_ANTIVIRUS_COMMAND') ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_COMMAND" class="minwidth500imp" value="'.(!empty($conf->global->MAIN_ANTIVIRUS_COMMAND) ?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_COMMAND) : '').'">'; 157if (defined('MAIN_ANTIVIRUS_COMMAND')) { 158 print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>'; 159} 160print "</td>"; 161print '</tr>'; 162 163// Use anti virus 164 165print '<tr class="oddeven">'; 166print '<td colspan="2">'.$langs->trans("AntiVirusParam").'<br>'; 167print '<span class="opacitymedium">'.$langs->trans("AntiVirusParamExample").'</span>'; 168print '</td>'; 169print '<td>'; 170print '<input type="text" '.(defined('MAIN_ANTIVIRUS_PARAM') ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_PARAM" class="minwidth500imp" value="'.(!empty($conf->global->MAIN_ANTIVIRUS_PARAM) ?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_PARAM) : '').'">'; 171if (defined('MAIN_ANTIVIRUS_PARAM')) { 172 print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>'; 173} 174print "</td>"; 175print '</tr>'; 176 177print '</table>'; 178print '</div>'; 179 180print dol_get_fiche_end(); 181 182print '<div class="center"><input type="submit" class="button" name="button" value="'.$langs->trans("Modify").'"></div>'; 183 184print '</form>'; 185 186 187// Form to test upload 188print '<br>'; 189$formfile = new FormFile($db); 190$formfile->form_attach_new_file($_SERVER['PHP_SELF'], $langs->trans("FormToTestFileUploadForm"), 0, 0, 1, 50, '', '', 1, '', 0); 191 192// List of document 193$filearray = dol_dir_list($upload_dir, "files", 0, '', '', 'name', SORT_ASC, 1); 194$formfile->list_of_documents($filearray, null, 'admin_temp', ''); 195 196// End of page 197llxFooter(); 198$db->close(); 199