1<?php
2/* Copyright (C) 2004-2017	Laurent Destailleur	<eldy@users.sourceforge.net>
3 * Copyright (C) 2005-2017	Regis Houssin		<regis.houssin@inodbox.com>
4 * Copyright (C) 2013		Juanjo Menent		<jmenent@2byte.es>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program. If not, see <https://www.gnu.org/licenses/>.
18 */
19
20/**
21 *	    \file       htdocs/admin/security_file.php
22 *      \ingroup    core
23 *      \brief      Security options setup
24 */
25
26require '../main.inc.php';
27require_once DOL_DOCUMENT_ROOT.'/core/lib/admin.lib.php';
28require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
29require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
30
31// Load translation files required by the page
32$langs->loadLangs(array('users', 'admin', 'other'));
33
34if (!$user->admin)
35	accessforbidden();
36
37$action = GETPOST('action', 'aZ09');
38
39$upload_dir = $conf->admin->dir_temp;
40
41
42/*
43 * Actions
44 */
45
46if (GETPOST('sendit') && !empty($conf->global->MAIN_UPLOAD_DOC))
47{
48	require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
49
50	dol_add_file_process($upload_dir, 1, 0, 'userfile');
51}
52
53if ($action == 'updateform')
54{
55	$antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe
56	$antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM', 'restricthtml'); // Use GETPOST restricthtml because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib"
57	$antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&")); // Sanitize command
58	$antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&")); // Sanitize params
59
60	$res3 = dolibarr_set_const($db, 'MAIN_UPLOAD_DOC', GETPOST('MAIN_UPLOAD_DOC', 'alpha'), 'chaine', 0, '', $conf->entity);
61	$res4 = dolibarr_set_const($db, "MAIN_UMASK", GETPOST('MAIN_UMASK', 'alpha'), 'chaine', 0, '', $conf->entity);
62	$res5 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand), 'chaine', 0, '', $conf->entity);
63	$res6 = dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam), 'chaine', 0, '', $conf->entity);
64	if ($res3 && $res4 && $res5 && $res6) setEventMessages($langs->trans("RecordModifiedSuccessfully"), null, 'mesgs');
65}
66
67
68
69// Delete file
70elseif ($action == 'delete')
71{
72	$langs->load("other");
73	$file = $conf->admin->dir_temp.'/'.GETPOST('urlfile', 'alpha'); // Do not use urldecode here ($_GET and $_REQUEST are already decoded by PHP).
74	$ret = dol_delete_file($file);
75	if ($ret) setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile', 'alpha')), null, 'mesgs');
76	else setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile', 'alpha')), null, 'errors');
77	Header('Location: '.$_SERVER["PHP_SELF"]);
78	exit;
79}
80
81
82/*
83 * View
84 */
85
86$form = new Form($db);
87
88$wikihelp = 'EN:Setup_Security|FR:Paramétrage_Sécurité|ES:Configuración_Seguridad';
89llxHeader('', $langs->trans("Files"), $wikihelp);
90
91print load_fiche_titre($langs->trans("SecuritySetup"), '', 'title_setup');
92
93print '<span class="opacitymedium">'.$langs->trans("SecurityFilesDesc")."</span><br>\n";
94print "<br>\n";
95
96
97print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
98print '<input type="hidden" name="token" value="'.newToken().'">';
99print '<input type="hidden" name="action" value="updateform">';
100
101$head = security_prepare_head();
102
103print dol_get_fiche_head($head, 'file', '', -1);
104
105
106// Upload options
107$var = false;
108
109print '<div class="div-table-responsive-no-min">';
110print '<table class="noborder centpercent">';
111print '<tr class="liste_titre">';
112print '<td colspan="2">'.$langs->trans("Parameters").'</td>';
113print '<td>'.$langs->trans("Value").'</td>';
114print '</tr>';
115
116print '<tr class="oddeven">';
117print '<td colspan="2">'.$langs->trans("MaxSizeForUploadedFiles").'.';
118$max = @ini_get('upload_max_filesize');
119if ($max) print ' '.$langs->trans("MustBeLowerThanPHPLimit", $max * 1024, $langs->trans("Kb")).'.';
120else print ' '.$langs->trans("NoMaxSizeByPHPLimit").'.';
121print '</td>';
122print '<td class="nowrap">';
123print '<input class="flat" name="MAIN_UPLOAD_DOC" type="text" size="6" value="'.htmlentities($conf->global->MAIN_UPLOAD_DOC).'"> '.$langs->trans("Kb");
124print '</td>';
125print '</tr>';
126
127
128print '<tr class="oddeven">';
129print '<td>'.$langs->trans("UMask").'</td><td class="right">';
130print $form->textwithpicto('', $langs->trans("UMaskExplanation"));
131print '</td>';
132print '<td class="nowrap">';
133print '<input class="flat" name="MAIN_UMASK" type="text" size="6" value="'.htmlentities($conf->global->MAIN_UMASK).'">';
134print '</td>';
135print '</tr>';
136
137// Use anti virus
138
139print '<tr class="oddeven">';
140print '<td colspan="2">'.$langs->trans("AntiVirusCommand").'<br>';
141print '<span class="opacitymedium">'.$langs->trans("AntiVirusCommandExample").'</span>';
142// Check command in inside safe_mode
143print '</td>';
144print '<td>';
145if (ini_get('safe_mode') && !empty($conf->global->MAIN_ANTIVIRUS_COMMAND))
146{
147	$langs->load("errors");
148	$basedir = preg_replace('/"/', '', dirname($conf->global->MAIN_ANTIVIRUS_COMMAND));
149	$listdir = explode(';', ini_get('safe_mode_exec_dir'));
150	if (!in_array($basedir, $listdir))
151	{
152		print img_warning($langs->trans('WarningSafeModeOnCheckExecDir'));
153		dol_syslog("safe_mode is on, basedir is ".$basedir.", safe_mode_exec_dir is ".ini_get('safe_mode_exec_dir'), LOG_WARNING);
154	}
155}
156print '<input type="text" '.(defined('MAIN_ANTIVIRUS_COMMAND') ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_COMMAND" class="minwidth500imp" value="'.(!empty($conf->global->MAIN_ANTIVIRUS_COMMAND) ?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_COMMAND) : '').'">';
157if (defined('MAIN_ANTIVIRUS_COMMAND')) {
158	print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
159}
160print "</td>";
161print '</tr>';
162
163// Use anti virus
164
165print '<tr class="oddeven">';
166print '<td colspan="2">'.$langs->trans("AntiVirusParam").'<br>';
167print '<span class="opacitymedium">'.$langs->trans("AntiVirusParamExample").'</span>';
168print '</td>';
169print '<td>';
170print '<input type="text" '.(defined('MAIN_ANTIVIRUS_PARAM') ? 'disabled ' : '').'name="MAIN_ANTIVIRUS_PARAM" class="minwidth500imp" value="'.(!empty($conf->global->MAIN_ANTIVIRUS_PARAM) ?dol_escape_htmltag($conf->global->MAIN_ANTIVIRUS_PARAM) : '').'">';
171if (defined('MAIN_ANTIVIRUS_PARAM')) {
172	print '<br><span class="opacitymedium">'.$langs->trans("ValueIsForcedBySystem").'</span>';
173}
174print "</td>";
175print '</tr>';
176
177print '</table>';
178print '</div>';
179
180print dol_get_fiche_end();
181
182print '<div class="center"><input type="submit" class="button" name="button" value="'.$langs->trans("Modify").'"></div>';
183
184print '</form>';
185
186
187// Form to test upload
188print '<br>';
189$formfile = new FormFile($db);
190$formfile->form_attach_new_file($_SERVER['PHP_SELF'], $langs->trans("FormToTestFileUploadForm"), 0, 0, 1, 50, '', '', 1, '', 0);
191
192// List of document
193$filearray = dol_dir_list($upload_dir, "files", 0, '', '', 'name', SORT_ASC, 1);
194$formfile->list_of_documents($filearray, null, 'admin_temp', '');
195
196// End of page
197llxFooter();
198$db->close();
199