PageRenderTime 3ms CodeModel.GetById 141ms app.highlight 41ms RepoModel.GetById 39ms app.codeStats 0ms

/htdocs/admin/security.php

https://github.com/asterix14/dolibarr
PHP | 433 lines | 321 code | 62 blank | 50 comment | 70 complexity | c26cd233c13e1b21d37b12fac8b8c296 MD5 | raw file
  1<?php
  2/* Copyright (C) 2004-2009 Laurent Destailleur  <eldy@users.sourceforge.net>
  3 * Copyright (C) 2005-2007 Regis Houssin        <regis@dolibarr.fr>
  4 *
  5 * This program is free software; you can redistribute it and/or modify
  6 * it under the terms of the GNU General Public License as published by
  7 * the Free Software Foundation; either version 2 of the License, or
  8 * (at your option) any later version.
  9 *
 10 * This program is distributed in the hope that it will be useful,
 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 13 * GNU General Public License for more details.
 14 *
 15 * You should have received a copy of the GNU General Public License
 16 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 17 */
 18
 19/**
 20 *		\file       htdocs/admin/security.php
 21 *      \ingroup    setup
 22 *      \brief      Page de configuration du module securite
 23 */
 24
 25require("../main.inc.php");
 26require_once(DOL_DOCUMENT_ROOT."/core/lib/admin.lib.php");
 27
 28$langs->load("users");
 29$langs->load("admin");
 30$langs->load("other");
 31
 32if (!$user->admin) accessforbidden();
 33
 34// Allow/Disallow change to clear passwords once passwords are crypted
 35$allow_disable_encryption=true;
 36
 37$mesg = '';
 38
 39
 40/*
 41 * Actions
 42 */
 43if ($_GET["action"] == 'setgeneraterule')
 44{
 45	if (! dolibarr_set_const($db, 'USER_PASSWORD_GENERATED',$_GET["value"],'chaine',0,'',$conf->entity))
 46	{
 47		dol_print_error($db);
 48	}
 49	else
 50	{
 51		Header("Location: ".$_SERVER["PHP_SELF"]);
 52		exit;
 53	}
 54}
 55
 56if ($_GET["action"] == 'activate_encrypt')
 57{
 58    $error=0;
 59
 60	$db->begin();
 61
 62    dolibarr_set_const($db, "DATABASE_PWD_ENCRYPTED", "1",'chaine',0,'',$conf->entity);
 63
 64    $sql = "SELECT u.rowid, u.pass, u.pass_crypted";
 65    $sql.= " FROM ".MAIN_DB_PREFIX."user as u";
 66    $sql.= " WHERE u.pass IS NOT NULL AND LENGTH(u.pass) < 32"; // Not a MD5 value
 67
 68    $resql=$db->query($sql);
 69    if ($resql)
 70    {
 71        $numrows=$db->num_rows($resql);
 72        $i=0;
 73        while ($i < $numrows)
 74        {
 75            $obj=$db->fetch_object($resql);
 76            if (dol_hash($obj->pass))
 77            {
 78                $sql = "UPDATE ".MAIN_DB_PREFIX."user";
 79                $sql.= " SET pass_crypted = '".dol_hash($obj->pass)."', pass = NULL";
 80                $sql.= " WHERE rowid=".$obj->rowid;
 81                //print $sql;
 82
 83                $resql2 = $db->query($sql);
 84                if (! $resql2)
 85                {
 86                    dol_print_error($db);
 87                    $error++;
 88                    break;
 89                }
 90
 91                $i++;
 92            }
 93        }
 94    }
 95    else dol_print_error($db);
 96
 97	//print $error." ".$sql;
 98    //exit;
 99    if (! $error)
100	{
101		$db->commit();
102		Header("Location: security.php");
103	    exit;
104	}
105	else
106	{
107		$db->rollback();
108		dol_print_error($db,'');
109	}
110}
111else if ($_GET["action"] == 'disable_encrypt')
112{
113	//On n'autorise pas l'annulation de l'encryption car les mots de passe ne peuvent pas etre decodes
114	//Do not allow "disable encryption" as passwords cannot be decrypted
115	if ($allow_disable_encryption)
116	{
117		dolibarr_del_const($db, "DATABASE_PWD_ENCRYPTED",$conf->entity);
118    }
119	Header("Location: security.php");
120    exit;
121}
122
123if ($_GET["action"] == 'activate_encryptdbpassconf')
124{
125	$result = encodedecode_dbpassconf(1);
126	if ($result > 0)
127	{
128		// database value not required
129		//dolibarr_set_const($db, "MAIN_DATABASE_PWD_CONFIG_ENCRYPTED", "1");
130		Header("Location: security.php");
131		exit;
132	}
133	else
134	{
135		$mesg='<div class="warning">'.$langs->trans('InstrucToEncodePass',dol_encode($dolibarr_main_db_pass)).'</div>';
136	}
137}
138else if ($_GET["action"] == 'disable_encryptdbpassconf')
139{
140	$result = encodedecode_dbpassconf(0);
141	if ($result > 0)
142	{
143		// database value not required
144		//dolibarr_del_const($db, "MAIN_DATABASE_PWD_CONFIG_ENCRYPTED",$conf->entity);
145		Header("Location: security.php");
146		exit;
147	}
148	else
149	{
150		$mesg='<div class="warning">'.$langs->trans('InstrucToClearPass',$dolibarr_main_db_pass).'</div>';
151	}
152}
153
154if ($_GET["action"] == 'activate_pdfsecurity')
155{
156	dolibarr_set_const($db, "PDF_SECURITY_ENCRYPTION", "1",'chaine',0,'',$conf->entity);
157	Header("Location: security.php");
158	exit;
159}
160else if ($_GET["action"] == 'disable_pdfsecurity')
161{
162	dolibarr_del_const($db, "PDF_SECURITY_ENCRYPTION",$conf->entity);
163	Header("Location: security.php");
164	exit;
165}
166
167if ($_GET["action"] == 'activate_MAIN_SECURITY_DISABLEFORGETPASSLINK')
168{
169	dolibarr_set_const($db, "MAIN_SECURITY_DISABLEFORGETPASSLINK", '1','chaine',0,'',$conf->entity);
170	Header("Location: security.php");
171	exit;
172}
173else if ($_GET["action"] == 'disable_MAIN_SECURITY_DISABLEFORGETPASSLINK')
174{
175	dolibarr_del_const($db, "MAIN_SECURITY_DISABLEFORGETPASSLINK",$conf->entity);
176	Header("Location: security.php");
177	exit;
178}
179
180
181
182
183/*
184 * View
185 */
186$form = new Form($db);
187
188llxHeader('',$langs->trans("Passwords"));
189
190print_fiche_titre($langs->trans("SecuritySetup"),'','setup');
191
192if ($mesg) print $mesg."<br>\n";
193
194print $langs->trans("GeneratedPasswordDesc")."<br>\n";
195print "<br>\n";
196
197
198$head=security_prepare_head();
199
200dol_fiche_head($head, 'passwords', $langs->trans("Security"));
201
202
203$var=false;
204
205
206// Choix du gestionnaire du generateur de mot de passe
207print '<form action="'.$_SERVER["PHP_SELF"].'" method="POST">';
208print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
209print '<input type="hidden" name="action" value="update">';
210print '<input type="hidden" name="constname" value="USER_PASSWORD_GENERATED">';
211print '<input type="hidden" name="consttype" value="yesno">';
212
213// Charge tableau des modules generation
214$dir = "../core/modules/security/generate";
215clearstatcache();
216$handle=opendir($dir);
217$i=1;
218if (is_resource($handle))
219{
220    while (($file = readdir($handle))!==false)
221    {
222        if (preg_match('/(modGeneratePass[a-z]+)\.class\.php/i',$file,$reg))
223        {
224            // Chargement de la classe de numerotation
225            $classname = $reg[1];
226            require_once($dir.'/'.$file);
227
228            $obj = new $classname($db,$conf,$langs,$user);
229            $arrayhandler[$obj->id]=$obj;
230    		$i++;
231        }
232    }
233    closedir($handle);
234}
235
236print '<table class="noborder" width="100%">';
237print '<tr class="liste_titre">';
238print '<td colspan="2">'.$langs->trans("RuleForGeneratedPasswords").'</td>';
239print '<td>'.$langs->trans("Example").'</td>';
240print '<td align="center">'.$langs->trans("Activated").'</td>';
241print '</tr>';
242
243foreach ($arrayhandler as $key => $module)
244{
245	// Show modules according to features level
246    if ($module->version == 'development'  && $conf->global->MAIN_FEATURES_LEVEL < 2) continue;
247    if ($module->version == 'experimental' && $conf->global->MAIN_FEATURES_LEVEL < 1) continue;
248
249	if ($module->isEnabled())
250	{
251        $var = !$var;
252        print '<tr '.$bc[$var].'><td width="100">';
253        print ucfirst($key);
254        print "</td><td>\n";
255        print $module->getDescription().'<br>';
256        print $langs->trans("MinLength").': '.$module->length;
257        print '</td>';
258
259        // Show example of numbering module
260        print '<td nowrap="nowrap">';
261        $tmp=$module->getExample();
262        if (preg_match('/^Error/',$tmp)) { $langs->load("errors"); print '<div class="error">'.$langs->trans($tmp).'</div>'; }
263        elseif ($tmp=='NotConfigured') print $langs->trans($tmp);
264        else print $tmp;
265        print '</td>'."\n";
266
267        print '<td width="100" align="center">';
268        if ($conf->global->USER_PASSWORD_GENERATED == $key)
269        {
270            print img_picto('','tick');
271        }
272        else
273        {
274            print '<a href="'.$_SERVER['PHP_SELF'].'?action=setgeneraterule&amp;value='.$key.'">'.$langs->trans("Activate").'</a>';
275        }
276        print "</td></tr>\n";
277	}
278}
279print '</table>';
280print '</form>';
281
282// Cryptage mot de passe
283print '<br>';
284$var=true;
285print "<form method=\"post\" action=\"security.php\">";
286print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
287print "<input type=\"hidden\" name=\"action\" value=\"encrypt\">";
288
289print '<table class="noborder" width="100%">';
290print '<tr class="liste_titre">';
291print '<td colspan="3">'.$langs->trans("Parameters").'</td>';
292print '<td align="center">'.$langs->trans("Activated").'</td>';
293print '<td align="center">'.$langs->trans("Action").'</td>';
294print '</tr>';
295
296// Disable clear password in database
297$var=!$var;
298print "<tr ".$bc[$var].">";
299print '<td colspan="3">'.$langs->trans("DoNotStoreClearPassword").'</td>';
300print '<td align="center" width="60">';
301if ($conf->global->DATABASE_PWD_ENCRYPTED)
302{
303	print img_picto($langs->trans("Active"),'tick');
304}
305print '</td>';
306if (! $conf->global->DATABASE_PWD_ENCRYPTED)
307{
308	print '<td align="center" width="100">';
309	print '<a href="security.php?action=activate_encrypt">'.$langs->trans("Activate").'</a>';
310	print "</td>";
311}
312if($conf->global->DATABASE_PWD_ENCRYPTED)
313{
314	print '<td align="center" width="100">';
315	if ($allow_disable_encryption)
316	{
317		//On n'autorise pas l'annulation de l'encryption car les mots de passe ne peuvent pas etre decodes
318	  	//Do not allow "disable encryption" as passwords cannot be decrypted
319	  	print '<a href="security.php?action=disable_encrypt">'.$langs->trans("Disable").'</a>';
320	}
321	else
322	{
323		print '-';
324	}
325	print "</td>";
326}
327print "</td>";
328print '</tr>';
329
330// Cryptage du mot de base de la base dans conf.php
331$var=!$var;
332print "<tr ".$bc[$var].">";
333print '<td colspan="3">'.$langs->trans("MainDbPasswordFileConfEncrypted").'</td>';
334print '<td align="center" width="60">';
335if (preg_match('/crypted:/i',$dolibarr_main_db_pass) || ! empty($dolibarr_main_db_encrypted_pass))
336{
337	print img_picto($langs->trans("Active"),'tick');
338}
339
340print '</td>';
341
342print '<td align="center" width="100">';
343if (empty($dolibarr_main_db_pass) && empty($dolibarr_main_db_encrypted_pass))
344{
345	$langs->load("errors");
346	print img_warning($langs->trans("WarningPassIsEmpty"));
347}
348else
349{
350	if (empty($dolibarr_main_db_encrypted_pass))
351	{
352		print '<a href="security.php?action=activate_encryptdbpassconf">'.$langs->trans("Activate").'</a>';
353	}
354	if (! empty($dolibarr_main_db_encrypted_pass))
355	{
356		print '<a href="security.php?action=disable_encryptdbpassconf">'.$langs->trans("Disable").'</a>';
357	}
358}
359print "</td>";
360
361print "</td>";
362print '</tr>';
363
364// Encryption et protection des PDF
365$var=!$var;
366print "<tr ".$bc[$var].">";
367print '<td colspan="3">';
368$text = $langs->trans("ProtectAndEncryptPdfFiles");
369$desc = $form->textwithpicto($text,$langs->transnoentities("ProtectAndEncryptPdfFilesDesc"),1);
370print $desc;
371print '</td>';
372print '<td align="center" width="60">';
373if($conf->global->PDF_SECURITY_ENCRYPTION == 1)
374{
375	print img_picto($langs->trans("Active"),'tick');
376}
377
378print '</td>';
379
380print '<td align="center" width="100">';
381if ($conf->global->PDF_SECURITY_ENCRYPTION == 0)
382{
383	print '<a href="security.php?action=activate_pdfsecurity">'.$langs->trans("Activate").'</a>';
384}
385if($conf->global->PDF_SECURITY_ENCRYPTION == 1)
386{
387	print '<a href="security.php?action=disable_pdfsecurity">'.$langs->trans("Disable").'</a>';
388}
389print "</td>";
390
391print "</td>";
392print '</tr>';
393
394
395
396// Disable link "Forget password" on logon
397$var=!$var;
398print "<tr ".$bc[$var].">";
399print '<td colspan="3">'.$langs->trans("DisableForgetPasswordLinkOnLogonPage").'</td>';
400print '<td align="center" width="60">';
401if($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK == 1)
402{
403	print img_picto($langs->trans("Active"),'tick');
404}
405print '</td>';
406if ($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK == 0)
407{
408	print '<td align="center" width="100">';
409	print '<a href="security.php?action=activate_MAIN_SECURITY_DISABLEFORGETPASSLINK">'.$langs->trans("Activate").'</a>';
410	print "</td>";
411}
412if($conf->global->MAIN_SECURITY_DISABLEFORGETPASSLINK == 1)
413{
414	print '<td align="center" width="100">';
415	print '<a href="security.php?action=disable_MAIN_SECURITY_DISABLEFORGETPASSLINK">'.$langs->trans("Disable").'</a>';
416	print "</td>";
417}
418print "</td>";
419print '</tr>';
420
421
422print '</table>';
423print '</form>';
424
425
426//print '<tr><td colspan="2" align="center"><input type="submit" class="button" value="'.$langs->trans("Save").'"></td></tr>';
427
428print '</div>';
429
430$db->close();
431
432llxFooter();
433?>