/admin/check/check_paths_inc.php

https://github.com/fusenigk/mantisbt-1 · PHP · 131 lines · 89 code · 17 blank · 25 comment · 7 complexity · 624956b1db05a45f6f09b52882c35b4f MD5 · raw file

  1. <?php
  2. # MantisBT - A PHP based bugtracking system
  3. # MantisBT is free software: you can redistribute it and/or modify
  4. # it under the terms of the GNU General Public License as published by
  5. # the Free Software Foundation, either version 2 of the License, or
  6. # (at your option) any later version.
  7. #
  8. # MantisBT is distributed in the hope that it will be useful,
  9. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  10. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11. # GNU General Public License for more details.
  12. #
  13. # You should have received a copy of the GNU General Public License
  14. # along with MantisBT. If not, see <http://www.gnu.org/licenses/>.
  15. /**
  16. * @package MantisBT
  17. * @copyright Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org
  18. * @copyright Copyright (C) 2002 - 2011 MantisBT Team - mantisbt-dev@lists.sourceforge.net
  19. * @link http://www.mantisbt.org
  20. *
  21. * @uses check_api.php
  22. * @uses config_api.php
  23. */
  24. if ( !defined( 'CHECK_PATHS_INC_ALLOW' ) ) {
  25. return;
  26. }
  27. /**
  28. * MantisBT Check API
  29. */
  30. require_once( 'check_api.php' );
  31. require_api( 'config_api.php' );
  32. check_print_section_header_row( 'Paths' );
  33. $t_path_config_names = array(
  34. 'absolute_path',
  35. 'core_path',
  36. 'class_path',
  37. 'library_path',
  38. 'language_path'
  39. );
  40. $t_paths = array();
  41. foreach( $t_path_config_names as $t_path_config_name ) {
  42. $t_new_path = array();
  43. $t_new_path['config_value'] = config_get_global( $t_path_config_name );
  44. $t_new_path['real_path'] = realpath( $t_new_path['config_value'] );
  45. $t_paths[$t_path_config_name] = $t_new_path;
  46. }
  47. foreach( $t_paths as $t_path_config_name => $t_path ) {
  48. check_print_test_row(
  49. $t_path_config_name . ' configuration option has a trailing directory separator',
  50. substr( $t_path['config_value'], -1, 1 ) == DIRECTORY_SEPARATOR,
  51. array( false => 'You must provide a trailing directory separator (' . DIRECTORY_SEPARATOR . ') to the end of the ' . $t_path_config_name . ' configuration value.' )
  52. );
  53. }
  54. foreach( $t_paths as $t_path_config_name => $t_path ) {
  55. check_print_test_row(
  56. $t_path_config_name . ' configuration option points to a valid directory',
  57. is_dir( $t_path['config_value'] ),
  58. array( false => 'The path specified by the ' . $t_path_config_name . ' configuration option does not point to a valid and accessible directory.' )
  59. );
  60. }
  61. if( $g_failed_test ) {
  62. return;
  63. }
  64. $t_moveable_paths = array(
  65. 'core_path',
  66. 'class_path',
  67. 'library_path',
  68. 'language_path'
  69. );
  70. if( $t_paths['absolute_path']['real_path'] !== false ) {
  71. $t_absolute_path_regex_safe = preg_quote( $t_paths['absolute_path']['real_path'], '/' );
  72. } else {
  73. $t_absolute_path_regex_safe = preg_quote( $t_paths['absolute_path']['config_value'], '/' );
  74. }
  75. foreach( $t_moveable_paths as $t_moveable_path ) {
  76. if( $t_paths[$t_moveable_path]['real_path'] !== false ) {
  77. $t_moveable_real_path = $t_paths[$t_moveable_path]['real_path'];
  78. } else {
  79. $t_moveable_real_path = $t_paths[$t_moveable_path]['config_value'];
  80. }
  81. check_print_test_warn_row(
  82. $t_moveable_path . ' configuration option is set to a path outside the web root',
  83. !preg_match( "/^$t_absolute_path_regex_safe/", $t_moveable_real_path ),
  84. array( false => 'For increased security it is recommended that you move the ' . $t_moveable_path . ' directory outside the web root.' )
  85. );
  86. }
  87. $t_removeable_directories = array(
  88. 'doc',
  89. );
  90. foreach( $t_removeable_directories as $t_removeable_directory ) {
  91. check_print_test_warn_row(
  92. 'Directory <em><a href="' . htmlentities( config_get_global( 'short_path' ) ) . $t_removeable_directory . '">' . $t_removeable_directory . '</a></em> does not need to exist within the MantisBT root',
  93. !is_dir( $t_paths['absolute_path']['config_value'] . $t_removeable_directory ),
  94. array( false => 'The ' . $t_removeable_directory . ' directory within the MantisBT root should be removed as it is not needed for the live operation of MantisBT.' )
  95. );
  96. }
  97. $t_developer_directories = array(
  98. 'docbook',
  99. 'packages',
  100. 'scripts',
  101. 'tests',
  102. 'javascript' . DIRECTORY_SEPARATOR . 'dev'
  103. );
  104. foreach( $t_developer_directories as $t_developer_directory ) {
  105. check_print_test_warn_row(
  106. 'Directory <em><a href="' . htmlentities( config_get_global( 'short_path' ) ) . $t_developer_directory . '">' . $t_developer_directory . '</a></em> exists. These files are not included in MantisBT builds. For production use, please use a release build/snapshot, and not the developer git code.',
  107. !is_dir( $t_paths['absolute_path']['config_value'] . $t_developer_directory ),
  108. array( false => 'The ' . $t_developer_directory . ' directory within the MantisBT root is for development use and is not included in official releases of MantisBT.' )
  109. );
  110. }
  111. check_print_test_warn_row(
  112. 'Directory <em><a href="' . htmlentities( config_get_global( 'short_path' ) ) . 'api">api</a></em> should be removed from the MantisBT root if you do not plan on using <a href="http://en.wikipedia.org/wiki/SOAP">SOAP</a>',
  113. !is_dir( $t_paths['absolute_path']['config_value'] . 'api' )
  114. );