3 +--------------------------------------------------------------------+
5 +--------------------------------------------------------------------+
6 | Copyright CiviCRM LLC (c) 2004-2019 |
7 +--------------------------------------------------------------------+
8 | This file is a part of CiviCRM. |
10 | CiviCRM is free software; you can copy, modify, and distribute it |
11 | under the terms of the GNU Affero General Public License |
12 | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. |
14 | CiviCRM is distributed in the hope that it will be useful, but |
15 | WITHOUT ANY WARRANTY; without even the implied warranty of |
16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
17 | See the GNU Affero General Public License for more details. |
19 | You should have received a copy of the GNU Affero General Public |
20 | License and the CiviCRM Licensing Exception along |
21 | with this program; if not, contact CiviCRM LLC |
22 | at info[AT]civicrm[DOT]org. If you have questions about the |
23 | GNU Affero General Public License or the licensing of CiviCRM, |
24 | see the CiviCRM license FAQ at http://civicrm.org/licensing |
25 +--------------------------------------------------------------------+
31 * @copyright CiviCRM LLC (c) 2004-2019
33 class CRM_Utils_Check_Component_Security
extends CRM_Utils_Check_Component
{
36 * CMS have a different pattern to their default file path and URL.
38 * @todo Use Civi::paths instead?
40 public function getFilePathMarker() {
41 $config = CRM_Core_Config
::singleton();
42 switch ($config->userFramework
) {
52 * Check if our logfile is directly accessible.
54 * Per CiviCRM default the logfile sits in a folder which is
55 * web-accessible, and is protected by a default .htaccess
56 * configuration. If server config causes the .htaccess not to
57 * function as intended, there may be information disclosure.
59 * The debug log may be jam-packed with sensitive data, we don't
62 * Being able to be retrieved directly doesn't mean the logfile
63 * is browseable or visible to search engines; it means it can be
70 public function checkLogFileIsNotAccessible() {
73 $config = CRM_Core_Config
::singleton();
75 $log = CRM_Core_Error
::createDebugLogger();
76 $log_filename = str_replace('\\', '/', $log->_filename
);
78 $filePathMarker = $this->getFilePathMarker();
80 // Hazard a guess at the URL of the logfile, based on common
82 if ($upload_url = explode($filePathMarker, $config->imageUploadURL
)) {
83 $url[] = $upload_url[0];
84 if ($log_path = explode($filePathMarker, $log_filename)) {
85 // CRM-17149: check if debug log path includes $filePathMarker
86 if (count($log_path) > 1) {
87 $url[] = $log_path[1];
88 $log_url = implode($filePathMarker, $url);
89 if ($this->fileExists($log_url)) {
90 $docs_url = $this->createDocUrl('checkLogFileIsNotAccessible');
91 $msg = 'The <a href="%1">CiviCRM debug log</a> should not be downloadable.'
93 '<a href="%2">Read more about this warning</a>';
94 $messages[] = new CRM_Utils_Check_Message(
96 ts($msg, [1 => $log_url, 2 => $docs_url]),
97 ts('Security Warning'),
98 \Psr\Log\LogLevel
::WARNING
,
110 * Check if our uploads directory has accessible files.
112 * We'll test a handful of files randomly. Hazard a guess at the URL
113 * of the uploads dir, based on common CiviCRM layouts. Try and
114 * request the files, and if any are successfully retrieved, warn.
116 * Being retrievable doesn't mean the files are browseable or visible
117 * to search engines; it only means they can be requested directly.
123 * @todo Test with WordPress, Joomla.
125 public function checkUploadsAreNotAccessible() {
128 $config = CRM_Core_Config
::singleton();
131 $config->customFileUploadDir
,
134 foreach ($privateDirs as $privateDir) {
135 $heuristicUrl = $this->guessUrl($privateDir);
136 if ($this->isDirAccessible($privateDir, $heuristicUrl)) {
137 $messages[] = new CRM_Utils_Check_Message(
139 ts('Files in the data directory (<a href="%3">%2</a>) should not be downloadable.'
141 . '<a href="%1">Read more about this warning</a>',
143 1 => $this->createDocUrl('checkUploadsAreNotAccessible'),
147 ts('Private Files Readable'),
148 \Psr\Log\LogLevel
::WARNING
,
158 * Check if our uploads or ConfigAndLog directories have browseable
161 * Retrieve a listing of files from the local filesystem, and the
162 * corresponding path via HTTP. Then check and see if the local
163 * files are represented in the HTTP result; if so then warn. This
164 * MAY trigger false positives (if you have files named 'a', 'e'
165 * we'll probably match that).
171 * @todo Test with WordPress, Joomla.
173 public function checkDirectoriesAreNotBrowseable() {
175 $config = CRM_Core_Config
::singleton();
177 $config->imageUploadDir
=> $config->imageUploadURL
,
180 // Setup index.html files to prevent browsing
181 foreach ($publicDirs as $publicDir => $publicUrl) {
182 CRM_Utils_File
::restrictBrowsing($publicDir);
185 // Test that $publicDir is not browsable
186 foreach ($publicDirs as $publicDir => $publicUrl) {
187 if ($this->isBrowsable($publicDir, $publicUrl)) {
188 $msg = 'Directory <a href="%1">%2</a> should not be browseable via the web.'
190 '<a href="%3">Read more about this warning</a>';
191 $docs_url = $this->createDocUrl('checkDirectoriesAreNotBrowseable');
192 $messages[] = new CRM_Utils_Check_Message(
194 ts($msg, [1 => $publicDir, 2 => $publicDir, 3 => $docs_url]),
195 ts('Browseable Directories'),
196 \Psr\Log\LogLevel
::ERROR
,
206 * Check that some files are not present.
208 * These files have generally been deleted but Civi source tree but could be
209 * left online if one does a faulty upgrade.
211 * @return array of messages
213 public function checkFilesAreNotPresent() {
214 global $civicrm_root;
219 // CRM-16005, upgraded from Civi <= 4.5.6
220 "{$civicrm_root}/packages/dompdf/dompdf.php",
221 \Psr\Log\LogLevel
::CRITICAL
,
224 // CRM-16005, Civi >= 4.5.7
225 "{$civicrm_root}/packages/vendor/dompdf/dompdf/dompdf.php",
226 \Psr\Log\LogLevel
::CRITICAL
,
229 // CRM-16005, Civi >= 4.6.0
230 "{$civicrm_root}/vendor/dompdf/dompdf/dompdf.php",
231 \Psr\Log\LogLevel
::CRITICAL
,
235 "{$civicrm_root}/packages/OpenFlashChart/php-ofc-library/ofc_upload_image.php",
236 \Psr\Log\LogLevel
::CRITICAL
,
239 "{$civicrm_root}/packages/html2text/class.html2text.inc",
240 \Psr\Log\LogLevel
::CRITICAL
,
243 foreach ($files as $file) {
244 if (file_exists($file[0])) {
245 $messages[] = new CRM_Utils_Check_Message(
247 ts('File \'%1\' presents a security risk and should be deleted.', [1 => $file[0]]),
258 * Discourage use of remote profile forms.
260 public function checkRemoteProfile() {
263 if (Civi
::settings()->get('remote_profile_submissions')) {
264 $messages[] = new CRM_Utils_Check_Message(
266 ts('Warning: External profile support (aka "HTML Snippet" support) is enabled in <a href="%1">system settings</a>. This setting may be prone to abuse. If you must retain it, consider HTTP throttling or other protections.',
267 [1 => CRM_Utils_System
::url('civicrm/admin/setting/misc', 'reset=1')]
269 ts('Remote Profiles Enabled'),
270 \Psr\Log\LogLevel
::WARNING
,
279 * Check that the sysadmin has not modified the Cxn
282 public function checkCxnOverrides() {
284 if (defined('CIVICRM_CXN_CA') && CIVICRM_CXN_CA
!== 'CiviRootCA') {
285 $list[] = 'CIVICRM_CXN_CA';
287 if (defined('CIVICRM_CXN_APPS_URL') && CIVICRM_CXN_APPS_URL
!== \Civi\Cxn\Rpc\Constants
::OFFICIAL_APPMETAS_URL
) {
288 $list[] = 'CIVICRM_CXN_APPS_URL';
294 $messages[] = new CRM_Utils_Check_Message(
296 ts('The system administrator has disabled security settings (%1). Connections to remote applications are insecure.', [
297 1 => implode(', ', $list),
299 ts('Security Warning'),
300 \Psr\Log\LogLevel
::WARNING
,
309 * Determine whether $url is a public, browsable listing for $dir
317 public function isBrowsable($dir, $url) {
318 if (empty($dir) ||
empty($url) ||
!is_dir($dir)) {
324 // this could be a new system with no uploads (yet) -- so we'll make a file
325 $file = CRM_Utils_File
::createFakeFile($dir);
327 if ($file === FALSE) {
328 // Couldn't write the file
332 $content = @file_get_contents
("$url");
333 if (stristr($content, $file)) {
336 unlink("$dir/$file");
342 * Determine whether $url is a public version of $dir in which files
343 * are remotely accessible.
351 public function isDirAccessible($dir, $url) {
352 $url = rtrim($url, '/');
353 if (empty($dir) ||
empty($url) ||
!is_dir($dir)) {
358 $file = CRM_Utils_File
::createFakeFile($dir, 'delete me');
360 if ($file === FALSE) {
361 // Couldn't write the file
365 if ($this->fileExists("$url/$file")) {
366 $content = @file_get_contents
("$url/$file");
367 if (preg_match('/delete me/', $content)) {
372 unlink("$dir/$file");
382 public function createDocUrl($topic) {
383 return CRM_Utils_System
::getWikiBaseURL() . $topic;
387 * Make a guess about the URL that corresponds to $targetDir.
389 * @param string $targetDir
390 * Local path to a directory.
392 * a guessed URL for $realDir
394 public function guessUrl($targetDir) {
395 $filePathMarker = $this->getFilePathMarker();
396 $config = CRM_Core_Config
::singleton();
398 list($heuristicBaseUrl) = explode($filePathMarker, $config->imageUploadURL
);
399 list(, $heuristicSuffix) = array_pad(explode($filePathMarker, str_replace('\\', '/', $targetDir)), 2, '');
400 return $heuristicBaseUrl . $filePathMarker . $heuristicSuffix;