3 +--------------------------------------------------------------------+
4 | CiviCRM version 4.7 |
5 +--------------------------------------------------------------------+
6 | Copyright CiviCRM LLC (c) 2004-2015 |
7 +--------------------------------------------------------------------+
8 | This file is a part of CiviCRM. |
10 | CiviCRM is free software; you can copy, modify, and distribute it |
11 | under the terms of the GNU Affero General Public License |
12 | Version 3, 19 November 2007 and the CiviCRM Licensing Exception. |
14 | CiviCRM is distributed in the hope that it will be useful, but |
15 | WITHOUT ANY WARRANTY; without even the implied warranty of |
16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
17 | See the GNU Affero General Public License for more details. |
19 | You should have received a copy of the GNU Affero General Public |
20 | License and the CiviCRM Licensing Exception along |
21 | with this program; if not, contact CiviCRM LLC |
22 | at info[AT]civicrm[DOT]org. If you have questions about the |
23 | GNU Affero General Public License or the licensing of CiviCRM, |
24 | see the CiviCRM license FAQ at http://civicrm.org/licensing |
25 +--------------------------------------------------------------------+
31 * @copyright CiviCRM LLC (c) 2004-2015
35 class CRM_Utils_Check_Security
{
38 * CMS have a different pattern to their default file path and URL.
40 * @TODO This function might be better shared in CRM_Utils_Check
41 * class, but that class doesn't yet exist.
43 public function getFilePathMarker() {
44 $config = CRM_Core_Config
::singleton();
45 switch ($config->userFramework
) {
55 * Run some sanity checks.
57 * @return array<CRM_Utils_Check_Message>
59 public function checkAll() {
60 $messages = array_merge(
61 $this->checkCxnOverrides(),
62 $this->checkLogFileIsNotAccessible(),
63 $this->checkUploadsAreNotAccessible(),
64 $this->checkDirectoriesAreNotBrowseable(),
65 $this->checkFilesAreNotPresent()
71 * Check if our logfile is directly accessible.
73 * Per CiviCRM default the logfile sits in a folder which is
74 * web-accessible, and is protected by a default .htaccess
75 * configuration. If server config causes the .htaccess not to
76 * function as intended, there may be information disclosure.
78 * The debug log may be jam-packed with sensitive data, we don't
81 * Being able to be retrieved directly doesn't mean the logfile
82 * is browseable or visible to search engines; it means it can be
89 public function checkLogFileIsNotAccessible() {
92 $config = CRM_Core_Config
::singleton();
94 $log = CRM_Core_Error
::createDebugLogger();
95 $log_filename = str_replace('\\', '/', $log->_filename
);
97 $filePathMarker = $this->getFilePathMarker();
99 // Hazard a guess at the URL of the logfile, based on common
101 if ($upload_url = explode($filePathMarker, $config->imageUploadURL
)) {
102 $url[] = $upload_url[0];
103 if ($log_path = explode($filePathMarker, $log_filename)) {
104 $url[] = $log_path[1];
105 $log_url = implode($filePathMarker, $url);
106 $headers = @get_headers
($log_url);
107 if (stripos($headers[0], '200')) {
108 $docs_url = $this->createDocUrl('checkLogFileIsNotAccessible');
109 $msg = 'The <a href="%1">CiviCRM debug log</a> should not be downloadable.'
111 '<a href="%2">Read more about this warning</a>';
112 $messages[] = new CRM_Utils_Check_Message(
113 'checkLogFileIsNotAccessible',
114 ts($msg, array(1 => $log_url, 2 => $docs_url)),
115 ts('Debug Log Downloadable'),
116 \Psr\Log\LogLevel
::CRITICAL
126 * Check if our uploads directory has accessible files.
128 * We'll test a handful of files randomly. Hazard a guess at the URL
129 * of the uploads dir, based on common CiviCRM layouts. Try and
130 * request the files, and if any are successfully retrieved, warn.
132 * Being retrievable doesn't mean the files are browseable or visible
133 * to search engines; it only means they can be requested directly.
139 * @TODO: Test with WordPress, Joomla.
141 public function checkUploadsAreNotAccessible() {
144 $config = CRM_Core_Config
::singleton();
145 $privateDirs = array(
147 $config->customFileUploadDir
,
150 foreach ($privateDirs as $privateDir) {
151 $heuristicUrl = $this->guessUrl($privateDir);
152 if ($this->isDirAccessible($privateDir, $heuristicUrl)) {
153 $messages[] = new CRM_Utils_Check_Message(
154 'checkUploadsAreNotAccessible',
155 ts('Files in the data directory (<a href="%3">%2</a>) should not be downloadable.'
157 . '<a href="%1">Read more about this warning</a>',
159 1 => $this->createDocUrl('checkUploadsAreNotAccessible'),
163 ts('Private Files Readable'),
164 \Psr\Log\LogLevel
::WARNING
173 * Check if our uploads or ConfigAndLog directories have browseable
176 * Retrieve a listing of files from the local filesystem, and the
177 * corresponding path via HTTP. Then check and see if the local
178 * files are represented in the HTTP result; if so then warn. This
179 * MAY trigger false positives (if you have files named 'a', 'e'
180 * we'll probably match that).
186 * @TODO: Test with WordPress, Joomla.
188 public function checkDirectoriesAreNotBrowseable() {
190 $config = CRM_Core_Config
::singleton();
192 $config->imageUploadDir
=> $config->imageUploadURL
,
195 // Setup index.html files to prevent browsing
196 foreach ($publicDirs as $publicDir => $publicUrl) {
197 CRM_Utils_File
::restrictBrowsing($publicDir);
200 // Test that $publicDir is not browsable
201 foreach ($publicDirs as $publicDir => $publicUrl) {
202 if ($this->isBrowsable($publicDir, $publicUrl)) {
203 $msg = 'Directory <a href="%1">%2</a> should not be browseable via the web.'
205 '<a href="%3">Read more about this warning</a>';
206 $docs_url = $this->createDocUrl('checkDirectoriesAreNotBrowseable');
207 $messages[] = new CRM_Utils_Check_Message(
208 'checkDirectoriesAreNotBrowseable',
209 ts($msg, array(1 => $publicDir, 2 => $publicDir, 3 => $docs_url)),
210 ts('Browseable Directories'),
211 \Psr\Log\LogLevel
::ERROR
221 * Check that some files are not present.
223 * These files have generally been deleted but Civi source tree but could be
224 * left online if one does a faulty upgrade.
226 * @return array of messages
228 public function checkFilesAreNotPresent() {
229 global $civicrm_root;
234 "{$civicrm_root}/packages/dompdf/dompdf.php", // CRM-16005, upgraded from Civi <= 4.5.6
235 \Psr\Log\LogLevel
::CRITICAL
,
238 "{$civicrm_root}/packages/vendor/dompdf/dompdf/dompdf.php", // CRM-16005, Civi >= 4.5.7
239 \Psr\Log\LogLevel
::CRITICAL
,
242 "{$civicrm_root}/vendor/dompdf/dompdf/dompdf.php", // CRM-16005, Civi >= 4.6.0
243 \Psr\Log\LogLevel
::CRITICAL
,
246 "{$civicrm_root}/packages/OpenFlashChart/php-ofc-library/ofc_upload_image.php", // CIVI-SA-2013-001
247 \Psr\Log\LogLevel
::CRITICAL
,
250 "{$civicrm_root}/packages/html2text/class.html2text.inc",
251 \Psr\Log\LogLevel
::CRITICAL
,
254 foreach ($files as $file) {
255 if (file_exists($file[0])) {
256 $messages[] = new CRM_Utils_Check_Message(
257 'checkFilesAreNotPresent',
258 ts('File \'%1\' presents a security risk and should be deleted.', array(1 => $file)),
268 * Check that the sysadmin has not modified the Cxn
271 public function checkCxnOverrides() {
273 if (defined('CIVICRM_CXN_CA') && CIVICRM_CXN_CA
!== 'CiviRootCA') {
274 $list[] = 'CIVICRM_CXN_CA';
276 if (defined('CIVICRM_CXN_APPS_URL') && CIVICRM_CXN_APPS_URL
!== \Civi\Cxn\Rpc\Constants
::OFFICIAL_APPMETAS_URL
) {
277 $list[] = 'CIVICRM_CXN_APPS_URL';
283 $messages[] = new CRM_Utils_Check_Message(
285 ts('The system administrator has disabled security settings (%1). Connections to remote applications are insecure.', array(
286 1 => implode(', ', $list),
288 ts('Security Warning')
296 * Determine whether $url is a public, browsable listing for $dir
304 public function isBrowsable($dir, $url) {
305 if (empty($dir) ||
empty($url) ||
!is_dir($dir)) {
310 $file = 'delete-this-' . CRM_Utils_String
::createRandom(10, CRM_Utils_String
::ALPHANUMERIC
);
312 // this could be a new system with no uploads (yet) -- so we'll make a file
313 file_put_contents("$dir/$file", "delete me");
314 $content = @file_get_contents
("$url");
315 if (stristr($content, $file)) {
318 unlink("$dir/$file");
324 * Determine whether $url is a public version of $dir in which files
325 * are remotely accessible.
333 public function isDirAccessible($dir, $url) {
334 $dir = rtrim($dir, '/');
335 $url = rtrim($url, '/');
336 if (empty($dir) ||
empty($url) ||
!is_dir($dir)) {
341 $file = 'delete-this-' . CRM_Utils_String
::createRandom(10, CRM_Utils_String
::ALPHANUMERIC
);
343 // this could be a new system with no uploads (yet) -- so we'll make a file
344 file_put_contents("$dir/$file", "delete me");
346 $headers = @get_headers
("$url/$file");
347 if (stripos($headers[0], '200')) {
348 $content = @file_get_contents
("$url/$file");
349 if (preg_match('/delete me/', $content)) {
354 unlink("$dir/$file");
364 public function createDocUrl($topic) {
365 return CRM_Utils_System
::getWikiBaseURL() . $topic;
369 * Make a guess about the URL that corresponds to $targetDir.
371 * @param string $targetDir
372 * Local path to a directory.
374 * a guessed URL for $realDir
376 public function guessUrl($targetDir) {
377 $filePathMarker = $this->getFilePathMarker();
378 $config = CRM_Core_Config
::singleton();
380 list ($heuristicBaseUrl, $ignore) = explode($filePathMarker, $config->imageUploadURL
);
381 list ($ignore, $heuristicSuffix) = explode($filePathMarker, str_replace('\\', '/', $targetDir));
382 return $heuristicBaseUrl . $filePathMarker . $heuristicSuffix;