1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
declare(strict_types=1); |
4
|
|
|
|
5
|
|
|
/* |
6
|
|
|
* This file is part of the Zikula package. |
7
|
|
|
* |
8
|
|
|
* Copyright Zikula Foundation - https://ziku.la/ |
9
|
|
|
* |
10
|
|
|
* For the full copyright and license information, please view the LICENSE |
11
|
|
|
* file that was distributed with this source code. |
12
|
|
|
*/ |
13
|
|
|
|
14
|
|
|
namespace Zikula\SecurityCenterModule; |
15
|
|
|
|
16
|
|
|
use Doctrine\Persistence\ManagerRegistry; |
17
|
|
|
use Exception; |
18
|
|
|
use Symfony\Component\HttpFoundation\RequestStack; |
19
|
|
|
use Symfony\Contracts\Translation\TranslatorInterface; |
20
|
|
|
use Zikula\Bundle\CoreBundle\CacheClearer; |
21
|
|
|
use Zikula\Bundle\CoreBundle\Doctrine\Helper\SchemaHelper; |
22
|
|
|
use Zikula\Bundle\CoreBundle\DynamicConfigDumper; |
23
|
|
|
use Zikula\Bundle\CoreBundle\HttpKernel\ZikulaKernel; |
24
|
|
|
use Zikula\ExtensionsModule\AbstractExtension; |
25
|
|
|
use Zikula\ExtensionsModule\Api\ApiInterface\VariableApiInterface; |
26
|
|
|
use Zikula\ExtensionsModule\Api\VariableApi; |
27
|
|
|
use Zikula\ExtensionsModule\Installer\AbstractExtensionInstaller; |
28
|
|
|
use Zikula\SecurityCenterModule\Api\ApiInterface\HtmlFilterApiInterface; |
29
|
|
|
use Zikula\SecurityCenterModule\Entity\IntrusionEntity; |
30
|
|
|
use Zikula\SecurityCenterModule\Helper\PurifierHelper; |
31
|
|
|
|
32
|
|
|
/** |
33
|
|
|
* Installation routines for the security center module. |
34
|
|
|
*/ |
35
|
|
|
class SecurityCenterModuleInstaller extends AbstractExtensionInstaller |
36
|
|
|
{ |
37
|
|
|
/** |
38
|
|
|
* @var DynamicConfigDumper |
39
|
|
|
*/ |
40
|
|
|
private $configDumper; |
41
|
|
|
|
42
|
|
|
/** |
43
|
|
|
* @var CacheClearer |
44
|
|
|
*/ |
45
|
|
|
private $cacheClearer; |
46
|
|
|
|
47
|
|
|
/** |
48
|
|
|
* @var PurifierHelper |
49
|
|
|
*/ |
50
|
|
|
private $purifierHelper; |
51
|
|
|
|
52
|
|
|
public function __construct( |
53
|
|
|
DynamicConfigDumper $configDumper, |
54
|
|
|
CacheClearer $cacheClearer, |
55
|
|
|
PurifierHelper $purifierHelper, |
56
|
|
|
AbstractExtension $extension, |
57
|
|
|
ManagerRegistry $managerRegistry, |
58
|
|
|
SchemaHelper $schemaTool, |
59
|
|
|
RequestStack $requestStack, |
60
|
|
|
TranslatorInterface $translator, |
61
|
|
|
VariableApiInterface $variableApi |
62
|
|
|
) { |
63
|
|
|
$this->configDumper = $configDumper; |
64
|
|
|
$this->cacheClearer = $cacheClearer; |
65
|
|
|
$this->purifierHelper = $purifierHelper; |
66
|
|
|
parent::__construct($extension, $managerRegistry, $schemaTool, $requestStack, $translator, $variableApi); |
67
|
|
|
} |
68
|
|
|
|
69
|
|
|
|
70
|
|
|
public function install(): bool |
71
|
|
|
{ |
72
|
|
|
// create the table |
73
|
|
|
try { |
74
|
|
|
$this->schemaTool->create([ |
75
|
|
|
IntrusionEntity::class |
76
|
|
|
]); |
77
|
|
|
} catch (Exception $exception) { |
78
|
|
|
return false; |
79
|
|
|
} |
80
|
|
|
|
81
|
|
|
// Set up an initial value for a module variable. |
82
|
|
|
$this->setVar('itemsperpage', 10); |
83
|
|
|
|
84
|
|
|
// We use config vars for the rest of the configuration as config vars |
85
|
|
|
$this->setSystemVar('updatecheck', 1); |
86
|
|
|
$this->setSystemVar('updatefrequency', 7); |
87
|
|
|
$this->setSystemVar('updatelastchecked', 0); |
88
|
|
|
$this->setSystemVar('updateversion', ZikulaKernel::VERSION); |
89
|
|
|
$this->setSystemVar('secure_domain'); |
90
|
|
|
$this->setSystemVar('signcookies', 1); |
91
|
|
|
$this->setSystemVar('signingkey', sha1((string) (random_int(0, time())))); |
92
|
|
|
$this->setSystemVar('seclevel', 'Medium'); |
93
|
|
|
$this->setSystemVar('secmeddays', 7); |
94
|
|
|
$this->setSystemVar('secinactivemins', 20); |
95
|
|
|
$this->setSystemVar('sessionstoretofile', Constant::SESSION_STORAGE_FILE); |
96
|
|
|
$this->setSystemVar('sessionsavepath'); |
97
|
|
|
$this->setSystemVar('gc_probability', 100); |
98
|
|
|
$this->setSystemVar('sessionregenerate', 1); |
99
|
|
|
$this->setSystemVar('sessionregeneratefreq', 10); |
100
|
|
|
$this->setSystemVar('sessionname', '_zsid'); |
101
|
|
|
|
102
|
|
|
$this->setSystemVar('filtergetvars', 1); |
103
|
|
|
$this->setSystemVar('filterpostvars', 1); |
104
|
|
|
$this->setSystemVar('filtercookievars', 1); |
105
|
|
|
|
106
|
|
|
// HTML Purifier cache dir |
107
|
|
|
$this->cacheClearer->clear('purifier'); |
108
|
|
|
|
109
|
|
|
// HTML Purifier default settings |
110
|
|
|
$purifierDefaultConfig = $this->purifierHelper->getPurifierConfig(['forcedefault' => true]); |
111
|
|
|
$this->setVar('htmlpurifierConfig', serialize($purifierDefaultConfig)); |
112
|
|
|
|
113
|
|
|
// create vars for phpids usage |
114
|
|
|
$this->setSystemVar('useids', 0); |
115
|
|
|
$this->setSystemVar('idsmail', 0); |
116
|
|
|
$this->setSystemVar('idsrulepath', 'system/SecurityCenterModule/Resources/config/phpids_zikula_default.xml'); |
117
|
|
|
$this->setSystemVar('idssoftblock', 1); // do not block requests, but warn for debugging |
118
|
|
|
$this->setSystemVar('idsfilter', 'xml'); // filter type |
119
|
|
|
$this->setSystemVar('idsimpactthresholdone', 1); // db logging |
120
|
|
|
$this->setSystemVar('idsimpactthresholdtwo', 10); // mail admin |
121
|
|
|
$this->setSystemVar('idsimpactthresholdthree', 25); // block request |
122
|
|
|
$this->setSystemVar('idsimpactthresholdfour', 75); // kick user, destroy session |
123
|
|
|
$this->setSystemVar('idsimpactmode', 1); // per request per default |
124
|
|
|
$this->setSystemVar('idshtmlfields', ['POST.__wysiwyg']); |
125
|
|
|
$this->setSystemVar('idsjsonfields', ['POST.__jsondata']); |
126
|
|
|
$this->setSystemVar('idsexceptions', [ |
127
|
|
|
'GET.__utmz', |
128
|
|
|
'GET.__utmc', |
129
|
|
|
'REQUEST.linksorder', 'POST.linksorder', |
130
|
|
|
'REQUEST.fullcontent', 'POST.fullcontent', |
131
|
|
|
'REQUEST.summarycontent', 'POST.summarycontent', |
132
|
|
|
'REQUEST.filter.page', 'POST.filter.page', |
133
|
|
|
'REQUEST.filter.value', 'POST.filter.value' |
134
|
|
|
]); |
135
|
|
|
|
136
|
|
|
$this->setSystemVar('outputfilter', 1); |
137
|
|
|
|
138
|
|
|
$this->setSystemVar('htmlentities', 1); |
139
|
|
|
|
140
|
|
|
// default values for AllowableHTML |
141
|
|
|
$defhtml = [ |
142
|
|
|
'!--' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
143
|
|
|
'a' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
144
|
|
|
'abbr' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
145
|
|
|
'acronym' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
146
|
|
|
'address' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
147
|
|
|
'applet' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
148
|
|
|
'area' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
149
|
|
|
'article' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
150
|
|
|
'aside' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
151
|
|
|
'audio' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
152
|
|
|
'b' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
153
|
|
|
'base' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
154
|
|
|
'basefont' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
155
|
|
|
'bdo' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
156
|
|
|
'big' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
157
|
|
|
'blockquote' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
158
|
|
|
'br' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
159
|
|
|
'button' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
160
|
|
|
'canvas' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
161
|
|
|
'caption' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
162
|
|
|
'center' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
163
|
|
|
'cite' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
164
|
|
|
'code' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
165
|
|
|
'col' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
166
|
|
|
'colgroup' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
167
|
|
|
'command' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
168
|
|
|
'datalist' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
169
|
|
|
'dd' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
170
|
|
|
'del' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
171
|
|
|
'details' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
172
|
|
|
'dfn' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
173
|
|
|
'dir' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
174
|
|
|
'div' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
175
|
|
|
'dl' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
176
|
|
|
'dt' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
177
|
|
|
'em' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
178
|
|
|
'embed' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
179
|
|
|
'fieldset' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
180
|
|
|
'figcaption' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
181
|
|
|
'figure' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
182
|
|
|
'footer' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
183
|
|
|
'font' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
184
|
|
|
'form' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
185
|
|
|
'h1' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
186
|
|
|
'h2' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
187
|
|
|
'h3' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
188
|
|
|
'h4' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
189
|
|
|
'h5' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
190
|
|
|
'h6' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
191
|
|
|
'header' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
192
|
|
|
'hgroup' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
193
|
|
|
'hr' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
194
|
|
|
'i' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
195
|
|
|
'iframe' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
196
|
|
|
'img' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
197
|
|
|
'input' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
198
|
|
|
'ins' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
199
|
|
|
'keygen' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
200
|
|
|
'kbd' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
201
|
|
|
'label' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
202
|
|
|
'legend' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
203
|
|
|
'li' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
204
|
|
|
'map' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
205
|
|
|
'mark' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
206
|
|
|
'menu' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
207
|
|
|
'marquee' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
208
|
|
|
'meter' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
209
|
|
|
'nav' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
210
|
|
|
'nobr' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
211
|
|
|
'object' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
212
|
|
|
'ol' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
213
|
|
|
'optgroup' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
214
|
|
|
'option' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
215
|
|
|
'output' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
216
|
|
|
'p' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
217
|
|
|
'param' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
218
|
|
|
'pre' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
219
|
|
|
'progress' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
220
|
|
|
'q' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
221
|
|
|
'rp' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
222
|
|
|
'rt' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
223
|
|
|
'ruby' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
224
|
|
|
's' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
225
|
|
|
'samp' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
226
|
|
|
'script' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
227
|
|
|
'section' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
228
|
|
|
'select' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
229
|
|
|
'small' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
230
|
|
|
'source' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
231
|
|
|
'span' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
232
|
|
|
'strike' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
233
|
|
|
'strong' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
234
|
|
|
'sub' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
235
|
|
|
'summary' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
236
|
|
|
'sup' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
237
|
|
|
'table' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
238
|
|
|
'tbody' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
239
|
|
|
'td' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
240
|
|
|
'textarea' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
241
|
|
|
'tfoot' => HtmlFilterApiInterface::TAG_ALLOWED_PLAIN, |
242
|
|
|
'th' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
243
|
|
|
'thead' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
244
|
|
|
'time' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
245
|
|
|
'tr' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
246
|
|
|
'tt' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
247
|
|
|
'u' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
248
|
|
|
'ul' => HtmlFilterApiInterface::TAG_ALLOWED_WITH_ATTRIBUTES, |
249
|
|
|
'var' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
250
|
|
|
'video' => HtmlFilterApiInterface::TAG_NOT_ALLOWED, |
251
|
|
|
'wbr' => HtmlFilterApiInterface::TAG_NOT_ALLOWED |
252
|
|
|
]; |
253
|
|
|
$this->setSystemVar('AllowableHTML', $defhtml); |
254
|
|
|
|
255
|
|
|
// Initialisation successful |
256
|
|
|
return true; |
257
|
|
|
} |
258
|
|
|
|
259
|
|
|
public function upgrade(string $oldVersion): bool |
260
|
|
|
{ |
261
|
|
|
switch ($oldVersion) { |
262
|
|
|
case '1.5.0': |
263
|
|
|
// avoid storing absolute pathes in module vars |
264
|
|
|
|
265
|
|
|
// delete obsolete variable |
266
|
|
|
$this->getVariableApi()->del(VariableApi::CONFIG, 'htmlpurifierlocation'); |
267
|
|
|
|
268
|
|
|
// only update this value if it has not been customised |
269
|
|
|
if (false !== mb_strpos($this->getVariableApi()->get(VariableApi::CONFIG, 'idsrulepath'), 'phpids_zikula_default')) { |
|
|
|
|
270
|
|
|
$this->setSystemVar('idsrulepath', 'system/SecurityCenterModule/Resources/config/phpids_zikula_default.xml'); |
271
|
|
|
} |
272
|
|
|
case '1.5.1': |
273
|
|
|
// set the session information in /config/dynamic/generated.yaml |
274
|
|
|
$sessionStoreToFile = $this->getVariableApi()->getSystemVar('sessionstoretofile', Constant::SESSION_STORAGE_DATABASE); |
275
|
|
|
$sessionHandlerId = Constant::SESSION_STORAGE_FILE === $sessionStoreToFile ? 'session.handler.native_file' : 'zikula_core.bridge.http_foundation.doctrine_session_handler'; |
276
|
|
|
$this->configDumper->setParameter('zikula.session.handler_id', $sessionHandlerId); |
277
|
|
|
$sessionStorageId = Constant::SESSION_STORAGE_FILE === $sessionStoreToFile ? 'zikula_core.bridge.http_foundation.zikula_session_storage_file' : 'zikula_core.bridge.http_foundation.zikula_session_storage_doctrine'; |
278
|
|
|
$this->configDumper->setParameter('zikula.session.storage_id', $sessionStorageId); // Symfony default is 'session.storage.native' |
279
|
|
|
$sessionSavePath = $this->getVariableApi()->getSystemVar('sessionsavepath', ''); |
280
|
|
|
$zikulaSessionSavePath = empty($sessionSavePath) ? '%kernel.cache_dir%/sessions' : $sessionSavePath; |
281
|
|
|
$this->configDumper->setParameter('zikula.session.save_path', $zikulaSessionSavePath); |
282
|
|
|
case '1.5.2': |
283
|
|
|
$varsToRemove = [ |
284
|
|
|
'sessioncsrftokenonetime', |
285
|
|
|
'sessionipcheck', |
286
|
|
|
'keyexpiry', |
287
|
|
|
'sessionauthkeyua', |
288
|
|
|
'gc_probability', |
289
|
|
|
'sessionrandregenerate', |
290
|
|
|
'sessionregenerate', |
291
|
|
|
'sessionregeneratefreq' |
292
|
|
|
]; |
293
|
|
|
foreach ($varsToRemove as $varName) { |
294
|
|
|
$this->getVariableApi()->del(VariableApi::CONFIG, $varName); |
295
|
|
|
} |
296
|
|
|
case '1.5.3': |
297
|
|
|
// current version |
298
|
|
|
} |
299
|
|
|
|
300
|
|
|
// Update successful |
301
|
|
|
return true; |
302
|
|
|
} |
303
|
|
|
|
304
|
|
|
public function uninstall(): bool |
305
|
|
|
{ |
306
|
|
|
// this module can't be uninstalled |
307
|
|
|
return false; |
308
|
|
|
} |
309
|
|
|
|
310
|
|
|
private function setSystemVar(string $name, $value = ''): bool |
311
|
|
|
{ |
312
|
|
|
return $this->getVariableApi()->set(VariableApi::CONFIG, $name, $value); |
313
|
|
|
} |
314
|
|
|
} |
315
|
|
|
|