123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491 |
- <?php
- use Chamilo\CoreBundle\Component\HTMLPurifier\Filter\AllowIframes;
- class Security
- {
- public static $clean = array();
-
- public static function check_abs_path($abs_path, $checker_path)
- {
-
- if (empty($checker_path)) {
- return false;
- }
- $true_path = str_replace("\\", '/', realpath($abs_path));
- $checker_path = str_replace("\\", '/', realpath($checker_path));
- if (empty($checker_path)) {
- return false;
- }
- $found = strpos($true_path.'/', $checker_path);
- if ($found === 0) {
- return true;
- } else {
-
- if (api_is_windows_os()) {
- $found = stripos($true_path.'/', $checker_path);
- if ($found === 0) {
- return true;
- }
- }
- }
- return false;
- }
-
- public static function check_rel_path($rel_path, $checker_path)
- {
-
- if (empty($checker_path)) {
- return false;
- }
- $current_path = getcwd();
- if (substr($rel_path, -1, 1) != '/') {
- $rel_path = '/'.$rel_path;
- }
- $abs_path = $current_path.$rel_path;
- $true_path = str_replace("\\", '/', realpath($abs_path));
- $found = strpos($true_path.'/', $checker_path);
- if ($found === 0) {
- return true;
- }
- return false;
- }
-
- public static function filter_filename($filename)
- {
- return disable_dangerous_file($filename);
- }
-
- public static function check_token($request_type = 'post')
- {
- switch ($request_type) {
- case 'request':
- if (isset($_SESSION['sec_token']) && isset($_REQUEST['sec_token']) && $_SESSION['sec_token'] === $_REQUEST['sec_token']) {
- return true;
- }
- return false;
- case 'get':
- if (isset($_SESSION['sec_token']) && isset($_GET['sec_token']) && $_SESSION['sec_token'] === $_GET['sec_token']) {
- return true;
- }
- return false;
- case 'post':
- if (isset($_SESSION['sec_token']) && isset($_POST['sec_token']) && $_SESSION['sec_token'] === $_POST['sec_token']) {
- return true;
- }
- return false;
- default:
- if (isset($_SESSION['sec_token']) && isset($request_type) && $_SESSION['sec_token'] === $request_type) {
- return true;
- }
- return false;
- }
- return false;
- }
-
- public static function check_ua()
- {
- if (isset($_SESSION['sec_ua']) && $_SESSION['sec_ua'] === $_SERVER['HTTP_USER_AGENT'].$_SESSION['sec_ua_seed']) {
- return true;
- }
- return false;
- }
-
- public static function clear_token()
- {
- $_SESSION['sec_token'] = null;
- unset($_SESSION['sec_token']);
- }
-
- public static function get_HTML_token()
- {
- $token = md5(uniqid(rand(), true));
- $string = '<input type="hidden" name="sec_token" value="'.$token.'" />';
- $_SESSION['sec_token'] = $token;
- return $string;
- }
-
- public static function get_token()
- {
- $token = md5(uniqid(rand(), true));
- $_SESSION['sec_token'] = $token;
- return $token;
- }
-
- public static function get_existing_token()
- {
- if (isset($_SESSION['sec_token']) && !empty($_SESSION['sec_token'])) {
- return $_SESSION['sec_token'];
- } else {
- return self::get_token();
- }
- }
-
- public static function get_ua()
- {
- $_SESSION['sec_ua_seed'] = uniqid(rand(), true);
- $_SESSION['sec_ua'] = $_SERVER['HTTP_USER_AGENT'].$_SESSION['sec_ua_seed'];
- }
-
- public static function get($varname)
- {
- if (isset(self::$clean[$varname])) {
- return self::$clean[$varname];
- }
- return null;
- }
-
- public static function remove_XSS($var, $user_status = null, $filter_terms = false)
- {
- if ($filter_terms) {
- $var = self::filter_terms($var);
- }
- if (empty($user_status)) {
- if (api_is_anonymous()) {
- $user_status = ANONYMOUS;
- } else {
- if (api_is_allowed_to_edit()) {
- $user_status = COURSEMANAGER;
- } else {
- $user_status = STUDENT;
- }
- }
- }
- if ($user_status == COURSEMANAGERLOWSECURITY) {
- return $var;
- }
- static $purifier = array();
- if (!isset($purifier[$user_status])) {
- $cache_dir = api_get_path(SYS_ARCHIVE_PATH).'Serializer';
- if (!file_exists($cache_dir)) {
- mkdir($cache_dir, 0777);
- }
- $config = HTMLPurifier_Config::createDefault();
- $config->set('Cache.SerializerPath', $cache_dir);
- $config->set('Core.Encoding', api_get_system_encoding());
- $config->set('HTML.Doctype', 'XHTML 1.0 Transitional');
- $config->set('HTML.MaxImgLength', '2560');
- $config->set('HTML.TidyLevel', 'light');
- $config->set('Core.ConvertDocumentToFragment', false);
- $config->set('Core.RemoveProcessingInstructions', true);
- if (api_get_setting('enable_iframe_inclusion') == 'true') {
- $config->set('Filter.Custom', array(new AllowIframes()));
- }
-
- $config->set('Attr.AllowedFrameTargets', array('_blank', '_top', '_self', '_parent'));
- if ($user_status == STUDENT) {
- global $allowed_html_student;
- $config->set('HTML.SafeEmbed', true);
- $config->set('HTML.SafeObject', true);
- $config->set('Filter.YouTube', true);
- $config->set('HTML.FlashAllowFullScreen', true);
- $config->set('HTML.Allowed', $allowed_html_student);
- } elseif ($user_status == COURSEMANAGER) {
- global $allowed_html_teacher;
- $config->set('HTML.SafeEmbed', true);
- $config->set('HTML.SafeObject', true);
- $config->set('Filter.YouTube', true);
- $config->set('HTML.FlashAllowFullScreen', true);
- $config->set('HTML.Allowed', $allowed_html_teacher);
- } else {
- global $allowed_html_anonymous;
- $config->set('HTML.Allowed', $allowed_html_anonymous);
- }
-
- $config->set('Attr.EnableID', true);
- $config->set('CSS.AllowImportant', true);
-
- $config->set('CSS.AllowTricky', true);
- $config->set('CSS.Proprietary', true);
-
- $config->set('URI.AllowedSchemes', array(
- 'http' => true,
- 'https' => true,
- 'mailto' => true,
- 'ftp' => true,
- 'nntp' => true,
- 'news' => true,
- 'data' => true,
- ));
- $purifier[$user_status] = new HTMLPurifier($config);
- }
- if (is_array($var)) {
- return $purifier[$user_status]->purifyArray($var);
- } else {
- return $purifier[$user_status]->purify($var);
- }
- }
-
- public static function filter_terms($text)
- {
- static $bad_terms = array();
- if (empty($bad_terms)) {
- $list = api_get_setting('filter_terms');
- if (!empty($list)) {
- $list = explode("\n", $list);
- $list = array_filter($list);
- if (!empty($list)) {
- foreach ($list as $term) {
- $term = str_replace(array("\r\n", "\r", "\n", "\t"), '', $term);
- $html_entities_value = api_htmlentities($term, ENT_QUOTES, api_get_system_encoding());
- $bad_terms[] = $term;
- if ($term != $html_entities_value) {
- $bad_terms[] = $html_entities_value;
- }
- }
- }
- $bad_terms = array_filter($bad_terms);
- }
- }
- $replace = '***';
- if (!empty($bad_terms)) {
-
- $new_text = str_ireplace($bad_terms, $replace, $text, $count);
- $text = $new_text;
- }
- return $text;
- }
-
- public static function filter_img_path($image_path)
- {
- static $allowed_extensions = array('png', 'gif', 'jpg', 'jpeg', 'svg', 'webp');
- $image_path = htmlspecialchars(trim($image_path));
-
- if (strpos($image_path, '?') !== false) {
- return '';
- }
- if (($pos = strpos($image_path, ':')) !== false) {
-
- if (stripos($image_path, 'javascript:') !== false) {
-
- return '';
- }
-
-
-
-
- if (stripos($image_path, 'http://') !== 0 && stripos($image_path, 'https://') !== 0) {
- return '';
- }
- }
-
-
-
-
- if (($pos = strrpos($image_path, '.')) !== false) {
- if (!in_array(strtolower(substr($image_path, $pos + 1)), $allowed_extensions)) {
- return '';
- }
- } else {
- return '';
- }
- return $image_path;
- }
-
- public static function getPasswordRequirements()
- {
-
- $requirements = [
- 'min' => [
- 'lowercase' => 0,
- 'uppercase' => 0,
- 'numeric' => 2,
- 'length' => 5
- ]
- ];
- $passwordRequirements = api_get_configuration_value('password_requirements');
- if (!empty($passwordRequirements)) {
- $requirements = $passwordRequirements;
- }
- return $requirements;
- }
-
- public static function getPasswordRequirementsToString($passedConditions = [])
- {
- $output = '';
- $setting = self::getPasswordRequirements();
- foreach ($setting as $type => $rules) {
- foreach ($rules as $rule => $parameter) {
- if (empty($parameter)) {
- continue;
- }
- $output .= sprintf(
- get_lang(
- 'NewPasswordRequirement'.ucfirst($type).'X'.ucfirst($rule)
- ),
- $parameter
- );
- $output .= '<br />';
- }
- }
- return $output;
- }
- }
|