Révision 6ae446a4
Ajouté par Assos Assos il y a environ 7 ans
drupal7/sites/all/modules/security_review/README.txt | ||
---|---|---|
80 | 80 |
Note, custom checks require that its module be enabled. Also, should you be |
81 | 81 |
skipping any check the 'store' option will not allow that check to be run. |
82 | 82 |
|
83 |
-- SITE AUDIT USAGE -- |
|
84 |
|
|
85 |
Security Review also integrates with https://www.drupal.org/project/site_audit , |
|
86 |
a static site analysis platform that generates reports with actionable best |
|
87 |
practice recommendations. Security Review can be installed on an entire |
|
88 |
platform, eliminating the need for module installation. |
|
89 |
|
|
90 |
To use, put Security Review either in your codebase or in your Drush command |
|
91 |
locations, then: |
|
92 |
|
|
93 |
# Clear Drush cache. |
|
94 |
drush cc drush |
|
95 |
# Audit security. |
|
96 |
drush audit_security |
|
97 |
|
|
98 |
### Marking field content as known to be safe |
|
99 |
|
|
100 |
The "Dangerous tags in content" check may indicate problems with fields that |
|
101 |
you known are safe. You can create a list of field contents and entities |
|
102 |
that you want to be skipped in future runs by creating a SHA-256 hash of the |
|
103 |
entity_id, entity_type, and field contents. See security_review_check_field |
|
104 |
function in security_review.inc for details. |
|
105 |
|
|
83 | 106 |
-- SUPPORT -- |
84 | 107 |
|
85 |
Please use the issue queue at http://drupal.org/project/security_review for all |
|
108 |
Please use the issue queue at https://drupal.org/project/security_review for all
|
|
86 | 109 |
module support. You can read more about securely configuring your site at |
87 | 110 |
http://drupal.org/security/secure-configuration and http://drupalscout.com |
88 | 111 |
|
drupal7/sites/all/modules/security_review/security_review.drush.inc | ||
---|---|---|
1 | 1 |
<?php |
2 |
|
|
3 | 2 |
/** |
4 | 3 |
* @file |
5 | 4 |
* Drush commands for Security Review module. |
... | ... | |
32 | 31 |
'secrev --store' => 'Run the checklist, store, and output the results', |
33 | 32 |
'secrev --lastrun' => 'Output the stored results from the last run of the checklist' |
34 | 33 |
), |
34 |
'outputformat' => array( |
|
35 |
'default' => 'table', |
|
36 |
'pipe-format' => 'csv', |
|
37 |
'fields-default' => array('message', 'status'), |
|
38 |
'field-labels' => array( |
|
39 |
'message' => 'Message', |
|
40 |
'status' => 'Status', |
|
41 |
'findings' => 'Findings', |
|
42 |
), |
|
43 |
'output-data-type' => 'format-table', |
|
44 |
), |
|
35 | 45 |
); |
46 |
|
|
36 | 47 |
$items['password-check-setup'] = array( |
37 | 48 |
'callback' => 'security_review_drush_hash_setup', |
38 | 49 |
'aliases' => array('passset'), |
... | ... | |
90 | 101 |
$show_results = FALSE; |
91 | 102 |
} |
92 | 103 |
|
104 |
$output = array(); |
|
93 | 105 |
if (!$lastrun) { |
94 | 106 |
if (!empty($specific_checks)) { |
95 | 107 |
// Get specified checks. |
... | ... | |
148 | 160 |
if ($store) { |
149 | 161 |
security_review_store_results($checklist_results); |
150 | 162 |
} |
151 |
// Print results.
|
|
163 |
// Compile results.
|
|
152 | 164 |
foreach ($checklist_results as $module => $checks) { |
153 | 165 |
foreach ($checks as $check_name => $check) { |
154 |
_security_review_drush_print_result($check, $short_titles, $show_results); |
|
166 |
if ($result = _security_review_drush_format_result($check, $short_titles, $show_results)) { |
|
167 |
$output[$module . '-' . $check_name] = $result; |
|
168 |
} |
|
155 | 169 |
} |
156 | 170 |
} |
157 | 171 |
} |
158 | 172 |
elseif ($lastrun) { |
159 | 173 |
// Retrieve results from last run of the checklist. |
160 | 174 |
$results = security_review_get_stored_results(); |
161 |
// Print results.
|
|
175 |
// Compile results.
|
|
162 | 176 |
if (!empty($results)) { |
163 | 177 |
foreach ($results as $result) { |
164 | 178 |
if (isset($checklist[$result['namespace']][$result['reviewcheck']])) { |
165 | 179 |
$check = array_merge($result, $checklist[$result['namespace']][$result['reviewcheck']]); |
166 |
_security_review_drush_print_result($check, $short_titles, $show_results); |
|
180 |
if ($result = _security_review_drush_format_result($check, $short_titles, $show_results)) { |
|
181 |
$output[$check['namespace'] . '-' . $check['reviewcheck']] = $result; |
|
182 |
} |
|
167 | 183 |
} |
168 | 184 |
} |
169 | 185 |
} |
170 | 186 |
} |
187 |
|
|
188 |
return $output; |
|
171 | 189 |
} |
172 | 190 |
|
173 | 191 |
/** |
174 |
* Helper function to print Security Review results using drush_log().
|
|
192 |
* Helper function to format Security Review results.
|
|
175 | 193 |
* |
176 | 194 |
* @param array $check |
177 | 195 |
* Check array with keys 'title', 'success', 'failure', 'result' |
... | ... | |
180 | 198 |
* message. |
181 | 199 |
* @param boolean $show_results |
182 | 200 |
* Whether to print failed check results. |
183 |
* @return NULL |
|
201 |
* |
|
202 |
* @return array|NULL |
|
203 |
* An array with the security review check's result, or NULL if no result. |
|
184 | 204 |
*/ |
185 |
function _security_review_drush_print_result($check, $short_titles = FALSE, $show_results = FALSE) {
|
|
205 |
function _security_review_drush_format_result($check, $short_titles = FALSE, $show_results = FALSE) {
|
|
186 | 206 |
if (is_null($check['result'])) { |
187 | 207 |
// Do nothing if result is NULL. |
188 | 208 |
return; |
... | ... | |
191 | 211 |
$element = $short_titles ? 'title' : 'success'; |
192 | 212 |
$message = $check[$element]; |
193 | 213 |
$status = 'success'; |
214 |
$findings = $check['value']; |
|
194 | 215 |
} |
195 | 216 |
else { |
196 | 217 |
$element = $short_titles ? 'title' : 'failure'; |
197 | 218 |
$message = $check[$element]; |
198 |
if ($show_results) { |
|
199 |
$results = _security_review_drush_findings_output($check); |
|
200 |
if (!empty($results)) { |
|
201 |
$message .= "\n"; |
|
202 |
foreach ($results as $item) { |
|
203 |
$message .= "\t" . $item . "\n"; |
|
204 |
} |
|
219 |
$findings = $check['value']; |
|
220 |
if ($show_results && !empty($findings)) { |
|
221 |
$message .= "\n"; |
|
222 |
foreach (_security_review_drush_findings_output($check) as $item) { |
|
223 |
$message .= "\t" . $item . "\n"; |
|
205 | 224 |
} |
206 | 225 |
} |
207 | 226 |
$status = 'error'; |
208 | 227 |
} |
209 |
drush_log($message, $status); |
|
228 |
|
|
229 |
return array( |
|
230 |
'message' => $message, |
|
231 |
'status' => $status, |
|
232 |
'findings' => $findings, |
|
233 |
); |
|
210 | 234 |
} |
211 | 235 |
|
212 | 236 |
function _security_review_drush_findings_output($check) { |
... | ... | |
290 | 314 |
drush_die('File not found'); |
291 | 315 |
} |
292 | 316 |
} |
317 |
|
|
318 |
/** |
|
319 |
* Implements hook_drush_command_alter(). |
|
320 |
*/ |
|
321 |
function security_review_drush_command_alter(&$command) { |
|
322 |
// Adds security_review checks to existing security report. |
|
323 |
if ($command['command'] == 'audit_security') { |
|
324 |
$security_review_checks = array( |
|
325 |
'FilePerms', |
|
326 |
'InputFormats', |
|
327 |
'Field', |
|
328 |
'ErrorReporting', |
|
329 |
'PrivateFiles', |
|
330 |
'UploadExtensions', |
|
331 |
'AdminPermissions', |
|
332 |
'ExecutablePhp', |
|
333 |
'BaseUrlSet', |
|
334 |
'TemporaryFiles', |
|
335 |
); |
|
336 |
foreach ($security_review_checks as $name) { |
|
337 |
$command['checks'][] = array( |
|
338 |
'name' => $name, |
|
339 |
'location' => __DIR__ . '/security_review.site_audit.inc', |
|
340 |
); |
|
341 |
} |
|
342 |
} |
|
343 |
} |
drupal7/sites/all/modules/security_review/security_review.help.inc | ||
---|---|---|
61 | 61 |
} |
62 | 62 |
|
63 | 63 |
function theme_security_review_help_options($element) { |
64 |
$output .= '<div class="sec-rev-help-option">';
|
|
64 |
$output = '<div class="sec-rev-help-option">'; |
|
65 | 65 |
$output .= l($element['problem'], 'admin/reports/security-review/help', array('fragment' => $element['type'], 'attributes' => array('class' => 'sec-rev-help-dyn'))); |
66 | 66 |
$output .= '<div class="sec-rev-help-content">'; |
67 | 67 |
$output .= '<p>' . $element['description'] . '</p>'; |
... | ... | |
209 | 209 |
$element['findings']['descriptions'][] = $skipped_message; |
210 | 210 |
} |
211 | 211 |
elseif ($check && $check['result'] == FALSE) { |
212 |
$element['findings']['descriptions'][] = t('The following IPs were observed with an abundanced of failed login attempts.');
|
|
212 |
$element['findings']['descriptions'][] = t('The following IPs were observed with an abundance of failed login attempts.'); |
|
213 | 213 |
foreach ($check['value'] as $ip) { |
214 | 214 |
$element['findings']['items'][] = array( |
215 | 215 |
'safe' => check_plain($ip), |
... | ... | |
247 | 247 |
|
248 | 248 |
function security_review_check_field_help($check = NULL, $skipped_message = NULL) { |
249 | 249 |
$element['title'] = t('Dangerous tags in content'); |
250 |
$element['descriptions'][] = t('Script and PHP code in content does not align with Drupal best practices and may be a vulnerability if an untrusted user is allowed to edit such content. It is recommended you remove such contents.'); |
|
250 |
$element['descriptions'][] = t('Script and PHP code in content does not align with Drupal best practices and may be a vulnerability if an untrusted user is allowed to edit such content. It is recommended you remove such contents or add the hash of the content to the security_review_known_risky_fields system variable (see the README.txt for more information).');
|
|
251 | 251 |
|
252 | 252 |
if (!empty($skipped_message)) { |
253 | 253 |
$element['findings']['descriptions'][] = $skipped_message; |
... | ... | |
271 | 271 |
$uri = $uri_callback($entity); |
272 | 272 |
$uri = url($uri['path'] . '/edit'); // @todo can this assumption be made? |
273 | 273 |
} |
274 |
$html = t('@description found in @field field of <a href="!link">@title</a>', array('@field' => $value[$entity->{$id}]['field'], '@description' => $value[$entity->{$id}]['type'], '!link' => $uri, '@title' => $entity->{$label}));
|
|
274 |
$html = t('@description found in @field field of <a href="!link">@title</a> (content hash: %hash).', array('@field' => $value[$entity->{$id}]['field'], '@description' => $value[$entity->{$id}]['type'], '!link' => $uri, '@title' => $entity->{$label}, '%hash' => $value[$entity->{$id}]['hash']));
|
|
275 | 275 |
$element['findings']['items'][] = array( |
276 | 276 |
'html' => $html, |
277 |
'safe' => t('@description in @field field of !url', array('@field' => $value[$entity->{$id}]['field'], '@description' => $value[$entity->{$id}], '!url' => $uri)), |
|
278 |
'raw' => $value[$entity->{$id}] . ':' . $uri, |
|
277 |
'safe' => t('@description in @field field of !url', array('@field' => $value[$entity->{$id}]['field'], '@description' => $value[$entity->{$id}]['type'], '!url' => $uri)),
|
|
278 |
'raw' => $value[$entity->{$id}]['field'] . ':' . $uri,
|
|
279 | 279 |
); |
280 | 280 |
} |
281 | 281 |
} |
... | ... | |
348 | 348 |
'raw' => $name, |
349 | 349 |
); |
350 | 350 |
} |
351 |
$element['findings']['pager'] = theme('pager', NULL, 20); |
|
351 |
//$element['findings']['pager'] = theme('pager', NULL, 20);
|
|
352 | 352 |
} |
353 | 353 |
|
354 | 354 |
return $element; |
drupal7/sites/all/modules/security_review/security_review.inc | ||
---|---|---|
158 | 158 |
'success' => t('Untrusted roles do not have administrative or trusted Drupal permissions.'), |
159 | 159 |
'failure' => t('Untrusted roles have been granted administrative or trusted Drupal permissions.'), |
160 | 160 |
); |
161 |
/*$checks['name_passwords'] = array(
|
|
161 |
$checks['name_passwords'] = array( |
|
162 | 162 |
'title' => t('Username as password'), |
163 | 163 |
'callback' => 'security_review_check_name_passwords', |
164 | 164 |
'success' => t('Trusted accounts do not have their password set to their username.'), |
165 | 165 |
'failure' => t('Some trusted accounts have set their password the same as their username.'), |
166 |
);*/
|
|
166 |
); |
|
167 | 167 |
// Check dependent on PHP filter being enabled. |
168 | 168 |
if (module_exists('php')) { |
169 | 169 |
$checks['untrusted_php'] = array( |
... | ... | |
471 | 471 |
foreach ($untrusted_permissions as $rid => $permissions) { |
472 | 472 |
$intersect = array_intersect($all_keys, array_keys($permissions)); |
473 | 473 |
foreach ($intersect as $permission) { |
474 |
if (isset($all_permissions[$permission]['restrict access'])) {
|
|
474 |
if (!empty($all_permissions[$permission]['restrict access'])) {
|
|
475 | 475 |
$check_result_value[$rid][] = $permission; |
476 | 476 |
} |
477 | 477 |
} |
... | ... | |
518 | 518 |
return array('result' => $check_result, 'value' => $check_result_value); |
519 | 519 |
} |
520 | 520 |
// Search for PHP or Javascript tags in text columns. |
521 |
$known_risky_fields = explode(',', variable_get('security_review_known_risky_fields', '')); |
|
521 | 522 |
foreach ($tables as $table => $info) { |
522 |
$sql = "SELECT DISTINCT entity_id, entity_type FROM {" . $table . "} WHERE " . $info['column'] . " LIKE :text"; |
|
523 |
// Column & table come from field definitions & are safe to use in a query. |
|
524 |
$sql = "SELECT DISTINCT entity_id, entity_type, " . $info['column'] . " AS field_text FROM {" . $table . "} WHERE " . $info['column'] . " LIKE :text"; |
|
523 | 525 |
// Handle changed? @todo |
524 | 526 |
foreach (array('Javascript' => '%<script%', 'PHP' => '%<?php%') as $vuln_type => $comparison) { |
525 | 527 |
$results = db_query($sql, array(':text' => $comparison)); // @pager query? |
526 | 528 |
foreach ($results as $result) { |
527 |
$check_result = FALSE; |
|
528 | 529 |
if (!isset($check_result_value[$result->entity_type]) || !array_key_exists($result->entity_id, $check_result_value[$result->entity_type])) { |
529 |
$check_result_value[$result->entity_type][$result->entity_id] = array( |
|
530 |
'type' => $vuln_type, |
|
531 |
'field' => $info['name'], |
|
532 |
); |
|
530 |
// Only alert on values that are not known to be safe. |
|
531 |
$hash = hash('sha256', implode((array) $result)); |
|
532 |
if (!in_array($hash, $known_risky_fields)) { |
|
533 |
$check_result = FALSE; |
|
534 |
$check_result_value[$result->entity_type][$result->entity_id] = array( |
|
535 |
'type' => $vuln_type, |
|
536 |
'field' => $info['name'], |
|
537 |
'hash' => $hash, |
|
538 |
); |
|
539 |
} |
|
533 | 540 |
} |
534 | 541 |
} |
535 | 542 |
} |
536 | 543 |
} |
537 |
|
|
538 | 544 |
return array('result' => $check_result, 'value' => $check_result_value); |
539 | 545 |
} |
540 | 546 |
|
... | ... | |
584 | 590 |
} |
585 | 591 |
|
586 | 592 |
function _security_review_weak_passwords($trusted_roles) { |
593 |
require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc'); |
|
594 |
|
|
587 | 595 |
$weak_users = array(); |
588 | 596 |
|
589 |
// Select users with a trusted role whose password is their username. |
|
590 |
// @todo need to generate passwords in PHP to get salt. |
|
591 |
$sql = "SELECT u.uid, u.name, COUNT(rid) AS count FROM {users} u LEFT JOIN |
|
592 |
{users_roles} ur ON u.uid = ur.uid AND ur.rid in (:rids) |
|
593 |
WHERE pass = md5(name) GROUP BY uid"; |
|
594 |
$results = db_query($sql, array(':rids' => $trusted_roles)); // @todo pager_query? |
|
597 |
// Select users with a trusted role. |
|
598 |
$query = db_select('users', 'u'); |
|
599 |
$query->leftJoin('users_roles', 'ur', 'u.uid = ur.uid AND ur.rid IN (:rids)', array(':rids' => $trusted_roles)); |
|
600 |
$query->fields('u', array('uid', 'name', 'pass')); |
|
601 |
$query->addExpression('COUNT(rid)', 'count'); |
|
602 |
$query->groupBy('u.uid'); |
|
603 |
$query->groupBy('u.name'); |
|
604 |
$query->groupBy('u.pass'); |
|
605 |
|
|
606 |
$results = $query->execute()->fetchAllAssoc('uid'); |
|
607 |
|
|
608 |
// Find users with the same password as their username. |
|
595 | 609 |
foreach ($results as $row) { |
596 |
$record[] = $row; |
|
597 |
if ($row->count > 0) { |
|
598 |
$weak_users[$row->uid] = $row->name; |
|
610 |
if ($row->count > 0 || $row->uid == 1) { |
|
611 |
// Make a psuedo account object to avoid loading the user. |
|
612 |
$account = (object)array( |
|
613 |
'uid' => $row->uid, |
|
614 |
'name' => $row->name, |
|
615 |
'pass' => $row->pass, |
|
616 |
); |
|
617 |
if (user_check_password($row->name, $account)) { |
|
618 |
$weak_users[$row->uid] = $row->name; |
|
619 |
} |
|
599 | 620 |
} |
600 | 621 |
} |
601 |
|
|
602 |
// Explicitly check uid 1 in case they have no roles. |
|
603 |
$weak_uid1 = db_fetch_object(db_query("SELECT u.uid, u.name, 1 AS count FROM {users} u WHERE pass = md5(name) AND uid = 1")); |
|
604 |
if (!empty($weak_uid1->count)) { |
|
605 |
$weak_users[$weak_uid1->uid] = $weak_uid1->name; |
|
606 |
} |
|
607 |
|
|
622 |
|
|
608 | 623 |
return $weak_users; |
609 | 624 |
} |
610 | 625 |
|
drupal7/sites/all/modules/security_review/security_review.info | ||
---|---|---|
4 | 4 |
files[] = tests/security_review.test |
5 | 5 |
configure = admin/reports/security-review/settings |
6 | 6 |
|
7 |
; Information added by Drupal.org packaging script on 2014-09-06
|
|
8 |
version = "7.x-1.2"
|
|
7 |
; Information added by Drupal.org packaging script on 2017-07-26
|
|
8 |
version = "7.x-1.3"
|
|
9 | 9 |
core = "7.x" |
10 | 10 |
project = "security_review" |
11 |
datestamp = "1410036834"
|
|
11 |
datestamp = "1501101849"
|
|
12 | 12 |
|
drupal7/sites/all/modules/security_review/security_review.install | ||
---|---|---|
10 | 10 |
* Implements hook_enable(). |
11 | 11 |
*/ |
12 | 12 |
function security_review_enable() { |
13 |
drupal_set_message(t('Security Review module enabled. You should first set the module access permissions at !link. Be sure to grant permissions to trusted users only as this module can show senstive site information.', array('!link' => l('admin/people/permissions', 'admin/people/permissions')))); |
|
13 |
drupal_set_message(t('Security Review module enabled. You should first set the module access permissions at !link. Be sure to grant permissions to trusted users only as this module can show sensitive site information.', array('!link' => l('admin/people/permissions', 'admin/people/permissions'))));
|
|
14 | 14 |
} |
15 | 15 |
|
16 | 16 |
/** |
drupal7/sites/all/modules/security_review/security_review.module | ||
---|---|---|
109 | 109 |
$checks[] = array( |
110 | 110 |
'namespace' => $record->namespace, |
111 | 111 |
'reviewcheck' => $record->reviewcheck, |
112 |
'result' => $record->result === '1' ? TRUE : FALSE,
|
|
112 |
'result' => $record->result == '1' ? TRUE : FALSE, |
|
113 | 113 |
'lastrun' => $record->lastrun, |
114 |
'skip' => $record->skip === '1' ? TRUE : FALSE,
|
|
114 |
'skip' => $record->skip == '1' ? TRUE : FALSE, |
|
115 | 115 |
'skiptime' => $record->skiptime, |
116 | 116 |
'skipuid' => $record->skipuid, |
117 | 117 |
); |
drupal7/sites/all/modules/security_review/security_review.pages.inc | ||
---|---|---|
337 | 337 |
* Helper function creates message for reporting check skip information. |
338 | 338 |
*/ |
339 | 339 |
function _security_review_check_skipped($last_check) { |
340 |
$account = array_pop(user_load_multiple(array($last_check['skipuid']))); |
|
340 |
$users = user_load_multiple(array($last_check['skipuid'])); |
|
341 |
$account = array_pop($users); |
|
341 | 342 |
$time = format_date($last_check['skiptime'], 'medium'); |
342 | 343 |
$message = t('Check marked for skipping on !time by !user', array('!time' => $time, '!user' => theme('username', array('account' => $account)))); |
343 | 344 |
return $message; |
... | ... | |
388 | 389 |
else { |
389 | 390 |
$output = _security_review_help(); |
390 | 391 |
// List all checks as links to specific help. |
391 |
$output .= '<h3>' . t('Check-specfic help') . '</h3>'; |
|
392 |
$output .= '<h3>' . t('Check-specific help') . '</h3>';
|
|
392 | 393 |
$output .= '<p>' . t("Details and help on the security review checks. Checks are not always perfectly correct in their procedure and result. Refer to drupal.org handbook documentation if you are unsure how to make the recommended alterations to your configuration or consult the module's README.txt for support.") . '</p>'; |
393 | 394 |
foreach ($checklist as $module => $checks) { |
394 | 395 |
foreach ($checks as $reviewcheck => $check) { |
drupal7/sites/all/modules/security_review/security_review.site_audit.inc | ||
---|---|---|
1 |
<?php |
|
2 |
/** |
|
3 |
* @file |
|
4 |
* Contains \SiteAudit\Check\Security security_review checks. |
|
5 |
*/ |
|
6 |
|
|
7 |
/** |
|
8 |
* Class SecurityReviewSiteAuditCheckAbstract |
|
9 |
*/ |
|
10 |
abstract class SecurityReviewSiteAuditCheckAbstract extends SiteAuditCheckAbstract { |
|
11 |
/** |
|
12 |
* The implementing module. |
|
13 |
* @var string |
|
14 |
*/ |
|
15 |
protected $module = 'security_review'; |
|
16 |
|
|
17 |
/** |
|
18 |
* The check in question. |
|
19 |
* @var string |
|
20 |
*/ |
|
21 |
protected $check; |
|
22 |
|
|
23 |
/** |
|
24 |
* Implements \SiteAudit\Check\Abstract\getLabel(). |
|
25 |
*/ |
|
26 |
public function getLabel() { |
|
27 |
$checks = security_review_get_checklist(); |
|
28 |
return $checks[$this->module][$this->check]['title']; |
|
29 |
} |
|
30 |
|
|
31 |
/** |
|
32 |
* Implements \SiteAudit\Check\Abstract\getDescription(). |
|
33 |
*/ |
|
34 |
public function getDescription() { |
|
35 |
$checks = security_review_get_checklist(); |
|
36 |
return dt('Security Check of @title', array( |
|
37 |
'@title' => $checks[$this->module][$this->check]['title'], |
|
38 |
)); |
|
39 |
} |
|
40 |
|
|
41 |
/** |
|
42 |
* Implements \SiteAudit\Check\Abstract\getResultFail(). |
|
43 |
*/ |
|
44 |
public function getResultFail() { |
|
45 |
$ret_val = $this->registry[$this->module][$this->check]['failure']; |
|
46 |
if (isset($this->registry[$this->module][$this->check]['value'])) { |
|
47 |
if (is_array($this->registry[$this->module][$this->check]['value'])) { |
|
48 |
$ret_val .= $this->generateUl($this->registry[$this->module][$this->check]['value'], drush_get_option('html')); |
|
49 |
} |
|
50 |
elseif ($this->registry[$this->module][$this->check]['value']) { |
|
51 |
$ret_val .= ' Additional: "' . $this->registry[$this->module][$this->check]['value'] . '"'; |
|
52 |
} |
|
53 |
} |
|
54 |
return $ret_val; |
|
55 |
} |
|
56 |
|
|
57 |
/** |
|
58 |
* Generates an unordered list or flattened text version of a nested array. |
|
59 |
* |
|
60 |
* @param array $array |
|
61 |
* Security Review results. |
|
62 |
* @param bool $html |
|
63 |
* TRUE if the result should be rendered as HTML. |
|
64 |
* @param int $indentation |
|
65 |
* The number of spaces; defaults to 6. |
|
66 |
* |
|
67 |
* @return string |
|
68 |
* Formatted result. |
|
69 |
*/ |
|
70 |
private function generateUl($array, $html = TRUE, $indentation = 6) { |
|
71 |
$result = $html ? '<ul>' : ''; |
|
72 |
foreach ($array as $key => $value) { |
|
73 |
$result .= $html ? '<li>' : PHP_EOL . str_repeat(' ', $indentation); |
|
74 |
$result .= $key . ': '; |
|
75 |
if (is_array($value)) { |
|
76 |
$result .= $this->generateUl($value, $html, $indentation + 2); |
|
77 |
} |
|
78 |
elseif (isset($value->name) && $value->name) { |
|
79 |
$result .= $value->name; |
|
80 |
} |
|
81 |
elseif ($value) { |
|
82 |
$result .= $value; |
|
83 |
} |
|
84 |
$result .= $html ? '</li>' : ''; |
|
85 |
} |
|
86 |
$result .= $html ? '</ul>' : ''; |
|
87 |
return $result; |
|
88 |
} |
|
89 |
|
|
90 |
/** |
|
91 |
* Implements \SiteAudit\Check\Abstract\getResultInfo(). |
|
92 |
*/ |
|
93 |
public function getResultInfo() {} |
|
94 |
|
|
95 |
/** |
|
96 |
* Implements \SiteAudit\Check\Abstract\getResultPass(). |
|
97 |
*/ |
|
98 |
public function getResultPass() { |
|
99 |
return $this->registry[$this->module][$this->check]['success']; |
|
100 |
} |
|
101 |
|
|
102 |
/** |
|
103 |
* Implements \SiteAudit\Check\Abstract\getResultWarn(). |
|
104 |
*/ |
|
105 |
public function getResultWarn() {} |
|
106 |
|
|
107 |
/** |
|
108 |
* Implements \SiteAudit\Check\Abstract\getAction(). |
|
109 |
*/ |
|
110 |
public function getAction() {} |
|
111 |
|
|
112 |
/** |
|
113 |
* Implements \SiteAudit\Check\Abstract\calculateScore(). |
|
114 |
*/ |
|
115 |
public function calculateScore() { |
|
116 |
$checks = security_review_get_checklist(); |
|
117 |
$checklist_results = security_review_run(array( |
|
118 |
$this->module => array($checks[$this->module][$this->check]), |
|
119 |
)); |
|
120 |
|
|
121 |
$this->registry[$this->module][$this->check] = $checklist_results['security_review'][0]; |
|
122 |
if (!$this->registry[$this->module][$this->check]['result']) { |
|
123 |
return SiteAuditCheckAbstract::AUDIT_CHECK_SCORE_FAIL; |
|
124 |
} |
|
125 |
else { |
|
126 |
return SiteAuditCheckAbstract::AUDIT_CHECK_SCORE_PASS; |
|
127 |
} |
|
128 |
} |
|
129 |
} |
|
130 |
|
|
131 |
class SiteAuditCheckSecurityFilePerms extends SecurityReviewSiteAuditCheckAbstract { |
|
132 |
protected $check = 'file_perms'; |
|
133 |
|
|
134 |
/** |
|
135 |
* Implements \SiteAudit\Check\Abstract\getResultWarn(). |
|
136 |
*/ |
|
137 |
public function getResultFail() { |
|
138 |
if (drush_get_option('detail')) { |
|
139 |
return parent::getResultFail(); |
|
140 |
} |
|
141 |
return $this->registry[$this->module][$this->check]['failure']; |
|
142 |
} |
|
143 |
} |
|
144 |
|
|
145 |
class SiteAuditCheckSecurityInputFormats extends SecurityReviewSiteAuditCheckAbstract { |
|
146 |
protected $check = 'input_formats'; |
|
147 |
} |
|
148 |
|
|
149 |
class SiteAuditCheckSecurityField extends SecurityReviewSiteAuditCheckAbstract { |
|
150 |
protected $check = 'field'; |
|
151 |
} |
|
152 |
|
|
153 |
class SiteAuditCheckSecurityErrorReporting extends SecurityReviewSiteAuditCheckAbstract { |
|
154 |
protected $check = 'error_reporting'; |
|
155 |
} |
|
156 |
|
|
157 |
class SiteAuditCheckSecurityPrivateFiles extends SecurityReviewSiteAuditCheckAbstract { |
|
158 |
protected $check = 'private_files'; |
|
159 |
} |
|
160 |
|
|
161 |
class SiteAuditCheckSecurityUploadExtensions extends SecurityReviewSiteAuditCheckAbstract { |
|
162 |
protected $check = 'upload_extensions'; |
|
163 |
} |
|
164 |
|
|
165 |
class SiteAuditCheckSecurityAdminPermissions extends SecurityReviewSiteAuditCheckAbstract { |
|
166 |
protected $check = 'admin_permissions'; |
|
167 |
} |
|
168 |
|
|
169 |
class SiteAuditCheckSecurityExecutablePhp extends SecurityReviewSiteAuditCheckAbstract { |
|
170 |
protected $check = 'executable_php'; |
|
171 |
} |
|
172 |
|
|
173 |
class SiteAuditCheckSecurityBaseUrlSet extends SecurityReviewSiteAuditCheckAbstract { |
|
174 |
protected $check = 'base_url_set'; |
|
175 |
} |
|
176 |
|
|
177 |
class SiteAuditCheckSecurityTemporaryFiles extends SecurityReviewSiteAuditCheckAbstract { |
|
178 |
protected $check = 'temporary_files'; |
|
179 |
} |
drupal7/sites/all/modules/security_review/tests/security_review.test | ||
---|---|---|
31 | 31 |
'create article content', |
32 | 32 |
'administer nodes', |
33 | 33 |
'administer content types', |
34 |
'administer fields', |
|
34 | 35 |
)); |
35 | 36 |
$this->drupalLogin($this->privileged_user); |
36 | 37 |
} |
Formats disponibles : Unified diff
Weekly update of contrib modules