[BUGFIX] Mark not set Install Tool password as secure
[Packages/TYPO3.CMS.git] / typo3 / sysext / install / Classes / Report / SecurityStatusReport.php
1 <?php
2 namespace TYPO3\CMS\Install\Report;
3
4 /*
5 * This file is part of the TYPO3 CMS project.
6 *
7 * It is free software; you can redistribute it and/or modify it under
8 * the terms of the GNU General Public License, either version 2
9 * of the License, or any later version.
10 *
11 * For the full copyright and license information, please read the
12 * LICENSE.txt file that was distributed with this source code.
13 *
14 * The TYPO3 project - inspiring people to share!
15 */
16
17 use TYPO3\CMS\Backend\Utility\BackendUtility;
18 use TYPO3\CMS\Core\Utility\GeneralUtility;
19 use TYPO3\CMS\Install\Service\EnableFileService;
20 use TYPO3\CMS\Reports\Status;
21
22 /**
23 * Provides an status report of the security of the install tool
24 */
25 class SecurityStatusReport implements \TYPO3\CMS\Reports\StatusProviderInterface
26 {
27 /**
28 * Compiles a collection of system status checks as a status report.
29 *
30 * @return Status[]
31 */
32 public function getStatus()
33 {
34 $this->executeAdminCommand();
35 $statuses = [
36 'installToolPassword' => $this->getInstallToolPasswordStatus(),
37 'installToolProtection' => $this->getInstallToolProtectionStatus()
38 ];
39 return $statuses;
40 }
41
42 /**
43 * Checks whether the Install Tool password is set to its default value.
44 *
45 * @return Status An object representing the security of the install tool password
46 */
47 protected function getInstallToolPasswordStatus()
48 {
49 $value = $GLOBALS['LANG']->getLL('status_ok');
50 $message = '';
51 $severity = Status::OK;
52 $validPassword = true;
53 $installToolPassword = $GLOBALS['TYPO3_CONF_VARS']['BE']['installToolPassword'];
54 $saltFactory = \TYPO3\CMS\Saltedpasswords\Salt\SaltFactory::getSaltingInstance($installToolPassword);
55 if ($installToolPassword !== '' && is_object($saltFactory)) {
56 $validPassword = !$saltFactory->checkPassword('joh316', $installToolPassword);
57 } elseif ($installToolPassword === md5('joh316')) {
58 $validPassword = false;
59 }
60 if (!$validPassword) {
61 $value = $GLOBALS['LANG']->getLL('status_insecure');
62 $severity = Status::ERROR;
63 $changeInstallToolPasswordUrl = BackendUtility::getModuleUrl('system_extinstall');
64 $message = sprintf($GLOBALS['LANG']->sL('LLL:EXT:lang/Resources/Private/Language/locallang_core.xlf:warning.installtool_default_password'),
65 '<a href="' . htmlspecialchars($changeInstallToolPasswordUrl) . '">', '</a>');
66 }
67 return GeneralUtility::makeInstance(Status::class,
68 $GLOBALS['LANG']->sL('LLL:EXT:install/Resources/Private/Language/Report/locallang.xlf:status_installToolPassword'), $value, $message, $severity);
69 }
70
71 /**
72 * Checks for the existence of the ENABLE_INSTALL_TOOL file.
73 *
74 * @return Status An object representing whether ENABLE_INSTALL_TOOL exists
75 */
76 protected function getInstallToolProtectionStatus()
77 {
78 $enableInstallToolFile = PATH_site . EnableFileService::INSTALL_TOOL_ENABLE_FILE_PATH;
79 $value = $GLOBALS['LANG']->getLL('status_disabled');
80 $message = '';
81 $severity = Status::OK;
82 if (EnableFileService::installToolEnableFileExists()) {
83 if (EnableFileService::isInstallToolEnableFilePermanent()) {
84 $severity = Status::WARNING;
85 $disableInstallToolUrl = GeneralUtility::getIndpEnv('TYPO3_REQUEST_URL') . '&adminCmd=remove_ENABLE_INSTALL_TOOL';
86 $value = $GLOBALS['LANG']->sL('LLL:EXT:install/Resources/Private/Language/Report/locallang.xlf:status_enabledPermanently');
87 $message = sprintf($GLOBALS['LANG']->sL('LLL:EXT:lang/Resources/Private/Language/locallang_core.xlf:warning.install_enabled'),
88 '<code style="white-space: nowrap;">' . $enableInstallToolFile . '</code>');
89 $message .= ' <a href="' . htmlspecialchars($disableInstallToolUrl) . '">' .
90 $GLOBALS['LANG']->sL('LLL:EXT:lang/Resources/Private/Language/locallang_core.xlf:warning.install_enabled_cmd') . '</a>';
91 } else {
92 if (EnableFileService::installToolEnableFileLifetimeExpired()) {
93 EnableFileService::removeInstallToolEnableFile();
94 } else {
95 $severity = Status::NOTICE;
96 $disableInstallToolUrl = GeneralUtility::getIndpEnv('TYPO3_REQUEST_URL') . '&adminCmd=remove_ENABLE_INSTALL_TOOL';
97 $value = $GLOBALS['LANG']->sL('LLL:EXT:install/Resources/Private/Language/Report/locallang.xlf:status_enabledTemporarily');
98 $message = sprintf($GLOBALS['LANG']->sL('LLL:EXT:install/Resources/Private/Language/Report/locallang.xlf:status_installEnabledTemporarily'),
99 '<code style="white-space: nowrap;">' . $enableInstallToolFile . '</code>', floor((@filemtime($enableInstallToolFile) + EnableFileService::INSTALL_TOOL_ENABLE_FILE_LIFETIME - time()) / 60));
100 $message .= ' <a href="' . htmlspecialchars($disableInstallToolUrl) . '">' .
101 $GLOBALS['LANG']->sL('LLL:EXT:lang/Resources/Private/Language/locallang_core.xlf:warning.install_enabled_cmd') . '</a>';
102 }
103 }
104 }
105 return GeneralUtility::makeInstance(Status::class,
106 $GLOBALS['LANG']->sL('LLL:EXT:install/Resources/Private/Language/Report/locallang.xlf:status_installTool'), $value, $message, $severity);
107 }
108
109 /**
110 * Executes commands like removing the Install Tool enable file.
111 */
112 protected function executeAdminCommand()
113 {
114 $command = GeneralUtility::_GET('adminCmd');
115 switch ($command) {
116 case 'remove_ENABLE_INSTALL_TOOL':
117 EnableFileService::removeInstallToolEnableFile();
118 break;
119 default:
120 // Do nothing
121 }
122 }
123 }