espocrm-extensions/espocrm-base
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

installer: security improvements

Browse Source
This commit is contained in:
Taras Machyshyn
2014-10-09 13:11:25 +03:00
parent d2669dba5e
commit 7cfc539ce9
7 changed files with 91 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install/core/SystemHelper.php
+4
View File
@@ -122,6 +122,10 @@ class SystemHelper extends \Espo\Core\Utils\System
protected function getMysqlSetting($name, \PDO $pdoConnection)
{
if (!method_exists($pdoConnection, 'prepare')) {
return null;
}
$sth = $pdoConnection->prepare("SHOW VARIABLES LIKE '" . $name . "'");
$sth->execute();
$res = $sth->fetch(PDO::FETCH_NUM);
install/core/Utils.php
+46
View File
@@ -0,0 +1,46 @@
<?php
/************************************************************************
* This file is part of EspoCRM.
*
* EspoCRM - Open Source CRM application.
* Copyright (C) 2014 Yuri Kuznetsov, Taras Machyshyn, Oleksiy Avramenko
* Website: http://www.espocrm.com
*
* EspoCRM is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* EspoCRM is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with EspoCRM. If not, see http://www.gnu.org/licenses/.
************************************************************************/
class Utils
{
static public $actionPath = 'install/core/actions';
static public function isActionExists($actionName)
{
$actionPath = static::$actionPath;
$actionFileName = $actionName . '.php';
$actionRealPath = realpath($actionPath . '/' . $actionFileName);
$fileManager = new \Espo\Core\Utils\File\Manager();
$actionList = $fileManager->getFileList($actionPath);
foreach ($actionList as $fileName) {
$fileRealPath = realpath($actionPath . '/' . $fileName);
if ($fileRealPath === $actionRealPath) {
return true;
}
}
return false;
}
}
install/core/actions/errors.php
+1 -5
View File
@@ -20,8 +20,4 @@
* along with EspoCRM. If not, see http://www.gnu.org/licenses/.
************************************************************************/
$errors = array();
if (!empty($_REQUEST['desc'])) {
$errors = str_replace('^^', '<br>', $_REQUEST['desc']);
$smarty->assign('errors', $errors);
}
install/core/actions/setupConfirmation.php
+5 -5
View File
@@ -24,18 +24,18 @@ $phpConfig = $systemHelper->getRecommendationList();
$smarty->assign('phpConfig', $phpConfig);
$installData = $_SESSION['install'];
list($host, $port) = explode(':', $installData['hostName']);
list($host, $port) = explode(':', $installData['host-name']);
$dbConfig = array(
'dbHostName' => $host,
'dbPort' => $port,
'dbName' => $installData['dbName'],
'dbUserName' => $installData['dbUserName'],
'dbUserPass' => $installData['dbUserPass'],
'dbName' => $installData['db-name'],
'dbUserName' => $installData['db-user-name'],
'dbUserPass' => $installData['db-user-password'],
);
$mysqlConfig = $systemHelper->getRecommendationList('mysql', $dbConfig);
$dbConfig['dbHostName'] = $installData['hostName'];
$dbConfig['dbHostName'] = $installData['host-name'];
unset($dbConfig['dbPort'], $dbConfig['dbUserPass']);
foreach ($dbConfig as $name => $value) {
install/core/tpl/errors.tpl
+2
View File
@@ -27,6 +27,8 @@
}
{literal}
var installScript = new InstallScript(opt);
installScript.showLoading();
installScript.actionsChecking();
})
{/literal}
</script>
install/index.php
+15 -12
View File
@@ -24,14 +24,21 @@ session_start();
require_once('../bootstrap.php');
//action
$action = (!empty($_POST['action']))? $_POST['action'] : 'main';
require_once('core/Utils.php');
if (!Utils::isActionExists($action)) {
die('This page does not exist.');
}
// temp save all settings
$ignore = array('desc', 'dbName', 'hostName', 'dbUserName', 'dbUserPass', 'dbDriver');
$ignoredFields = array('installProcess', 'dbName', 'hostName', 'dbUserName', 'dbUserPass', 'dbDriver');
if (!empty($_REQUEST)) {
foreach ($_REQUEST as $key => $val) {
if (!in_array($val, $ignore))
$_SESSION['install'][$key] = trim($val);
if (!empty($_POST)) {
foreach ($_POST as $key => $val) {
if (!in_array($key, $ignoredFields)) {
$_SESSION['install'][$key] = trim($val);
}
}
}
@@ -59,6 +66,7 @@ if (!$systemHelper->initWritable()) {
require_once ('install/vendor/smarty/libs/Smarty.class.php');
require_once 'core/Installer.php';
require_once 'core/Utils.php';
$smarty = new Smarty();
$installer = new Installer();
@@ -85,11 +93,6 @@ $smarty->assign("langs", $langs);
$smarty->assign("langsJs", json_encode($langs));
// include actions and set tpl name
$tplName = 'main.tpl';
$actionsDir = 'core/actions';
$actionFile = '';
$action = (!empty($_REQUEST['action']))? $_REQUEST['action'] : 'main';
switch ($action) {
case 'main':
$languageList = $installer->getLanguageList();
@@ -119,7 +122,7 @@ switch ($action) {
break;
}
$actionFile = $actionsDir.'/'.$action.'.php';
$actionFile = 'core/actions/'.$action.'.php';
$tplName = $action.'.tpl';
$smarty->assign('tplName', $tplName);
$smarty->assign('action', ucfirst($action));
@@ -128,7 +131,7 @@ $smarty->assign('action', ucfirst($action));
$config = include('core/config.php');
$smarty->assign('config', $config);
if (!empty($actionFile) && file_exists('install/'.$actionFile)) {
if (Utils::isActionExists($action)) {
include $actionFile;
}
install/js/install.js
+18 -16
View File
@@ -514,18 +514,12 @@ InstallScript.prototype.validate = function() {
return valid;
}
InstallScript.prototype.setForm = function(opt) {
var formId = opt.formId || 'nav';
var action = opt.action || 'main';
var desc = opt.desc || '';
var actionField = $('<input>', {'name': 'action', 'value': action, 'type': 'hidden'});
$('#'+formId).append(actionField);
var descField = $('<textarea>', {'name': 'desc', 'value': action, 'type': 'hidden'});
descField.val(desc);
descField.css('display', 'none');
$('#'+formId).append(descField);
$('#'+formId).attr('method', 'POST');
}
@@ -648,7 +642,6 @@ InstallScript.prototype.checkAction = function(dataMain) {
})
}
InstallScript.prototype.checkModRewrite = function() {
var self = this;
this.modRewriteUrl;
@@ -681,11 +674,8 @@ InstallScript.prototype.callbackModRewrite = function(data) {
}
ajaxData.success = false;
if (typeof(this.langs) !== 'undefined') {
ajaxData.errorMsg = (typeof(this.langs['options']['modRewriteHelp'][this.serverType]) !== 'undefined')? this.langs['options']['modRewriteHelp'][this.serverType] : this.langs['options']['modRewriteHelp']['default'];
ajaxData.errorMsg += (typeof(this.langs['options']['modRewriteInstruction'][this.serverType]) !== 'undefined' && typeof(this.langs['options']['modRewriteInstruction'][this.serverType][this.OS]) !== 'undefined') ? this.langs['options']['modRewriteInstruction'][this.serverType][this.OS] : '';
ajaxData.errorMsg = ajaxData.errorMsg.replace("{ESPO_PATH}", this.getEspoPath(true)).replace("{API_PATH}", this.apiPath).replace("{API_PATH}", this.apiPath);
}
ajaxData.errorMsg = this.getModRewriteErrorMesssage();
var realCheckIndex = this.checkIndex - 1;
if (typeof(this.checkActions[realCheckIndex]) != 'undefined'
&& typeof(this.checkActions[realCheckIndex].break) != 'undefined') {
@@ -705,14 +695,14 @@ InstallScript.prototype.callbackChecking = function(data) {
this.goTo('step3');
}
else {
var desc = (typeof(data.errorMsg))? data.errorMsg : '';
desc += (typeof(data.errorFixInstruction) != 'undefined')? data.errorFixInstruction : '';
var errorMsg = (typeof(data.errorMsg))? data.errorMsg : '';
errorMsg += (typeof(data.errorFixInstruction) != 'undefined')? data.errorFixInstruction : '';
if (this.reChecking) {
this.showMsg({msg: desc, error: true});
this.showMsg({msg: errorMsg, error: true});
$("#re-check").removeAttr('disabled');
}
else {
this.setForm({action: 'errors', desc: desc});
this.setForm({action: 'errors'});
$('#nav').submit();
}
}
@@ -732,6 +722,18 @@ InstallScript.prototype.getEspoPath = function(onlyPath) {
return location;
}
InstallScript.prototype.getModRewriteErrorMesssage = function() {
var message = '';
if (typeof(this.langs) !== 'undefined') {
message = (typeof(this.langs['options']['modRewriteHelp'][this.serverType]) !== 'undefined')? this.langs['options']['modRewriteHelp'][this.serverType] : this.langs['options']['modRewriteHelp']['default'];
message += (typeof(this.langs['options']['modRewriteInstruction'][this.serverType]) !== 'undefined' && typeof(this.langs['options']['modRewriteInstruction'][this.serverType][this.OS]) !== 'undefined') ? this.langs['options']['modRewriteInstruction'][this.serverType][this.OS] : '';
message = message.replace("{ESPO_PATH}", this.getEspoPath(true)).replace("{API_PATH}", this.apiPath).replace("{API_PATH}", this.apiPath);
}
return message;
}
InstallScript.prototype.goToEspo = function() {
var location = this.getEspoPath();