admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security administration : add a confirmation with generate random string and record it in audit

Browse source
This commit is contained in:
Dany wm De Bontridder 2020-11-11 18:08:03 +01:00 • committed by sparkyx
parent 8bd9ba4fb5
commit 4c9a9f1a74
8 changed files with 127 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

4
include/ajax/ajax_admin.php
View file

@ -261,8 +261,8 @@ if (in_array($op, array('modele_drop', 'modele_modify', 'folder_modify', 'folder
$confirm=new ICheckBox();
$confirm->name="p_confirm";
echo '<p>';
echo _('Cochez la case si vous êtes sûr de vouloir effacer ce dossier');
echo $confirm->input();
echo _("Tapez le code de confirmation");
echo confirm_with_string("fld_drop",5);
echo '</p>';
echo '<p style="text-align:center">';
echo HtmlInput::submit('remove', _('Effacer'));

38
include/class/user.class.php
View file

@ -1085,6 +1085,21 @@ class User
return $array;
}
/**
* Audit action from the administration menu
* @param $p_module description of the action
*/
static function audit_admin($p_module) {
$cn = new Database();
$sql = "insert into audit_connect (ac_user,ac_ip,ac_module,ac_url,ac_state) values ($1,$2,$3,$4,$5)";
$cn->exec_sql($sql, array(
$_SESSION['g_user'],
$_SERVER["REMOTE_ADDR"],
$p_module,
$_SERVER['REQUEST_URI'],
'ADMIN'));
}
function audit($action = 'AUDIT', $p_module = "")
{
global $audit;
@ -1364,19 +1379,28 @@ class User
static function remove_inexistant_user($p_dossier)
{
$cnx_repo=new Database();
$name=$cnx_repo->format_name($p_dossier,'dos');
if ($cnx_repo->exist_database($name) == 0 )return;
$cnx_dossier=new Database($p_dossier);
$a_user=$cnx_dossier->get_array('select user_name from profile_user');
if ($cnx_dossier->exist_table('profile_user'))
$a_user=$cnx_dossier->get_array('select user_name from profile_user');
else
return;
if ( ! $a_user ) return;
$nb=count($a_user);
for ($i=0;$i < $nb;$i++) {
if ( $cnx_repo->get_value('select count(*) from ac_users where use_login=$1',
array($a_user[$i]['user_name'])) == 0) {
$cnx_dossier->exec_sql("delete from user_sec_jrn where uj_login=$1",array($a_user[$i]['user_name']));
$cnx_dossier->exec_sql("delete from profile_user where user_name=$1",array($a_user[$i]['user_name']));
$cnx_dossier->exec_sql("delete from user_sec_act where ua_login=$1",array($a_user[$i]['user_name']));
$cnx_dossier->exec_sql("delete from user_sec_jrn where uj_login=$1",array($a_user[$i]['user_name']));
$cnx_dossier->exec_sql("delete from user_active_security where us_login=$1",array($a_user[$i]['user_name']));
if ($cnx_dossier->exist_table('user_sec_jrn'))
$cnx_dossier->exec_sql("delete from user_sec_jrn where uj_login=$1",array($a_user[$i]['user_name']));
$cnx_dossier->exec_sql("delete from profile_user where user_name=$1",array($a_user[$i]['user_name']));
if ($cnx_dossier->exist_table('user_sec_act'))
$cnx_dossier->exec_sql("delete from user_sec_act where ua_login=$1",array($a_user[$i]['user_name']));
if ($cnx_dossier->exist_table('user_sec_jrn'))
$cnx_dossier->exec_sql("delete from user_sec_jrn where uj_login=$1",array($a_user[$i]['user_name']));
if ($cnx_dossier->exist_table('user_active_security'))
$cnx_dossier->exec_sql("delete from user_active_security where us_login=$1",array($a_user[$i]['user_name']));
}
}
}

2
include/constant.php
View file

@ -109,7 +109,7 @@ if ( ! defined ("SYSINFO_DISPLAY")) {
}
define ("DBVERSION",151);
define ("MONO_DATABASE",25);
define ("DBVERSIONREPO",18);
define ("DBVERSIONREPO",19);
define ('NOTFOUND','--not found--');
define ("MAX_COMPTE",4);
define ('MAX_ARTICLE',5);

13
include/dossier.inc.php
View file

@ -105,6 +105,8 @@ if ( isset ($_POST["DATABASE"]) )
values ($1,$2,$3)",array($dos,$desc,$max_email));
$l_id=$repo->get_current_seq('dossier_id');
$repo->commit();
}
catch (Exception $e)
{
@ -181,7 +183,7 @@ if ( isset ($_POST["DATABASE"]) )
Dossier::synchro_admin($l_id);
User::remove_inexistant_user($l_id);
User::audit_admin(sprintf('CREATE DATABASE %s %s',$l_id,$dos));
}
}
@ -204,6 +206,7 @@ if ( isset ($_POST["DATABASE"]) )
echo _("Echec création ");
exit;
}
User::audit_admin(sprintf('CREATE DATABASE %s %s',$l_id,$dos));
ob_flush();
}
@ -376,10 +379,11 @@ if ( $sa == 'list' )
//---------------------------------------------------------------------------
if ( $sa == 'remove' && isNumber($dossier_id) == 1 && $dossier_id != -1 )
{
if ( ! isset ($_REQUEST['p_confirm']))
$ctl=$http->request("fld_drop");
$ctl_code=$http->request("ctlcode");
if ( $ctl != $ctl_code)
{
echo _('Désolé, vous n\'avez pas coché la case');
echo _('Désolé, le code est invalide');
echo HtmlInput::button_anchor(_('Retour'),'?action=dossier_mgt');
return;
}
@ -423,6 +427,7 @@ if ( $sa == 'remove' && isNumber($dossier_id) == 1 && $dossier_id != -1 )
$cn->exec_sql($sql,array($dossier_id));
print '<h2 class="error">';
printf (_("Le dossier %s est effacé").'</h2>',h($name));
User::audit_admin(sprintf('DROP DATABASE %s %s',$dossier_id,$name));
echo HtmlInput::button_anchor(_('Retour'),'?action=dossier_mgt');
}
?>

32
include/lib/ac_common.php
View file

@ -1392,3 +1392,35 @@ function remove_divide_zero($p_formula)
return $p_formula;
}
/**
* Create randomly a string
* @param int $p_length length of the generate string
*/
function generate_random_string($car)
{
$string="";
$chaine="abcdefghijklmnpqrstuvwxyABCDEFGHIJKLMNPQRSTUVWXY0123456789*/+-=<>";
srand((double) microtime()*1020030);
for ($i=0; $i<$car; $i++)
{
$string .= $chaine[rand()%strlen($chaine)];
}
return $string;
}
/**
* generate a string of p_car character and a input text with name p_ctl_name
* work like a kind of captcha.The control code for checking is ctlcode.
* You compare the content of the variable p_ctl_name with ctlcode
* @param $p_ctl_name
* @param $p_car
*/
function confirm_with_string($p_ctl_name,$p_car)
{
$code=generate_random_string($p_car );
$r = HtmlInput::hidden("ctlcode",$code);
$r.='<span style="margin-left:1.2em;margin-right:1.2em;font-size:112%;font-weight:bold">'. $code.'</span>';
$ctl=new IText($p_ctl_name);
$r.=$ctl->input();
return $r;
}

7
include/sql/patch/ac-upgrade19.sql Normal file
View file

@ -0,0 +1,7 @@
begin;
ALTER TABLE public.audit_connect DROP CONSTRAINT valid_state ;
ALTER TABLE public.audit_connect ADD CONSTRAINT valid_state CHECK ( ac_state in ('FAIL','SUCCESS','AUDIT','ADMIN'));
select upgrade_repo(19);
commit;

2
include/user.inc.php
View file

@ -57,6 +57,8 @@ if ( isset ($_POST["ADD"]) )
$new_user->insert();
$new_user->load();
$_REQUEST['use_id']=$new_user->id;
User::audit_admin(sprintf('ADD USER %s %s',$new_user->id,$login));
require_once NOALYSS_INCLUDE.'/user_detail.inc.php';
return;

48
include/user_detail.inc.php
View file

@ -87,7 +87,16 @@ else if ($sbaction == "delete")
//
// Delete the user
//
// check that the control is correct
$code=$http->post("userdel");
$ctl_code=$http->post('ctlcode');
if ( $code != $ctl_code) {
echo _("Code invalide, effacement refusé");
return;
}
$cn = new Database();
$auser=$cn->get_row('select use_login from ac_users where use_id = $1',[$uid]);
if ( $auser == null) return;
$Res = $cn->exec_sql("delete from jnt_use_dos where use_id=$1", array($uid));
$Res = $cn->exec_sql("delete from ac_users where use_id=$1", array($uid));
//------------------------------------
@ -99,8 +108,10 @@ else if ($sbaction == "delete")
for ( $i=0;$i<$nb;$i++)
User::remove_inexistant_user($a_dossier[$i]['dos_id']);
}
echo "<center><H2 class=\"info\"> Utilisateur " . h($_POST['fname']) . " " . h($_POST['lname']) . " est effacé</H2></CENTER>";
User::audit_admin(sprintf('DELETE USER %s %s',$uid,$auser['use_login']));
echo "<H2 class=\"info\">";
printf (_("Utilisateur %s %s est effacé"),$http->post('fname'),$http->post('lname')) ;
echo " </H2>";
require_once NOALYSS_INCLUDE.'/lib/iselect.class.php';
require_once NOALYSS_INCLUDE.'/user.inc.php';
return;
@ -180,12 +191,39 @@ $it_pass->value="";
</td>
</tr>
</table>
<input type="hidden" name="sbaction" id="sbaction" value="">
<input type="Submit" class="button" NAME="SAVE" VALUE="Sauver les changements" onclick="$('sbaction').value='save';return confirm_box('user_detail_frm','Confirmer changement ?');">
<input type="Submit" class="button" NAME="DELETE" VALUE="Effacer" onclick="$('sbaction').value='delete';return confirm_box('user_detail_frm','Confirmer effacement ?');" >
<input type="hidden" name="sbaction" id="sbaction" value="save">
<input type="Submit" class="button" NAME="SAVE" VALUE="<?=('Sauver les changements')?>" onclick="return confirm_box('user_detail_frm','<?=_('Confirmer')?>');">
<input type="button" class="button" NAME="DELETE" VALUE="<?=('Effacer')?>" onclick="$('delete_user_div').show();" >
</FORM>
<div id="delete_user_div" class="inner_box" style="display: none">
<?=HtmlInput::title_box(_("Effacer"),'delete_user_div','hide')?>
<FORM id="user_detail_frm" METHOD="POST">
<INPUT type="hidden" NAME="lname" value="<?=_("$UserChange->name")?>">
<INPUT type="hidden" NAME="fname" value="<?=_("$UserChange->first_name")?>">
<?php echo HtmlInput::hidden('UID',$uid)?>
<input type="hidden" name="sbaction" value="delete">
<p class="info" id="codedel_div">
<?php
echo _("Pour effacer , confirmez en retapant le code");
echo confirm_with_string('userdel','5');
?>
</p>
<ul class="aligned-block">
<li>
<input type="Submit" class="button" NAME="DELETE" VALUE="<?=_("Confirmer")?>">
</li>
<li>
<?=HtmlInput::button_hide('delete_user_div')?>
</li>
</ul>
</FORM>
</div>
<?php
if ($UserChange->admin == 0 ) :
?>