admingit/altocompta
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

task 126 : add security audit

Browse source
This commit is contained in:
Dany De Bontridder 2010-11-17 20:16:43 +00:00
parent 9f7e521fa7
commit 6d7fbfcb36
10 changed files with 116 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
html/admin_repo.php
View file

@ -80,6 +80,11 @@ if ( isset ($_REQUEST["action"]) )
// Backup and restaure folders
require_once("restore.inc.php");
}
if ($_REQUEST['action'] == 'audit_log')
{
/* List the connexion successuf and failed */
require_once('audit_log.php');
}
}// action = modele_mgt
?>

2
html/login.php
View file

@ -40,7 +40,7 @@ if ( isset ($_POST["p_user"] ) )
$rep=new Database();
include_once ("class_user.php");
$User=new User($rep);
$User->Check();
$User->Check(false,'LOGIN');
if ($g_captcha == true)
{
include("securimage/securimage.php");

84
include/audit_log.php Normal file
View file

@ -0,0 +1,84 @@
<?php
/*
* This file is part of PhpCompta.
*
* PhpCompta is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* PhpCompta is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with PhpCompta; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/* $Revision$ */
// Copyright Author Dany De Bontridder ddebontridder@yahoo.fr
/*!\file
* \brief let you see the list of the connexion
*/
?>
<DIV class="content" style="width:80%;margin-left:10%">
<?php
$cn=new Database();
$cn->exec_sql("select ac_user,ac_ip,to_char(ac_date,'DD.MM.YYYY HH24:MI') as fmt_date,ac_state,ac_module from audit_connect order by 3");
?>
<TABLE CLASS="result" style="border-collapse:separate;border-spacing:2">
<tr>
<th>Utilisateur </th>
<th>Date </th>
<th>Adresse </th>
<th>Module</th>
<th> Résultat</th>
</tr>
<TR>
<?php
$max=$cn->count();
for ($i=0;$i < $max ;$i++):
$r=$cn->fetch($i);
?>
<td>
<?=h($r['ac_user']);?>
</td>
<td>
<?=$r['fmt_date'];?>
</td>
<td>
<?=$r['ac_ip'];?>
</td>
<td>
<?=$r['ac_module'];?>
</td>
<?
switch ( $r['ac_state'] )
{
case 'FAIL';
echo '<td style="background-color:red;color:white">';
break;
case 'SUCCESS';
echo '<td style="background-color:green;color:white">';
break;
}
?>
<?=$r['ac_state']?>
</td>
</TR>
<?
endfor;
?>
</DIV>

2
include/class_database.php
View file

@ -311,7 +311,7 @@ class Database
function fetch($p_indice)
{
if ( $this->ret == false ) throw new Exception ('this->ret is empty');
return pg_fetch_array($this->ret ) ;
return pg_fetch_array($this->ret,$p_indice ) ;
}
/*!@brief return the number of rows found by the last query,
synomym for count()*/

2
include/class_dossier.php
View file

@ -95,7 +95,7 @@ class dossier
if ( $Max == 0 ) return null;
for ( $i=0;$i<$Max; $i++)
{
$row[]=$this->cn->fetch($p_res);
$row[]=$this->cn->fetch($i);
}
return $row;
}

20
include/class_user.php
View file

@ -127,7 +127,7 @@ class User
* default is false
*
++*/
function Check($silent=false)
function Check($silent=false,$from='')
{
$res=0;
@ -158,9 +158,12 @@ class User
}
$sql="insert into audit_connect (ac_user,ac_ip,ac_module,ac_state) values ($1,$2,$3,$4)";
if ( $res == 0 )
{
if ( $from=='LOGIN')
$cn->exec_sql($sql,array($_SESSION['g_user'],$_SERVER["REMOTE_ADDR"],$from,'FAIL'));
if ( ! $silent)
{
alert(_('Utilisateur ou mot de passe incorrect'));
@ -171,7 +174,9 @@ class User
}
else
{
$this->valid=1;
if ( $from=='LOGIN')
$cn->exec_sql($sql,array($_SESSION['g_user'],$_SERVER["REMOTE_ADDR"],$from,'SUCCESS'));
$this->valid=1;
}
return $ret;
@ -468,7 +473,14 @@ class User
*/
function check_action ( $p_action_id)
{
/* save it into the log */
global $audit;
if (isset ($audit) && $audit == true)
{
$cn=new Database();
$sql="insert into audit_connect (ac_user,ac_ip,ac_module,ac_state) values ($1,$2,$3,$4)";
$cn->exec_sql($sql,array($_SESSION['g_user'],$_SERVER["REMOTE_ADDR"],$_SERVER['REQUEST_URI'],'FAIL'));
}
if ( $this->Admin()==1 ) return 1;
if ( $this->is_local_admin(dossier::id()) == 1 ) return 1;

2
include/constant.php
View file

@ -31,7 +31,7 @@ global $version_phpcompta;
error_reporting (15);
global $g_captcha;
$g_captcha=true;
$g_captcha=false;
/* set to none for production */
/* uncomment for production */

2
include/constant.security.php
View file

@ -44,4 +44,6 @@ define ("STOWRITE",1510); //Stock (changement)
define ("EXTENSION",1600); //Extension
define ("PREVCON",1701); //Prevision
define ("PREVMOD",1702); //Prevision
global $audit; $audit=true;
?>

4
include/user_menu.php
View file

@ -312,6 +312,9 @@ function MenuAdmin()
case 'modele_mgt':
$def=2;
break;
case 'audit_log':
$def=4;
break;
case 'restore';
$def=3;
break;
@ -321,6 +324,7 @@ function MenuAdmin()
array("admin_repo.php?action=dossier_mgt",_("Dossiers"),_('Gestion des dossiers'),1),
array("admin_repo.php?action=modele_mgt",_("Modèles"),_('Gestion des modèles'),2),
array("admin_repo.php?action=restore",_("Restaure"),_("Restaure une base de données"),3),
array("admin_repo.php?action=audit_log",_("Audit"),_("Utilisateurs qui se sont connectés"),4),
array("login.php",_("Accueil"))
);

1
sql/trunk/upgrade_account_repository.sql
View file

@ -23,6 +23,7 @@ CREATE TABLE audit_connect (
ac_user text,
ac_date timestamp without time zone DEFAULT now(),
ac_ip text,
ac_module text,
ac_state text,
CONSTRAINT valid_state CHECK (((ac_state = 'FAIL'::text) OR (ac_state = 'SUCCESS'::text)))
);