Changeset 29

Timestamp:

2007-11-23 18:16:43 (4 years ago)

Author:

hannes

Message:

• installer: trying to secure db and sessions directories (warning if failed)
  

Files:

• trunk/includes/lang/en.php (modified) (1 diff)
• trunk/install.php (modified) (3 diffs)

trunk/includes/lang/en.php

@@ -398 +398 @@
-$LANG['installer_overall_success'] = "Congratulations! Your Spam Board has been fully set up. If you didn't see any error messages or warnings, it should now be fully functional.<br /><br />You still have some work to do, of course:<ol><li>delete this installer script</li><li>go to <a href=\"%boardurl%\">your board</a></li><li>log in with the admin account you just created</li><li>go to the Administration Panel</li><li>set up at least one category and one forum</li><li>set appropriate permissions on this forum</li><li>deactive maintainance mode in the settings</li></ol>";
-$LANG['installer_warning_cleanup_failed'] = "Warning: Although the installation of your board has been finished successfully, the install script didn't manage to clean every up. This isn't fatal at all, it just meant there are still a few pre-install files floating around your directory tree. If you like to have it completely clean, delete all .tmpl files in includes/config/.";
+$LANG['installer_warning_insecure_directories'] = "Warning: The installer couldn't secure the directories 'db' (containing the database) and 'sessions' (containing the user sessions). It is <i>essential</i> that these directories can't be accessed via HTTP! Otherwise, the whole world will be able to download your whole database and view all sessions!";
-
-/* error messages */

trunk/install.php

@@ -287 +287 @@
-                    if ($ok == 1) {
-                        print($LANG['installer_database_success'] . '<br /><br />');
+                        /* try securing sessions and db directories */
+                        if (strpos($_SERVER['SERVER_SOFTWARE'], 'Apache') !== FALSE) {
+                            // Apache -> .htaccess
+                            if ($file = @fopen('sessions/.htaccess', 'w')) {
+                                // write settings
+                                if (@fwrite($file, 'deny from all')) {
+                                    @fclose($file);
+                                    // set permissions
+                                    @chmod('sessions/.htaccess', 0660);
+                                }
+                            }
+                            if ($file = @fopen('db/.htaccess', 'w')) {
+                                // write settings
+                                if (@fwrite($file, 'deny from all')) {
+                                    @fclose($file);
+                                    // set permissions
+                                    @chmod('db/.htaccess', 0660);
+                                }
+                            }
+                        } else {
+                            // other webservers...
+                        }
-                    } else {
-                        print($LANG['error_installer_database'] . '<br /><br />');
@@ -292 +314 @@
-                }
-            }
+        }
+        /* test whether db and settings directories are accessable via HTTP */
+        $fp = @fsockopen($_SERVER['SERVER_NAME'], $_SERVER['SERVER_PORT'], $errno, $errstr, 30);
+        if ($fp !== FALSE) {
+            // db
+            $req = 'GET ' . $SETTINGS['webpath'] . "db/spamboard.sql HTTP/1.1\r\n";
+            $req .= 'Host: ' . $_SERVER['SERVER_NAME'] . "\r\n";
+            $req .= "Connection: Close\r\n\r\n";
+            fwrite($fp, $req);
+            $reply = '';
+            while (!feof($fp)) {
+                $reply .= fgets($fp, 128);
+            }
+            fclose($fp);
+            if (strpos($reply, '403 Forbidden') === FALSE) {
+                // db accessable via HTTP -> bad
+                $ok = -1;
+            }
+        } else {
+            $ok = -1;
+        }
+        $fp = @fsockopen($_SERVER['SERVER_NAME'], $_SERVER['SERVER_PORT'], $errno, $errstr, 30);
+        if ($fp !== FALSE) {
+            // sessions
+            @touch('sessions/test.file');
+            $req = 'GET ' . $SETTINGS['webpath'] . "sessions/test.file HTTP/1.1\r\n";
+            $req .= 'Host: ' . $_SERVER['SERVER_NAME'] . "\r\n";
+            $req .= "Connection: Close\r\n\r\n";
+            fwrite($fp, $req);
+            $reply = '';
+            while (!feof($fp)) {
+                $reply .= fgets($fp, 128);
+            }
+            fclose($fp);
+            if (strpos($reply, '403 Forbidden') === FALSE) {
+                // db accessable via HTTP -> bad
+                $ok = -1;
+            }
+            @unlink('sessions/test.file');
+        } else {
+            $ok = -1;
+        }
+        if ($ok == -1) {
+            // message about securing db and settings directories
+            print($LANG['installer_warning_insecure_directories'] . '<br /><br />');
+            // this won't make the overall installation fail
+            $ok = 1;
-        }
-        /* clean up */
@@ -325 +394 @@
-                print($LANG['installer_warning_cleanup_failed'] . '<br /><br />');
-            }
-
+
+
+
+
-        }
-    break;