Skip to content

Commit 50bb1a2

Browse files
funkatronfunkatron
committed
- requires are now resolved relative to base phpsecinfo path, so PhpSecInfo does not need to be in php's include path
- allow_url_fopen now will not throw a warning if enabled and PHP version >= 5.2 - Added simple View system; moved HTML views out of PhpSecInfo class. You can use PhpSecInfo->setViewDirectory($path) to set the path to your own custom views (your view files need to mirror the structure of the default views). - Added cli, CSV, JSON and RSS views - Added examples directory to demonstrate more advanced usage of views system
1 parent 6b4a7f5 commit 50bb1a2

34 files changed

+267
-46
lines changed

‎CHANGELOG

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
v0.2.2
2+
- requires are now resolved relative to base phpsecinfo path, so PhpSecInfo does
3+
not need to be in php's include path
4+
- allow_url_fopen now will not throw a warning if enabled and PHP version >= 5.2
25
- Added simple View system; moved HTML views out of PhpSecInfo class. You can
36
use PhpSecInfo->setViewDirectory($path) to set the path to your own custom
47
views (your view files need to mirror the structure of the default views).
5-
- Added stubs for cli, CSV and RSS views
8+
- Added cli, CSV, JSON and RSS views
9+
- Added examples directory to demonstrate more advanced usage of views system
610
- PHPSecInfo_Test::getUnixId() now handles failure better and tries alternate
711
methods before giving up
812
- Minor CSS fixes in HTML view <Thomas Corbiere>

‎PhpSecInfo/PhpSecInfo.php

+42-12
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
* a YYYYMMDD date string to indicate "build" date
2424
*
2525
*/
26-
define ('PHPSECINFO_BUILD', '20070408');
26+
define ('PHPSECINFO_BUILD', '20080723');
2727

2828
/**
2929
* Homepage for phpsecinfo project
@@ -44,14 +44,19 @@
4444
define('PHPSECINFO_FORMAT_DEFAULT', 'Html');
4545

4646

47+
/**
48+
* The base directory, used to resolve requires and includes
49+
*/
50+
define('PHPSECINFO_BASE_DIR', dirname(__FILE__));
51+
4752
/**
4853
* This is the main class for the phpsecinfo system. It's responsible for
4954
* dynamically loading tests, running those tests, and generating the results
5055
* output
5156
*
5257
* Example:
5358
* <code>
54-
* <?php require_once('PhpSecInfo/PhpSecInfo.php'); ?>
59+
* <?php require_once(PHPSECINFO_BASE_DIR.'/PhpSecInfo.php'); ?>
5560
* <?php phpsecinfo(); ?>
5661
* </code>
5762
*
@@ -60,7 +65,7 @@
6065
*
6166
* Example:
6267
* <code>
63-
* require_once('PhpSecInfo/PhpSecInfo.php');
68+
* require_once(PHPSECINFO_BASE_DIR.'/PhpSecInfo.php');
6469
* // instantiate the class
6570
* $psi = new PhpSecInfo();
6671
*
@@ -150,6 +155,12 @@ class PhpSecInfo
150155
var $num_tests_run = 0;
151156

152157

158+
/**
159+
* The base directory for phpsecinfo. Set within the constructor. Paths are resolved from this.
160+
* @var string
161+
*/
162+
var $_base_dir;
163+
153164

154165
/**
155166
* The directory PHPSecInfo will look for views. It defaults to the value
@@ -173,15 +184,34 @@ class PhpSecInfo
173184
*
174185
* @return PhpSecInfo
175186
*/
176-
function PhpSecInfo() {
177-
/**
178-
* set the default View directory
179-
*/
180-
$this->setViewDirectory(dirname(__FILE__).DIRECTORY_SEPARATOR . PHPSECINFO_VIEW_DIR_DEFAULT);
181-
if (strtolower(php_sapi_name()) == 'cli' ) {
182-
$this->setFormat('Cli');
183-
} else {
184-
$this->setFormat(PHPSECINFO_FORMAT_DEFAULT);
187+
function PhpSecInfo($opts = null) {
188+
189+
$this->_base_dir = dirname(__FILE__);
190+
191+
if ($opts) {
192+
if (isset($opts['view_directory'])) {
193+
$this->setViewDirectory($opts['view_directory']);
194+
} else {
195+
$this->setViewDirectory(dirname(__FILE__).DIRECTORY_SEPARATOR . PHPSECINFO_VIEW_DIR_DEFAULT);
196+
}
197+
198+
if (isset($opts['format'])) {
199+
$this->setFormat($opts['format']);
200+
} else {
201+
if (strtolower(php_sapi_name()) == 'cli' ) {
202+
$this->setFormat('Cli');
203+
} else {
204+
$this->setFormat(PHPSECINFO_FORMAT_DEFAULT);
205+
}
206+
}
207+
208+
} else { /* Use defaults */
209+
$this->setViewDirectory(dirname(__FILE__).DIRECTORY_SEPARATOR . PHPSECINFO_VIEW_DIR_DEFAULT);
210+
if (strtolower(php_sapi_name()) == 'cli' ) {
211+
$this->setFormat('Cli');
212+
} else {
213+
$this->setFormat(PHPSECINFO_FORMAT_DEFAULT);
214+
}
185215
}
186216
}
187217

‎PhpSecInfo/Test/CGI/force_redirect.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the PhpSecInfo_Test_Cgi class
1111
*/
12-
require_once('PhpSecInfo/Test/Test_Cgi.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Cgi.php');
1313

1414
/**
1515
* Test class for cgi force_redirect

‎PhpSecInfo/Test/Core/allow_url_fopen.php

+16-7
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515
/**
1616
* Test Class for allow_url_fopen
@@ -47,11 +47,16 @@ function _retrieveCurrentValue() {
4747
*
4848
*/
4949
function _execTest() {
50-
if ($this->current_value == $this->recommended_value) {
50+
if ( version_compare(PHP_VERSION, '5.2', '<') ) { /* this is much more severe if we're running < 5.2 */
51+
if ($this->current_value == $this->recommended_value) {
52+
return PHPSECINFO_TEST_RESULT_OK;
53+
}
54+
55+
return PHPSECINFO_TEST_RESULT_WARN;
56+
} else { /* In 5.2, we'll consider allow_url_fopen "safe" */
57+
$this->recommended_value = TRUE;
5158
return PHPSECINFO_TEST_RESULT_OK;
5259
}
53-
54-
return PHPSECINFO_TEST_RESULT_WARN;
5560
}
5661

5762

@@ -61,9 +66,13 @@ function _execTest() {
6166
*/
6267
function _setMessages() {
6368
parent::_setMessages();
64-
65-
$this->setMessageForResult(PHPSECINFO_TEST_RESULT_OK, 'en', 'allow_url_fopen is disabled, which is the recommended setting');
66-
$this->setMessageForResult(PHPSECINFO_TEST_RESULT_WARN, 'en', 'allow_url_fopen is enabled. This could be a serious security risk. You should disable allow_url_fopen and consider using the <a href="http://php.net/manual/en/ref.curl.php" target="_blank">PHP cURL functions</a> instead.');
69+
if ( version_compare(PHP_VERSION, '5.2', '<') ) { /* this is much more severe if we're running < 5.2 */
70+
$this->setMessageForResult(PHPSECINFO_TEST_RESULT_OK, 'en', 'allow_url_fopen is disabled, which is the recommended setting');
71+
$this->setMessageForResult(PHPSECINFO_TEST_RESULT_WARN, 'en', 'allow_url_fopen is enabled. This could be a serious security risk. You should disable allow_url_fopen and consider using the <a href="http://php.net/manual/en/ref.curl.php" target="_blank">PHP cURL functions</a> instead.');
72+
73+
} else {
74+
$this->setMessageForResult(PHPSECINFO_TEST_RESULT_OK, 'en', 'You are running PHP 5.2 or greater, which makes allow_url_fopen significantly safer. Make sure allow_url_include is <em>disabled</em>, though');
75+
}
6776
}
6877

6978

‎PhpSecInfo/Test/Core/allow_url_include.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515
/**
1616
* Test Class for allow_url_include

‎PhpSecInfo/Test/Core/display_errors.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515
/**
1616
* Test class for display_errors

‎PhpSecInfo/Test/Core/expose_php.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515
/**
1616
* Test class for expose_php

‎PhpSecInfo/Test/Core/file_uploads.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515
/**
1616
* Test Class for file_uploads

‎PhpSecInfo/Test/Core/gid.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515

1616
/**

‎PhpSecInfo/Test/Core/magic_quotes_gpc.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
/**
1212
* require the PhpSecInfo_Test_Core class
1313
*/
14-
require_once('PhpSecInfo/Test/Test_Core.php');
14+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1515

1616
/**
1717
* Test Class for magic_quotes_gpc

‎PhpSecInfo/Test/Core/memory_limit.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
/**
1313
* require the PhpSecInfo_Test_Core class
1414
*/
15-
require_once('PhpSecInfo/Test/Test_Core.php');
15+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1616

1717
/**
1818
* The max recommended size for the memory_limit setting, in bytes

‎PhpSecInfo/Test/Core/open_basedir.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515
/**
1616
* Test Class for open_basedir

‎PhpSecInfo/Test/Core/post_max_size.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515
/**
1616
* The max recommended size for the post_max_size setting, in bytes

‎PhpSecInfo/Test/Core/register_globals.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515

1616
/**

‎PhpSecInfo/Test/Core/uid.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Core class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Core.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1414

1515

1616
/**

‎PhpSecInfo/Test/Core/upload_max_filesize.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the PhpSecInfo_Test_Core class
1111
*/
12-
require_once('PhpSecInfo/Test/Test_Core.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1313

1414
/**
1515
* The max recommended size for the upload_max_filesize setting, in bytes

‎PhpSecInfo/Test/Core/upload_tmp_dir.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the PhpSecInfo_Test_Core class
1111
*/
12-
require_once('PhpSecInfo/Test/Test_Core.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Core.php');
1313

1414
/**
1515
* Test Class for upload_tmp_dir

‎PhpSecInfo/Test/Curl/file_support.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the PhpSecInfo_Test_Curl class
1111
*/
12-
require_once('PhpSecInfo/Test/Test_Curl.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Curl.php');
1313

1414
/**
1515
* Test class for CURL file_support

‎PhpSecInfo/Test/Session/save_path.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the PhpSecInfo_Test_Core class
1111
*/
12-
require_once('PhpSecInfo/Test/Test_Session.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Session.php');
1313

1414
/**
1515
* Test class for session save_path

‎PhpSecInfo/Test/Session/use_trans_sid.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the PhpSecInfo_Test_Session class
1212
*/
13-
require_once('PhpSecInfo/Test/Test_Session.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test_Session.php');
1414

1515
/**
1616
* Test class for session use_trans_sid

‎PhpSecInfo/Test/Test.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the main PhpSecInfo class
1111
*/
12-
require_once('PhpSecInfo/PhpSecInfo.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/PhpSecInfo.php');
1313

1414

1515

‎PhpSecInfo/Test/Test_Cgi.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the main PhpSecInfo class
1111
*/
12-
require_once('PhpSecInfo/Test/Test.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test.php');
1313

1414

1515

‎PhpSecInfo/Test/Test_Core.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the main PhpSecInfo class
1111
*/
12-
require_once('PhpSecInfo/Test/Test.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test.php');
1313

1414

1515

‎PhpSecInfo/Test/Test_Curl.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
/**
1010
* require the main PhpSecInfo class
1111
*/
12-
require_once('PhpSecInfo/Test/Test.php');
12+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test.php');
1313

1414

1515

‎PhpSecInfo/Test/Test_Session.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
/**
1111
* require the main PhpSecInfo class
1212
*/
13-
require_once('PhpSecInfo/Test/Test.php');
13+
require_once(PHPSECINFO_BASE_DIR.'/Test/Test.php');
1414

1515

1616

‎PhpSecInfo/View/Csv.php

+14-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,16 @@
11
<?php
2-
/**
3-
* @todo write CSV view
4-
*/
2+
header('Content-type: text/csv');
3+
header('Content-Disposition: attachment; filename="phpsecinfo.csv"');
4+
5+
// This is kind of a lot of logic for a view, but...
6+
foreach ($this->test_results as $group_name=>$group_results) {
7+
8+
$this->_outputRenderTable($group_name, $group_results);
9+
}
10+
11+
$this->_outputRenderNotRunTable();
12+
13+
/* stats will probably be handled by the app reading the csv */
14+
//$this->_outputRenderStatsTable();
15+
516
?>

‎PhpSecInfo/View/Csv/Result.php

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<?php
2+
foreach($group_results as $test_name=>$test_results) {
3+
4+
echo strtoupper($group_name).',';
5+
echo strtoupper($test_name).',';
6+
if ($group_name != 'Test Results Summary'):
7+
echo $this->_outputGetResultTypeFromCode($test_results['result']).',';
8+
endif;
9+
10+
11+
echo $test_results['value_current'].',';
12+
echo $test_results['value_recommended'].',';
13+
14+
echo '"'.str_replace('"', '""',
15+
strip_tags(
16+
trim(
17+
preg_replace("/(\s+)/im", ' ', $test_results['message'])
18+
)
19+
)
20+
) . '",';
21+
echo $test_results['moreinfo_url'];
22+
23+
echo "\n";
24+
}

0 commit comments

Comments
 (0)