Set of function used for dolibarr security (common function included into filefunc.inc.php) Warning, this file must not depends on other library files, except function.lib.php because it is used at low code level. More...

Functions
	dol_encode ($chain, $key='1')
	Encode a string with base 64 algorithm + specific delta change. More...

	dol_decode ($chain, $key='1')
	Decode a base 64 encoded + specific delta change. More...

	dolGetRandomBytes ($length)
	Return a string of random bytes (hexa string) with length = $length fro cryptographic purposes. More...

	dolEncrypt ($chain, $key='', $ciphering="AES-256-CTR")
	Encode a string with a symetric encryption. More...

	dolDecrypt ($chain, $key='')
	Decode a string with a symetric encryption. More...

	dol_hash ($chain, $type='0')
	Returns a hash (non reversible encryption) of a string. More...

	dol_verifyHash ($chain, $hash, $type='0')
	Compute a hash and compare it to the given one For backward compatibility reasons, if the hash is not in the password_hash format, we will try to match against md5 and sha1md5 If constant MAIN_SECURITY_HASH_ALGO is defined, we use this function as hashing function. More...

	dolGetLdapPasswordHash ($password, $type='md5')
	Returns a specific ldap hash of a password. More...

	restrictedArea (User $user, $features, $object=0, $tableandshare='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid', $isdraft=0, $mode=0)
	Check permissions of a user to show a page and an object. More...

	checkUserAccessToObject ($user, array $featuresarray, $object=0, $tableandshare='', $feature2='', $dbt_keyfield='', $dbt_select='rowid', $parenttableforentity='')
	Check that access by a given user to an object is ok. More...

	httponly_accessforbidden ($message=1, $http_response_code=403, $stringalreadysanitized=0)
	Show a message to say access is forbidden and stop program. More...

	accessforbidden ($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
	Show a message to say access is forbidden and stop program. More...

	getMaxFileSizeArray ()
	Return the max allowed for file upload. More...

Detailed Description

Set of function used for dolibarr security (common function included into filefunc.inc.php) Warning, this file must not depends on other library files, except function.lib.php because it is used at low code level.

Definition in file security.lib.php.

Function Documentation

◆ accessforbidden()

accessforbidden	(	$message = `''`,
		$printheader = `1`,
		$printfooter = `1`,
		$showonlymessage = `0`,
		$params = `null`
	)

Show a message to say access is forbidden and stop program.

This includes HTTP and HTML header and footer (except if $printheader and $printfooter is 0, use this case inside an already started page). Calling this function terminate execution of PHP.

Parameters

string	$message	Force error message
int	$printheader	Show header before
int	$printfooter	Show footer after
int	$showonlymessage	Show only message parameter. Otherwise add more information.
array \| null	$params	More parameters provided to hook

Returns: void

See also: httponly_accessforbidden()

Definition at line 1084 of file security.lib.php.

◆ checkUserAccessToObject()

checkUserAccessToObject	(		$user,
		array	$featuresarray,
			$object = `0`,
			$tableandshare = `''`,
			$feature2 = `''`,
			$dbt_keyfield = `''`,
			$dbt_select = `'rowid'`,
			$parenttableforentity = `''`
	)

Check that access by a given user to an object is ok.

This function is also called by restrictedArea() that check before if module is enabled and if permission of user for $action is ok.

Parameters

User	$user	User to check
array	$featuresarray	Features/modules to check. Example: ('user','service','member','project','task',...)
int \| string \| Object	$object	Full object or object ID or list of object id. For example if we want to check a particular record (optional) is linked to a owned thirdparty (optional).
string	$tableandshare	'TableName&SharedElement' with Tablename is table where object is stored. SharedElement is an optional key to define where to check entity for multicompany modume. Param not used if objectid is null (optional).
array \| string	$feature2	Feature to check, second level of permission (optional). Can be or check with 'level1\|level2'.
string	$dbt_keyfield	Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional). Can use '' if NA.
string	$dbt_select	Field name for select if not rowid. Not used if objectid is null (optional).
string	$parenttableforentity	Parent table for entity. Example 'fk_website@website'

Returns: bool True if user has access, False otherwise

See also: restrictedArea()

Definition at line 761 of file security.lib.php.

◆ dol_decode()

dol_decode	(	$chain,
		$key = `'1'`
	)

Decode a base 64 encoded + specific delta change.

This function is called by filefunc.inc.php at each page call.

Parameters

string	$chain	string to decode
string	$key	rule to use for delta ('0', '1' or 'myownkey')

Returns: string decoded string

See also: dol_encode()

Definition at line 69 of file security.lib.php.

◆ dol_encode()

dol_encode	(	$chain,
		$key = `'1'`
	)

Encode a string with base 64 algorithm + specific delta change.

Parameters

string	$chain	string to encode
string	$key	rule to use for delta ('0', '1' or 'myownkey')

Returns: string encoded string

See also: dol_decode()

Definition at line 38 of file security.lib.php.

◆ dol_hash()

dol_hash	(	$chain,
		$type = `'0'`
	)

Returns a hash (non reversible encryption) of a string.

If constant MAIN_SECURITY_HASH_ALGO is defined, we use this function as hashing function (recommanded value is 'password_hash') If constant MAIN_SECURITY_SALT is defined, we use it as a salt (used only if hashing algorightm is something else than 'password_hash').

Parameters

string	$chain	String to hash
string	$type	Type of hash ('0':auto will use MAIN_SECURITY_HASH_ALGO else md5, '1':sha1, '2':sha1+md5, '3':md5, '4': for OpenLdap, '5':sha256, '6':password_hash). Use '3' here, if hash is not needed for security purpose, for security need, prefer '0'.

Returns: string Hash of string

See also: getRandomPassword(), dol_verifyHash()

Definition at line 206 of file security.lib.php.

Referenced by BlockedLog\checkSignature(), SMTPs\setAttachment(), SMTPs\setBodyContent(), and SMTPs\setImageInline().

◆ dol_verifyHash()

dol_verifyHash	(	$chain,
		$hash,
		$type = `'0'`
	)

Compute a hash and compare it to the given one For backward compatibility reasons, if the hash is not in the password_hash format, we will try to match against md5 and sha1md5 If constant MAIN_SECURITY_HASH_ALGO is defined, we use this function as hashing function.

If constant MAIN_SECURITY_SALT is defined, we use it as a salt.

Parameters

string	$chain	String to hash (not hashed string)
string	$hash	hash to compare
string	$type	Type of hash ('0':auto, '1':sha1, '2':sha1+md5, '3':md5, '4': for OpenLdap, '5':sha256). Use '3' here, if hash is not needed for security purpose, for security need, prefer '0'.

Returns: bool True if the computed hash is the same as the given one

See also: dol_hash()

Definition at line 254 of file security.lib.php.

◆ dolDecrypt()

dolDecrypt	(	$chain,
		$key = `''`
	)

Decode a string with a symetric encryption.

Used to decrypt sensitive data saved into database. Note: If a backup is restored onto another instance with a different $dolibarr_main_instance_unique_id, then decoded value will differ.

Parameters

string	$chain	string to encode
string	$key	If '', we use $dolibarr_main_instance_unique_id

Returns: string encoded string

See also: dolEncrypt(), dol_hash()

Definition at line 165 of file security.lib.php.

◆ dolEncrypt()

dolEncrypt	(	$chain,
		$key = `''`,
		$ciphering = `"AES-256-CTR"`
	)

Encode a string with a symetric encryption.

Used to encrypt sensitive data into database. Note: If a backup is restored onto another instance with a different $dolibarr_main_instance_unique_id, then decoded value will differ.

Parameters

string	$chain	string to encode
string	$key	If '', we use $dolibarr_main_instance_unique_id
string	$ciphering	Default ciphering algorithm

Returns: string encoded string

See also: dolDecrypt(), dol_hash()

Definition at line 119 of file security.lib.php.

◆ dolGetLdapPasswordHash()

dolGetLdapPasswordHash	(	$password,
		$type = `'md5'`
	)

Returns a specific ldap hash of a password.

Parameters

string	$password	Password to hash
string	$type	Type of hash

Returns: string Hash of password

Definition at line 280 of file security.lib.php.

◆ dolGetRandomBytes()

dolGetRandomBytes ( $length )

Return a string of random bytes (hexa string) with length = $length fro cryptographic purposes.

Parameters

int $length Length of random string

Returns: string Random string

Definition at line 100 of file security.lib.php.

◆ getMaxFileSizeArray()

getMaxFileSizeArray ( )

Return the max allowed for file upload.

Analyze among: upload_max_filesize, post_max_size, MAIN_UPLOAD_DOC

Returns: array Array with all max size for file upload

Definition at line 1146 of file security.lib.php.

◆ httponly_accessforbidden()

httponly_accessforbidden	(	$message = `1`,
		$http_response_code = `403`,
		$stringalreadysanitized = `0`
	)

Show a message to say access is forbidden and stop program.

This includes only HTTP header. Calling this function terminate execution of PHP.

Parameters

string	$message	Force error message
int	$http_response_code	HTTP response code
int	$stringalreadysanitized	1 if string is already sanitized with HTML entities

Returns: void

See also: accessforbidden()

Definition at line 1057 of file security.lib.php.

◆ restrictedArea()

restrictedArea	(	User	$user,
			$features,
			$object = `0`,
			$tableandshare = `''`,
			$feature2 = `''`,
			$dbt_keyfield = `'fk_soc'`,
			$dbt_select = `'rowid'`,
			$isdraft = `0`,
			$mode = `0`
	)

Check permissions of a user to show a page and an object.

Check read permission. If GETPOST('action','aZ09') defined, we also check write and delete permission. This method check permission on module then call checkUserAccessToObject() for permission on object (according to entity and socid of user).

Parameters

User	$user	User to check
string	$features	Features to check (it must be module $object->element. Can be a 'or' check with 'levela\|levelb'. Examples: 'societe', 'contact', 'produit&service', 'produit\|service', ...) This is used to check permission $user->rights->features->...
int \| string \| object	$object	Object or Object ID or list of Object ID if we want to check a particular record (optional) is linked to a owned thirdparty (optional).
string	$tableandshare	'TableName&SharedElement' with Tablename is table where object is stored. SharedElement is an optional key to define where to check entity for multicompany module. Param not used if objectid is null (optional).
string	$feature2	Feature to check, second level of permission (optional). Can be a 'or' check with 'sublevela\|sublevelb'. This is used to check permission $user->rights->features->feature2...
string	$dbt_keyfield	Field name for socid foreign key if not fk_soc. Not used if objectid is null (optional). Can use '' if NA.
string	$dbt_select	Field name for select if not "rowid". Not used if objectid is null (optional)
int	$isdraft	1=The object with id=$objectid is a draft
int	$mode	Mode (0=default, 1=return without dieing)

Returns: int If mode = 0 (default): Always 1, die process if not allowed. If mode = 1: Return 0 if access not allowed.

See also: dol_check_secure_access_document(), checkUserAccessToObject()

Definition at line 337 of file security.lib.php.

Functions

Detailed Description

Function Documentation

◆ accessforbidden()

◆ checkUserAccessToObject()

◆ dol_decode()

◆ dol_encode()

◆ dol_hash()

◆ dol_verifyHash()

◆ dolDecrypt()

◆ dolEncrypt()

◆ dolGetLdapPasswordHash()

◆ dolGetRandomBytes()

◆ getMaxFileSizeArray()

◆ httponly_accessforbidden()

◆ restrictedArea()