8ddabd73db
Issue:
Analisis de los resultados de escaneo de las funciones en ProcessMaker. Plugin/trigger code scanner.
Cause:
Nueva solicitud de funciones
Solution:
Se ha implementado esta nueva funcionalidad, que consta de lo siguiente:
- Escaneo de codigo al importar un plugin (no se aplica a plugins enterprise)
- Escaneo de codigo al habilitar un plugin (si el plugin ya se encuentra fisicamente en el directorio de los plugins)
- Escaneo de codigo al importar un proceso
- Escaneo de codigo al crear/modificar codigo de un trigger
- Escaneo de codigo al ejecutar un caso que tenga seteados triggers en sus steps (si el trigger tiene codigo
no deseado, no se ejecuta el trigger)
- Se ha agregado la opcion "check-plugin-disabled-code" al comando "./gulliver", el mismo muestra
informacion sobre los plugins con codigo no deseado.
Ej: $ ./gulliver check-plugin-disabled-code [enterprise-plugin|custom-plugin|all|<plugin-name>]
- Se ha agregado la opcion "check-workspace-disabled-code" al comando "./processmaker", el mismo muestra
informacion sobre los workspaces con codigo no deseado en sus triggers.
Ej: $ ./processmaker check-workspace-disabled-code <myWorkspace>
- Por defecto ProcessMaker no realiza el escaneo de codigo, si se desea escanear codigo no deseado, se
debera definir el atributo "enable_blacklist = 1" en el archivo "env.ini", este atributo no se aplica
a las nuevas opciones creadas para los comandos "./gulliver" y "./processmaker"
- Para una configuracion personalizada de codigo no deseado (lista negra), se pueden definir las mismas en
el archivo "path/to/processmaker/workflow/engine/config/blacklist.ini" (si no existe el
archivo se puede crear), o tambien en el atributo "disable_functions" esto en el archivo "php.ini"
Ejemplo de "blacklist.ini":
;Classes
;=======
DashletInterface
;Functions
;=========
eval
exec
;date
;echo
strlen
87 lines
3.7 KiB
PHP
Executable File
87 lines
3.7 KiB
PHP
Executable File
<?php
|
|
/**
|
|
* pluginsChange.php
|
|
*
|
|
* ProcessMaker Open Source Edition
|
|
* Copyright (C) 2004 - 2008 Colosa Inc.23
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License as
|
|
* published by the Free Software Foundation, either version 3 of the
|
|
* License, or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*
|
|
* For more information, contact Colosa Inc, 2566 Le Jeune Rd.,
|
|
* Coral Gables, FL, 33134, USA, or email info@colosa.com.
|
|
*/
|
|
|
|
// lets display the items
|
|
$pluginFile = $_GET['id'];
|
|
$pluginStatus = $_GET['status'];
|
|
|
|
$items = array ();
|
|
G::LoadClass( 'plugin' );
|
|
//here we are enabling or disabling the plugin and all related options registered.
|
|
|
|
|
|
$oPluginRegistry = & PMPluginRegistry::getSingleton();
|
|
|
|
if ($handle = opendir( PATH_PLUGINS )) {
|
|
while (false !== ($file = readdir( $handle ))) {
|
|
if (strpos( $file, '.php', 1 ) && $file == $pluginFile) {
|
|
|
|
if ($pluginStatus == '1') {
|
|
//print "change to disable";
|
|
$details = $oPluginRegistry->getPluginDetails( $pluginFile );
|
|
$oPluginRegistry->disablePlugin( $details->sNamespace );
|
|
$size = file_put_contents( PATH_DATA_SITE . 'plugin.singleton', $oPluginRegistry->serializeInstance() );
|
|
G::auditLog("DisablePlugin", "Plugin Name: ".$details->sNamespace);
|
|
//print "size saved : $size <br>";
|
|
} else {
|
|
$pluginName = str_replace(".php", "", $pluginFile);
|
|
|
|
if (is_file(PATH_PLUGINS . $pluginName . ".php") && is_dir(PATH_PLUGINS . $pluginName)) {
|
|
//Check disabled code
|
|
G::LoadClass("codeScanner");
|
|
|
|
$arraySystemConfiguration = System::getSystemConfiguration(PATH_CONFIG . "env.ini");
|
|
|
|
$cs = new CodeScanner((isset($arraySystemConfiguration["enable_blacklist"]) && (int)($arraySystemConfiguration["enable_blacklist"]) == 1)? "DISABLED_CODE" : "");
|
|
|
|
$arrayFoundDisabledCode = array_merge($cs->checkDisabledCode("FILE", PATH_PLUGINS . $pluginName . ".php"), $cs->checkDisabledCode("PATH", PATH_PLUGINS . $pluginName));
|
|
|
|
if (count($arrayFoundDisabledCode) > 0) {
|
|
$response = array();
|
|
$response["status"] = "DISABLED-CODE";
|
|
$response["message"] = G::LoadTranslation("ID_DISABLED_CODE_PLUGIN");
|
|
|
|
echo G::json_encode($response);
|
|
exit(0);
|
|
}
|
|
|
|
//print "change to ENABLED";
|
|
require_once(PATH_PLUGINS . $pluginFile);
|
|
$details = $oPluginRegistry->getPluginDetails($pluginFile);
|
|
$oPluginRegistry->enablePlugin($details->sNamespace);
|
|
$oPluginRegistry->setupPlugins(); //get and setup enabled plugins
|
|
$size = file_put_contents(PATH_DATA_SITE . "plugin.singleton", $oPluginRegistry->serializeInstance());
|
|
G::auditLog("EnablePlugin", "Plugin Name: " . $details->sNamespace);
|
|
//print "size saved : $size <br>";
|
|
}
|
|
}
|
|
}
|
|
}
|
|
closedir( $handle );
|
|
}
|
|
|
|
//$oPluginRegistry->showArrays();
|
|
//G::Header('location: pluginsList');
|
|
|