[Summary view]

Differences Between: [Versions 310 and 311] [Versions 310 and 400] [Versions 310 and 401] [Versions 310 and 402] [Versions 310 and 403]

   1  <?php
   2  // This file is part of Moodle - http://moodle.org/
   3  //
   4  // Moodle is free software: you can redistribute it and/or modify
   5  // it under the terms of the GNU General Public License as published by
   6  // the Free Software Foundation, either version 3 of the License, or
   7  // (at your option) any later version.
   8  //
   9  // Moodle is distributed in the hope that it will be useful,
  10  // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  // GNU General Public License for more details.
  13  //
  14  // You should have received a copy of the GNU General Public License
  15  // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  16  
  17  /**
  18   * Lists all users with XSS risk
  19   *
  20   * It would be great to combine this with risk trusts in user table,
  21   * unfortunately nobody implemented user trust UI yet :-(
  22   *
  23   * @package    core
  24   * @category   check
  25   * @copyright  2020 Brendan Heywood <brendan@catalyst-au.net>
  26   * @copyright  2008 petr Skoda
  27   * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  28   */
  29  
  30  namespace core\check\access;
  31  
  32  defined('MOODLE_INTERNAL') || die();
  33  
  34  use core\check\result;
  35  
  36  /**
  37   * Lists all users with XSS risk
  38   *
  39   * It would be great to combine this with risk trusts in user table,
  40   * unfortunately nobody implemented user trust UI yet :-(
  41   *
  42   * @copyright  2020 Brendan Heywood <brendan@catalyst-au.net>
  43   * @copyright  2008 petr Skoda
  44   * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  45   */
  46  class riskbackup_result extends \core\check\result {
  47  
  48      /**
  49       * Constructor
  50       */
  51      public function __construct() {
  52          global $DB;
  53  
  54          $syscontext = \context_system::instance();
  55  
  56          $params = array('capability' => 'moodle/backup:userinfo', 'permission' => CAP_ALLOW, 'contextid' => $syscontext->id);
  57          $sql = "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder, r.archetype
  58                    FROM {role} r
  59                    JOIN {role_capabilities} rc ON rc.roleid = r.id
  60                   WHERE rc.capability = :capability
  61                     AND rc.contextid  = :contextid
  62                     AND rc.permission = :permission";
  63          $this->systemroles = $DB->get_records_sql($sql, $params);
  64  
  65          $params = array('capability' => 'moodle/backup:userinfo', 'permission' => CAP_ALLOW, 'contextid' => $syscontext->id);
  66          $sql = "SELECT DISTINCT r.id, r.name, r.shortname, r.sortorder, r.archetype, rc.contextid
  67                    FROM {role} r
  68                    JOIN {role_capabilities} rc ON rc.roleid = r.id
  69                   WHERE rc.capability = :capability
  70                     AND rc.contextid <> :contextid
  71                     AND rc.permission = :permission";
  72          $this->overriddenroles = $DB->get_records_sql($sql, $params);
  73  
  74          // List of users that are able to backup personal info
  75          // note:
  76          // "sc" is context where is role assigned,
  77          // "c" is context where is role overridden or system context if in role definition.
  78          $params = [
  79              'capability' => 'moodle/backup:userinfo',
  80              'permission' => CAP_ALLOW,
  81              'context1' => CONTEXT_COURSE,
  82              'context2' => CONTEXT_COURSE,
  83          ];
  84  
  85          $this->sqluserinfo = "
  86              FROM (SELECT DISTINCT rcx.contextid,
  87                           rcx.roleid
  88                      FROM {role_capabilities} rcx
  89                     WHERE rcx.permission = :permission
  90                       AND rcx.capability = :capability) rc
  91              JOIN {context} c ON c.id = rc.contextid
  92              JOIN {context} sc ON sc.contextlevel <= :context1
  93              JOIN {role_assignments} ra ON ra.contextid = sc.id AND ra.roleid = rc.roleid
  94              JOIN {user} u ON u.id = ra.userid AND u.deleted = 0
  95             WHERE (sc.path = c.path OR
  96                    sc.path LIKE " . $DB->sql_concat('c.path', "'/%'") . " OR
  97                     c.path LIKE " . $DB->sql_concat('sc.path', "'/%'") . ")
  98               AND c.contextlevel <= :context2";
  99  
 100          $usercount = $DB->count_records_sql("SELECT COUNT('x') FROM (SELECT DISTINCT u.id $this->sqluserinfo) userinfo", $params);
 101          $systemrolecount = empty($this->systemroles) ? 0 : count($this->systemroles);
 102          $overriddenrolecount = empty($this->overriddenroles) ? 0 : count($this->overriddenroles);
 103  
 104          if (max($usercount, $systemrolecount, $overriddenrolecount) > 0) {
 105              $this->status = result::WARNING;
 106          } else {
 107              $this->status = result::OK;
 108          }
 109  
 110          $a = (object)array(
 111              'rolecount' => $systemrolecount,
 112              'overridecount' => $overriddenrolecount,
 113              'usercount' => $usercount,
 114          );
 115          $this->summary = get_string('check_riskbackup_warning', 'report_security', $a);
 116      }
 117  
 118      /**
 119       * Showing the full list of roles may be slow so defer it
 120       *
 121       * @return string
 122       */
 123      public function get_details(): string {
 124  
 125          global $CFG, $DB;
 126  
 127          $details = '';
 128  
 129          // Make a list of roles.
 130          if ($this->systemroles) {
 131              $links = array();
 132              foreach ($this->systemroles as $role) {
 133                  $role->name = role_get_name($role);
 134                  $role->url = (new \moodle_url('/admin/roles/manage.php', ['action' => 'edit', 'roleid' => $role->id]))->out();
 135                  $links[] = \html_writer::tag('li', get_string('check_riskbackup_editrole', 'report_security', $role));
 136              }
 137              $links = \html_writer::tag('ul', implode('', $links));
 138              $details .= get_string('check_riskbackup_details_systemroles', 'report_security', $links);
 139          }
 140  
 141          // Make a list of overrides to roles.
 142          $rolelinks2 = array();
 143          if ($this->overriddenroles) {
 144              $links = array();
 145              foreach ($this->overriddenroles as $role) {
 146                  $role->name = $role->localname;
 147                  $context = context::instance_by_id($role->contextid);
 148                  $role->name = role_get_name($role, $context, ROLENAME_BOTH);
 149                  $role->contextname = $context->get_context_name();
 150                  $role->url = (new \moodle_url('/admin/roles/override.php',
 151                      ['contextid' => $role->contextid, 'roleid' => $role->id]))->out();
 152                  $links[] = \html_writer::tag('li', get_string('check_riskbackup_editoverride', 'report_security', $role));
 153              }
 154              $links = \html_writer::tag('ul', implode('', $links));
 155              $details .= get_string('check_riskbackup_details_overriddenroles', 'report_security', $links);
 156          }
 157  
 158          // Get a list of affected users as well.
 159          $users = array();
 160  
 161          list($sort, $sortparams) = users_order_by_sql('u');
 162          $params = [
 163              'capability' => 'moodle/backup:userinfo',
 164              'permission' => CAP_ALLOW,
 165              'context1' => CONTEXT_COURSE,
 166              'context2' => CONTEXT_COURSE,
 167          ];
 168          $userfields = \user_picture::fields('u');
 169          $rs = $DB->get_recordset_sql("
 170              SELECT DISTINCT $userfields,
 171                              ra.contextid,
 172                              ra.roleid
 173                              $this->sqluserinfo
 174                     ORDER BY $sort", array_merge($params, $sortparams));
 175  
 176          foreach ($rs as $user) {
 177              $context = \context::instance_by_id($user->contextid);
 178              $url = new \moodle_url('/admin/roles/assign.php', ['contextid' => $user->contextid, 'roleid' => $user->roleid]);
 179              $a = (object)array(
 180                  'fullname' => fullname($user),
 181                  'url' => $url->out(),
 182                  'email' => s($user->email),
 183                  'contextname' => $context->get_context_name(),
 184              );
 185              $users[] = \html_writer::tag('li', get_string('check_riskbackup_unassign', 'report_security', $a));
 186          }
 187          $rs->close();
 188          if (!empty($users)) {
 189              $users = \html_writer::tag('ul', implode('', $users));
 190              $details .= get_string('check_riskbackup_details_users', 'report_security', $users);
 191          }
 192  
 193          return $details;
 194      }
 195  }
 196