Skip to content

Commit ffb3c82

Browse files
jsokoljsokol
committed
SimpleRisk 20230106-001 Release
1 parent cafa774 commit ffb3c82

16,965 files changed

Lines changed: 2365909 additions & 287644 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎simplerisk/account/change_password.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@
1010
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
1111
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1212

13-
// Include Laminas Escaper for HTML Output Encoding
14-
$escaper = new Laminas\Escaper\Escaper('utf-8');
15-
1613
// Add various security headers
1714
add_security_headers();
1815

@@ -23,6 +20,8 @@
2320
include_csrf_magic();
2421

2522
// Include the SimpleRisk language file
23+
// Ignoring detections related to language files
24+
// @phan-suppress-next-line SecurityCheck-PathTraversal
2625
require_once(language_file());
2726

2827
// Check if a new password was submitted

‎simplerisk/account/mfa.php‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
<?php
2+
3+
/* This Source Code Form is subject to the terms of the Mozilla Public
4+
* License, v. 2.0. If a copy of the MPL was not distributed with this
5+
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
6+
7+
// Include required functions file
8+
require_once(realpath(__DIR__ . '/../includes/functions.php'));
9+
require_once(realpath(__DIR__ . '/../includes/mfa.php'));
10+
require_once(realpath(__DIR__ . '/../includes/authenticate.php'));
11+
require_once(realpath(__DIR__ . '/../includes/display.php'));
12+
require_once(realpath(__DIR__ . '/../includes/messages.php'));
13+
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
14+
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
15+
16+
// Add various security headers
17+
add_security_headers();
18+
19+
// Add the session
20+
add_session_check();
21+
22+
// Include the CSRF Magic library
23+
include_csrf_magic();
24+
25+
// Include the SimpleRisk language file
26+
require_once(language_file());
27+
28+
// If the user attempted to verify the MFA
29+
if (isset($_POST['verify']))
30+
{
31+
// If the MFA verification process was successful
32+
if (process_mfa_verify())
33+
{
34+
// Redirect back to the profile.php page
35+
header("Location: profile.php");
36+
}
37+
}
38+
39+
// If the user attempted to disable the MFA
40+
if (isset($_POST['disable']))
41+
{
42+
// If the MFA disable process was successful
43+
if (process_mfa_disable())
44+
{
45+
// Redirect back to the profile.php page
46+
header("Location: profile.php");
47+
}
48+
}
49+
50+
?>
51+
52+
<!doctype html>
53+
<html>
54+
55+
<head>
56+
<meta http-equiv="X-UA-Compatible" content="IE=10,9,7,8">
57+
<?php
58+
// Use these jQuery scripts
59+
$scripts = [
60+
'jquery.min.js',
61+
];
62+
63+
// Include the jquery javascript source
64+
display_jquery_javascript($scripts);
65+
66+
// Use these jquery-ui scripts
67+
$scripts = [
68+
'jquery-ui.min.js',
69+
];
70+
71+
// Include the jquery-ui javascript source
72+
display_jquery_ui_javascript($scripts);
73+
74+
display_bootstrap_javascript();
75+
?>
76+
<script src="../js/bootstrap-multiselect.js?<?php echo current_version("app"); ?>"></script>
77+
<script src="../js/permissions-widget.js?<?php echo current_version("app"); ?>"></script>
78+
<title>SimpleRisk: Enterprise Risk Management Simplified</title>
79+
<meta name="viewport" content="width=device-width, initial-scale=1">
80+
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
81+
<link rel="stylesheet" href="../css/bootstrap.css?<?php echo current_version("app"); ?>">
82+
<link rel="stylesheet" href="../css/bootstrap-responsive.css?<?php echo current_version("app"); ?>">
83+
<link rel="stylesheet" href="../css/bootstrap-multiselect.css?<?php echo current_version("app"); ?>">
84+
<link rel="stylesheet" href="../css/divshot-util.css?<?php echo current_version("app"); ?>">
85+
<link rel="stylesheet" href="../css/divshot-canvas.css?<?php echo current_version("app"); ?>">
86+
<link rel="stylesheet" href="../css/display.css?<?php echo current_version("app"); ?>">
87+
<link rel="stylesheet" href="../vendor/components/font-awesome/css/fontawesome.min.css?<?php echo current_version("app"); ?>">
88+
<link rel="stylesheet" href="../css/theme.css?<?php echo current_version("app"); ?>">
89+
<link rel="stylesheet" href="../css/side-navigation.css?<?php echo current_version("app"); ?>">
90+
91+
<?php
92+
setup_favicon("..");
93+
setup_alert_requirements("..");
94+
?>
95+
96+
</style>
97+
</head>
98+
99+
<body>
100+
<?php
101+
view_top_menu("Configure");
102+
103+
// Get any alert messages
104+
get_alert();
105+
106+
?>
107+
108+
<div class="container-fluid">
109+
<div class="row-fluid">
110+
<div class="span12">
111+
<div class="row-fluid">
112+
<div class="span6">
113+
114+
<?php
115+
116+
echo "<form name='mfa' method='post' action=''>\n";
117+
118+
// If the authenticated user does not have MFA enabled
119+
if (!mfa_enabled_for_uid($_SESSION['uid']))
120+
{
121+
// Display the MFA verification webpage content
122+
display_mfa_verification_page();
123+
}
124+
else
125+
{
126+
// Display the MFA reset webpage content
127+
display_mfa_reset_page();
128+
}
129+
130+
echo "</form>\n";
131+
132+
?>
133+
</div>
134+
</div>
135+
</div>
136+
</div>
137+
</div>
138+
139+
</body>
140+
141+
</html>

‎simplerisk/account/profile.php‎

Lines changed: 46 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,6 @@
1111
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
1212
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1313

14-
// Include Laminas Escaper for HTML Output Encoding
15-
$escaper = new Laminas\Escaper\Escaper('utf-8');
16-
1714
// Add various security headers
1815
add_security_headers();
1916

@@ -24,6 +21,8 @@
2421
include_csrf_magic();
2522

2623
// Include the SimpleRisk language file
24+
// Ignoring detections related to language files
25+
// @phan-suppress-next-line SecurityCheck-PathTraversal
2726
require_once(language_file());
2827

2928
// If the language was changed
@@ -38,6 +37,8 @@
3837
update_language($_SESSION['uid'], get_name_by_value("languages", $language));
3938

4039
// Use the new language file
40+
// Ignoring detections related to language files
41+
// @phan-suppress-next-line SecurityCheck-PathTraversal
4142
require_once(language_file());
4243

4344
// Display an alert
@@ -51,6 +52,13 @@
5152
}
5253
}
5354

55+
// If the user wants to enable or disable MFA
56+
if (isset($_POST['mfa_disable']) || isset($_POST['mfa_enable']))
57+
{
58+
// Redirect to the MFA configuration page
59+
header("Location: mfa.php");
60+
}
61+
5462
$user_id = $_SESSION['uid'];
5563
// Get the users information
5664
$user_info = get_user_by_id($user_id);
@@ -60,7 +68,8 @@
6068
$manager = $user_info['manager'] ? get_user_name($user_info['manager']) : "-";
6169
$last_login = format_date($user_info['last_login']);
6270
$teams = get_names_by_multi_values('team', $user_info['teams'], true);
63-
$language = $user_info['lang'];
71+
$language = (string)$user_info['lang'];
72+
$multi_factor = (int)$user_info['multi_factor'];
6473
$admin = $user_info['admin'];
6574

6675
$role_id = $user_info['role_id'];
@@ -229,7 +238,7 @@
229238
}
230239

231240
.admin-info:before {
232-
font-family: "Font Awesome 5 Free";
241+
font-family: "Font Awesome 6 Free";
233242
font-weight: "900";
234243
content: "\f05A";
235244
display: inline-block;
@@ -262,6 +271,7 @@
262271
<tr><td class="profile-data-name"><?php echo $escaper->escapeHtml($lang['Manager']); ?>:</td><td class="profile-data"><?php echo $escaper->escapeHtml($manager); ?></td></tr>
263272
<tr><td class="profile-data-name teams"><?php echo $escaper->escapeHtml($lang['Teams']); ?>:</td><td><div class="profile-data teams">
264273
<?php
274+
global $escaper;
265275
if ($teams) {
266276
$teams = array_map(function($team) use ($escaper) {
267277
return $escaper->escapeHtml($team);
@@ -288,6 +298,37 @@
288298
?></div></td></tr>
289299
<tr><td class="profile-data-name"><?php echo $escaper->escapeHtml($lang['Role']); ?>:</td><td><div class="profile-data"><?php echo $escaper->escapeHtml($role); ?></div></td></tr>
290300
<tr><td class="profile-data-name"><i class="admin-info" title="<?php echo $escaper->escapeHtml($lang['AdminRoleDescription']);?>"></i><?php echo $escaper->escapeHtml($lang['Admin']); ?>:</td><td><div class="profile-data"><?php echo $escaper->escapeHtml(localized_yes_no($admin)); ?></div></td></tr>
301+
<tr><td>&nbsp;</td></tr>
302+
<tr>
303+
<td class ="profile-data-name">MFA:</td>
304+
<td>
305+
<div class="profile-data">
306+
<?php
307+
308+
echo ($multi_factor == 1 ? $escaper->escapeHtml($lang['Enabled']) : $escaper->escapeHtml($lang['Disabled']));
309+
310+
// If MFA is disabled for this user
311+
if ($multi_factor == 0)
312+
{
313+
// Display the button to enable MFA
314+
echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input name='mfa_enable' type='submit' value='" . $escaper->escapeHtml($lang['EnableMFA']) . "' />";
315+
}
316+
// If MFA is enabled for this user
317+
else
318+
{
319+
// If we do not require MFA for all users
320+
if (!get_setting("mfa_required"))
321+
{
322+
// Display the button to disable MFA
323+
echo "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input name='mfa_disable' type='submit' value='" . $escaper->escapeHtml($lang['DisableMFA']) . "' />";
324+
}
325+
}
326+
327+
?>
328+
</div>
329+
</td>
330+
</tr>
331+
<tr><td>&nbsp;</td></tr>
291332
<tr><td class="profile-data-name"><?php echo $escaper->escapeHtml($lang['Language']); ?>:&nbsp;</td><td><?php create_dropdown("languages", get_value_by_name("languages", $language)); ?><input type="submit" name="change_language" value="<?php echo $escaper->escapeHtml($lang['Update']); ?>" /></td></tr>
292333
<?php
293334
// If the API Extra is enabled

‎simplerisk/admin/about.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@
99
require_once(realpath(__DIR__ . '/../includes/display.php'));
1010
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1111

12-
// Include Laminas Escaper for HTML Output Encoding
13-
$escaper = new Laminas\Escaper\Escaper('utf-8');
14-
1512
// Add various security headers
1613
add_security_headers();
1714

@@ -26,6 +23,8 @@
2623
include_csrf_magic();
2724

2825
// Include the SimpleRisk language file
26+
// Ignoring detections related to language files
27+
// @phan-suppress-next-line SecurityCheck-PathTraversal
2928
require_once(language_file());
3029

3130
?>

‎simplerisk/admin/active_assessments.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@
1010
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
1111
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1212

13-
// Include Laminas Escaper for HTML Output Encoding
14-
$escaper = new Laminas\Escaper\Escaper('utf-8');
15-
1613
// Add various security headers
1714
add_security_headers();
1815

@@ -27,6 +24,8 @@
2724
include_csrf_magic();
2825

2926
// Include the SimpleRisk language file
27+
// Ignoring detections related to language files
28+
// @phan-suppress-next-line SecurityCheck-PathTraversal
3029
require_once(language_file());
3130

3231
// Check if assessment extra is enabled

‎simplerisk/admin/add_remove_values.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@
1010
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
1111
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1212

13-
// Include Laminas Escaper for HTML Output Encoding
14-
$escaper = new Laminas\Escaper\Escaper('utf-8');
15-
1613
// Add various security headers
1714
add_security_headers();
1815

@@ -27,6 +24,8 @@
2724
include_csrf_magic();
2825

2926
// Include the SimpleRisk language file
27+
// Ignoring detections related to language files
28+
// @phan-suppress-next-line SecurityCheck-PathTraversal
3029
require_once(language_file());
3130

3231
$customAddFunction_team = function($name) {

‎simplerisk/admin/advanced_search.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@
1010
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
1111
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1212

13-
// Include Laminas Escaper for HTML Output Encoding
14-
$escaper = new Laminas\Escaper\Escaper('utf-8');
15-
1613
// Add various security headers
1714
add_security_headers();
1815

@@ -27,6 +24,8 @@
2724
include_csrf_magic();
2825

2926
// Include the SimpleRisk language file
27+
// Ignoring detections related to language files
28+
// @phan-suppress-next-line SecurityCheck-PathTraversal
3029
require_once(language_file());
3130

3231
// If the extra directory exists

‎simplerisk/admin/announcements.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@
1010
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
1111
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1212

13-
// Include Laminas Escaper for HTML Output Encoding
14-
$escaper = new Laminas\Escaper\Escaper('utf-8');
15-
1613
// Add various security headers
1714
add_security_headers();
1815

@@ -27,6 +24,8 @@
2724
include_csrf_magic();
2825

2926
// Include the SimpleRisk language file
27+
// Ignoring detections related to language files
28+
// @phan-suppress-next-line SecurityCheck-PathTraversal
3029
require_once(language_file());
3130

3231
?>

‎simplerisk/admin/api.php‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,6 @@
1010
require_once(realpath(__DIR__ . '/../includes/alerts.php'));
1111
require_once(realpath(__DIR__ . '/../vendor/autoload.php'));
1212

13-
// Include Laminas Escaper for HTML Output Encoding
14-
$escaper = new Laminas\Escaper\Escaper('utf-8');
15-
1613
// Add various security headers
1714
add_security_headers();
1815

@@ -27,6 +24,8 @@
2724
include_csrf_magic();
2825

2926
// Include the SimpleRisk language file
27+
// Ignoring detections related to language files
28+
// @phan-suppress-next-line SecurityCheck-PathTraversal
3029
require_once(language_file());
3130

3231
// If the extra directory exists

0 commit comments

Comments
 (0)