This repository has been archived by the owner on Nov 18, 2017. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathtypo3-probe.php
1626 lines (1509 loc) · 71.6 KB
/
typo3-probe.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?php
/***************************************************************
* Copyright notice
*
* (c) 2013 Christian Kuhn <[email protected]>
* (c) 2013 Felix Kopp <[email protected]>
* All rights reserved
*
* This script is part of the TYPO3 project. The TYPO3 project is
* free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* The GNU General Public License can be found at
* http://www.gnu.org/copyleft/gpl.html.
*
* This script is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* This copyright notice MUST APPEAR in all copies of the script!
***************************************************************/
/**
* Extraction of system environment status from the TYPO3 project
* Picked on 2013-03-14, commit 009f307bd2e1aca577f82044800286529ebaa5e5
* @see http://git.typo3.org/TYPO3v4/Core.git/commit/009f307bd2e1aca577f82044800286529ebaa5e5
*
*
* Status interface
*
* @author Christian Kuhn <[email protected]>
* @see TYPO3 project: typo3/sysext/install/Classes/SystemEnvironment/StatusInterface.php
*/
interface StatusInterface {
/**
* Get severity
*
* @return string The severity
*/
public function getSeverity();
/**
* Get title
*
* @return string The title
*/
public function getTitle();
/**
* Set title
*
* @param string $title The title
* @return void
*/
public function setTitle($title);
/**
* Get status message
*
* @return string Status message
*/
public function getMessage();
/**
* Set status message
*
* @param string $message Status message
* @return void
*/
public function setMessage($message);
}
/**
* Abstract status
*
* @author Christian Kuhn <[email protected]>
*/
abstract class AbstractStatus implements StatusInterface {
/**
* @var string Severity
*/
protected $severity = '';
/**
* @var string Title
*/
protected $title = '';
/**
* @var string Status message
*/
protected $message = '';
/**
* @return string The severity
*/
public function getSeverity() {
return $this->severity;
}
/**
* @return string The title
*/
public function getTitle() {
return $this->title;
}
/**
* Set title
*
* @param string $title The title
* @return void
*/
public function setTitle($title) {
$this->title = $title;
}
/**
* Get status message
*
* @return string Status message
*/
public function getMessage() {
return $this->message;
}
/**
* Set status message
*
* @param string $message Status message
* @return void
*/
public function setMessage($message) {
$this->message = $message;
}
}
/**
* Warning level status
*
* @author Christian Kuhn <[email protected]>
*/
class WarningStatus extends AbstractStatus implements StatusInterface {
/**
* @var string The severity
*/
protected $severity = 'warning';
}
/**
* Error level status
*
* @author Christian Kuhn <[email protected]>
*/
class ErrorStatus extends AbstractStatus implements StatusInterface {
/**
* @var string The severity
*/
protected $severity = 'error';
}
/**
* Info level status
*
* @author Christian Kuhn <[email protected]>
*/
class InfoStatus extends AbstractStatus implements StatusInterface {
/**
* @var string The severity
*/
protected $severity = 'information';
}
/**
* Notice level status
*
* @author Christian Kuhn <[email protected]>
*/
class NoticeStatus extends AbstractStatus implements StatusInterface {
/**
* @var string The severity
*/
protected $severity = 'notice';
}
/**
* Ok level status
*
* @author Christian Kuhn <[email protected]>
*/
class OkStatus extends AbstractStatus implements StatusInterface {
/**
* @var string The severity
*/
protected $severity = 'ok';
}
/**
* Check system environment status
*
* This class is a hardcoded requirement check of the underlying
* server and PHP system.
*
* The class *must not* check for any TYPO3 specific things like
* specific configuration values or directories. It should not fail
* if there is no TYPO3 at all.
*
* The only core code used is the class loader
*
* This class is instantiated as the *very first* class during
* installation. It is meant to be *standalone* und must not have
* any requirements, except the status classes. It must be possible
* to run this script separated from the rest of the core, without
* dependencies.
*
* This means especially:
* * No hooks or anything like that
* * No usage of *any* TYPO3 code like GeneralUtility
* * No require of anything but the status classes
* * No localization
*
* The status messages and title *must not* include HTML, use plain
* text only. The return values of this class are not bound to HTML
* and can be used in different scopes (eg. as json array).
*
* @author Christian Kuhn <[email protected]>
*/
class Check {
/**
* @var array List of required PHP extensions
*/
protected $requiredPhpExtensions = array(
'fileinfo',
'filter',
'gd',
'hash',
'json',
'mysqli',
'openssl',
'pcre',
'session',
'soap',
'SPL',
'standard',
'xml',
'zip',
'zlib',
);
/**
* Get all status information as array with status objects
*
* @return array<StatusInterface>
*/
public function getStatus() {
$statusArray = array();
$statusArray[] = $this->checkCurrentDirectoryIsInIncludePath();
$statusArray[] = $this->checkFileUploadEnabled();
$statusArray[] = $this->checkMaximumFileUploadSize();
$statusArray[] = $this->checkPostUploadSizeIsHigherOrEqualMaximumFileUploadSize();
$statusArray[] = $this->checkMemorySettings();
$statusArray[] = $this->checkPhpVersion();
$statusArray[] = $this->checkMaxExecutionTime();
$statusArray[] = $this->checkDisableFunctions();
$statusArray[] = $this->checkSafeMode();
$statusArray[] = $this->checkDocRoot();
$statusArray[] = $this->checkOpenBaseDir();
$statusArray[] = $this->checkXdebugMaxNestingLevel();
$statusArray[] = $this->checkOpenSslInstalled();
$statusArray[] = $this->checkSuhosinLoaded();
$statusArray[] = $this->checkSuhosinRequestMaxVars();
$statusArray[] = $this->checkSuhosinPostMaxVars();
$statusArray[] = $this->checkSuhosinGetMaxValueLength();
$statusArray[] = $this->checkSuhosinExecutorIncludeWhitelistContainsPhar();
$statusArray[] = $this->checkSuhosinExecutorIncludeWhitelistContainsVfs();
$statusArray[] = $this->checkSomePhpOpcodeCacheIsLoaded();
$statusArray[] = $this->checkReflectionDocComment();
$statusArray[] = $this->checkWindowsApacheThreadStackSize();
foreach ($this->requiredPhpExtensions as $extension) {
$statusArray[] = $this->checkRequiredPhpExtension($extension);
}
$statusArray[] = $this->checkGdLibTrueColorSupport();
$statusArray[] = $this->checkGdLibGifSupport();
$statusArray[] = $this->checkGdLibJpgSupport();
$statusArray[] = $this->checkGdLibPngSupport();
$statusArray[] = $this->checkGdLibFreeTypeSupport();
$statusArray[] = $this->checkPhpMagicQuotes();
$statusArray[] = $this->checkRegisterGlobals();
$statusArray[] = $this->isTrueTypeFontDpiStandard();
return $statusArray;
}
/**
* Checks if current directory (.) is in PHP include path
*
* @return StatusInterface
*/
protected function checkCurrentDirectoryIsInIncludePath() {
$includePath = ini_get('include_path');
$delimiter = $this->isWindowsOs() ? ';' : ':';
$pathArray = $this->trimExplode($delimiter, $includePath);
if (!in_array('.', $pathArray)) {
$status = new WarningStatus();
$status->setTitle('Current directory (./) is not within PHP include path');
$status->setMessage(
'include_path = ' . implode(' ', $pathArray) . LF .
'Normally the current path \'.\' is included in the' .
' include_path of PHP. Although TYPO3 does not rely on this,' .
' it is an unusual setting that may introduce problems for' .
' some extensions.'
);
} else {
$status = new OkStatus();
$status->setTitle('Current directory (./) is within PHP include path.');
}
return $status;
}
/**
* Check if file uploads are enabled in PHP
*
* @return StatusInterface
*/
protected function checkFileUploadEnabled() {
if (!ini_get('file_uploads')) {
$status = new ErrorStatus();
$status->setTitle('File uploads not allowed in PHP');
$status->setMessage(
'file_uploads=' . ini_get('file_uploads') . LF .
'TYPO3 uses the ability to upload files from the browser in various cases.' .
' As long as this flag is disabled in PHP, you\'ll not be able to upload files.' .
' But it doesn\'t end here, because not only are files not accepted by' .
' the server - ALL content in the forms are discarded and therefore' .
' nothing at all will be editable if you don\'t set this flag!' .
' However if you cannot enable fileupload for some reason in PHP, alternatively' .
' change the default form encoding value with \\$TYPO3_CONF_VARS[SYS][form_enctype].'
);
} else {
$status = new OkStatus();
$status->setTitle('File uploads allowed in PHP');
}
return $status;
}
/**
* Check maximum file upload size against default value of 10MB
*
* @return StatusInterface
*/
protected function checkMaximumFileUploadSize() {
$maximumUploadFilesize = $this->getBytesFromSizeMeasurement(ini_get('upload_max_filesize'));
if ($maximumUploadFilesize < 1024 * 1024 * 10) {
$status = new ErrorStatus();
$status->setTitle('PHP Maximum upload filesize too small');
$status->setMessage(
'upload_max_filesize=' . ini_get('upload_max_filesize') . LF .
'By default TYPO3 supports uploading, copying and moving' .
' files of sizes up to 10MB (you can alter the TYPO3 defaults' .
' by the config option TYPO3_CONF_VARS[BE][maxFileSize]).' .
' Your current PHP value is below this, so at this point, PHP determines' .
' the limits for uploaded filesizes and not TYPO3.' .
' It is recommended that the value of upload_max_filesize at least equals to the value' .
' of TYPO3_CONF_VARS[BE][maxFileSize]'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP Maximum file upload size is higher or equal to 10MB');
}
return $status;
}
/**
* Check maximum post upload size correlates with maximum file upload
*
* @return StatusInterface
*/
protected function checkPostUploadSizeIsHigherOrEqualMaximumFileUploadSize() {
$maximumUploadFilesize = $this->getBytesFromSizeMeasurement(ini_get('upload_max_filesize'));
$maximumPostSize = $this->getBytesFromSizeMeasurement(ini_get('post_max_size'));
if ($maximumPostSize < $maximumUploadFilesize) {
$status = new ErrorStatus();
$status->setTitle('Maximum size for POST requests is smaller than maximum upload filesize in PHP');
$status->setMessage(
'upload_max_filesize=' . ini_get('upload_max_filesize') . LF .
'post_max_size=' . ini_get('post_max_size') . LF .
'You have defined a maximum size for file uploads in PHP which' .
' exceeds the allowed size for POST requests. Therefore the' .
' file uploads can not be larger than ' . ini_get('post_max_size') . '.'
);
} else {
$status = new OkStatus();
$status->setTitle('Maximum post upload size correlates with maximum upload file size in PHP');
}
return $status;
}
/**
* Check memory settings
*
* @return StatusInterface
*/
protected function checkMemorySettings() {
$minimumMemoryLimit = 32;
$recommendedMemoryLimit = 64;
$memoryLimit = $this->getBytesFromSizeMeasurement(ini_get('memory_limit'));
if ($memoryLimit <= 0) {
$status = new WarningStatus();
$status->setTitle('Unlimited memory limit for PHP');
$status->setMessage(
'PHP is configured to not limit memory usage at all. This is a risk' .
' and should be avoided in production setup. In general it\'s best practice to limit this.' .
' To be safe, set a limit in PHP, but with a minimum of ' . $recommendedMemoryLimit . 'MB:' . LF .
'memory_limit=' . $recommendedMemoryLimit . 'M'
);
} elseif ($memoryLimit < 1024 * 1024 * $minimumMemoryLimit) {
$status = new ErrorStatus();
$status->setTitle('PHP Memory limit below ' . $minimumMemoryLimit . 'MB');
$status->setMessage(
'memory_limit=' . ini_get('memory_limit') . LF .
'Your system is configured to enforce a memory limit of PHP scripts lower than ' .
$minimumMemoryLimit . 'MB. It is required to raise the limit.' .
' We recommend a minimum PHP memory limit of ' . $recommendedMemoryLimit . 'MB:' . LF .
'memory_limit=' . $recommendedMemoryLimit . 'M'
);
} elseif ($memoryLimit < 1024 * 1024 * $recommendedMemoryLimit) {
$status = new WarningStatus();
$status->setTitle('PHP Memory limit below ' . $recommendedMemoryLimit . 'MB');
$status->setMessage(
'memory_limit=' . ini_get('memory_limit') . LF .
'Your system is configured to enforce a memory limit of PHP scripts lower than ' .
$recommendedMemoryLimit . 'MB.' .
' A slim TYPO3 instance without many extensions will probably work, but you should monitor your' .
' system for exhausted messages, especially if using the backend. To be on the safe side,' .
' we recommend a minimum PHP memory limit of ' . $recommendedMemoryLimit . 'MB:' . LF .
'memory_limit=' . $recommendedMemoryLimit . 'M'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP Memory limit equals to ' . $recommendedMemoryLimit . 'MB or more');
}
return $status;
}
/**
* Check minimum PHP version
*
* @return StatusInterface
*/
protected function checkPhpVersion() {
$minimumPhpVersion = '5.3.7';
$currentPhpVersion = phpversion();
if (version_compare($currentPhpVersion, $minimumPhpVersion) < 0) {
$status = new ErrorStatus();
$status->setTitle('PHP version too low');
$status->setMessage(
'Your PHP version ' . $currentPhpVersion . ' is too old. TYPO3 CMS does not run' .
' with this version. Update to at least PHP ' . $minimumPhpVersion
);
} else {
$status = new OkStatus();
$status->setTitle('PHP version is fine');
}
return $status;
}
/**
* Check maximum execution time
*
* @return StatusInterface
*/
protected function checkMaxExecutionTime() {
$minimumMaximumExecutionTime = 30;
$recommendedMaximumExecutionTime = 240;
$currentMaximumExecutionTime = ini_get('max_execution_time');
if ($currentMaximumExecutionTime == 0) {
if (PHP_SAPI === 'cli') {
$status = new OkStatus();
$status->setTitle('Infinite PHP script execution time');
$status->setMessage(
'Maximum PHP script execution time is always set to infinite (0) in cli mode.' .
' The setting used for web requests can not be checked from command line.'
);
} else {
$status = new WarningStatus();
$status->setTitle('Infinite PHP script execution time');
$status->setMessage(
'max_execution_time=' . $currentMaximumExecutionTime . LF .
'While TYPO3 is fine with this, you risk a denial-of-service of your system if for whatever' .
' reason some script hangs in an infinite loop. You are usually on safe side ' .
' if it is reduced to ' . $recommendedMaximumExecutionTime . ' seconds:' . LF .
'max_execution_time=' . $recommendedMaximumExecutionTime
);
}
} elseif ($currentMaximumExecutionTime < $minimumMaximumExecutionTime) {
$status = new ErrorStatus();
$status->setTitle('Low PHP script execution time');
$status->setMessage(
'max_execution_time=' . $currentMaximumExecutionTime . LF .
'Your max_execution_time is too low. Some expensive operation in TYPO3 can take longer than that.' .
' It is recommended to raise the limit to ' . $recommendedMaximumExecutionTime . ' seconds:' . LF .
'max_execution_time=' . $recommendedMaximumExecutionTime
);
} elseif ($currentMaximumExecutionTime < $recommendedMaximumExecutionTime) {
$status = new WarningStatus();
$status->setTitle('Low PHP script execution time');
$status->setMessage(
'max_execution_time=' . $currentMaximumExecutionTime . LF .
'Your max_execution_time is low. While TYPO3 often runs without problems' .
' with ' . $minimumMaximumExecutionTime . ' seconds,' .
' it still may happen that script execution is stopped before finishing' .
' calculations. You should monitor the system for messages in this area' .
' and maybe raise the limit to ' . $recommendedMaximumExecutionTime . ' seconds:' . LF .
'max_execution_time=' . $recommendedMaximumExecutionTime
);
} else {
$status = new OkStatus();
$status->setTitle('Maximum PHP script execution time equals ' . $recommendedMaximumExecutionTime . ' or more');
}
return $status;
}
/**
* Check for disabled functions
*
* @return StatusInterface
*/
protected function checkDisableFunctions() {
$disabledFunctions = trim(ini_get('disable_functions'));
// Filter "disable_functions"
$disabledFunctionsArray = $this->trimExplode(',', $disabledFunctions);
// Array with strings to find
$findStrings = array(
// Disabled by default on Ubuntu OS but this is okay since the Core does not use them
'pcntl_',
);
foreach ($disabledFunctionsArray as $key => $disabledFunction) {
foreach ($findStrings as $findString) {
if (strpos($disabledFunction, $findString) !== FALSE) {
unset($disabledFunctionsArray[$key]);
}
}
}
if (strlen($disabledFunctions) > 0 && count($disabledFunctionsArray) > 0) {
$status = new ErrorStatus();
$status->setTitle('Some PHP functions disabled');
$status->setMessage(
'disable_functions=' . implode(' ', explode(',', $disabledFunctions)) . LF .
'These function(s) are disabled. TYPO3 uses some of those, so there might be trouble.' .
' TYPO3 is designed to use the default set of PHP functions plus some common extensions.' .
' Possibly these functions are disabled' .
' due to security considerations and most likely the list would include a function like' .
' exec() which is used by TYPO3 at various places. Depending on which exact functions' .
' are disabled, some parts of the system may just break without further notice.'
);
} elseif (strlen($disabledFunctions) > 0 && count($disabledFunctionsArray) === 0) {
$status = new NoticeStatus();
$status->setTitle('Some PHP functions currently disabled but OK');
$status->setMessage(
'disable_functions=' . implode(' ', explode(',', $disabledFunctions)) . LF .
'These function(s) are disabled. TYPO3 uses currently none of those, so you are good to go.'
);
} else {
$status = new OkStatus();
$status->setTitle('No disabled PHP functions');
}
return $status;
}
/**
* Check if safe mode is enabled
*
* @return StatusInterface
*/
protected function checkSafeMode() {
$safeModeEnabled = FALSE;
if (version_compare(phpversion(), '5.4', '<')) {
$safeModeEnabled = filter_var(
ini_get('safe_mode'),
FILTER_VALIDATE_BOOLEAN,
array(FILTER_REQUIRE_SCALAR, FILTER_NULL_ON_FAILURE)
);
}
if ($safeModeEnabled) {
$status = new ErrorStatus();
$status->setTitle('PHP safe mode on');
$status->setMessage(
'PHP safe_mode enabled. This is unsupported by TYPO3 CMS, it must be turned off:' . LF .
'safe_mode=Off'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP safe mode off');
}
return $status;
}
/**
* Check for doc_root ini setting
*
* @return StatusInterface
*/
protected function checkDocRoot() {
$docRootSetting = trim(ini_get('doc_root'));
if (strlen($docRootSetting) > 0) {
$status = new NoticeStatus();
$status->setTitle('doc_root is set');
$status->setMessage(
'doc_root=' . $docRootSetting . LF .
'PHP cannot execute scripts' .
' outside this directory. This setting is used seldom and must correlate' .
' with your actual document root. You might be in trouble if your' .
' TYPO3 CMS core code is linked to some different location.' .
' If that is a problem, the setting must be adapted.'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP doc_root is not set');
}
return $status;
}
/**
* Check open_basedir
*
* @return StatusInterface
*/
protected function checkOpenBaseDir() {
$openBaseDirSetting = trim(ini_get('open_basedir'));
if (strlen($openBaseDirSetting) > 0) {
$status = new NoticeStatus();
$status->setTitle('PHP open_basedir is set');
$status->setMessage(
'open_basedir = ' . ini_get('open_basedir') . LF .
'This restricts TYPO3 to open and include files only in this' .
' path. Please make sure that this does not prevent TYPO3 from running,' .
' if for example your TYPO3 CMS core is linked to a different directory' .
' not included in this path.'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP open_basedir is off');
}
return $status;
}
/**
* If xdebug is loaded, the default max_nesting_level of 100 must be raised
*
* @return StatusInterface
*/
protected function checkXdebugMaxNestingLevel() {
if (extension_loaded('xdebug')) {
$recommendedMaxNestingLevel = 250;
$currentMaxNestingLevel = ini_get('xdebug.max_nesting_level');
if ($currentMaxNestingLevel < $recommendedMaxNestingLevel) {
$status = new ErrorStatus();
$status->setTitle('PHP xdebug.max_nesting_level too low');
$status->setMessage(
'xdebug.max_nesting_level=' . $currentMaxNestingLevel . LF .
'This setting controls the maximum number of nested function calls to protect against' .
' infinite recursion. The current value is too low for TYPO3 CMS and must' .
' be either raised or xdebug unloaded. A value of ' . $recommendedMaxNestingLevel .
' is recommended. Warning: Expect fatal PHP errors in central parts of the CMS' .
' if the default value of 100 is not raised significantly to:' . LF .
'xdebug.max_nesting_level=' . $recommendedMaxNestingLevel
);
} else {
$status = new OkStatus();
$status->setTitle('PHP xdebug.max_nesting_level ok');
}
} else {
$status = new OkStatus();
$status->setTitle('PHP xdebug extension not loaded');
}
return $status;
}
/**
* Check accessibility and functionality of OpenSSL
*
* @return StatusInterface
*/
protected function checkOpenSslInstalled() {
if (extension_loaded('openssl')) {
$testKey = @openssl_pkey_new();
if (is_resource($testKey)) {
openssl_free_key($testKey);
$status = new OkStatus();
$status->setTitle('PHP OpenSSL extension installed properly');
} else {
$status = new ErrorStatus();
$status->setTitle('PHP OpenSSL extension not working');
$status->setMessage(
'Something went wrong while trying to create a new private key for testing.' .
' Please check the integration of the PHP OpenSSL extension and if it is installed correctly.'
);
}
} else {
$status = new ErrorStatus();
$status->setTitle('PHP OpenSSL extension not loaded');
$status->setMessage(
'OpenSSL is a PHP extension to encrypt/decrypt data between requests.' .
' TYPO3 CMS requires it to be able to store passwords encrypted to improve the security on database layer.'
);
}
return $status;
}
/**
* Check enabled suhosin
*
* @return StatusInterface
*/
protected function checkSuhosinLoaded() {
if ($this->isSuhosinLoaded()) {
$status = new OkStatus();
$status->setTitle('PHP suhosin extension loaded');
} else {
$status = new NoticeStatus();
$status->setTitle('PHP suhosin extension not loaded');
$status->setMessage(
'suhosin is an extension to harden the PHP environment. In general, it is' .
' good to have it from a security point of view. While TYPO3 CMS works' .
' fine with suhosin, it has some requirements different from default settings' .
' to be set if enabled.'
);
}
return $status;
}
/**
* Check suhosin.request.max_vars
*
* @return StatusInterface
*/
protected function checkSuhosinRequestMaxVars() {
$recommendedRequestMaxVars = 400;
if ($this->isSuhosinLoaded()) {
$currentRequestMaxVars = ini_get('suhosin.request.max_vars');
if ($currentRequestMaxVars < $recommendedRequestMaxVars) {
$status = new ErrorStatus();
$status->setTitle('PHP suhosin.request.max_vars too low');
$status->setMessage(
'suhosin.request.max_vars=' . $currentRequestMaxVars . LF .
'This setting can lead to lost information if submitting big forms in TYPO3 CMS like' .
' it is done in the install tool. It is heavily recommended to raise this' .
' to at least ' . $recommendedRequestMaxVars . ':' . LF .
'suhosin.request.max_vars=' . $recommendedRequestMaxVars
);
} else {
$status = new OkStatus();
$status->setTitle('PHP suhosin.request.max_vars ok');
}
} else {
$status = new InfoStatus();
$status->setTitle('Suhosin not loaded');
$status->setMessage(
'If enabling suhosin, suhosin.request.max_vars' .
' should be set to at least ' . $recommendedRequestMaxVars . ':' . LF .
'suhosin.request.max_vars=' . $recommendedRequestMaxVars
);
}
return $status;
}
/**
* Check suhosin.post.max_vars
*
* @return StatusInterface
*/
protected function checkSuhosinPostMaxVars() {
$recommendedPostMaxVars = 400;
if ($this->isSuhosinLoaded()) {
$currentPostMaxVars = ini_get('suhosin.post.max_vars');
if ($currentPostMaxVars < $recommendedPostMaxVars) {
$status = new ErrorStatus();
$status->setTitle('PHP suhosin.post.max_vars too low');
$status->setMessage(
'suhosin.post.max_vars=' . $currentPostMaxVars . LF .
'This setting can lead to lost information if submitting big forms in TYPO3 CMS like' .
' it is done in the install tool. It is heavily recommended to raise this' .
' to at least ' . $recommendedPostMaxVars . ':' . LF .
'suhosin.post.max_vars=' . $recommendedPostMaxVars
);
} else {
$status = new OkStatus();
$status->setTitle('PHP suhosin.post.max_vars ok');
}
} else {
$status = new InfoStatus();
$status->setTitle('Suhosin not loaded');
$status->setMessage(
'If enabling suhosin, suhosin.post.max_vars' .
' should be set to at least ' . $recommendedPostMaxVars . ':' . LF .
'suhosin.post.max_vars=' . $recommendedPostMaxVars
);
}
return $status;
}
/**
* Check suhosin.get.max_value_length
*
* @return StatusInterface
*/
protected function checkSuhosinGetMaxValueLength() {
$recommendedGetMaxValueLength = 2000;
if ($this->isSuhosinLoaded()) {
$currentGetMaxValueLength = ini_get('suhosin.get.max_value_length');
if ($currentGetMaxValueLength < $recommendedGetMaxValueLength) {
$status = new ErrorStatus();
$status->setTitle('PHP suhosin.get.max_value_length too low');
$status->setMessage(
'suhosin.get.max_value_length=' . $currentGetMaxValueLength . LF .
'This setting can lead to lost information if submitting big forms in TYPO3 CMS like' .
' it is done in the install tool. It is heavily recommended to raise this' .
' to at least ' . $recommendedGetMaxValueLength . ':' . LF .
'suhosin.get.max_value_length=' . $recommendedGetMaxValueLength
);
} else {
$status = new OkStatus();
$status->setTitle('PHP suhosin.get.max_value_length ok');
}
} else {
$status = new InfoStatus();
$status->setTitle('Suhosin not loaded');
$status->setMessage(
'If enabling suhosin, suhosin.get.max_value_length' .
' should be set to at least ' . $recommendedGetMaxValueLength . ':' . LF .
'suhosin.get.max_value_length=' . $recommendedGetMaxValueLength
);
}
return $status;
}
/**
* Check suhosin.executor.include.whitelist contains phar
*
* @return StatusInterface
*/
protected function checkSuhosinExecutorIncludeWhiteListContainsPhar() {
if ($this->isSuhosinLoaded()) {
$currentWhiteListArray = $this->trimExplode(' ', ini_get('suhosin.executor.include.whitelist'));
if (!in_array('phar', $currentWhiteListArray)) {
$status = new NoticeStatus();
$status->setTitle('PHP suhosin.executor.include.whitelist does not contain phar');
$status->setMessage(
'suhosin.executor.include.whitelist= ' . implode(' ', $currentWhiteListArray) . LF .
'"phar" is currently not a hard requirement of TYPO3 CMS but is nice to have and a possible' .
' requirement in future versions. A useful setting is:' . LF .
'suhosin.executor.include.whitelist=phar vfs'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP suhosin.executor.include.whitelist contains phar');
}
} else {
$status = new InfoStatus();
$status->setTitle('Suhosin not loaded');
$status->setMessage(
'If enabling suhosin, a useful setting is:' . LF .
'suhosin.executor.include.whitelist=phar vfs'
);
}
return $status;
}
/**
* Check suhosin.executor.include.whitelist contains vfs
*
* @return StatusInterface
*/
protected function checkSuhosinExecutorIncludeWhiteListContainsVfs() {
if ($this->isSuhosinLoaded()) {
$currentWhiteListArray = $this->trimExplode(' ', ini_get('suhosin.executor.include.whitelist'));
if (!in_array('vfs', $currentWhiteListArray)) {
$status = new WarningStatus();
$status->setTitle('PHP suhosin.executor.include.whitelist does not contain vfs');
$status->setMessage(
'suhosin.executor.include.whitelist= ' . implode(' ', $currentWhiteListArray) . LF .
'"vfs" is currently not a hard requirement of TYPO3 CMS but tons of unit tests rely on it.' .
' Furthermore, vfs is likely a base for an additional compatibility layer in the future.' .
' A useful setting is:' . LF .
'suhosin.executor.include.whitelist=phar vfs'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP suhosin.executor.include.whitelist contains vfs');
}
} else {
$status = new InfoStatus();
$status->setTitle('Suhosin not loaded');
$status->setMessage(
'If enabling suhosin, a useful setting is:' . LF .
'suhosin.executor.include.whitelist=phar vfs'
);
}
return $status;
}
/**
* Check if some opcode cache is loaded
*
* @return StatusInterface
*/
protected function checkSomePhpOpcodeCacheIsLoaded() {
if (
// Currently APCu identifies itself both as "apcu" and "apc" (for compatibility) although it doesn't provide the APC-opcache functionality
extension_loaded('eaccelerator')
|| extension_loaded('xcache')
|| (extension_loaded('apc') && !extension_loaded('apcu'))
|| extension_loaded('Zend Optimizer+')
|| extension_loaded('Zend OPcache')
|| extension_loaded('wincache')
) {
$status = new OkStatus();
$status->setTitle('A PHP opcode cache is loaded');
} else {
$status = new WarningStatus();
$status->setTitle('No PHP opcode cache loaded');
$status->setMessage(
'PHP opcode caches hold a compiled version of executed PHP scripts in' .
' memory and do not require to recompile any script on each access.' .
' This can be a massive performance improvement and can put load off a' .
' server in general, a parse time reduction by factor three for full cached' .
' pages can be achieved easily if using some opcode cache.' .
' If in doubt choosing one, APC runs well and can be used as data' .
' cache layer in TYPO3 CMS as additional feature.'
);
}
return $status;
}
/**
* Check doc comments can be fetched by reflection
*
* @return StatusInterface
*/
protected function checkReflectionDocComment() {
$testReflection = new \ReflectionMethod(get_class($this), __FUNCTION__);
if (strlen($testReflection->getDocComment()) === 0) {
$status = new ErrorStatus();
$status->setTitle('PHP Doc comment reflection broken');
$status->setMessage(
'TYPO3 CMS core extensions like extbase and fluid heavily rely on method' .
' comment parsing to fetch annotations and add magic according to them.' .
' This does not work in the current environment and will lead to a lot of' .
' broken extensions. The PHP extension eaccelerator is known to break this if' .
' it is compiled without --with-eaccelerator-doc-comment-inclusion flag.' .
' This compile flag must be given, otherwise TYPO3 CMS is no fun.'
);
} else {
$status = new OkStatus();
$status->setTitle('PHP Doc comment reflection works');
}
return $status;
}
/**
* Checks thread stack size if on windows with apache
*
* @return StatusInterface
*/
protected function checkWindowsApacheThreadStackSize() {
if (
$this->isWindowsOs()
&& substr($_SERVER['SERVER_SOFTWARE'], 0, 6) === 'Apache'
) {
$status = new WarningStatus();
$status->setTitle('Windows apache thread stack size');
$status->setMessage(
'This current value can not be checked by the system, so please ignore this warning if it' .
' is already taken care of: Fluid uses complex regular expressions which require a lot' .
' of stack space during the first processing.' .
' On Windows the default stack size for Apache is a lot smaller than on UNIX.' .
' You can increase the size to 8MB (default on UNIX) by adding the following configuration' .
' to httpd.conf and restart Apache afterwards:' . LF .
'<IfModule mpm_winnt_module>' . LF .