Config.php

Go to the documentation of this file.

<?php

namespace Rsi\Fred\Security\Server;

class Config extends \Rsi\Fred\Security\Server{

  /**
   * Perform check on server config.
   * https://www.owasp.org/index.php/PHP_Configuration_Cheat_Sheet
   */
  public function check(){
    $warnings = [];
    if(ini_get('expose_php')) $warnings[] = 'php.ini: expose_php = On';
    if(ini_get('error_reporting') != E_ALL) $warnings[] = 'php.ini: error_reporting != E_ALL';
    if(ini_get('display_errors')) $warnings[] = 'php.ini: display_errors = On';
    if(ini_get('display_startup_errors')) $warnings[] = 'php.ini: display_startup_errors = On';
    if(!ini_get('log_errors')) $warnings[] = 'php.ini: log_errors = Off';
    if(\Rsi\File::inBaseDir($filename = ini_get('error_log')) && !is_dir(dirname($filename))) $warnings[] = 'php.ini: dirname(error_log) does not exist';
    if(ini_get('ignore_repeated_errors')) $warnings[] = 'php.ini: ignore_repeated_errors = On';
    if(ini_get('session.name') == 'PHPSESSID') $warnings[] = 'php.ini: session.name = default';
    if(!ini_get('session.cookie_httponly')) $warnings[] = 'php.ini: session.cookie_httponly = Off';
    if(\Rsi\Http::secure() && !ini_get('session.cookie_secure')) $warnings[] = 'php.ini: session.cookie_secure = Off (HTTPS = On)';
    if($warnings) $this->component('log')->warning('Insecure server configuration',__FILE__,__LINE__,['warnings' => $warnings]);
    return $warnings;
  }

}