From 0e88c8ffbc741f1b42f9e4aa06ffe91dbb21e92a Mon Sep 17 00:00:00 2001 From: ldestailleur Date: Wed, 9 Jul 2025 18:20:48 +0200 Subject: [PATCH] Support HTTP_EXPOSED_CREDENTIAL_CHECK and use a better log to parse for security analysis. --- htdocs/main.inc.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 09e07148143..3ec582aa0f5 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -597,7 +597,7 @@ if (!defined('NOLOGIN')) { // Process error of captcha validation if (!$ok) { - dol_syslog('Bad value for code, connection refused', LOG_NOTICE); + dol_syslog('--- Security warning: Bad value for code, connection refused', LOG_NOTICE); // Load translation files required by page $langs->loadLangs(array('main', 'errors')); @@ -667,6 +667,13 @@ if (!defined('NOLOGIN')) { $langs->setDefaultLang($langcode); } + // Test HTTP header + if (!empty($_SERVER['HTTP_EXPOSED_CREDENTIAL_CHECK'])) { + // TODO Read option $dolibarr_main_no_leaked_credentials with value 1, 2, ... and return + //dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"].' refused by option $dolibarr_main_no_leaked_credentials='.$dolibarr_main_no_leaked_credentials, LOG_NOTICE); + dol_syslog('--- Security warning: credentials reported as leaked were used to try to login. HTTP_EXPOSED_CREDENTIAL_CHECK='.((int) $_SERVER['HTTP_EXPOSED_CREDENTIAL_CHECK']), LOG_NOTICE); + } + // Validation of login/pass/entity // If ok, the variable login will be returned // If error, we will put error message in session under the name dol_loginmesg