paranoia.info | 2 +- paranoia.install | 2 +- paranoia.module | 107 ++++++++++++++++-------------------------------------- 3 files changed, 33 insertions(+), 78 deletions(-) diff --git paranoia.info paranoia.info index bee79dd..76b8cd3 100644 --- paranoia.info +++ paranoia.info @@ -1,5 +1,5 @@ ; $Id$ name = Paranoia description = Protects the site from insecure configurations. -core = 6.x +core = 7.x diff --git paranoia.install paranoia.install index 14f84bc..2d8b5a9 100644 --- paranoia.install +++ paranoia.install @@ -2,7 +2,7 @@ // $Id$ /** - * Implementation of hook_enable(). + * Implements hook_enable(). */ function paranoia_enable() { // Disable the php module if it is enabled. diff --git paranoia.module paranoia.module index a88a232..feb5767 100644 --- paranoia.module +++ paranoia.module @@ -2,89 +2,55 @@ // $Id$ /** * @file - * - Disables PHP block visibility permission and gives status error if a role has this permission. + * - Disables PHP block visibility permission and gives status error if a role + * has this permission. * - Disables the PHP module. * - Hides the PHP and paranoia modules from the modules page. - * - Prevents user/1 editing which could give access to abitrary contrib module php execution. + * - Prevents user/1 editing which could give access to abitrary contrib module + * php execution. */ - /** - * Implementation of hook_form_alter(). + * Implements hook_form_FORM_ID_alter(). + * + * Hide Paranoia and PHP modules from module admin form. */ -function paranoia_form_alter(&$form, $form_state, $form_id) { - switch ($form_id) { - case 'user_admin_perm': // Disable PHP input - $hide_permissions = module_invoke_all('paranoia_revoke'); - foreach ($hide_permissions as $hidden) { - unset($form['permission'][$hidden]); - foreach (element_children($form['checkboxes']) as $rid) { - unset($form['checkboxes'][$rid]['#options'][$hidden]); - } - } - break; - - case 'system_modules': // Hide Paranoia and PHP modules from module admin form - $hidden_modules = module_invoke_all('paranoia_hide'); - foreach($hidden_modules as $module){ - _paranoia_hide_module($form, $module); - } - break; - - case 'user_profile_form': // Prevent modifying user/1 - if ($form['#uid'] === '1') { - global $user; - // Allow user/1 to edit own details. - if ($user->uid != 1) { - drupal_set_message('You must login as this user (user/1) to modify the email address and password for this account.'); - $form['account']['mail']['#access'] = FALSE; - $form['account']['pass']['#access'] = FALSE; - } - } - break; - +function paranoia_form_system_modules_alter(&$form, &$form_state) { + $hidden_modules = module_invoke_all('paranoia_hide'); + foreach($hidden_modules as $module => $package){ + // Unset instead of using #access because #access => FALSE shows an empty + // table row. + unset($form['modules'][$package][$module]); } } /** - * Remove a module from the module administration form. + * Implements hook_form_FORM_ID_alter(). */ -function _paranoia_hide_module(&$form, $module){ - unset( - $form['validation_modules']['#value'][$module], - $form['name'][$module], - $form['version'][$module], - $form['description'][$module], - $form['throttle'][$module], - $form['throttle']['#options'][$module], - $form['status']['#options'][$module] - ); -} +function paranoia_form_user_profile_form_alter(&$form, &$form_state) { + if ($form_state['user']->uid === '1') { + global $user; + // Allow user/1 to edit own details. + if ($user->uid != 1) { + drupal_set_message(t('You must login as this user (user/1) to modify the email address and password for this account.'), 'warning'); + $form['account']['mail']['#access'] = FALSE; + $form['account']['pass']['#access'] = FALSE; + $form['account']['current_pass']['#access'] = FALSE; + } + } +} /** - * Implementation of hook_requirements(). + * Implements hook_requirements(). */ function paranoia_requirements($phase) { $requirements = array(); if ($phase == 'runtime') { - // Ensure that no roles have permission to use PHP for block visibility. - module_load_include('inc', 'user', 'user.admin'); - $form = user_admin_perm($form_state); - $hide_permissions = module_invoke_all('paranoia_revoke'); - foreach (element_children($form['checkboxes']) as $rid) { - if (count(array_intersect($hide_permissions, $form['checkboxes'][$rid]['#default_value']))) { - $requirements['paranoia'] = array( - 'title' => t('Paranoia'), - 'description' => t('At least one user role has permission to input PHP. Resubmit your user permissions to close this security hole.', array('@admin/user/permissions' => url('admin/user/permissions'))), - 'severity' => REQUIREMENT_ERROR, - ); - } - } // Ensure the PHP module is not enabled. if (module_exists('php')) { $requirements['paranoia_php'] = array( 'title' => t('Paranoia'), - 'description' => t('The PHP module is enabled. This module should be disabled (but paranoia module prevents it from showing in the module admin form). It may have been enabled in the database, circumventing the effectiveness of paranoia module.'), + 'description' => t('The PHP module is enabled. This module should be disabled (but paranoia module prevents it from showing in the module admin form). It may have been enabled in the database, circumventing the effectiveness of paranoia module.'), 'severity' => REQUIREMENT_ERROR, ); } @@ -93,22 +59,11 @@ function paranoia_requirements($phase) { } /** - * Implementation of hook_paranoia_hide(). + * Implements hook_paranoia_hide(). */ function paranoia_paranoia_hide() { - return array('php', 'paranoia'); -} - -/** - * Implementation of hook_paranoia_revoke(). - */ -function paranoia_paranoia_revoke() { return array( - // block module - 'use PHP for block visibility', - // content module (in CCK) - 'Use PHP input for field settings (dangerous - grant with care)', - // webform module - 'use PHP for additional processing', + 'php' => 'Core', + 'paranoia' => 'Other', ); }