From 5943f3418d61ab724a35152740b5e72909a2daf4 Mon Sep 17 00:00:00 2001 From: Chihiro Adachi <8196725+chihiro-adachi@users.noreply.github.com> Date: Wed, 14 Nov 2018 19:44:37 +0900 Subject: [PATCH 1/9] =?UTF-8?q?=E7=AE=A1=E7=90=86=E7=94=BB=E9=9D=A2?= =?UTF-8?q?=E3=81=AE=E3=82=A2=E3=82=AF=E3=82=BB=E3=82=B9=E5=88=B6=E9=99=90?= =?UTF-8?q?=E5=BC=B7=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .htaccess | 15 +++++++++++++++ src/Eccube/Controller/Admin/AdminController.php | 4 ++++ .../Admin/Setting/System/SecurityController.php | 5 +++++ src/Eccube/Form/Type/Install/Step3Type.php | 1 + src/Eccube/Resource/locale/validators.ja.yaml | 1 + 5 files changed, 26 insertions(+) diff --git a/.htaccess b/.htaccess index 4f633227d7d..b9200cfc102 100644 --- a/.htaccess +++ b/.htaccess @@ -49,3 +49,18 @@ DirectoryIndex index.php index.html .ht RewriteCond %{REQUEST_FILENAME} !^(.*)\.(gif|png|jpe?g|css|ico|js|svg|map)$ [NC] RewriteRule ^(.*)$ index.php [QSA,L] + +# 管理画面へのBasic認証サンプル +# +# Satisfy Any +# +# AuthType Basic +# AuthName "Please enter username and password" +# AuthUserFile /path/to/.htpasswd +# AuthGroupFile /dev/null +# require valid-user +# +# SetEnvIf Request_URI "^/admin" admin_path +# Order Allow,Deny +# Allow from all +# Deny from env=admin_path diff --git a/src/Eccube/Controller/Admin/AdminController.php b/src/Eccube/Controller/Admin/AdminController.php index 984f1fe948c..82677f2ad4e 100644 --- a/src/Eccube/Controller/Admin/AdminController.php +++ b/src/Eccube/Controller/Admin/AdminController.php @@ -169,6 +169,10 @@ public function login(Request $request) */ public function index(Request $request) { + $adminRoute = $this->eccubeConfig['eccube_admin_route']; + if ($adminRoute === 'admin') { + $this->addWarning('adminは危険です', 'admin'); + } /** * 受注状況. */ diff --git a/src/Eccube/Controller/Admin/Setting/System/SecurityController.php b/src/Eccube/Controller/Admin/Setting/System/SecurityController.php index 17576f14a53..5203fd003d9 100644 --- a/src/Eccube/Controller/Admin/Setting/System/SecurityController.php +++ b/src/Eccube/Controller/Admin/Setting/System/SecurityController.php @@ -45,6 +45,11 @@ public function __construct(TokenStorageInterface $tokenStorage) */ public function index(Request $request, CacheUtil $cacheUtil) { + $adminRoute = $this->eccubeConfig['eccube_admin_route']; + if ($adminRoute === 'admin') { + $this->addWarning('adminは危険です', 'admin'); + } + $builder = $this->formFactory->createBuilder(SecurityType::class); $form = $builder->getForm(); $form->handleRequest($request); diff --git a/src/Eccube/Form/Type/Install/Step3Type.php b/src/Eccube/Form/Type/Install/Step3Type.php index ab32120a8b7..16f8314e778 100644 --- a/src/Eccube/Form/Type/Install/Step3Type.php +++ b/src/Eccube/Form/Type/Install/Step3Type.php @@ -113,6 +113,7 @@ public function buildForm(FormBuilderInterface $builder, array $options) 'max' => $this->eccubeConfig['eccube_id_max_len'], ]), new Assert\Regex(['pattern' => '/\A\w+\z/']), + new Assert\NotEqualTo(['value' => 'admin', 'message' => 'form_error.admin_is_not_available']), ], ]) ->add('admin_force_ssl', CheckboxType::class, [ diff --git a/src/Eccube/Resource/locale/validators.ja.yaml b/src/Eccube/Resource/locale/validators.ja.yaml index 1b37781a1a6..60f3d7218f6 100644 --- a/src/Eccube/Resource/locale/validators.ja.yaml +++ b/src/Eccube/Resource/locale/validators.ja.yaml @@ -39,6 +39,7 @@ form_error.select_is_future_or_now_date: 生年月日が不正な日付です。 form_error.float_only: 数字と小数点のみ入力できます。 form_error.same_password: 同じパスワードを入力してください。 form_error.same_email: 同じメールアドレスを入力してください。 +form_error.admin_is_not_available: 「admin」は利用できません。 #------------------------------------------------------------------------------------ # Deplicated From 190631b5251e39afb6041cb5ae17fb6ae326eda7 Mon Sep 17 00:00:00 2001 From: kanako_kina Date: Fri, 16 Nov 2018 10:53:46 +0900 Subject: [PATCH 2/9] =?UTF-8?q?=E3=82=A8=E3=83=A9=E3=83=BC=E3=83=A1?= =?UTF-8?q?=E3=83=83=E3=82=BB=E3=83=BC=E3=82=B8=E3=81=AE=E5=86=85=E5=AE=B9?= =?UTF-8?q?=E3=80=81=E8=A1=A8=E7=A4=BA=E3=82=BF=E3=82=A4=E3=83=9F=E3=83=B3?= =?UTF-8?q?=E3=82=B0=E3=82=92=E5=A4=89=E6=9B=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/Eccube/Controller/Admin/AdminController.php | 4 +++- .../Admin/Setting/System/SecurityController.php | 6 +++--- src/Eccube/Resource/locale/validators.ja.yaml | 2 +- src/Eccube/Resource/template/admin/index.twig | 9 +++++++++ 4 files changed, 16 insertions(+), 5 deletions(-) diff --git a/src/Eccube/Controller/Admin/AdminController.php b/src/Eccube/Controller/Admin/AdminController.php index 82677f2ad4e..f50fbd4a2e6 100644 --- a/src/Eccube/Controller/Admin/AdminController.php +++ b/src/Eccube/Controller/Admin/AdminController.php @@ -170,8 +170,9 @@ public function login(Request $request) public function index(Request $request) { $adminRoute = $this->eccubeConfig['eccube_admin_route']; + $is_danger_admin_url = false; if ($adminRoute === 'admin') { - $this->addWarning('adminは危険です', 'admin'); + $is_danger_admin_url = true; } /** * 受注状況. @@ -265,6 +266,7 @@ public function index(Request $request) 'countProducts' => $countProducts, 'countCustomers' => $countCustomers, 'recommendedPlugins' => $recommendedPlugins, + 'is_danger_admin_url' => $is_danger_admin_url, ]; } diff --git a/src/Eccube/Controller/Admin/Setting/System/SecurityController.php b/src/Eccube/Controller/Admin/Setting/System/SecurityController.php index 5203fd003d9..113380dc508 100644 --- a/src/Eccube/Controller/Admin/Setting/System/SecurityController.php +++ b/src/Eccube/Controller/Admin/Setting/System/SecurityController.php @@ -46,9 +46,6 @@ public function __construct(TokenStorageInterface $tokenStorage) public function index(Request $request, CacheUtil $cacheUtil) { $adminRoute = $this->eccubeConfig['eccube_admin_route']; - if ($adminRoute === 'admin') { - $this->addWarning('adminは危険です', 'admin'); - } $builder = $this->formFactory->createBuilder(SecurityType::class); $form = $builder->getForm(); @@ -99,6 +96,9 @@ public function index(Request $request, CacheUtil $cacheUtil) return $this->redirectToRoute('admin_setting_system_security'); } + if ($adminRoute === 'admin') { + $this->addWarning('管理画面URLは、セキュリティのため推測されにくいものを設定してください。', 'admin'); + } return [ 'form' => $form->createView(), diff --git a/src/Eccube/Resource/locale/validators.ja.yaml b/src/Eccube/Resource/locale/validators.ja.yaml index 60f3d7218f6..77e882f9a70 100644 --- a/src/Eccube/Resource/locale/validators.ja.yaml +++ b/src/Eccube/Resource/locale/validators.ja.yaml @@ -39,7 +39,7 @@ form_error.select_is_future_or_now_date: 生年月日が不正な日付です。 form_error.float_only: 数字と小数点のみ入力できます。 form_error.same_password: 同じパスワードを入力してください。 form_error.same_email: 同じメールアドレスを入力してください。 -form_error.admin_is_not_available: 「admin」は利用できません。 +form_error.admin_is_not_available: ディレクトリ名に「admin」を使用することはできません。 #------------------------------------------------------------------------------------ # Deplicated diff --git a/src/Eccube/Resource/template/admin/index.twig b/src/Eccube/Resource/template/admin/index.twig index fccfe4e813b..53245146c11 100644 --- a/src/Eccube/Resource/template/admin/index.twig +++ b/src/Eccube/Resource/template/admin/index.twig @@ -109,6 +109,15 @@ file that was distributed with this source code. {% endblock javascript %} {% block main %} + {% if is_danger_admin_url %} + + {% endif %}
From a967bbe798b7970d9e823cfec5e51b3e64ca2e4d Mon Sep 17 00:00:00 2001 From: kanako_kina Date: Fri, 16 Nov 2018 11:01:21 +0900 Subject: [PATCH 3/9] =?UTF-8?q?=E3=82=B7=E3=82=B9=E3=83=86=E3=83=A0?= =?UTF-8?q?=E7=AE=A1=E7=90=86=E3=81=B8=E3=81=AE=E9=81=B7=E7=A7=BBURL?= =?UTF-8?q?=E3=82=92=E5=A4=89=E6=9B=B4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/Eccube/Resource/template/admin/index.twig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Eccube/Resource/template/admin/index.twig b/src/Eccube/Resource/template/admin/index.twig index 53245146c11..f9f57373f42 100644 --- a/src/Eccube/Resource/template/admin/index.twig +++ b/src/Eccube/Resource/template/admin/index.twig @@ -112,7 +112,7 @@ file that was distributed with this source code. {% if is_danger_admin_url %}