tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT not set.");
} else {
$error_log_realpath = realpath(ini_get('error_log'));
$document_root_realpath = realpath($_SERVER['DOCUMENT_ROOT']);
if ($error_log_realpath === FALSE) {
tres($meta, TEST_SKIPPED, "error_log invalid or relative path.");
} elseif ($document_root_realpath === FALSE) {
tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT invalid or relative path.");
} elseif (strpos($error_log_realpath, $document_root_realpath) === 0) {
tres($meta, TEST_HIGH, "error_log in DOCUMENT_ROOT.", "The error logfile is located inside the document root directory and may be accessible publicly. The error_log should point to a file outside the document root.");
} else {
tres($meta, TEST_OK, "error_log outside of DOCUMENT_ROOT.");
}
}
// writable document root?
$meta = tdesc("Writable document root", "Checks if the current document root is writable");
if (!isset($_SERVER['DOCUMENT_ROOT'])) {
tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT not set.");
} elseif (is_writable($_SERVER['DOCUMENT_ROOT'])) {
tres($meta, TEST_HIGH, "document root is writable.", "Making the document root writable may give an attacker the advantage of persisting an exploit. It is probably best to restrict write access to the document root and its subdirectories. Temporary files your application may need to write can be safely stored outside the document root.");
} elseif (is_writable_or_chmodable($_SERVER['DOCUMENT_ROOT'])) {
tres($meta, TEST_MEDIUM, "document root is potentially writable.", "The document root's access permissions prevent write access, but the current user has the right to change these permissions. Please change the directory's owner.");
} else {
tres($meta, TEST_OK, "document root not writable.");
}
/*****************************************************************************/
// output
if ($cfg['output_type'] == "text") {
echo $cfg['s1_logo_aa'] . "\n\n";
if ($cfg['need_update']) {
echo "[*] This script is rather old. Please check for updates:\n {$pcc_url}\n\n";
function test_godmode()
{
global $cfg;
$meta = tdesc("got root?", "Test for root access on non-windows systems");
if ($cfg['is_win']) {
tres($meta, TEST_SKIPPED, "windows.");
// maybe check for admin access. but how?
return;
}
if (!extension_loaded("posix")) {
tres($meta, TEST_SKIPPED, "posix extension not available");
return;
}
if (posix_getuid() == 0) {
tres($meta, TEST_CRITICAL, "you are root!", "Executing PHP as root is hardly ever necessary.");
} else {
tres($meta, TEST_OK, "not root");
}
}
