setupchecks.js 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315
  1. /*
  2. * Copyright (c) 2014
  3. *
  4. * This file is licensed under the Affero General Public License version 3
  5. * or later.
  6. *
  7. * See the COPYING-README file.
  8. *
  9. */
  10. (function() {
  11. OC.SetupChecks = {
  12. /* Message types */
  13. MESSAGE_TYPE_INFO:0,
  14. MESSAGE_TYPE_WARNING:1,
  15. MESSAGE_TYPE_ERROR:2,
  16. /**
  17. * Check whether the WebDAV connection works.
  18. *
  19. * @return $.Deferred object resolved with an array of error messages
  20. */
  21. checkWebDAV: function() {
  22. var deferred = $.Deferred();
  23. var afterCall = function(xhr) {
  24. var messages = [];
  25. if (xhr.status !== 207 && xhr.status !== 401) {
  26. messages.push({
  27. msg: t('core', 'Your web server is not yet set up properly to allow file synchronization because the WebDAV interface seems to be broken.'),
  28. type: OC.SetupChecks.MESSAGE_TYPE_ERROR
  29. });
  30. }
  31. deferred.resolve(messages);
  32. };
  33. $.ajax({
  34. type: 'PROPFIND',
  35. url: OC.linkToRemoteBase('webdav'),
  36. data: '<?xml version="1.0"?>' +
  37. '<d:propfind xmlns:d="DAV:">' +
  38. '<d:prop><d:resourcetype/></d:prop>' +
  39. '</d:propfind>',
  40. complete: afterCall,
  41. allowAuthErrors: true
  42. });
  43. return deferred.promise();
  44. },
  45. /**
  46. * Check whether the .well-known URLs works.
  47. *
  48. * @param url the URL to test
  49. * @param placeholderUrl the placeholder URL - can be found at oc_defaults.docPlaceholderUrl
  50. * @param {boolean} runCheck if this is set to false the check is skipped and no error is returned
  51. * @return $.Deferred object resolved with an array of error messages
  52. */
  53. checkWellKnownUrl: function(url, placeholderUrl, runCheck) {
  54. var deferred = $.Deferred();
  55. if(runCheck === false) {
  56. deferred.resolve([]);
  57. return deferred.promise();
  58. }
  59. var afterCall = function(xhr) {
  60. var messages = [];
  61. if (xhr.status !== 207) {
  62. var docUrl = placeholderUrl.replace('PLACEHOLDER', 'admin-setup-well-known-URL');
  63. messages.push({
  64. msg: t('core', 'Your web server is not set up properly to resolve "{url}". Further information can be found in our <a target="_blank" rel="noreferrer" href="{docLink}">documentation</a>.', { docLink: docUrl, url: url }),
  65. type: OC.SetupChecks.MESSAGE_TYPE_INFO
  66. });
  67. }
  68. deferred.resolve(messages);
  69. };
  70. $.ajax({
  71. type: 'PROPFIND',
  72. url: url,
  73. complete: afterCall,
  74. allowAuthErrors: true
  75. });
  76. return deferred.promise();
  77. },
  78. /**
  79. * Runs setup checks on the server side
  80. *
  81. * @return $.Deferred object resolved with an array of error messages
  82. */
  83. checkSetup: function() {
  84. var deferred = $.Deferred();
  85. var afterCall = function(data, statusText, xhr) {
  86. var messages = [];
  87. if (xhr.status === 200 && data) {
  88. if (!data.serverHasInternetConnection) {
  89. messages.push({
  90. msg: t('core', 'This server has no working Internet connection: Multiple endpoints could not be reached. This means that some of the features like mounting external storage, notifications about updates or installation of third-party apps will not work. Accessing files remotely and sending of notification emails might not work, either. We suggest to enable Internet connection for this server if you want to have all features.'),
  91. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  92. });
  93. }
  94. if(!data.isMemcacheConfigured) {
  95. messages.push({
  96. msg: t('core', 'No memory cache has been configured. To enhance your performance please configure a memcache if available. Further information can be found in our <a target="_blank" rel="noreferrer" href="{docLink}">documentation</a>.', {docLink: data.memcacheDocs}),
  97. type: OC.SetupChecks.MESSAGE_TYPE_INFO
  98. });
  99. }
  100. if(!data.isUrandomAvailable) {
  101. messages.push({
  102. msg: t('core', '/dev/urandom is not readable by PHP which is highly discouraged for security reasons. Further information can be found in our <a target="_blank" rel="noreferrer" href="{docLink}">documentation</a>.', {docLink: data.securityDocs}),
  103. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  104. });
  105. }
  106. if(data.isUsedTlsLibOutdated) {
  107. messages.push({
  108. msg: data.isUsedTlsLibOutdated,
  109. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  110. });
  111. }
  112. if(data.phpSupported && data.phpSupported.eol) {
  113. messages.push({
  114. msg: t('core', 'You are currently running PHP {version}. We encourage you to upgrade your PHP version to take advantage of <a target="_blank" rel="noreferrer" href="{phpLink}">performance and security updates provided by the PHP Group</a> as soon as your distribution supports it.', {version: data.phpSupported.version, phpLink: 'https://secure.php.net/supported-versions.php'}),
  115. type: OC.SetupChecks.MESSAGE_TYPE_INFO
  116. });
  117. }
  118. if(!data.forwardedForHeadersWorking) {
  119. messages.push({
  120. msg: t('core', 'The reverse proxy headers configuration is incorrect, or you are accessing Nextcloud from a trusted proxy. If you are not accessing Nextcloud from a trusted proxy, this is a security issue and can allow an attacker to spoof their IP address as visible to Nextcloud. Further information can be found in our <a target="_blank" rel="noreferrer" href="{docLink}">documentation</a>.', {docLink: data.reverseProxyDocs}),
  121. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  122. });
  123. }
  124. if(!data.isCorrectMemcachedPHPModuleInstalled) {
  125. messages.push({
  126. msg: t('core', 'Memcached is configured as distributed cache, but the wrong PHP module "memcache" is installed. \\OC\\Memcache\\Memcached only supports "memcached" and not "memcache". See the <a target="_blank" rel="noreferrer" href="{wikiLink}">memcached wiki about both modules</a>.', {wikiLink: 'https://code.google.com/p/memcached/wiki/PHPClientComparison'}),
  127. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  128. });
  129. }
  130. if(!data.hasPassedCodeIntegrityCheck) {
  131. messages.push({
  132. msg: t(
  133. 'core',
  134. 'Some files have not passed the integrity check. Further information on how to resolve this issue can be found in our <a target="_blank" rel="noreferrer" href="{docLink}">documentation</a>. (<a href="{codeIntegrityDownloadEndpoint}">List of invalid files…</a> / <a href="{rescanEndpoint}">Rescan…</a>)',
  135. {
  136. docLink: data.codeIntegrityCheckerDocumentation,
  137. codeIntegrityDownloadEndpoint: OC.generateUrl('/settings/integrity/failed'),
  138. rescanEndpoint: OC.generateUrl('/settings/integrity/rescan?requesttoken={requesttoken}', {'requesttoken': OC.requestToken})
  139. }
  140. ),
  141. type: OC.SetupChecks.MESSAGE_TYPE_ERROR
  142. });
  143. }
  144. if(!data.isOpcacheProperlySetup) {
  145. messages.push({
  146. msg: t(
  147. 'core',
  148. 'The PHP Opcache is not properly configured. <a target="_blank" rel="noreferrer" href="{docLink}">For better performance we recommend ↗</a> to use following settings in the <code>php.ini</code>:',
  149. {
  150. docLink: data.phpOpcacheDocumentation,
  151. }
  152. ) + "<pre><code>opcache.enable=On\nopcache.enable_cli=1\nopcache.interned_strings_buffer=8\nopcache.max_accelerated_files=10000\nopcache.memory_consumption=128\nopcache.save_comments=1\nopcache.revalidate_freq=1</code></pre>",
  153. type: OC.SetupChecks.MESSAGE_TYPE_INFO
  154. });
  155. }
  156. } else {
  157. messages.push({
  158. msg: t('core', 'Error occurred while checking server setup'),
  159. type: OC.SetupChecks.MESSAGE_TYPE_ERROR
  160. });
  161. }
  162. deferred.resolve(messages);
  163. };
  164. $.ajax({
  165. type: 'GET',
  166. url: OC.generateUrl('settings/ajax/checksetup'),
  167. allowAuthErrors: true
  168. }).then(afterCall, afterCall);
  169. return deferred.promise();
  170. },
  171. /**
  172. * Runs generic checks on the server side, the difference to dedicated
  173. * methods is that we use the same XHR object for all checks to save
  174. * requests.
  175. *
  176. * @return $.Deferred object resolved with an array of error messages
  177. */
  178. checkGeneric: function() {
  179. var self = this;
  180. var deferred = $.Deferred();
  181. var afterCall = function(data, statusText, xhr) {
  182. var messages = [];
  183. messages = messages.concat(self._checkSecurityHeaders(xhr));
  184. messages = messages.concat(self._checkSSL(xhr));
  185. deferred.resolve(messages);
  186. };
  187. $.ajax({
  188. type: 'GET',
  189. url: OC.generateUrl('heartbeat'),
  190. allowAuthErrors: true
  191. }).then(afterCall, afterCall);
  192. return deferred.promise();
  193. },
  194. checkDataProtected: function() {
  195. var deferred = $.Deferred();
  196. if(oc_dataURL === false){
  197. return deferred.resolve([]);
  198. }
  199. var afterCall = function(xhr) {
  200. var messages = [];
  201. // .ocdata is an empty file in the data directory - if this is readable then the data dir is not protected
  202. if (xhr.status === 200 && xhr.responseText === '') {
  203. messages.push({
  204. msg: t('core', 'Your data directory and your files are probably accessible from the Internet. The .htaccess file is not working. We strongly suggest that you configure your web server in a way that the data directory is no longer accessible or you move the data directory outside the web server document root.'),
  205. type: OC.SetupChecks.MESSAGE_TYPE_ERROR
  206. });
  207. }
  208. deferred.resolve(messages);
  209. };
  210. $.ajax({
  211. type: 'GET',
  212. url: OC.linkTo('', oc_dataURL+'/.ocdata?t=' + (new Date()).getTime()),
  213. complete: afterCall,
  214. allowAuthErrors: true
  215. });
  216. return deferred.promise();
  217. },
  218. /**
  219. * Runs check for some generic security headers on the server side
  220. *
  221. * @param {Object} xhr
  222. * @return {Array} Array with error messages
  223. */
  224. _checkSecurityHeaders: function(xhr) {
  225. var messages = [];
  226. if (xhr.status === 200) {
  227. var securityHeaders = {
  228. 'X-XSS-Protection': '1; mode=block',
  229. 'X-Content-Type-Options': 'nosniff',
  230. 'X-Robots-Tag': 'none',
  231. 'X-Frame-Options': 'SAMEORIGIN',
  232. 'X-Download-Options': 'noopen',
  233. 'X-Permitted-Cross-Domain-Policies': 'none',
  234. };
  235. for (var header in securityHeaders) {
  236. if(!xhr.getResponseHeader(header) || xhr.getResponseHeader(header).toLowerCase() !== securityHeaders[header].toLowerCase()) {
  237. messages.push({
  238. msg: t('core', 'The "{header}" HTTP header is not configured to equal to "{expected}". This is a potential security or privacy risk and we recommend adjusting this setting.', {header: header, expected: securityHeaders[header]}),
  239. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  240. });
  241. }
  242. }
  243. } else {
  244. messages.push({
  245. msg: t('core', 'Error occurred while checking server setup'),
  246. type: OC.SetupChecks.MESSAGE_TYPE_ERROR
  247. });
  248. }
  249. return messages;
  250. },
  251. /**
  252. * Runs check for some SSL configuration issues on the server side
  253. *
  254. * @param {Object} xhr
  255. * @return {Array} Array with error messages
  256. */
  257. _checkSSL: function(xhr) {
  258. var messages = [];
  259. if (xhr.status === 200) {
  260. var tipsUrl = OC.generateUrl('settings/admin/tips-tricks');
  261. if(OC.getProtocol() === 'https') {
  262. // Extract the value of 'Strict-Transport-Security'
  263. var transportSecurityValidity = xhr.getResponseHeader('Strict-Transport-Security');
  264. if(transportSecurityValidity !== null && transportSecurityValidity.length > 8) {
  265. var firstComma = transportSecurityValidity.indexOf(";");
  266. if(firstComma !== -1) {
  267. transportSecurityValidity = transportSecurityValidity.substring(8, firstComma);
  268. } else {
  269. transportSecurityValidity = transportSecurityValidity.substring(8);
  270. }
  271. }
  272. var minimumSeconds = 15552000;
  273. if(isNaN(transportSecurityValidity) || transportSecurityValidity <= (minimumSeconds - 1)) {
  274. messages.push({
  275. msg: t('core', 'The "Strict-Transport-Security" HTTP header is not configured to at least "{seconds}" seconds. For enhanced security we recommend enabling HSTS as described in our <a href="{docUrl}" rel="noreferrer">security tips</a>.', {'seconds': minimumSeconds, docUrl: tipsUrl}),
  276. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  277. });
  278. }
  279. } else {
  280. messages.push({
  281. msg: t('core', 'You are accessing this site via HTTP. We strongly suggest you configure your server to require using HTTPS instead as described in our <a href="{docUrl}">security tips</a>.', {docUrl: tipsUrl}),
  282. type: OC.SetupChecks.MESSAGE_TYPE_WARNING
  283. });
  284. }
  285. } else {
  286. messages.push({
  287. msg: t('core', 'Error occurred while checking server setup'),
  288. type: OC.SetupChecks.MESSAGE_TYPE_ERROR
  289. });
  290. }
  291. return messages;
  292. }
  293. };
  294. })();