| 123 | | |
|---|
| 124 | | function module_get_security($xmlarray, $base_version=null) { |
|---|
| 125 | | |
|---|
| 126 | | if ($base_version === null) { |
|---|
| 127 | | $version = getversion(); |
|---|
| 128 | | // we need to know the freepbx major version we have running (ie: 2.1.2 is 2.1) |
|---|
| 129 | | preg_match('/(\d+\.\d+)/',$version,$matches); |
|---|
| 130 | | $base_version = $matches[1]; |
|---|
| 131 | | } |
|---|
| 132 | | |
|---|
| 133 | | if (!empty($xmlarray['xml']['security'])) { |
|---|
| 134 | | $exposures = array(); |
|---|
| 135 | | $modinfo = module_getinfo(); |
|---|
| 136 | | |
|---|
| 137 | | //foreach ($xmlarray['xml']['security'] as $vul => $sinfo) { |
|---|
| 138 | | foreach ($xmlarray['xml']['security']['issue'] as $sinfo) { |
|---|
| 139 | | $vul = $sinfo['id']; |
|---|
| 140 | | if (!empty($sinfo['versions']['v' . $base_version])) { |
|---|
| 141 | | //dbug("vulnerability info for $base_version: ", $sinfo['versions']['v' . $base_version]); |
|---|
| 142 | | //dbug("is vulnerable?:: " . $sinfo['versions']['v' . $base_version]['vulnerable']); |
|---|
| 143 | | // TODO: if vulnerable or maybe, and no fixes listed need to post something, mostly around the unknown |
|---|
| 144 | | if (strtolower($sinfo['versions']['v' . $base_version]['vulnerable']) == 'yes' && !empty($sinfo['versions']['v' . $base_version]['fixes'])) foreach ($sinfo['versions']['v' . $base_version]['fixes'] as $rmod => $mver) { |
|---|
| 145 | | dbug("checking $rmod"); |
|---|
| 146 | | $rmod = trim($rmod); |
|---|
| 147 | | $mver = trim($mver); |
|---|
| 148 | | if (!empty($modinfo[trim($rmod)])) { |
|---|
| 149 | | //dbug("Vulnerability: $vul, module: " . $rmod . ", version: " . $mver); |
|---|
| 150 | | if (!isset($modinfo[$rmod]['dbversion'])) { |
|---|
| 151 | | //dbug("dbversion isn't set for $rmod so Locally Available but NOT installed, report on it"); |
|---|
| 152 | | } else { |
|---|
| 153 | | if (version_compare_freepbx($modinfo[$rmod]['dbversion'], $mver, 'lt')) { |
|---|
| 154 | | if (!isset($exposures[$rmod])) { |
|---|
| 155 | | //dbug("$rmod not set so setting min ver to $mver"); |
|---|
| 156 | | $exposures[$rmod] = array('vul' => array($vul), 'minver' => $mver, 'curver' => $modinfo[$rmod]['dbversion']); |
|---|
| 157 | | } else { |
|---|
| 158 | | $exposures[$rmod]['vul'][] = $vul; |
|---|
| 159 | | //dbug("$rmod IS set so setting so check $mver against current minver: " . $exposures[$rmod]['minver']); |
|---|
| 160 | | if (version_compare_freepbx($mver, $exposures[$rmod]['minver'], 'gt')) { |
|---|
| 161 | | //dbug("since the new $mver is greater, we are setting $rmod up to it because of $vul"); |
|---|
| 162 | | $exposures[$rmod]['minver'] = $mver; |
|---|
| 163 | | } |
|---|
| 164 | | } |
|---|
| 165 | | } else { |
|---|
| 166 | | //dbug($modinfo[$rmod]['dbversion'] . " is at least $mver"); |
|---|
| 167 | | } |
|---|
| 168 | | } |
|---|
| 169 | | } else { |
|---|
| 170 | | //dbug("module $rmod not there or"); |
|---|
| 171 | | } |
|---|
| 172 | | } |
|---|
| 173 | | } |
|---|
| 174 | | } |
|---|
| 175 | | return $exposures; |
|---|
| 176 | | } |
|---|
| 177 | | } |
|---|
| 178 | | |
|---|
