<?php

/**
 * @file
 * Site security review and reporting Drupal module.
 *
 * @TODO other check types
 * @TODO reporting
 */

/**
 * Implements hook_permission().
 */
function security_review_permission() {
  return array(
    'access security review list' => array(
      'title' => t('Access security review pages'),
      'description' => t('View security review checks and output. Give only to trusted users.'),
    ),
    'run security checks' => array(
      'title' => t('Run security review checks'),
      'description' => t('Run the security review checks'),
    ),
  );
}

/**
 * Implements hook_menu().
 */
function security_review_menu() {
  $items = array();
  $items['admin/reports/security-review'] = array(
    'title' => 'Security review',
    'description' => 'Perform a review or the security of your site.',
    'page callback' => 'security_review_page',
    'access arguments' => array('access security review list'),
    'type' => MENU_NORMAL_ITEM,
  );
  $items['admin/reports/security-review/run'] = array(
    'title' => 'Run & review',
    'access arguments' => array('access security review list'),
    'type' => MENU_DEFAULT_LOCAL_TASK,
  );
  $items['admin/reports/security-review/toggle/%'] = array(
    'title' => 'Security review toggle',
    'page callback' => 'security_review_toggle_check',
    'page arguments' => array(4),
    'access arguments' => array('access security review list'),
    'type' => MENU_CALLBACK,
  );
  $items['admin/reports/security-review/help'] = array(
    'title' => 'Help',
    'page callback' => 'security_review_check_help',
    'access arguments' => array('access security review list'),
    'type' => MENU_LOCAL_TASK,
    'weight' => 10,
  );
  $items['admin/reports/security-review/settings'] = array(
    'title' => 'Settings',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('security_review_settings'),
    'access arguments' => array('access security review list'),
    'type' => MENU_LOCAL_TASK,
    'weight' => 15,
  );

  return $items;
}

/**
 * Implements hook_theme().
 */
function security_review_theme($existing, $type, $theme, $path) {
  return array(
    'security_review_reviewed' => array('variables' => array('items' => array(), 'header' => '', 'description' => '')),
    'security_review_help_options' => array('variables' => array('element' => array())),
    'security_review_check_help' => array('variables' => array('element' => array())),
  );
}

/**
 * Page callback for run & review.
 */
function security_review_page() {
  $checks = array();
  $output = array();
  // Retrieve the checklist.
  $checklist = module_invoke_all('security_checks');
  // Retrieve results from last run of the checklist.
  $result = db_query("SELECT namespace, reviewcheck, result, lastrun, skip, skiptime, skipuid FROM {security_review}");
  foreach ($result as $record) {
    $checks[] = $record;
  }
  // Only users with the proper permission can run the checklist.
  if (user_access('run security checks')) {
    $output += drupal_get_form('security_review_run_form', $checks);
  }

  if (!empty($checks)) {
    // We have prior results, so display them.
    $output['results'] = security_review_reviewed($checklist, $checks);
  }
  else {
    // If they haven't configured the site, prompt them to do so.
    $variable = variable_get('security_review_log', FALSE);
    if (!$variable) {
      drupal_set_message(t('It appears this is your first time using the Security Review checklist. Before running the checklist please review the settings page at !link to set which roles are untrusted.', array('!link' => l('admin/reports/security-review/settings', 'admin/reports/security-review/settings'))));
    }
  }
  return $output;
}

/**
 * Retrieve the result from the last run of a security check.
 */
function security_review_get_last_check($namespace, $check_name) {
  $fields = array('namespace', 'reviewcheck', 'result', 'lastrun', 'skip', 'skiptime', 'skipuid');
  $result = db_select('security_review', 'sr')->fields('sr', $fields)
    ->condition('namespace', $namespace)
    ->condition('reviewcheck', $check_name)
    ->execute()->fetchAssoc();
  return !empty($result) ? $result : NULL;
}

/**
 * Page callback provides general help and check specific help documentation.
 */
function security_review_check_help($module = NULL, $check_name = NULL) {
  // Include checks and help files.
  module_load_include('inc', 'security_review');
  module_load_include('inc', 'security_review', 'security_review.help');
  $output = '';
  if (!is_null($module) && !is_null($check_name)) {
    $function = $module . '_security_checks'; // Call the hook implementation.
    if (function_exists($function)) {
      $checklist = $function();
      $check = $checklist[$module][$check_name];
      if (isset($check['help'])) {
        $output = $check['help'];
      }
      elseif (isset($check['callback'])) {
        if (isset($check['file'])) {
          // Handle Security Review defining checks for other modules.
          if (isset($check['module'])) {
            $module = $check['module'];
          }
          module_load_include('inc', $module, $check['file']);
        }
        $function = $check['callback'] . '_help';
        if (function_exists($function)) {
          $element = $function();
          $output = theme('security_review_check_help', array('element' => $element));
        }
      }
    }
  }
  else {
    $output = _security_review_help();
    // List all checks as links to specific help.
    $output .= '<h3>' . t('Check-specfic help') . '</h3>';
    $output .= '<p>' . t("Details and help on the security review checks. Checks are not always perfectly correct in their procedure and result. Refer to drupal.org handbook documentation if you are unsure how to make the recommended alterations to your configuration or consult the module's README.txt for support.") . '</p>';
    $checklist = module_invoke_all('security_checks');
    foreach ($checklist as $module => $checks) {
      foreach ($checks as $reviewcheck => $check) {
        $items[] = l($check['title'], 'admin/reports/security-review/help/' . $module . '/' . $reviewcheck);
      }
    }
    if ($items) {
      $output .= theme('item_list', array('items' => $items));
    }
  }
  if (empty($output)) {
    return drupal_not_found();
  }
  return array('#markup' => $output);
}

function security_review_reviewed($checklist, $checks, $namespace = NULL) {
  $items = array();
  $header = t('Review results from last run');
  $desc = t("Here you can review the results from the last run of the checklist. Checks are not always perfectly correct in their procedure and result. You can keep a check from running by clicking the 'Skip' link beside it. You can run the checklist again by expanding the fieldset above.");
  foreach ($checks as $check) {
    $message = $check->result ? $checklist[$check->namespace][$check->reviewcheck]['success'] : $checklist[$check->namespace][$check->reviewcheck]['failure'];
    $title = $check->result ? t('OK') : t('Error');
    $class = $check->skip ? 'info' : ($check->result ? 'ok' : 'error');
    $toggle = $check->skip ? t('Enable') : t('Skip');
    $token = drupal_get_token($check->reviewcheck);
    $link_options = array(
      'query' => array('token' => $token),
      //'attributes' => array('class' => 'use-ajax'),
    );
    $items[] = array(
      'title' => $title,
      'value' => $check->result,
      'class' => $class,
      'message' => $message,
      'help_link' => l(t('Details'), 'admin/reports/security-review/help/' . $check->namespace . '/' . $check->reviewcheck),
      'toggle_link' => l($toggle, 'admin/reports/security-review/toggle/nojs/' . $check->reviewcheck, $link_options),
    );
  }
  $output = theme('security_review_reviewed', array('items' => $items, 'header' => $header, 'description' => $desc));
  // @todo #markup?
  return array('#markup' => $output);
}

function theme_security_review_reviewed($variables) {
  // @todo
  //drupal_add_js(drupal_get_path('module', 'security_review') . '/security_review.js', array('scope' => 'footer'));
  $output = '<h3>' . $variables['header'] . '</h3>';
  $output .= '<p>' . $variables['description'] . '</p>';
  $output .= '<table class="system-status-report">';
  if (!empty($variables['items'])) {
    foreach ($variables['items'] as $item) {
      $output .= '<tr class="' . $item['class'] . '">';
      $output .= '<td class="status-icon"><div title="' . $item['title'] . '"><span class="element-invisible">' . $item['title'] . '</span></div></td>';
      $output .= '<td>' . $item['message'] . '</td>';
      $output .= '<td>' . $item['help_link'] . '</td>';
      $output .= '<td>' . $item['toggle_link'] . '</td>';
      $output .= '</tr>';
    }
  }
  $output .= '</table>';
  return $output;
}

/**
 * Theme function for help on a security check.
 *
 * Calling function should filter and sanitize.
 */
function theme_security_review_check_help($variables) {
  $element = $variables['element'];
  $output = '<h3>' . $element['title'] . '</h3>';
  foreach ($element['descriptions'] as $description) {
    $output .= '<p>' . $description . '</p>';
  }
  if (!empty($element['findings'])) {
    foreach ($element['findings']['descriptions'] as $description) {
      $output .= '<p>' . $description . '</p>';
    }
    if (!empty($element['findings']['items'])) {
      $items = $element['findings']['items'];
      $output .= "<ul>\n";
      // Loop through items outputting the best value HTML, safe, or raw if thats all there is.
      foreach ($items as $item) {
        if (is_array($item)) {
          if (isset($item['html'])) {
            $data = $item['html'];
          }
          elseif (isset($item['safe'])) {
            $data = $item['safe'];
          }
          else {
            $data = $item['raw'];
          }
        }
        else {
          $data = $item;
        }
        $output .= "<li>" . $data . "</li>\n";
      }
      $output .= "</ul>\n";
    }
    if (!empty($element['findings']['pager'])) {
      $output .= $element['findings']['pager'];
    }
  }
  return $output;
}

function security_review_run_form($form, &$form_state, $checks = NULL) {
  $form['run_form'] = array(
    '#type' => 'fieldset',
    '#title' => t('Run'),
    '#description' => t('Click the button below to run the security checklist and review the results.'),
    '#collapsible' => TRUE,
    '#collapsed' => empty($checks) ? FALSE : TRUE,
  );
  $form['run_form']['submit'] = array(
    '#type' => 'submit',
    '#value' => t('Run checklist'),
  );

  return $form;
}

function security_review_run_form_submit($form, &$form_state) {
  $checklist = module_invoke_all('security_checks');
  $skipped = security_review_skipped_checks();
  // Remove checks that are being skipped.
  if (!empty($skipped)) {
    foreach ($skipped as $module => $checks) {
      foreach ($checks as $check_name => $check) {
        unset($checklist[$module][$check_name]);
      }
      if (empty($checklist[$module])) {
        unset($checklist[$module]);
      }
    }
  }

  // Use Batch to process the checklist.
  $batch = array('operations' => array(),
    'title' => t('Performing Security Review'),
    'progress_message' => t('Progress @current out of @total.'),
    'error_message' => t('An error occurred. Rerun the process or consult the logs.'),
    'finished' => '_security_review_batch_finished',
  );
  $log = variable_get('security_review_log', TRUE);
  foreach ($checklist as $module => $checks) {
    foreach ($checks as $check_name => $check) {
      // Each check is its own operation. There could be a case where a single
      // check needs to run itself a batch operation, perhaps @todo?
      $batch['operations'][] = array('_security_review_batch_op', array($module, $check_name, $check, $log));
    }
  }
  batch_set($batch);
  return;
}

/**
 * Run the security review checklist and store the results.
 */
function security_review_run_store($checklist, $log = NULL) {
  // Allow callers, like our drush command, to decide not to log.
  if (is_null($log)) {
    $log = variable_get('security_review_log', TRUE);
  }
  // Call our private function to perform the actual review.
  $results = _security_review_run($checklist, $log);
  // Store results and return.
  return security_review_store_results($results);
}

/**
 * Store checklist results.
 */
function security_review_store_results($results) {
  $log = variable_get('security_review_log', TRUE);
  $saved = $to_save = 0;
  foreach ($results as $module => $checks) {
    foreach ($checks as $check_name => $check) {
      $num_deleted = db_delete('security_review')
        ->condition('namespace', $module)
        ->condition('reviewcheck', $check_name)
        ->execute();
      if ($num_deleted == 1 && is_null($check['result']) && $log) {
        // Last check was deleted and current check returns null so check is
        // no longer applicable.
        $message = '!name no longer applicable for checking';
        _security_review_log($module, $check_name, $message, array('!name' => $check['title']), WATCHDOG_INFO);
      }
      // Only save checks that have a boolean result.
      elseif (!is_null($check['result'])) {
        $to_save++;
        $record = array(
          'namespace' => $module,
          'reviewcheck' => $check_name,
          'result' => $check['result'],
          'lastrun' => $check['lastrun'] ? $check['lastrun'] : REQUEST_TIME,
        );

        if (drupal_write_record('security_review', $record) == SAVED_NEW) {
          $saved++;
        }
        elseif ($log) {
          _security_review_log($module, $check_name, 'Unable to store check !reviewcheck for !namespace', array('!reviewcheck' => $check_name, '!namespace' => $module), WATCHDOG_ERROR);
        }
      }
    }
  }
  return ($to_save == $saved) ? TRUE : FALSE;
}

/**
 * Run the security review checklist and return the full results.
 */
function security_review_run_full($checklist, $log = NULL) {
  // Allow callers, like our drush command, to decide not to log.
  if (is_null($log)) {
    $log = variable_get('security_review_log', TRUE);
  }
  // Call our private function to perform the actual review.
  $results = _security_review_run($checklist, $log);

  // Fill out the descriptions of the results.
  foreach ($results as $module => $checks) {
    foreach ($checks as $check_name => $check) {
      $function = $check['callback'] . '_help';
      // We should have loaded all necessary include files.
      if (function_exists($function)) {
        $element = call_user_func($function, $check);
        // @todo run through theme?
        $results[$module][$check_name]['help'] = $element;
      }
    }
  }
  return $results;
}

/**
 * Operation function called by Batch.
 */
function _security_review_batch_op($module, $check_name, $check, $log, &$context) {
  module_load_include('inc', 'security_review');
  $context['message'] = $check['title'];
  // Run the check.
  $check_result = _security_review_run_check($module, $check_name, $check, $log);
  if (!empty($check_result)) {
    $context['results'][$module][$check_name] = $check_result;
  }
}

/**
 * Finished callback for Batch processing the checklist.
 */
function _security_review_batch_finished($success, $results, $operations) {
  module_load_include('inc', 'security_review');
  if ($success) {
    if (!empty($results)) {
      // Store results in our present table.
      $storage_result = security_review_store_results($results);
    }
    drupal_set_message(t('Review complete'));
  }
  else {
   $error_operation = reset($operations);
   $message = 'An error occurred while processing ' . $error_operation[0] . ' with arguments :' . print_r($error_operation[0], TRUE);
   _security_review_log('', '', $message, array(), WATCHDOG_ERROR);
    drupal_set_message(t('The review did not store all results, please run again or check the logs for details.'));
  }
}

/**
 * Implements hook_security_checks().
 */
function security_review_security_checks() {
  module_load_include('inc', 'security_review');
  // security_review_get_checks() will include implementations of this hook
  // that Security Review defines on behalf of other modules.
  return security_review_get_checks();
}

/**
 * Helper function returns skipped checks.
 */
function security_review_skipped_checks() {
  $skipped = array();

  $results = db_query("SELECT namespace, reviewcheck, result, lastrun, skip, skiptime, skipuid FROM {security_review} WHERE skip = 1");
  while ($record = $results->fetchAssoc()) {
    $skipped[$record['namespace']][$record['reviewcheck']] = $record;
  }

  return $skipped;
}

/**
 * Menu callback and Javascript callback for check skip toggling.
 */
function security_review_toggle_check($type = 'ajax', $check_name) {
  global $user;
  if (!isset($_GET['token']) || !drupal_valid_token($_GET['token'], $check_name)) {
    return drupal_access_denied();
  }
  $result = FALSE;
  // To be sure, compare the user-provided check with available checks.
  $checklist = module_invoke_all('security_checks');
  foreach ($checklist as $module => $checks) {
    if (in_array($check_name, array_keys($checks))) {
      $query = db_select('security_review', 'sr')
        ->fields('sr', array('namespace', 'reviewcheck', 'result', 'lastrun', 'skip', 'skiptime', 'skipuid'))
        ->condition('namespace', $module, '=')
        ->condition('reviewcheck', $check_name, '=');
      $record = $query->execute()->fetchObject();
      // Toggle the skip.
      if ($record->skip) {
        // We were skipping, so stop skipping and clear skip identifiers.
        $record->skip = FALSE;
        $record->skiptime = 0;
        $record->skipuid = NULL;
        $message = '!name check no longer skipped';
      }
      else {
        // Start skipping and record who made the decision and when.
        $record->skip = TRUE;
        $record->skiptime = REQUEST_TIME;
        $record->skipuid = $user->uid;
        $message = '!name check skipped';
      }
      $result = drupal_write_record('security_review', $record, array('namespace', 'reviewcheck'));
      // To log, or not to log?
      $log = variable_get('security_review_log', TRUE);
      if ($log) {
        $variables = array('!name' => $checks[$check_name]['title']);
        _security_review_log($module, $check_name, $message, $variables, WATCHDOG_INFO);
      }
      break;
    }
  }
  if ($type == 'ajax') {
    drupal_json_output($record);
    return;
  }
  else {
    // We weren't invoked via JS so set a message and return to the review page.
    drupal_set_message(t($message, array('!name' => $checks[$check_name]['title'])));
    drupal_goto('admin/reports/security-review');
  }
}

/**
 * Implementation of hook_security_review_log().
 */
function security_review_security_review_log($module, $check_name, $message, $variables, $type) {
  // Log using watchdog().
  watchdog('security_review', $message, $variables, $type);
}

/**
 * Module settings form.
 */
function security_review_settings() {
  $checklist = module_invoke_all('security_checks');
  $roles = user_roles();
  foreach ($roles as $rid => $role) {
    $options[$rid] = check_plain($role);
  }
  $message = '';
  $defaults = _security_review_default_untrusted_roles();
  if (array_key_exists(DRUPAL_AUTHENTICATED_RID, $defaults)) {
    $message = 'You have allowed anonymous users to create accounts without approval, the authenticated role thus defaults to untrusted.';
  }

  $form['security_review_untrusted_roles'] = array(
    '#type' => 'checkboxes',
    '#title' => t('Untrusted roles'),
    '#description' => t('Mark which roles are not trusted. The anonymous role defaults to untrusted. @message Read more about the idea behind trusted and untrusted roles on <a href="!url">DrupalScout.com</a>.', array('@message' => $message, '!url' => url('http://drupalscout.com/knowledge-base/importance-user-roles-and-permissions-site-security'))),
    '#options' => $options,
    '#default_value' => variable_get('security_review_untrusted_roles', array_keys($defaults)),
  );

  $form['security_review_adv'] = array(
    '#type' => 'fieldset',
    '#title' => t('Advanced'),
    '#collapsible' => TRUE,
    '#collapsed' => FALSE,
  );
  $form['security_review_adv']['security_review_log'] = array(
    '#type' => 'checkbox',
    '#title' => t('Log checklist results and skips'),
    '#description' => t('The result of each check and skip can be logged to watchdog for tracking.'),
    '#default_value' => variable_get('security_review_log', TRUE),
  );
  $options = $values = array();

  $skipped = security_review_skipped_checks();
  foreach ($checklist as $module => $checks) {
    foreach ($checks as $check_name => $check) {
      // Determine if check is being skipped.
      if (!empty($skipped) && array_key_exists($check_name, $skipped[$module])) {
        $values[] = $check_name;
        $label = t('!name <em>skipped by UID !uid on !date</em>', array('!name' => $check['title'], '!uid' => $skipped[$module][$check_name]['skipuid'], '!date' => format_date($skipped[$module][$check_name]['skiptime'])));
      }
      else {
        $label = $check['title'];
      }
      $options[$check_name] = $label;
    }
  }
  $form['security_review_adv']['security_review_skip'] = array(
    '#type' => 'checkboxes',
    '#title' => t('Checks to skip'),
    '#description' => t('Skip running certain checks. This can also be set on the <em>Run & review</em> page. It is recommended that you do not skip any checks unless you know the result is wrong or the process times out while running.'),
    '#options' => $options,
    '#default_value' => $values,
  );
  // Add a submit handler to set the skipped checks.
  $form['#submit'][] = '_security_review_settings_submit';

  return system_settings_form($form);
}

function _security_review_settings_submit($form, &$form_state) {
  global $user;
  $log = $form_state['values']['security_review_log'];
  // Set checked.
  $checklist = module_invoke_all('security_checks');

  $stored = array();
  $results = db_query("SELECT namespace, reviewcheck, result, lastrun, skip, skiptime, skipuid FROM {security_review}");
  while($record = $results->fetchAssoc()) {
    $stored[$record['namespace']][$record['reviewcheck']] = $record;
  }

  foreach ($checklist as $module => $checks) {
    foreach ($checks as $check_name => $check) {
      $record = new stdClass();
      $update = array();
      // Toggle the skip.
      if (isset($stored[$module][$check_name]) && $stored[$module][$check_name]['skip'] == 1 && $form_state['values']['security_review_skip'][$check_name] === 0) {
        // We were skipping, so stop skipping and clear skip identifiers.
        $record->namespace = $module;
        $record->reviewcheck = $check_name;
        $record->skip = FALSE;
        $record->skiptime = 0;
        $record->skipuid = NULL;
        $result = drupal_write_record('security_review', $record, array('namespace', 'reviewcheck'));
        if ($log) {
          $variables = array('!name' => $check['title']);
          _security_review_log($module, $check_name, '!name check no longer skipped', $variables, WATCHDOG_INFO);
        }
      }
      elseif ($form_state['values']['security_review_skip'][$check_name] !== 0) {
        // Start skipping and record who made the decision and when.
        if (isset($stored[$module][$check_name])) {
          $update = array('namespace', 'reviewcheck');
        }
        $record->namespace = $module;
        $record->reviewcheck = $check_name;
        $record->skip = TRUE;
        $record->skiptime = REQUEST_TIME;
        $record->skipuid = $user->uid;
        $result = drupal_write_record('security_review', $record, $update);
        if ($log) {
          $variables = array('!name' => $check['title']);
          _security_review_log($module, $check_name, '!name check skipped', $variables, WATCHDOG_INFO);
        }
      }
    }
  }
  // Unset security_review_skip to keep it from being written to a variable.
  unset($form_state['values']['security_review_skip']);
}

/**
 * Helper function creates message for reporting check skip information.
 */
function _security_review_check_skipped($last_check) {
  $account = array_pop(user_load_multiple(array($last_check['skipuid'])));
  $time = format_date($last_check['skiptime'], 'medium');
  $message = t('Check marked for skipping on !time by !user', array('!time' => $time, '!user' => theme('username', array('account' => $account))));
  return $message;
}
