3 namespace Drupal\security_review\Checks;
5 use Drupal\security_review\Check;
6 use Drupal\security_review\CheckResult;
9 * Check for sensitive temporary files like settings.php~.
11 class TemporaryFiles extends Check {
16 public function getNamespace() {
17 return 'Security Review';
23 public function getTitle() {
24 return 'Temporary files';
30 public function run() {
31 $result = CheckResult::SUCCESS;
34 // Get list of files from the site directory.
36 $site_path = $this->security()->sitePath() . '/';
37 $dir = scandir($site_path);
38 foreach ($dir as $file) {
39 // Set full path to only files.
41 $files[] = $site_path . $file;
44 $this->moduleHandler()->alter('security_review_temporary_files', $files);
46 // Analyze the files' names.
47 foreach ($files as $path) {
49 if (file_exists($path) && preg_match('/.*(~|\.sw[op]|\.bak|\.orig|\.save)$/', $path, $matches) !== FALSE && !empty($matches)) {
50 // Found a temporary file.
55 if (!empty($findings)) {
56 $result = CheckResult::FAIL;
59 return $this->createResult($result, $findings);
65 public function help() {
67 $paragraphs[] = $this->t("Some file editors create temporary copies of a file that can be left on the file system. A copy of a sensitive file like Drupal's settings.php may be readable by a malicious user who could use that information to further attack a site.");
70 '#theme' => 'check_help',
71 '#title' => $this->t('Sensitive temporary files'),
72 '#paragraphs' => $paragraphs,
79 public function evaluate(CheckResult $result) {
80 $findings = $result->findings();
81 if (empty($findings)) {
86 $paragraphs[] = $this->t("The following are extraneous files in your Drupal installation that can probably be removed. You should confirm you have saved any of your work in the original files prior to removing these.");
89 '#theme' => 'check_evaluation',
90 '#paragraphs' => $paragraphs,
91 '#items' => $findings,
98 public function evaluatePlain(CheckResult $result) {
99 $findings = $result->findings();
100 if (empty($findings)) {
104 $output = $this->t('Temporary files:') . "\n";
105 foreach ($findings as $file) {
106 $output .= "\t" . $file . "\n";
115 public function getMessage($result_const) {
116 switch ($result_const) {
117 case CheckResult::SUCCESS:
118 return $this->t('No sensitive temporary files were found.');
120 case CheckResult::FAIL:
121 return $this->t('Sensitive temporary files were found on your files system.');
124 return $this->t('Unexpected result.');