--- /dev/null
+<?php
+
+/**
+ * @file
+ * Drush commands for Security Review module.
+ */
+
+use Drupal\security_review\CheckResult;
+
+/**
+ * Implements hook_drush_command().
+ */
+function security_review_drush_command() {
+ $items = [];
+
+ $items['security-review'] = [
+ 'aliases' => ['secrev'],
+ 'callback' => 'security_review_drush',
+ 'description' => "Run the Security Review checklist",
+ 'options' => [
+ 'store' => 'Write results to the database',
+ 'log' => 'Log results of each check to watchdog, defaults to off',
+ 'lastrun' => 'Do not run the checklist, just print last results',
+ 'check' => 'Comma-separated list of specified checks to run. See README.txt for list of options',
+ 'skip' => 'Comma-separated list of specified checks not to run. This takes precedence over --check.',
+ 'short' => "Short result messages instead of full description (e.g. 'Text formats')",
+ 'results' => 'Show the incorrect settings for failed checks',
+ ],
+ 'examples' => [
+ 'secrev' => 'Run the checklist and output the results',
+ 'secrev --store' => 'Run the checklist, store, and output the results',
+ 'secrev --lastrun' => 'Output the stored results from the last run of the checklist',
+ ],
+ 'bootstrap' => DRUSH_BOOTSTRAP_DRUPAL_FULL,
+ 'outputformat' => [
+ 'default' => 'table',
+ 'pipe-format' => 'csv',
+ 'fields-default' => ['message', 'status'],
+ 'field-labels' => [
+ 'message' => 'Message',
+ 'status' => 'Status',
+ 'findings' => 'Findings',
+ ],
+ 'output-data-type' => 'format-table',
+ ],
+ ];
+
+ return $items;
+}
+
+/**
+ * Implements hook_drush_help().
+ */
+function security_review_drush_help($section) {
+ switch ($section) {
+ case 'drush:security-review':
+ return dt("Run configuration security checks on your Drupal site.");
+ }
+}
+
+/**
+ * Runs a checklist and displays results.
+ */
+function security_review_drush() {
+ /** @var \Drupal\security_review\SecurityReview $security_review */
+ $security_review = Drupal::service('security_review');
+
+ /** @var \Drupal\security_review\Checklist $checklist */
+ $checklist = Drupal::service('security_review.checklist');
+
+ $store = drush_get_option('store');
+ $log = drush_get_option('log');
+ $last_run = drush_get_option('lastrun');
+ $run_checks = drush_get_option_list('check');
+ $skip_checks = drush_get_option_list('skip');
+ $short_titles = drush_get_option('short');
+ $show_findings = drush_get_option('results');
+
+ // Set temporary logging.
+ $log = in_array($log, [TRUE, 1, 'TRUE']);
+ $security_review->setLogging($log, TRUE);
+
+ if (!empty($short_titles)) {
+ $short_titles = TRUE;
+ }
+ else {
+ $short_titles = FALSE;
+ }
+
+ $results = [];
+ if (!$last_run) {
+ // Do a normal security review run.
+ /** @var \Drupal\security_review\Check[] $checks */
+ $checks = [];
+ /** @var \Drupal\security_review\Check[] $to_skip */
+ $to_skip = [];
+
+ // Fill the $checks array.
+ if (!empty($run_checks)) {
+ // Get explicitly specified checks.
+ foreach ($run_checks as $check) {
+ $checks[] = _security_review_drush_get_check($check);
+ }
+ }
+ else {
+ // Get the whole checklist.
+ $checks = $checklist->getChecks();
+ }
+
+ // Mark checks listed after --skip for removal.
+ if (!empty($skip_checks)) {
+ foreach ($skip_checks as $skip_check) {
+ $to_skip[] = _security_review_drush_get_check($skip_check);
+ }
+ }
+
+ // If storing, mark skipped checks for removal.
+ if ($store) {
+ foreach ($checks as $check) {
+ if ($check->isSkipped()) {
+ $to_skip[] = $check;
+ }
+ }
+ }
+
+ // Remove the skipped checks from $checks.
+ foreach ($to_skip as $skip_check) {
+ foreach ($checks as $key => $check) {
+ if ($check->id() == $skip_check->id()) {
+ unset($checks[$key]);
+ }
+ }
+ }
+
+ // If $checks is empty at this point, return with an error.
+ if (empty($checks)) {
+ return drush_set_error('EMPTY_CHECKLIST', dt("No checks to run. Run 'drush help secrev' for option use or consult the drush section of API.txt for further help."));
+ }
+
+ // Run the checks.
+ $results = $checklist->runChecks($checks, TRUE);
+
+ // Store the results.
+ if ($store) {
+ $checklist->storeResults($results);
+ }
+ }
+ else {
+ // Show the latest stored results.
+ foreach ($checklist->getChecks() as $check) {
+ $last_result = $check->lastResult($show_findings);
+ if ($last_result instanceof CheckResult) {
+ $results[] = $last_result;
+ }
+ }
+ }
+
+ return _security_review_drush_format_results($results, $short_titles, $show_findings);
+}
+
+/**
+ * Helper function for parsing input check name strings.
+ *
+ * @param string $check_name
+ * The check to get.
+ *
+ * @return \Drupal\security_review\Check|null
+ * The found Check.
+ */
+function _security_review_drush_get_check($check_name) {
+ /** @var \Drupal\security_review\Checklist $checklist */
+ $checklist = Drupal::service('security_review.checklist');
+
+ // Default namespace is Security Review.
+ $namespace = 'security_review';
+ $title = $check_name;
+
+ // Set namespace and title if explicitly defined.
+ if (strpos($check_name, ':') !== FALSE) {
+ list($namespace, $title) = explode(':', $check_name);
+ }
+
+ // Return the found check if any.
+ return $checklist->getCheck($namespace, $title);
+}
+
+/**
+ * Helper function to compile Security Review results.
+ *
+ * @param \Drupal\security_review\CheckResult[] $results
+ * An array of CheckResults.
+ * @param bool $short_titles
+ * Whether to use short message (check title) or full check success or failure
+ * message.
+ * @param bool $show_findings
+ * Whether to print failed check results.
+ *
+ * @return array
+ * The results of the security review checks.
+ */
+function _security_review_drush_format_results(array $results, $short_titles = FALSE, $show_findings = FALSE) {
+ $output = [];
+
+ foreach ($results as $result) {
+ if ($result instanceof CheckResult) {
+ if (!$result->isVisible()) {
+ // Continue with the next check.
+ continue;
+ }
+
+ $check = $result->check();
+ $message = $short_titles ? $check->getTitle() : $result->resultMessage();
+ $status = 'notice';
+
+ // Set log level according to check result.
+ switch ($result->result()) {
+ case CheckResult::SUCCESS:
+ $status = 'success';
+ break;
+
+ case CheckResult::FAIL:
+ $status = 'failed';
+ break;
+
+ case CheckResult::WARN:
+ $status = 'warning';
+ break;
+
+ case CheckResult::INFO:
+ $status = 'info';
+ break;
+ }
+
+ // Attach findings.
+ if ($show_findings) {
+ $findings = trim($result->check()->evaluatePlain($result));
+ if ($findings != '') {
+ $message .= "\n" . $findings;
+ }
+ }
+
+ $output[$check->id()] = [
+ 'message' => (string) $message,
+ 'status' => $status,
+ 'findings' => $result->findings(),
+ ];
+ }
+ }
+
+ return $output;
+}
projects / yaffs-website / blobdiff