butterfly/hook.php
Claude 0248febe8b Higiene e segurança: sanitização de theme, permissões, BMP e temas duplicados
- $_GET['theme'] sanitizado no display_login com a mesma regex do
  picture.send.php; getThemeInfo() ganhou defesa em profundidade
  (rejeita qualquer valor que não seja nome simples de diretório).
- mkdir 0755 (era 0777) no storage de imagens.
- IMAGETYPE_BMP usava imagecreatefromwbmp (WBMP != BMP); agora
  imagecreatefrombmp.
- public/themes/ removido: era cópia divergente e corrompida (CSS
  mutilado por find/replace) da fonte real themes/ — o código só lê
  themes/ da raiz e serve via picture.send.php.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 17:55:00 -03:00

144 lines
5.3 KiB
PHP

<?php
function plugin_butterfly_display_login() {
// Mesma sanitização do picture.send.php — tema é sempre um nome simples de diretório
$requestedTheme = null;
if (isset($_GET['theme'])) {
$requestedTheme = preg_replace('/[^a-zA-Z0-9_\-]/', '', (string)$_GET['theme']);
}
$themeInfo = null;
if ($requestedTheme) {
$themeInfo = PluginButterflyTheme::getThemeInfo($requestedTheme);
}
if (!$themeInfo) {
$theme = PluginButterflyConfig::getConfig("login_theme", '');
$themeInfo = PluginButterflyTheme::getThemeInfo($theme);
}
$loginPicture = PluginButterflyConfig::getConfig('login_picture');
if (!$loginPicture && $themeInfo && !empty($themeInfo['login-logo'])) {
$loginPicture = $themeInfo['login-logo'] . '&theme=' . $themeInfo['id'];
}
if ($loginPicture && version_compare(GLPI_VERSION, '9.5.0', '<')) {
echo Html::css("/plugins/butterfly/css/login.base.css", [
'version' => PLUGIN_BUTTERFLY_VERSION,
]);
}
$loginCss = PluginButterflyScss::getLoginCSS($requestedTheme);
if (!empty($loginCss)) {
echo "<style id='plugin-butterfly-login-css'>\n" . $loginCss . "\n</style>";
}
?>
<?php if ($loginPicture) : ?>
<?php
$pictureUrl = PluginButterflyToolbox::getPictureUrl($loginPicture);
$maxWidth = Html::cleanInputText(PluginButterflyConfig::getConfig('login_picture_max_width', '145px'));
$maxHeight = Html::cleanInputText(PluginButterflyConfig::getConfig('login_picture_max_height', '80px'));
?>
<style>
.page-anonymous .glpi-logo {
--logo: url(<?php echo $pictureUrl ?>);
content: url(<?php echo $pictureUrl ?>);
width: auto;
height: auto;
max-width: <?php echo $maxWidth ?>;
max-height: <?php echo $maxHeight ?>;
}
</style>
<?php endif; ?>
<script type="text/javascript">
$(function() {
var $loginInputs = $('#login_name, #inputUsername');
if ($loginInputs.length) {
$loginInputs.attr('placeholder', <?php echo json_encode(__('Login'), JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
}
var $passwordInputs = $('input[type=password], input[name=password]');
if ($passwordInputs.length) {
$passwordInputs.attr('placeholder', <?php echo json_encode(__('Password'), JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
$passwordInputs.each(function() {
var $input = $(this);
var $description = $input.siblings('.form-label-description').first();
if ($description.length) {
$input.after($description);
}
});
}
<?php
$favicon = PluginButterflyConfig::getConfig('favicon_picture');
if ($favicon) :
$faviconUrl = PluginButterflyToolbox::getPictureUrl($favicon);
?>
var $icon = $('link[rel*=icon]');
$icon.attr('type', null);
$icon.attr('href', <?php echo json_encode($faviconUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
<?php
endif;
$pageTitle = PluginButterflyConfig::getConfig('page_title');
if ($pageTitle) :
?>
var $title = $('title');
var newTitle = $title.text().replace('GLPI', <?php echo json_encode($pageTitle, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
$title.text(newTitle);
<?php
endif;
$footerDisplay = PluginButterflyConfig::getConfig('page_footer_display', 'original');
$footerText = PluginButterflyConfig::getConfig('page_footer_text', '');
if ($footerDisplay === 'hide') :
?>
$('#footer-login, .login-footer').hide();
<?php
endif;
if ($footerDisplay === 'custom') :
$footerText = \Glpi\RichText\RichText::getEnhancedHtml($footerText);
?>
var $footerTarget = $('#footer-login, .login-footer').first();
if ($footerTarget.length) {
$footerTarget.html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
} else {
$('a.copyright').parent().html(<?php echo json_encode($footerText, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP) ?>);
}
<?php
endif;
if ($loginPicture) :
?>
var pictureUrl = <?php echo json_encode($pictureUrl, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
var maxWidth = <?php echo json_encode($maxWidth, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
var maxHeight = <?php echo json_encode($maxHeight, JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP); ?>;
$('.page-anonymous .glpi-logo').css({
'background-image': 'url(' + pictureUrl + ')',
'background-position': 'center',
'background-repeat': 'no-repeat',
'background-size': 'contain'
});
$('.login-header img, .glpi-login__logo img, .login-logo img')
.attr('src', pictureUrl)
.css({
'width': 'auto',
'height': 'auto',
'max-width': maxWidth,
'max-height': maxHeight
});
<?php
endif;
?>
});
</script>
<?php
}
function plugin_butterfly_install() {
return true;
}
function plugin_butterfly_uninstall() {
return true;
}