Issues (1940)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

programs/utilit/entry_elem.class.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/************************************************************************
3
 * OVIDENTIA http://www.ovidentia.org                                   *
4
 ************************************************************************
5
 * Copyright (c) 2003 by CANTICO ( http://www.cantico.fr )              *
6
 *                                                                      *
7
 * This file is part of Ovidentia.                                      *
8
 *                                                                      *
9
 * Ovidentia is free software; you can redistribute it and/or modify    *
10
 * it under the terms of the GNU General Public License as published by *
11
 * the Free Software Foundation; either version 2, or (at your option)  *
12
 * any later version.													*
13
 *																		*
14
 * This program is distributed in the hope that it will be useful, but  *
15
 * WITHOUT ANY WARRANTY; without even the implied warranty of			*
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.					*
17
 * See the  GNU General Public License for more details.				*
18
 *																		*
19
 * You should have received a copy of the GNU General Public License	*
20
 * along with this program; if not, write to the Free Software			*
21
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,*
22
 * USA.																	*
23
************************************************************************/
24
25
require_once dirname(__FILE__).'/record.class.php';
26
require_once dirname(__FILE__).'/entry.class.php';
27
28
/**
29
 * @property int	$id_entry
30
 * @property int	$id_right
31
 * @property float 	$quantity
32
 * @property string $date_begin
33
 * @property string $date_end
34
 * 
35
 */
36
class absences_EntryElem extends absences_Record 
37
{
38
	/**
39
	 * @var absences_Right
40
	 */
41
	private $right;
42
	
43
	
44
	/**
45
	 * 
46
	 * @var absences_Entry
47
	 */
48
	private $entry;
49
	
50
	
51
	
52
	/**
53
	 * @return absences_EntryElem
54
	 */
55
	public static function getById($id_elem)
56
	{
57
		$entry = new absences_EntryElem;
58
		$entry->id = $id_elem;
59
	
60
		return $entry;
61
	}
62
	
63
	
64
	
65
	
66
	/**
67
	 * (non-PHPdoc)
68
	 * @see absences_Record::getRow()
69
	 */
70 41
	public function getRow()
71
	{
72 41
		if (null === $this->row)
73 41
		{
74 1
			if (!isset($this->id))
75 1
			{
76
				throw new Exception('Failed to load entry elem, missing entry elem id');
77
			}
78
	
79 1
			global $babDB;
80 1
			$res = $babDB->db_query('SELECT * FROM absences_entries_elem WHERE id='.$babDB->quote($this->id));
81 1
			$this->setRow($babDB->db_fetch_assoc($res));
82 1
		}
83
	
84 41
		return $this->row;
85
	}
86
	
87
	
88
	
89
	/**
90
	 *
91
	 * @param absences_Right $right
92
	 * @return absences_EntryElem
93
	 */
94 32
	public function setRight(absences_Right $right)
95
	{
96 32
		$this->right = $right;
97 32
		return $this;
98
	}
99
	
100
	
101
	/**
102
	 * @return absences_Right
103
	 */
104 28
	public function getRight()
105
	{
106 28
		if (!isset($this->right))
107 28
		{
108 8
			require_once dirname(__FILE__).'/right.class.php';
109
			
110 8
			$row = $this->getRow();
111 8
			$this->right = new absences_Right($row['id_right']);
112 8
		}
113
	
114 28
		return $this->right;
115
	}
116
	
117
	
118
	/**
119
	 *
120
	 * @param absences_Entry $entry
121
	 * @return absences_EntryElem
122
	 */
123 32
	public function setEntry(absences_Entry $entry)
124
	{
125 32
		$this->entry = $entry;
126 32
		return $this;
127
	}
128
	
129
	
130
	/**
131
	 * @return absences_Entry
132
	 */
133 View Code Duplication
	public function getEntry()
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
134
	{
135
		if (!isset($this->entry))
136
		{
137
			$row = $this->getRow();
138
			$this->entry = absences_Entry::getById($row['id_entry']);
139
		}
140
	
141
		return $this->entry;
142
	}
143
	
144
	
145
	/**
146
	 * @return absences_AgentRight
147
	 */
148
	public function getAgentRight()
149
	{
150
	    $entry = $this->getEntry();
151
	    $agent = $entry->getAgent();
152
	    
153
	    $I = $agent->getAgentRightManagerIterator();
154
	    
155
	    foreach($I as $agentRight) {
156
	        if ($agentRight->id_right === $this->id_right) {
157
	            return $agentRight;
158
	        }
159
	    }
160
	    
161
	    return null;
162
	}
163
	
164
	
165
	
166
	/**
167
	 * Check validity before saving an element
168
	 * @throws UnexpectedValueException
169
	 * 
170
	 * @return bool
171
	 */
172
	public function checkValidity()
173
	{
174
		if (!isset($this->id_right) || $this->id_right <= 0)
175
		{
176
			throw new UnexpectedValueException('Missing id_right');
177
		}
178
		
179
		$quantity = (int) round(100 * $this->quantity);
180
		
181
		if (!$quantity && !isset($this->id))
182
		{
183
		    
184
		    require_once $GLOBALS['babInstallPath'].'utilit/devtools.php';
185
		    bab_debug_print_backtrace();
186
		    
187
		    $message = sprintf(
188
		        absences_translate('An absence cannot be created because of a missing quantity in right "%s"'), 
189
		        $this->getRight()->description
190
		    );
191
			throw new UnexpectedValueException($message);
192
		}
193
		
194
		return true;
195
	}
196
	
197
	
198
	/**
199
	 * For previsional requests, check if requested quantity is available
200
	 * @return bool
201
	 */
202
	public function isQuantityAvailable()
203
	{
204
	    $agentRight = $this->getAgentRight();
205
	    $bookableQuantity = $agentRight->getAvailableQuantity() - $agentRight->getWaitingQuantity();
206
	    
207
	    if ($bookableQuantity >= (float) $this->quantity) {
208
	        return true;
209
	    }
210
	    
211
	    return false;
212
	}
213
	
214
	
215
	
216
	/**
217
	 *
218
	 * @param string $message	Generated message
219
	 * @param string $comment	Author comment
220
	 */
221
	public function addMovement($message, $comment = '')
222
	{
223
		require_once dirname(__FILE__).'/movement.class.php';
224
	
225
		$movement = new absences_Movement();
226
		$movement->message = $message;
227
		$movement->comment = $comment;
228
		$movement->setRequest($this->getEntry());
229
		$movement->setAgent($this->getEntry()->getAgent());
230
		$movement->setRight($this->getRight());
231
		$movement->save();
232
	}
233
	
234
	
235
	
236
	/**
237
	 * Save element (insert or update or delete)
238
	 */
239 7
	public function save()
240
	{
241 7
		global $babDB;
242
		
243 7
		if (isset($this->id))
244 7
		{
245
			$quantity = (int) round(100 * $this->quantity);
246
			
247
			if (0 === $quantity)
248
			{
249
				// if quantity has been set to 0, the element must be deleted
250
251
				$babDB->db_query("DELETE FROM absences_entries_elem id=".$babDB->quote($this->id));
252
				
253
			} else {
254
			
255
			
256
				$babDB->db_query("
257
					UPDATE absences_entries_elem 
258
					SET 
259
						quantity=".$babDB->quote($this->quantity).",
260
				        date_begin=".$babDB->quote($this->date_begin).",
261
				        date_end=".$babDB->quote($this->date_end)." 
262
					WHERE 
263
						id=".$babDB->quote($this->id)
264
				);
265
			
266
			}
267
			
268
			
269 View Code Duplication
		} else {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
270
			
271 7
			if (isset($this->id_entry))
272 7
			{
273 7
				$id_entry = $this->id_entry;
274 7
			} else {
275
				$entry = $this->getEntry();
276
				$id_entry = $entry->id;
277
			}
278
			
279 7
			$babDB->db_query("
280
				INSERT INTO absences_entries_elem 
281
					(id_entry, id_right, quantity, date_begin, date_end)
282
				VALUES 
283
				(
284 7
					" .$babDB->quote($id_entry). ",
285 7
					" .$babDB->quote($this->id_right). ",
286 7
					" .$babDB->quote($this->quantity). ",
287 7
			        " .$babDB->quote($this->date_begin). ",
288 7
			        " .$babDB->quote($this->date_end). "
289
				)
290 7
			");
291
			
292 7
			$this->id = $babDB->db_insert_id();
293
		}
294 7
	}
295
	
296
	
297
	
298
	public function delete()
299
	{
300
	    global $babDB;
301
	    
302
	    if (!$this->id) {
303
	        return false;
304
	    }
305
	    
306
	    $babDB->db_query("DELETE FROM absences_entries_elem WHERE id=".$babDB->quote($this->id));
307
	}
308
	
309
	
310
	
311
	
312
	/**
313
	 * Trouver la quantitee totale de la demande disponible sur la periode
314
	 * la quantitee est dans l'unite du droit
315
	 * si les dates de l'element sont comprises dans l'interval, la quantite 
316
	 * de l'element est utilises
317
	 * si les dates de l'element sont a cheval sur la periode demandee
318
	 * on utlise les heures travailles de l'utilisateur
319
	 *
320
	 * @param string $begin		Datetime
321
	 * @param string $end		Datetime
322
	 *
323
	 * @return float (days or hours)
324
	 */
325
	public function getQuantityBetween($begin, $end)
326
	{
327
	    require_once $GLOBALS['babInstallPath'].'utilit/dateTime.php';
328
	    
329
	    if ($begin <= $this->date_begin && $this->date_end <= $end) {
330
	        return (float) $this->quantity;
331
	    }
332
	    
333
	    $quantity_unit = $this->getRight()->quantity_unit;
334
	    
335
	    switch($quantity_unit) {
336
	        case 'D': $seconds = 86400; break;
337
	        case 'H': $seconds = 3600; break;
338
	    }
339
	
340
	    $test_begin = ($begin > $this->date_begin) ? $begin : $this->date_begin;
341
	    $test_end 	= ($end   < $this->date_end  ) ? $end   : $this->date_end;
342
	    
343
	    $entry = $this->getEntry();
344
	
345
	    list(, $index) = absences_getHalfDaysIndex($entry->id_user, BAB_DateTime::fromIsoDateTime($test_begin), BAB_DateTime::fromIsoDateTime($test_end), true);
346
	
347
	    $total = 0.0;
348
	    foreach($index as $period)
349
	    {
350
	        /*@var $period bab_CalendarPeriod */
351
	        $total += ($period->getDuration() / $seconds);
0 ignored issues
show
The variable $seconds does not seem to be defined for all execution paths leading up to this point.

If you define a variable conditionally, it can happen that it is not defined for all execution paths.

Let’s take a look at an example:

function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}

In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.

Available Fixes

  1. Check for existence of the variable explicitly:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        if (isset($x)) { // Make sure it's always set.
            echo $x;
        }
    }
    
  2. Define a default value for the variable:

    function myFunction($a) {
        $x = ''; // Set a default which gets overridden for certain paths.
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
        }
    
        echo $x;
    }
    
  3. Add a value for the missing path:

    function myFunction($a) {
        switch ($a) {
            case 'foo':
                $x = 1;
                break;
    
            case 'bar':
                $x = 2;
                break;
    
            // We add support for the missing case.
            default:
                $x = '';
                break;
        }
    
        echo $x;
    }
    
Loading history...
352
	    }
353
	   
354
	    return $total;
355
	}
356
	
357
	
358
	/**
359
	 * Trouver la quantitee totale de la demande disponible sur la periode
360
	 * la quantitee est dans l'unite du droit
361
	 * si les dates de l'element sont comprises dans l'interval, la quantite
362
	 * de l'element est utilises
363
	 * si les dates de l'element sont a cheval sur la periode demandee
364
	 * on utlise les heures travailles qui etait en vigeur au moment de la creation 
365
	 * de la demande
366
	 *
367
	 * @param string $begin		Datetime
368
	 * @param string $end		Datetime
369
	 *
370
	 * @return float (days or hours)
371
	 */
372 1
	public function getPlannedQuantityBetween($begin, $end)
373
	{
374 1
	    if ($begin <= $this->date_begin && $this->date_end <= $end) {
375 1
	        return (float) $this->quantity;
376
	    }
377
	    
378
	    $entry = $this->getEntry();
379
	   
380
	    // ne pas sortir des bornes de l'element pour ne pas 
381
	    // capter une quantite sur un autre element de la meme demande
382
	    $begin = $begin > $this->date_begin ? $begin : $this->date_begin;
383
	    $end = $end < $this->date_end ? $end : $this->date_end;
384
385
	    switch($this->getRight()->quantity_unit) {
386
	        case 'D': return $entry->getPlannedDurationDays($begin, $end);
387
	        case 'H': return $entry->getPlannedDurationHours($begin, $end);
388
	    }
389
	    
390
	    return 0;
391
	}
392
	
393
	
394
	/**
395
	 * @return float
396
	 */
397
	public function getDays()
398
	{
399
	    $right = $this->getRight();
400
	    if ('D' !== $right->quantity_unit) {
401
	        return 0;
402
	    }
403
	     
404
	    return (float) $this->quantity;
405
	}
406
	
407
	/**
408
	 * @return float
409
	 */
410
	public function getHours()
411
	{
412
	    $right = $this->getRight();
413
	    if ('H' !== $right->quantity_unit) {
414
	        return 0;
415
	    }
416
	    
417
	    return (float) $this->quantity;
418
	}
419
}