Issues (106)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Classes/Hooks/T3libPage.php (5 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace AOE\Languagevisibility\Hooks;
4
5
/***************************************************************
6
 * Copyright notice
7
 *
8
 * (c) 2016 AOE GmbH <[email protected]>
9
 * All rights reserved
10
 *
11
 * This script is part of the TYPO3 project. The TYPO3 project is
12
 * free software; you can redistribute it and/or modify
13
 * it under the terms of the GNU General Public License as published by
14
 * the Free Software Foundation; either version 2 of the License, or
15
 * (at your option) any later version.
16
 *
17
 * The GNU General Public License can be found at
18
 * http://www.gnu.org/copyleft/gpl.html.
19
 *
20
 * This script is distributed in the hope that it will be useful,
21
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
23
 * GNU General Public License for more details.
24
 *
25
 * This copyright notice MUST APPEAR in all copies of the script!
26
 ***************************************************************/
27
28
use AOE\Languagevisibility\Exceptions\InvalidRowException;
29
use AOE\Languagevisibility\FceElement;
30
use AOE\Languagevisibility\FceOverlayElement;
31
use AOE\Languagevisibility\Services\FeServices;
32
use TYPO3\CMS\Core\Utility\GeneralUtility;
33
34
/**
35
 * Class tx_languagevisibility_hooks_t3lib_page
36
 *
37
 * @package Aoe\Languagevisibility\Hooks
38
 */
39
class T3libPage implements \TYPO3\CMS\Frontend\Page\PageRepositoryGetPageOverlayHookInterface, \TYPO3\CMS\Frontend\Page\PageRepositoryGetRecordOverlayHookInterface {
40
41
	/**
42
	 * This function has various possible results:
43
	 * 1)    $lUid unchanged -
44
	 * there was nothing to do for langvis and the overlay is requested is fine
45
	 * 2)    $lUid == null
46
	 * is relevant if we did the overlay ourselfs and the processing within getPageOverlay function is not relevant anymore
47
	 * 3)    $lUid changed
48
	 * is relevant if we just changed the target-languge but require getPageOverlay to proceed with the overlay-chrunching
49
	 * 4)   $lUid changed to 0 (which may be the case for forced fallbacks to default). Please check Core Setting hideIfNotTranslated in this case to be sure the page can be shown in this case
50
	 *
51
	 * @param mixed $pageInput
52
	 * @param integer $lUid Passed ad reference!
53
	 * @param \TYPO3\CMS\Frontend\Page\PageRepository $parent
54
	 * @return void
55
	 */
56
	public function getPageOverlay_preProcess(&$pageInput, &$lUid, \TYPO3\CMS\Frontend\Page\PageRepository $parent) {
57
		if (is_int($pageInput)) {
58
			$page_id = $pageInput;
59
		} elseif (is_array($pageInput) && isset($pageInput['uid'])) {
60
			$page_id = $pageInput['uid'];
61
		} else {
62
			return;
63
		}
64
65
		// call service to know if element is visible and which overlay language to use
66
		$overlayLanguage = FeServices::getOverlayLanguageIdForElementRecord($page_id, 'pages', $lUid);
67
68
		if ($overlayLanguage === FALSE) {
69
			if (is_array($pageInput)) {
70
				$pageInput['_NOTVISIBLE'] = TRUE;
71
			}
72
			$lUid = NULL;
73
		} else {
74
			$lUid = $overlayLanguage;
75
		}
76
	}
77
78
	/**
79
	 * The flow in t3lib_page is:
80
	 *  - call preProcess
81
	 *  - if uid and pid > then overlay if langauge != 0
82
	 *  - after this postProcess is called - which only corrects the overlay row for certain elements
83
	 *
84
	 * @param string $table
85
	 * @param array $row
86
	 * @param integer $sys_language_content
87
	 * @param string $OLmode
88
	 * @param \TYPO3\CMS\Frontend\Page\PageRepository $parent
89
	 * @return void
90
	 */
91
	public function getRecordOverlay_preProcess($table, &$row, &$sys_language_content, $OLmode, \TYPO3\CMS\Frontend\Page\PageRepository $parent) {
92
		if (!FeServices::isSupportedTable($table)
93
			|| (!is_array($row))
94
			|| (!isset($row['uid']))) {
95
			return;
96
		}
97
98
		try {
99
			$element = FeServices::getElement($row['uid'], $table);
100
			$overlayLanguage = FeServices::getOverlayLanguageIdForElement($element, $sys_language_content);
101
		} catch ( InvalidRowException $e ) {
102
			$row['uid'] = 0;
103
			$row['pid'] = 0;
104
			return;
105
		}
106
		catch (\Exception $e) {
107
			return;
108
		}
109
110
		if ($overlayLanguage === FALSE) {
111
			$row['uid'] = 0;
112
			$row['pid'] = 0;
113
			return;
114
		} elseif (!$element->isMonolithicTranslated()) {
115
				// for monolytic elements the tx_languagevisibility_feservices::getOverlayLanguageIdForElement return 0 to "tell" us that no overlay is required
116
				// but since the TYPO3 Core interprets a language with id 0 to not return anything we need to leave the $sys_language_content untouched for MonolithicTranslated elements
117
			$sys_language_content = $overlayLanguage;
118
		}
119
120
			/**
121
			 * the original value will be replaced by the original getRecordOverlay process
122
			 * therefore we've to store this elsewhere to make sure that the flexdata is available
123
			 * for the postProcess
124
			 */
125
		if ($element instanceof FceOverlayElement) {
126
			$row['_ORIG_tx_templavoila_flex'] = $row['tx_templavoila_flex'];
127
		}
128
	}
129
130
	/**
131
	 *
132
	 * @param string $table
133
	 * @param array $row
134
	 * @param integer $sys_language_content
135
	 * @param string $OLmode
136
	 * @param \TYPO3\CMS\Frontend\Page\PageRepository $parent
137
	 * @return void
138
	 */
139
	public function getRecordOverlay_postProcess($table, &$row, &$sys_language_content, $OLmode, \TYPO3\CMS\Frontend\Page\PageRepository $parent) {
140
		if (is_array($row) && $row['uid'] === 0 && $row['pid'] === 0) {
141
			$row = FALSE;
142
			return;
143
		}
144
145
		if (!FeServices::isSupportedTable($table)
146
			|| (!is_array($row))
147
			|| (!isset($row['uid']))
148
			|| ($sys_language_content == 0)) {
149
			return;
150
		}
151
152
		try {
153
			$element = FeServices::getElement($row['uid'], $table);
154
			$overlayLanguage = FeServices::getOverlayLanguageIdForElement($element, $sys_language_content);
155
		} catch (\Exception $e) {
156
			return;
157
		}
158
159
		if ($element instanceof FceElement) {
160
				//for FCE the overlay processing is handled by templavoila module, so mark the row with additional infos:
161
			$languageRep = GeneralUtility::makeInstance('AOE\\Languagevisibility\\LanguageRepository');
162
			$overlayLanguageObj = $languageRep->getLanguageById($overlayLanguage);
163
			$row['_OVERLAYLANGUAGEISOCODE'] = $overlayLanguageObj->getIsoCode();
164
		} elseif ($element instanceof FceOverlayElement) {
165
				//now its getting tricky: we need to return overlay record with merged XML
166
			$row['tx_templavoila_flex'] = $row['_ORIG_tx_templavoila_flex'];
167
			unset($row['_ORIG_tx_templavoila_flex']);
168
			$olrow = $this->_getDatabaseTranslationOverlayRecord('tt_content', $row, $overlayLanguage);
169
			if ($GLOBALS['TSFE']) {
170
				$GLOBALS['TSFE']->includeTCA('tt_content');
171
			}
172
				//parse fce xml, and where a xml field is empty in olrow -> use default one
173
			$flexObj = GeneralUtility::makeInstance('TYPO3\\CMS\\Core\\Configuration\\FlexForm\\FlexFormTools');
174
			$this->_callbackVar_defaultXML = GeneralUtility::xml2array($row['tx_templavoila_flex']);
0 ignored issues
show
The property _callbackVar_defaultXML does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
175
			$this->_callbackVar_overlayXML = GeneralUtility::xml2array($olrow['tx_templavoila_flex']);
0 ignored issues
show
The property _callbackVar_overlayXML does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
176
			if (! is_array($this->_callbackVar_overlayXML)) {
177
				$this->_callbackVar_overlayXML = array();
178
			}
179
			$return = $flexObj->traverseFlexFormXMLData('tt_content', 'tx_templavoila_flex', $row, $this, '_callback_checkXMLFieldsForFallback');
0 ignored issues
show
$return is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
180
181
			if ($sys_language_content != $overlayLanguage) {
182
				$row = $parent->getRecordOverlay($table, $row, $overlayLanguage, $OLmode);
183
			}
184
			if ($olrow['tx_templavoila_flex']) {
185
				$row['tx_templavoila_flex'] = GeneralUtility::array2xml_cs($this->_callbackVar_overlayXML, 'T3FlexForms', array('useCDATA' => TRUE));
0 ignored issues
show
Deprecated Code introduced by
The method TYPO3\CMS\Core\Utility\G...Utility::array2xml_cs() has been deprecated with message: since TYPO3 v8, will be removed in TYPO3 v9.

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
186
			}
187
		}
188
	}
189
190
	/**
191
	 * @param $dsArr
192
	 * @param $dataValue
193
	 * @param $PA
194
	 * @param $structurePath
195
	 * @param $pObj
196
	 */
197
	public function _callback_checkXMLFieldsForFallback($dsArr, $dataValue, $PA, $structurePath, $pObj) {
0 ignored issues
show
The parameter $PA is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
198
		if ($dsArr['TCEforms']['l10n_mode'] == 'exclude') {
199
			$pObj->setArrayValueByPath($structurePath, $this->_callbackVar_overlayXML, $dataValue);
200
		} elseif ($dataValue != '' && $dsArr['TCEforms']['l10n_mode'] == 'mergeIfNotBlank') {
201
			$overlayValue = $pObj->getArrayValueByPath($structurePath, $this->_callbackVar_overlayXML);
202
			if ($overlayValue == '') {
203
				$pObj->setArrayValueByPath($structurePath, $this->_callbackVar_overlayXML, $dataValue);
204
			}
205
		}
206
	}
207
208
	/**
209
	 * @param $table
210
	 * @param $row
211
	 * @param $languageId
212
	 * @return mixed
213
	 */
214
	protected function _getDatabaseTranslationOverlayRecord($table, $row, $languageId) {
215
			// Select overlay record:
216
		$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', $table, 'pid=' . intval($row['pid']) . ' AND ' . $GLOBALS['TCA'][$table]['ctrl']['languageField'] . '=' . intval($languageId) . ' AND ' . $GLOBALS['TCA'][$table]['ctrl']['transOrigPointerField'] . '=' . intval($row['uid']) . $GLOBALS['TSFE']->sys_page->enableFields($table), '', '', '1');
217
		$olrow = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($res);
218
		$GLOBALS['TSFE']->sys_page->versionOL($table, $olrow);
219
		$GLOBALS['TYPO3_DB']->sql_free_result($res);
220
		return $olrow;
221
	}
222
}
223