Ariadne-CMS /
ariadne
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /************************************************************************** |
||
| 3 | mod_lock v1.0b MySQL |
||
| 4 | |||
| 5 | table layout: |
||
| 6 | |||
| 7 | Table locks |
||
| 8 | +----------+---------------+------+-----+---------+-------+ |
||
| 9 | | Field | Type | Null | Key | Default | Extra | |
||
| 10 | +----------+---------------+------+-----+---------+-------+ |
||
| 11 | | release | int(11) | | MUL | 0 | | |
||
| 12 | | type | enum('O','T') | | MUL | O | | |
||
| 13 | | identity | varchar(23) | | MUL | | | |
||
| 14 | | path | varchar(127) | | MUL | | | |
||
| 15 | +----------+---------------+------+-----+---------+-------+ |
||
| 16 | |||
| 17 | error numbers: |
||
| 18 | |||
| 19 | 1 lock() mysql error when running lock query |
||
| 20 | 2 lock() path already locked by someone else |
||
| 21 | |||
| 22 | **************************************************************************/ |
||
| 23 | |||
| 24 | |||
| 25 | class mysqllock { |
||
| 26 | |||
| 27 | function __construct($tbl_prefix="", $dbh) { |
||
| 28 | debug("mysqllock::mysqllock($tbl_prefix)"); |
||
| 29 | $this->tbl_prefix=$tbl_prefix; |
||
| 30 | $this->dbh = $dbh; |
||
| 31 | debug("mysqllock::mysqllock end","all"); |
||
| 32 | } |
||
| 33 | |||
| 34 | function connect($host="localhost",$user="root",$password="", $database) { |
||
| 35 | debug("mysqllock::connect($host, $user, [password])","store"); |
||
| 36 | $this->dbh = new mysqli('p:'.$host, $user, $password, $database); |
||
| 37 | if ($this->dbh->connect_errno) { |
||
| 38 | die("Error " . $this->dbh->connect_error); |
||
|
0 ignored issues
–
show
|
|||
| 39 | } |
||
| 40 | |||
| 41 | if( !$this->dbh->ping() ){ |
||
| 42 | $this->dbh->close(); |
||
| 43 | $this->dbh = new mysqli('p:'.$config['host'], $config["user"], $config["password"], $config["database"]); |
||
| 44 | if ($this->dbh->connect_errno) { |
||
| 45 | die("Error " . $this->dbh->connect_error); |
||
|
0 ignored issues
–
show
The method
connect() contains an exit expression.
An exit expression should only be used in rare cases. For example, if you write a short command line script. In most cases however, using an Loading history...
|
|||
| 46 | } |
||
| 47 | } |
||
| 48 | debug("mysqllock::connect end","all"); |
||
| 49 | } |
||
| 50 | |||
| 51 | function get_locks($identity) { |
||
| 52 | debug("mysqllock:get_locks($identity)","store"); |
||
| 53 | $query_string="select `path`,`release`, `type`, `identity` from ".$this->tbl_prefix."locks where |
||
| 54 | `release` >=".time()." and `identity`='".AddSlashes($identity)."'"; |
||
| 55 | $query=@$this->dbh->query($query_string); |
||
| 56 | while ($temp=@$query->fetch_array()) { |
||
| 57 | $result[$temp["path"]]=$temp; |
||
| 58 | } |
||
| 59 | debug("mysqllock:get_locks end","all"); |
||
| 60 | return $result; |
||
| 61 | } |
||
| 62 | |||
| 63 | function lock($identity, $path, $type="O", $time=0) { |
||
| 64 | /********************************************************************** |
||
| 65 | This function locks an object/path |
||
| 66 | **********************************************************************/ |
||
| 67 | debug("mysqllock:lock($identity,$path,$time,$type)","store"); |
||
| 68 | $tablelock = "write"; |
||
| 69 | $checkonly = false; |
||
| 70 | |||
| 71 | if (!$time) { |
||
| 72 | $time=time()+$this->lock_duration; |
||
| 73 | } |
||
| 74 | |||
| 75 | if($time < time()) { |
||
| 76 | $checkonly = true; |
||
| 77 | $tablelock = "read"; |
||
| 78 | } |
||
| 79 | |||
| 80 | // lock table first |
||
| 81 | $query_string="lock tables ".$this->tbl_prefix."locks ".$tablelock; |
||
| 82 | $this->dbh->query($query_string); |
||
| 83 | |||
| 84 | // check if the path is not already locked by a parent |
||
| 85 | $query_string=" |
||
| 86 | select `path`, `release`, `type`, `identity` |
||
| 87 | from ".$this->tbl_prefix."locks |
||
| 88 | where ( ( path=substring('".AddSlashes($path)."',1,length(path)) |
||
| 89 | AND `type`='T' ) |
||
| 90 | OR ( `path`='".AddSlashes($path)."' )"; |
||
| 91 | |||
| 92 | // if we are locking a whole tree we must also check if no |
||
| 93 | // child has been locked already |
||
| 94 | if ($type=="T") { |
||
| 95 | $query_string.=" OR ( `path` like '".AddSlashes($path)."%' ) "; |
||
| 96 | } |
||
| 97 | |||
| 98 | $alreadylocked=false; |
||
| 99 | // see if this lock is still alive |
||
| 100 | $query_string.=") AND `release`>=".time(); |
||
| 101 | $query=@$this->dbh->query($query_string); |
||
| 102 | while ($lock=@$query->fetch_array()) { |
||
| 103 | if ($lock["identity"]!=$identity) { |
||
| 104 | // this is a lock with another identity, so fail the current lock attempt |
||
| 105 | $alreadylocked=true; |
||
| 106 | $this->locklist[]=$lock; |
||
| 107 | } |
||
| 108 | } |
||
| 109 | |||
| 110 | $result=false; |
||
| 111 | if (!$alreadylocked) { |
||
| 112 | if(!$checkonly) { |
||
| 113 | // clear old lock entries |
||
| 114 | $query_string=" |
||
| 115 | delete from ".$this->tbl_prefix."locks where `path`='".AddSlashes($path)."'"; |
||
| 116 | |||
| 117 | $this->dbh->query($query_string); |
||
| 118 | |||
| 119 | $query_string=" |
||
| 120 | insert into ".$this->tbl_prefix."locks (`path`, `release`, `type`, `identity`) values ( |
||
| 121 | '".AddSlashes($path)."', $time, '".AddSlashes($type)."', |
||
| 122 | '".AddSlashes($identity)."')"; |
||
| 123 | |||
| 124 | $this->dbh->query($query_string); |
||
| 125 | if (!$this->dbh->errno) { |
||
| 126 | $result=true; |
||
| 127 | } else { |
||
| 128 | $this->error=2; |
||
| 129 | $this->error_message="MOD_LOCK: ERROR 2: ".$this->dbh->error; |
||
| 130 | } |
||
| 131 | } else { |
||
| 132 | $result = true; |
||
| 133 | } |
||
| 134 | } else { |
||
| 135 | $this->error=1; |
||
| 136 | $this->error_message="MOD_LOCK: ERROR 1: $path already locked."; |
||
| 137 | } |
||
| 138 | $query_string="unlock tables"; |
||
| 139 | $this->dbh->query($query_string); |
||
| 140 | |||
| 141 | return ($result); |
||
| 142 | } |
||
| 143 | |||
| 144 | function unlock($identity,$path="") { |
||
| 145 | |||
| 146 | $query_string="delete from ".$this->tbl_prefix."locks where `identity`='".AddSlashes($identity)."'"; |
||
| 147 | if ($path) { |
||
| 148 | $query_string.=" and `path`='".AddSlashes($path)."'"; |
||
| 149 | } |
||
| 150 | $this->dbh->query($query_string); |
||
| 151 | |||
| 152 | } |
||
| 153 | |||
| 154 | function close() { |
||
| 155 | } |
||
| 156 | |||
| 157 | function init() { |
||
| 158 | $query_string=" |
||
| 159 | CREATE TABLE ".$this->tbl_prefix."locks ( |
||
| 160 | `release` int NOT NULL, |
||
| 161 | `type` enum('O','T') NOT NULL, |
||
| 162 | `identity` varchar(32) NOT NULL, |
||
| 163 | `path` varchar(127) NOT NULL, |
||
| 164 | key (`release`), |
||
| 165 | key (`type`), |
||
| 166 | key (`identity`), |
||
| 167 | key (`path`) |
||
| 168 | )"; |
||
| 169 | $this->dbh->query($query_string); |
||
| 170 | } |
||
| 171 | } |
||
| 172 |
An exit expression should only be used in rare cases. For example, if you write a short command line script.
In most cases however, using an
exitexpression makes the code untestable and often causes incompatibilities with other libraries. Thus, unless you are absolutely sure it is required here, we recommend to refactor your code to avoid its usage.