Issues (1751)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

lib/modules/mod_pdf.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
require_once("fpdf151/fpdf.php");
3
//define('FPDF_FONTPATH','D:/Program Files/Ariadne/lib/modules/fpdf151/font/');
4
define('FPDF_FONTPATH','font/');
5
6
class pinp_PDF {
7
	public static function _init($orientation='P',$unit='mm',$format='A4') {
0 ignored issues
show
The parameter $orientation is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $unit is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $format is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
8
		$pdf=new pinp_FPDF($orientation='P',$unit='mm',$format='A4');
9
		return $pdf;
10
	}
11
}
12
13
class pinp_FPDF extends FPDF
14
{
15
16
	public function __construct ($orientation='P',$unit='mm',$format='A4')
17
	{
18
		//Call parent constructor
19
		$this->FPDF($orientation,$unit,$format);
20
		//Initialization
21
		$this->B=0;
22
		$this->I=0;
23
		$this->U=0;
24
		$this->HREF='';
25
		$this->fontlist=array("arial","times","courier","helvetica","symbol");
26
		$this->issetfont=false;
27
		$this->issetcolor=false;
28
	}
29
30
	public function _SetMargins($left,$top,$right=-1)
31
	{
32
		return $this->SetMargins($left,$top,$right);
33
	}
34
35
	public function _SetLeftMargin($margin)
36
	{
37
		return $this->SetLeftMargin($margin);
38
	}
39
40
	public function _SetTopMargin($margin)
41
	{
42
		return $this->SetTopMargin($margin);
43
	}
44
45
	public function _SetRightMargin($margin)
46
	{
47
		return $this->SetRightMargin($margin);
48
	}
49
50
	public function _SetAutoPageBreak($auto,$margin=0)
51
	{
52
		return $this->SetAutoPageBreak($auto,$margin);
53
	}
54
55
	public function _SetDisplayMode($zoom,$layout='continuous')
56
	{
57
		return $this->SetDisplayMode($zoom,$layout);
58
	}
59
60
	public function _SetCompression($compress)
61
	{
62
		return $this->SetCompression($compress);
63
	}
64
65
	public function _SetTitle($title)
66
	{
67
		return $this->SetTitle($title);
68
	}
69
70
	public function _SetSubject($subject)
71
	{
72
		return $this->SetSubject($subject);
73
	}
74
75
	public function _SetAuthor($author)
76
	{
77
		return $this->SetAuthor($author);
78
	}
79
80
	public function _SetKeywords($keywords)
81
	{
82
		return $this->SetKeywords($keywords);
83
	}
84
85
	public function _SetCreator($creator)
86
	{
87
		return $this->SetCreator($creator);
88
	}
89
90
	public function _AliasNbPages($alias='{nb}')
91
	{
92
		return $this->AliasNbPages($alias);
93
	}
94
95
	public function _Error($msg)
96
	{
97
		return $this->Eroor($msg);
98
	}
99
100
	public function _Open()
101
	{
102
		return $this->Open();
103
	}
104
105
	public function _Close()
106
	{
107
		return $this->Close();
108
	}
109
110
	public function _AddPage($orientation='')
111
	{
112
		return $this->AddPage($orientation);
113
	}
114
115
	public function _Header()
116
	{
117
		//To be implemented in your own inherited class
118
	}
119
120
	public function _Footer()
121
	{
122
		//To be implemented in your own inherited class
123
	}
124
125
	public function _PageNo()
126
	{
127
		return $this->PageNo();
128
	}
129
130
	public function _SetDrawColor($r,$g=-1,$b=-1)
131
	{
132
		return $this->SetDrawColor($r,$g,$b);
133
	}
134
135
	public function _SetFillColor($r,$g=-1,$b=-1)
136
	{
137
		return $this->SetFillColor($r,$g,$b);
138
	}
139
140
	public function _SetTextColor($r,$g=-1,$b=-1)
141
	{
142
		return $this->SetTextColor($r,$g,$b);
143
	}
144
145
	public function _GetStringWidth($s)
146
	{
147
		return $this->GetStringWidth($s);
148
	}
149
150
	public function _SetLineWidth($width)
151
	{
152
		return $this->SetLineWidth($width);
153
	}
154
155
	public function _Line($x1,$y1,$x2,$y2)
156
	{
157
		return $this->Line($x1,$y1,$x2,$y2);
158
	}
159
160
	public function _Rect($x,$y,$w,$h,$style='')
161
	{
162
		return $this->Rect($x,$y,$w,$h,$style);
163
	}
164
165
	public function _AddFont($family,$style='',$file='')
166
	{
167
		// FIXME: this is insecure, fonts should be gotten from
168
		// inside Ariadne
169
		return $this->AddFont($family,$style,$file);
170
	}
171
172
	public function _SetFont($family,$style='',$size=0)
173
	{
174
		return $this->SetFont($family,$style,$size);
175
	}
176
177
	public function _SetFontSize($size)
178
	{
179
		return $this->SetFontSize($size);
180
	}
181
182
	public function _AddLink()
183
	{
184
		return $this->AddLink();
185
	}
186
187
	public function _SetLink($link,$y=0,$page=-1)
188
	{
189
		return $this->SetLink($link,$y,$page);
190
	}
191
192
	public function _Link($x,$y,$w,$h,$link)
193
	{
194
		return $this->Link($x,$y,$w,$h,$link);
195
	}
196
197
	public function _Text($x,$y,$txt)
198
	{
199
		return $this->Text($x,$y,$txt);
200
	}
201
202
	public function _AcceptPageBreak()
203
	{
204
		return $this->AcceptPageBreak();
205
	}
206
207
	public function _Cell($w,$h=0,$txt='',$border=0,$ln=0,$align='',$fill=0,$link='')
208
	{
209
		return $this->Cell($w,$h,$txt,$border,$ln,$align,$fill,$link);
210
	}
211
212
	public function _MultiCell($w,$h,$txt,$border=0,$align='J',$fill=0)
213
	{
214
		return $this->MultiCell($w,$h,$txt,$border,$align,$fill);
215
	}
216
217
	public function _Write($h,$txt,$link='')
218
	{
219
		return $this->Write($h,$txt,$link);
220
	}
221
222
	public function _Image($file,$x,$y,$w,$h=0,$type='',$link='')
223
	{
224
		return $this->Image($file,$x,$y,$w,$h,$type,$link);
225
	}
226
227
	public function _Ln($h='')
228
	{
229
		return $this->Ln($h);
230
	}
231
232
	public function _GetX()
233
	{
234
		return $this->GetX();
235
	}
236
237
	public function _SetX($x)
238
	{
239
		return $this->SetX($x);
240
	}
241
242
	public function _GetY()
243
	{
244
		return $this->GetY();
245
	}
246
247
	public function _SetY($y)
248
	{
249
		return $this->SetY($y);
250
	}
251
252
	public function _SetXY($x,$y)
253
	{
254
		return $this->SetXY($x,$y);
255
	}
256
257
	public function _Output($file='',$download=false)
258
	{
259
		return $this->Output($file,$download);
260
	}
261
262
	public function _WriteHTML($html)
263
	{
264
		return $this->WriteHTML($html);
265
	}
266
267
	public function _OpenTag($tag,$attr)
268
	{
269
		return $this->OpenTag($tag,$attr);
270
	}
271
272
	public function _CloseTag($tag)
273
	{
274
		return $this->CloseTag($tag);
275
	}
276
277
	public function _SetStyle($tag,$enable)
278
	{
279
		return $this->SetStyle($tag,$enable);
280
	}
281
282
	public function _PutLink($URL,$txt)
283
	{
284
		return $this->PutLink($URL,$txt);
285
	}
286
287
	// code originally from HTML2PDF by Cl�ment Lavoillotte
288
	// [email protected]
289
	// [email protected]
290
	// http://www.streetpc.tk
291
292
	// function hex2dec
293
	// returns an associative array (keys: R,G,B) from
294
	// a hex html code (e.g. #3FE5AA)
295
	public function hex2dec($color = "#000000"){
296
		$R = substr($color, 1, 2);
297
		$rouge = hexdec($R);
298
		$V = substr($color, 3, 2);
299
		$vert = hexdec($V);
300
		$B = substr($color, 5, 2);
301
		$bleu = hexdec($B);
302
		$tbl_color = array();
303
		$tbl_color['R']=$rouge;
304
		$tbl_color['G']=$vert;
305
		$tbl_color['B']=$bleu;
306
		return $tbl_color;
307
	}
308
309
	// conversion pixel -> millimeter in 72 dpi
310
	public function px2mm($px){
311
		return $px*25.4/72;
312
	}
313
314
	public function txtentities($html){
315
		$trans = get_html_translation_table(HTML_ENTITIES);
316
		$trans = array_flip($trans);
317
		return strtr($html, $trans);
318
	}
319
320
	//variables of html parser
321
	protected $B;
322
	protected $I;
323
	protected $U;
324
	protected $HREF;
325
	protected $fontList;
326
	protected $issetfont;
327
	protected $issetcolor;
328
329
	public function WriteHTML($html)
330
	{
331
		require_once('mod_unicode.php');
332
		$html=unicode::utf8toiso8859($html);
333
		$html=strip_tags($html,"<b><u><i><a><img><p><br><strong><em><font><tr><blockquote>"); //remove all unsupported tags
334
		$html=str_replace("\n",' ',$html); //replace carriage returns by spaces
335
		$a=preg_split('/<(.*)>/U',$html,-1,PREG_SPLIT_DELIM_CAPTURE); //explodes the string
336
		foreach($a as $i=>$e)
337
		{
338
			if($i%2==0)
339
			{
340
				//Text
341
				if($this->HREF)
342
					$this->PutLink($this->HREF,$e);
343
				else
344
					$this->Write(5,stripslashes($this->txtentities($e)));
345
			}
346
			else
347
			{
348
				//Tag
349
				if($e{0}=='/')
350
					$this->CloseTag(strtoupper(substr($e,1)));
351
				else
352
				{
353
					//Extract attributes
354
					$a2=explode(' ',$e);
355
					$tag=strtoupper(array_shift($a2));
356
					$attr=array();
357
					foreach($a2 as $v)
358
						if(preg_match('/^([^=]*)=["\']?([^"\']*)["\']?$/',$v,$a3))
359
							$attr[strtoupper($a3[1])]=$a3[2];
360
					$this->OpenTag($tag,$attr);
361
				}
362
			}
363
		}
364
	}
365
366
	public function OpenTag($tag,$attr)
367
	{
368
		//Opening tag
369
		switch($tag){
370
			case 'STRONG':
371
				$this->SetStyle('B',true);
372
				break;
373
			case 'EM':
374
				$this->SetStyle('I',true);
375
				break;
376
			case 'B':
377
			case 'I':
378
			case 'U':
379
				$this->SetStyle($tag,true);
380
				break;
381
			case 'A':
382
				$this->HREF=$attr['HREF'];
383
				break;
384
			case 'IMG':
385
				if ($attr['SRC'] && substr($attr['SRC'], -1)=='/') {
386
					$attr['SRC']=substr($attr['SRC'], 0, -1);
387
				}
388
				// FIXME: make the image available as a file.
389
				// FIXME: remove width or height requirement.
390
				if(isset($attr['SRC']) && (isset($attr['WIDTH']) || isset($attr['HEIGHT']))) {
391
					if(!isset($attr['WIDTH']))
392
						$attr['WIDTH'] = 0;
393
					if(!isset($attr['HEIGHT']))
394
						$attr['HEIGHT'] = 0;
395
					$this->Image($attr['SRC'], $this->GetX(), $this->GetY(), $this->px2mm($attr['WIDTH']), $this->px2mm($attr['HEIGHT']));
396
				}
397
				break;
398
			case 'TR':
399
			case 'BLOCKQUOTE':
400
			case 'BR':
401
				$this->Ln(5);
402
				break;
403
			case 'P':
404
				$this->Ln(10);
405
				break;
406
			case 'FONT':
407
				if (isset($attr['COLOR']) || $attr['COLOR']!='') {
408
					$coul=$this->hex2dec($attr['COLOR']);
409
					$this->SetTextColor($coul['R'],$coul['G'],$coul['B']);
410
					$this->issetcolor=true;
411
				}
412
				if (isset($attr['FACE']) || in_array(strtolower($attr['FACE']), $this->fontlist)) {
413
					$this->SetFont(strtolower($attr['FACE']));
414
					$this->issetfont=true;
415
				}
416
				break;
417
		}
418
	}
419
420
	public function CloseTag($tag)
421
	{
422
		//Closing tag
423
		if($tag=='STRONG')
424
			$tag='B';
425
		if($tag=='EM')
426
			$tag='I';
427
		if($tag=='B' || $tag=='I' || $tag=='U')
428
			$this->SetStyle($tag,false);
429
		if($tag=='A')
430
			$this->HREF='';
431
		if($tag=='FONT'){
432
			if ($this->issetcolor==true) {
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
433
				$this->SetTextColor(0);
434
			}
435
			if ($this->issetfont) {
436
				$this->SetFont('arial');
437
				$this->issetfont=false;
438
			}
439
		}
440
	}
441
442
	public function SetStyle($tag,$enable)
443
	{
444
		//Modify style and select corresponding font
445
		$this->$tag+=($enable ? 1 : -1);
446
		$style='';
447
		foreach(array('B','I','U') as $s)
448
			if($this->$s>0)
449
				$style.=$s;
450
		$this->SetFont('',$style);
451
	}
452
453
	public function PutLink($URL,$txt)
454
	{
455
		//Put a hyperlink
456
		$this->SetTextColor(0,0,255);
457
		$this->SetStyle('U',true);
458
		$this->Write(5,$txt,$URL);
459
		$this->SetStyle('U',false);
460
		$this->SetTextColor(0);
461
	}
462
463
	//End of class
464
}
465