This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | $ARLoader = 'soap'; |
||
4 | $currentDir = getcwd(); |
||
5 | $ariadne = dirname($currentDir).'/lib/'; |
||
6 | |||
7 | View Code Duplication | if (!@include_once($ariadne."/bootstrap.php")) { |
|
8 | chdir(substr($_SERVER['PHP_SELF'], 0, strrpos($_SERVER['PHP_SELF'], '/'))); |
||
9 | $ariadne = dirname(getcwd()).'/lib/'; |
||
10 | |||
11 | if(!include_once($ariadne."/bootstrap.php")){ |
||
12 | echo "could not find Ariadne"; |
||
13 | exit(1); |
||
14 | } |
||
15 | |||
16 | chdir($currentDir); |
||
17 | } |
||
18 | |||
19 | function unpack_array_names($source, &$target) { |
||
20 | if (is_array($source)) { |
||
21 | reset($source); |
||
22 | while (list($key, $val) = each($source)) { |
||
23 | $kpos = strpos($key, '.'); |
||
24 | if ($kpos !== false) { |
||
25 | $count = 0; |
||
26 | $targetkey = substr($key, 0, $kpos); |
||
27 | if (!is_array($target[$targetkey])) { |
||
28 | $target[$targetkey] = Array(); |
||
29 | } |
||
30 | $subtarget = &$target[$targetkey]; |
||
31 | debug("creating array ($targetkey)"); |
||
32 | do { |
||
33 | $count++; |
||
34 | if ($count > 10) { |
||
35 | debug("endless loop detected, dying"); |
||
36 | exit; |
||
0 ignored issues
–
show
|
|||
37 | } |
||
38 | $kendpos = strpos($key, '.', $kpos+1); |
||
39 | if (!$kendpos) { |
||
40 | $kendpos = strlen($key)-1; |
||
41 | } |
||
42 | debug("key kpos($kpos) kendpos($kendpos)"); |
||
43 | $klen = $kendpos - $kpos; |
||
44 | $targetkey = substr($key, $kpos+1, $klen); |
||
45 | debug("soap::unpack_array_names found($targetkey)"); |
||
46 | |||
47 | if (!is_array($subtarget[$targetkey])) { |
||
48 | $subtarget[$targetkey] = Array(); |
||
49 | } |
||
50 | $subtarget = &$subtarget[$targetkey]; |
||
51 | |||
52 | $kpos = strpos($key, '.', $kendpos+1); |
||
53 | } while ($kpos !== false); |
||
54 | debug("soap::unpack_array_names setting value\n"); |
||
55 | $subtarget = $val; |
||
56 | } else { |
||
57 | unpack_array_names($val, $target); |
||
58 | } |
||
59 | } |
||
60 | } |
||
61 | |||
62 | } |
||
63 | |||
64 | $AR_PATH_INFO=$_SERVER["PATH_INFO"]; |
||
65 | if (!$AR_PATH_INFO) { |
||
66 | ldRedirect($_SERVER["PHP_SELF"]."/"); |
||
67 | exit; |
||
68 | |||
69 | } else { |
||
70 | |||
71 | @ob_end_clean(); // just in case the output buffering is set on in php.ini, disable it here, as Ariadne's cache system gets confused otherwise. |
||
72 | |||
73 | // go check for a sessionid |
||
74 | $root=$AR->root; |
||
75 | |||
76 | // set the default user (public) |
||
77 | $AR->login="public"; |
||
78 | |||
79 | // look for the template |
||
80 | $split=strrpos($AR_PATH_INFO, "/"); |
||
81 | $path=substr($AR_PATH_INFO,0,$split+1); |
||
82 | |||
83 | |||
84 | /* remove template from PATH_INFO */ |
||
85 | if (substr($AR_PATH_INFO,$split+1)) { |
||
86 | $AR_PATH_INFO=substr($AR_PATH_INFO, 0, $split); |
||
87 | } |
||
88 | |||
89 | // look for the language |
||
90 | $split=strpos(substr($AR_PATH_INFO, 1), "/"); |
||
91 | $ARCurrent->nls=substr($path, 1, $split); |
||
92 | if (!$AR->nls->list[$ARCurrent->nls]) { |
||
93 | // not a valid language |
||
94 | $ARCurrent->nls=""; |
||
95 | $nls=$AR->nls->default; |
||
96 | $cachenls=""; |
||
97 | } else { |
||
98 | // valid language |
||
99 | $path=substr($path, $split+1); |
||
100 | ldSetNls($ARCurrent->nls); |
||
101 | $nls=$ARCurrent->nls; |
||
102 | $cachenls="/$nls"; |
||
103 | } |
||
104 | |||
105 | $soapserver = new soap_server; |
||
106 | debug($HTTP_RAW_POST_DATA); |
||
107 | $arguments = $soapserver->get_request($HTTP_RAW_POST_DATA); |
||
108 | $function = strtolower($soapserver->methodname); |
||
109 | |||
110 | ob_start(); |
||
111 | echo "Arguments: \n"; |
||
112 | print_r($arguments); |
||
113 | debug(ob_get_contents()); |
||
114 | ob_end_clean(); |
||
115 | |||
116 | if ($arguments["arUnpackArrayNames"]) { |
||
117 | debug("loader starting unpackarraynames\n\n"); |
||
118 | unpack_array_names($arguments, $arguments); |
||
119 | } |
||
120 | |||
121 | debug("soap::request ($path) ('$function')", "loader"); |
||
122 | |||
123 | // instantiate the store |
||
124 | $inst_store = $store_config["dbms"]."store"; |
||
125 | $store=new $inst_store($root,$store_config); |
||
126 | $store->rootoptions = $rootoptions; |
||
127 | |||
128 | // load language file |
||
129 | require($ariadne."/nls/".$nls); |
||
130 | $ARCurrent->nolangcheck=1; |
||
131 | |||
132 | if (!ldCheckLogin($arguments["ARLogin"], $arguments["ARPassword"])) { |
||
133 | ldCheckLogin("public", "none"); |
||
134 | } |
||
135 | |||
136 | // finally call the requested object |
||
137 | // unset($arguments["ARPassword"]); |
||
138 | |||
139 | if ($arguments["ARPath"]) { |
||
140 | $path = $store->make_path($path, $arguments["ARPath"]); |
||
141 | } |
||
142 | $result = current( |
||
143 | $store->call( |
||
144 | 'soap.call.phtml', |
||
145 | Array( |
||
146 | 'function' => $function, |
||
147 | 'arguments' => $arguments |
||
148 | ), |
||
149 | $store->get($path) |
||
150 | ) |
||
151 | ); |
||
152 | |||
153 | if (!$store->total) { |
||
154 | ldObjectNotFound($path, $soapserver->methodname); |
||
155 | } else { |
||
156 | if (!$SOAP_Fault) { |
||
157 | $soapserver->send_returnvalue($result); |
||
158 | } |
||
159 | } |
||
160 | if ($SOAP_Fault) { |
||
161 | $soapserver->send_returnvalue($SOAP_Fault); |
||
162 | } |
||
163 | $store->close(); |
||
164 | } |
||
165 | |||
166 | // save session data |
||
167 | if ($ARCurrent->session) { |
||
168 | $ARCurrent->session->save(); |
||
169 | } |
||
170 | |||
171 | ?> |
||
172 |
An exit expression should only be used in rare cases. For example, if you write a short command line script.
In most cases however, using an
exit
expression makes the code untestable and often causes incompatibilities with other libraries. Thus, unless you are absolutely sure it is required here, we recommend to refactor your code to avoid its usage.