Passed
Push — server_release/1/1.4 ( 715173...1a8200 )
by
unknown
12:00
created

add_file()   A

Complexity

Conditions 4
Paths 8

Size

Total Lines 19
Code Lines 14

Duplication

Lines 0
Ratio 0 %

Importance

Changes 1
Bugs 0 Features 0
Metric Value
cc 4
eloc 14
nc 8
nop 1
dl 0
loc 19
rs 9.7998
c 1
b 0
f 0
1
<?php
2
// This file is part of BOINC.
3
// http://boinc.berkeley.edu
4
// Copyright (C) 2011 University of California
5
//
6
// BOINC is free software; you can redistribute it and/or modify it
7
// under the terms of the GNU Lesser General Public License
8
// as published by the Free Software Foundation,
9
// either version 3 of the License, or (at your option) any later version.
10
//
11
// BOINC is distributed in the hope that it will be useful,
12
// but WITHOUT ANY WARRANTY; without even the implied warranty of
13
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14
// See the GNU Lesser General Public License for more details.
15
//
16
// You should have received a copy of the GNU Lesser General Public License
17
// along with BOINC.  If not, see <http://www.gnu.org/licenses/>.
18
19
// Per-user "file sandboxes" for job submission.
20
// These are stored in project-root/sandbox/USERID/
21
//
22
// The entries in a sandbox directory have contents
23
// size md5
24
//
25
// The actual files are stored in the download hierarchy,
26
// with sb_userid_MD5 as the physical name
27
28
// NOTE: PHP's default max file upload size is 2MB.
29
// To increase this, edit /etc/php.ini, and change, e.g.
30
//
31
// upload_max_filesize = 64M
32
// post_max_size = 64M
33
34
error_reporting(E_ALL);
35
ini_set('display_errors', true);
0 ignored issues
show
Bug introduced by
true of type true is incompatible with the type string expected by parameter $value of ini_set(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

35
ini_set('display_errors', /** @scrutinizer ignore-type */ true);
Loading history...
36
ini_set('display_startup_errors', true);
37
38
require_once("../inc/sandbox.inc");
39
require_once("../inc/submit_db.inc");
40
require_once("../inc/submit_util.inc");
41
42
function list_files($user, $err_msg) {
43
    $dir = sandbox_dir($user);
44
    $d = opendir($dir);
45
    if (!$d) error_page("Can't open sandbox directory");
0 ignored issues
show
introduced by
$d is of type resource, thus it always evaluated to false.
Loading history...
46
    page_head("File sandbox");
47
    echo "
48
        <form action=sandbox.php method=post ENCTYPE=\"multipart/form-data\">
49
        <input type=hidden name=action value=upload_file>
50
        Upload files to your sandbox:
51
        <p><input size=80 type=file name=\"new_file[]\" multiple=\"multiple\">
52
        <p> <input class=\"btn btn-default\" type=submit value=Upload>
53
        </form>
54
        <hr>
55
    ";
56
57
    form_start('sandbox.php', 'post');
58
    form_input_hidden('action', 'add_file');
59
    form_input_text('Name', 'name');
60
    form_input_textarea('Contents', 'contents');
61
    form_submit('OK');
62
    form_end();
63
    echo "
64
        <hr>
65
        <h3>Get web file</h3>
66
    ";
67
    form_start('sandbox.php', 'post');
68
    form_input_hidden('action', 'get_file');
69
    form_input_text('URL', 'url');
70
    form_submit('OK');
71
    form_end();
72
    page_tail();
73
}
74
75
function list_files($user) {
76
    $dir = sandbox_dir($user);
77
    if (!is_dir($dir)) error_page("Can't open sandbox directory");
78
    page_head("File sandbox");
79
    $notice = htmlspecialchars(get_str('notice', true));
80
    if ($notice) {
81
        echo "<p>$notice<hr>";
82
    }
83
    $files = array();
84
    while (($f = readdir($d)) !== false) {
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $d seems to be never defined.
Loading history...
85
        if ($f == '.') continue;
86
        if ($f == '..') continue;
87
        $files[] = $f;
88
    }
89
    if (count($files) == 0) {
90
        echo "Your sandbox is currently empty.";
91
    } else {
92
        sort($files);
93
        start_table();
94
        table_header("Name<br><p class=\"text-muted\">(click to view)</p>", "Modified", "Size (bytes)", "MD5", "Delete","Download");
95
        foreach ($files as $f) {
96
            $path = "$dir/$f";
97
            list($error, $size, $md5) = sandbox_parse_link_file($path);
98
            if ($error) {
99
                table_row($f, "Can't parse link file", "", "<a href=sandbox.php?action=delete_files&name=$f>delete</a>");
100
                continue;
101
            }
102
            $p = sandbox_physical_path($user, $md5);
103
            if (!is_file($p)) {
104
                table_row($f, "Physical file not found", "", "");
105
                continue;
106
            }
107
            $ct = time_str(filemtime($path));
108
            table_row(
109
                "<a href=sandbox.php?action=view_file&name=$f>$f</a>",
110
                $ct,
111
                $size,
112
                $md5,
113
                button_text(
114
                    "sandbox.php?action=delete_file&name=$f",
115
                    "Delete"
116
                ),
117
                button_text(
118
                    "sandbox.php?action=download_file&name=$f",
119
                    "Download"
120
                )
121
            );
122
        }
123
        end_table();
124
    }
125
    page_tail();
126
}
0 ignored issues
show
Coding Style introduced by
PHP syntax error: Cannot redeclare list_files() (previously declared in /home/scrutinizer/build/html/user/sandbox.php:42)
Loading history...
127
128
function upload_file($user) {
129
    $notice = "";
130
    $count = count($_FILES['new_file']['tmp_name']);
131
    for ($i = 0; $i < $count; $i++) {
132
        $tmp_name = $_FILES['new_file']['tmp_name'][$i];
133
        if (!is_uploaded_file($tmp_name)) {
134
            error_page("$tmp_name is not uploaded file");
135
        }
136
        $name = $_FILES['new_file']['name'][$i];
137
        if (strstr($name, "/")) {
138
            error_page("no / allowed");
139
        }
140
        $md5 = md5_file($tmp_name);
141
        $s = stat($tmp_name);
142
        $size = $s['size'];
143
        list($exist, $elf) = sandbox_lf_exist($user, $md5);
144
        if ($exist){
145
            $notice .= "<strong>Notice:</strong> Invalid Upload<br/>";
146
            $notice .= "You are trying to upload file  <strong>$name</strong><br/>";
147
            $notice .= "Another file <strong>$elf</strong> with the same content (md5: $md5) already exists!<br/>";
148
        } else {
149
            // move file to download dir
150
            //
151
            $phys_path = sandbox_physical_path($user, $md5);
152
            rename($tmp_name, $phys_path);
153
154
            // write link file
155
            //
156
            $dir = sandbox_dir($user);
157
            $link_path = "$dir/$name";
158
            sandbox_write_link_file($link_path, $size, $md5);
159
            $notice .= "Uploaded file <strong>$name</strong><br/>";
160
        }
161
    }
162
    list_files($user, $notice);
0 ignored issues
show
Unused Code introduced by
The call to list_files() has too many arguments starting with $notice. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

162
    /** @scrutinizer ignore-call */ 
163
    list_files($user, $notice);

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.

Loading history...
163
}
164
165
function add_file($user) {
166
    $dir = sandbox_dir($user);
167
    $name = post_str('name');
168
    if (!is_valid_filename($name)) {
169
        error_page('bad filename');
170
    }
171
    if (!$name) error_page('No name given');
172
    if (file_exists("$dir/$name")) {
173
        error_page("file $name exists");
174
    }
175
    $contents = post_str('contents');
176
    $contents = str_replace("\r\n", "\n", $contents);
177
    file_put_contents("$dir/$name", $contents);
178
179
    [$md5, $size] = get_file_info("$dir/$name");
180
    write_info_file("$dir/.md5/$name", $md5, $size);
181
182
    $notice = "Added file <strong>$name</strong> ($size bytes)";
183
    header(sprintf('Location: sandbox.php?notice=%s', urlencode($notice)));
184
}
185
186
function get_file($user) {
187
    $dir = sandbox_dir($user);
188
    $url = post_str('url');
189
    if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) {
190
        error_page('Not a valid URL');
191
    }
192
    $fname = basename($url);
193
    $path = "$dir/$fname";
194
    if (file_exists($path)) {
195
        error_page("File $fname exists; delete it first.");
196
    }
197
    copy($url, $path);
198
    $notice = "Fetched file from <strong>$url</strong><br/>";
199
    header(sprintf('Location: sandbox.php?notice=%s', urlencode($notice)));
200
}
201
202
// delete a sandbox file.
203
//
204
function delete_file($user) {
205
    $name = get_str('name');
206
    if (!is_valid_filename($name)) {
207
        error_page('bad filename');
208
    }
209
    $dir = sandbox_dir($user);
210
    list($error, $size, $md5) = sandbox_parse_link_file("$dir/$name");
211
    if ($error) {
212
        error_page("can't parse link file");
213
    }
214
    $p = sandbox_physical_path($user, $md5);
215
    if (!is_file($p)) {
216
        error_page("no such physical file");
217
    }
218
    $bused = sandbox_file_in_use($user, $name);
219
    if ($bused){
220
        $notice = "<strong>$name</strong> is being used by batch(es), you can not delete it now!<br/>";
221
    } else{ 
222
        $notice = "<strong>$name</strong> is not being used by any batch(es) and successfully deleted from your sandbox<br/>";
223
        unlink("$dir/$name");
224
        unlink($p);
225
    
226
    }
227
    list_files($user,$notice);
0 ignored issues
show
Unused Code introduced by
The call to list_files() has too many arguments starting with $notice. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

227
    /** @scrutinizer ignore-call */ 
228
    list_files($user,$notice);

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.

Loading history...
228
    //Header("Location: sandbox.php");
229
}
230
function download_file($user) {
231
    $name = get_str('name');
232
    if (!is_valid_filename($name)) {
233
        error_page('bad filename');
234
    }
235
    $dir = sandbox_dir($user);
236
    list($err, $size, $md5) = sandbox_parse_link_file("$dir/$name");
237
    if ($err) {
238
        error_page("can't parse link file");
239
    }
240
    $p = sandbox_physical_path($user, $md5);
241
    if (!is_file($p)) {
242
        error_page("$p does not exist!");
243
    }
244
    do_download($p, $name);
245
}
246
function view_file($user) {
247
    $name = get_str('name');
248
    if (!is_valid_filename($name)) {
249
        error_page('bad filename');
250
    }
251
    $dir = sandbox_dir($user);
252
    $path = "$dir/$name";
253
    if (!is_file($path)) {
254
        error_page("no such file");
255
    }
256
    echo "<pre>\n";
257
    readfile($p);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $p seems to be never defined.
Loading history...
258
    echo "</pre>\n";
259
}
260
261
$user = get_logged_in_user();
0 ignored issues
show
Bug introduced by
Are you sure the assignment to $user is correct as get_logged_in_user() seems to always return null.

This check looks for function or method calls that always return null and whose return value is assigned to a variable.

class A
{
    function getObject()
    {
        return null;
    }

}

$a = new A();
$object = $a->getObject();

The method getObject() can return nothing but null, so it makes no sense to assign that value to a variable.

The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.

Loading history...
262
if (!submit_permissions($user)) error_page("no job submission access");
263
264
$action = get_str('action', true);
265
if (!$action) $action = post_str('action', true);
266
267
switch ($action) {
268
case '': list_files($user,""); break;
0 ignored issues
show
Unused Code introduced by
The call to list_files() has too many arguments starting with ''. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

268
case '': /** @scrutinizer ignore-call */ list_files($user,""); break;

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.

Loading history...
269
case 'upload_file': upload_file($user); break;
270
case 'delete_file': delete_file($user); break;
271
case 'download_file': download_file($user); break;
272
case 'view_file': view_file($user); break;
273
default: error_page("no such action: $action");
0 ignored issues
show
Coding Style introduced by
DEFAULT keyword must be indented 4 spaces from SWITCH keyword
Loading history...
Coding Style introduced by
Blank lines are not allowed after DEFAULT statements
Loading history...
274
case 'add_form': add_form($user); break;
275
default: error_page("no such action: ".htmlspecialchars($action));
0 ignored issues
show
Coding Style introduced by
DEFAULT keyword must be indented 4 spaces from SWITCH keyword
Loading history...
Coding Style introduced by
DEFAULT case must have a breaking statement
Loading history...
276
}
277
278
?>
279