GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (4873)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

plugins/git/include/GitBackend.class.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
  * Copyright (c) Xerox Corporation, Codendi Team, 2001-2009. All rights reserved
4
  *
5
  * This file is a part of Codendi.
6
  *
7
  * Codendi is free software; you can redistribute it and/or modify
8
  * it under the terms of the GNU General Public License as published by
9
  * the Free Software Foundation; either version 2 of the License, or
10
  * (at your option) any later version.
11
  *
12
  * Codendi is distributed in the hope that it will be useful,
13
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
  * GNU General Public License for more details.
16
  *
17
  * You should have received a copy of the GNU General Public License
18
  * along with Codendi. If not, see <http://www.gnu.org/licenses/
19
  */
20
require_once('common/backend/Backend.class.php');
21
22
/**
23
 * Description of GitBackend
24
 *
25
 * @author Guillaume Storchi
26
 */
27
class GitBackend extends Backend implements Git_Backend_Interface, GitRepositoryCreator {
28
    
29
    private $driver;    
30
    private $packagesFile;
31
    private $configFile;
32
    //path MUST end with a '/'
33
    private $gitRootPath;
34
35
    /** @var Git_GitRepositoryUrlManager */
36
    private $url_manager;
37
38
    const DEFAULT_DIR_MODE = '770';
39
40
    protected function __construct() {
41
        $this->gitRootPath  = '';
42
        $this->driver       = new GitDriver();
43
        $this->packagesFile = 'etc/packages.ini';
44
        $this->configFile   = 'etc/config.ini';
45
        $this->dao          = new GitDao();
46
        //WARN : this is much safer to set it to an absolute path
47
        $this->gitRootPath  = Git_Backend_Interface::GIT_ROOT_PATH ;
48
        $this->gitBackupDir = PluginManager::instance()->getPluginByName('git')->getPluginInfo()->getPropVal('git_backup_dir');
49
    }
50
51
    public function setUp(Git_GitRepositoryUrlManager $url_manager) {
52
        $this->url_manager  = $url_manager;
53
    }
54
55
    public function setGitBackupDir($dir) {
56
        $this->gitBackupDir = $dir;
57
    }
58
    
59
    public function setGitRootPath($gitRootPath) {
60
        $this->gitRootPath = $gitRootPath;
61
    }
62
63
    public function getGitRootPath() {
64
        return $this->gitRootPath;
65
    }   
66
67
    public function getDao() {
68
        return $this->dao;
69
    }
70
    public function getDriver() {
71
        return $this->driver;
72
    }
73
74
    public function canBeDeleted(GitRepository $repository) {
75
        return ($this->getDao()->hasChild($repository) !== true);
76
    }
77
78
    public function markAsDeleted(GitRepository $repository) {
79
        $this->getDao()->delete($repository);
80
    }
81
82
    public function delete(GitRepository $repository) {
83
        $path = $this->getGitRootPath().DIRECTORY_SEPARATOR.$repository->getPath();        
84
        $this->archive($repository);
85
        $this->getDriver()->delete($path);
86
    }
87
88
    public function save($repository) {
89
        $path          = Git_Backend_Interface::GIT_ROOT_PATH .'/'.$repository->getPath();
90
        $fsDescription = $this->getDriver()->getDescription($path);
91
        $description   = $repository->getDescription();
92
        if ( $description != $fsDescription ) {
93
            $this->getDriver()->setDescription( $path, $description );
94
        }
95
        $this->getDao()->save($repository);
96
    }
97
98
    public function renameProject(Project $project, $newName) {
99
        if (is_dir(Git_Backend_Interface::GIT_ROOT_PATH .'/'.$project->getUnixName())) {
100
            return rename(Git_Backend_Interface::GIT_ROOT_PATH .'/'.$project->getUnixName(), Git_Backend_Interface::GIT_ROOT_PATH .'/'.$newName);
101
        }
102
        return true;
103
    }
104
105
    public function isInitialized(GitRepository $repository) {
106
        $masterExists = $this->getDriver()->masterExists( $this->getGitRootPath().'/'.$repository->getPath() );
107
        if ( $masterExists ) {
108
            $this->getDao()->initialize( $repository->getId() );
109
            return true;
110
        } else {
111
            return false;
112
        }
113
    }
114
115
    /**
116
     *
117
     * @param GitRepository $respository
0 ignored issues
show
There is no parameter named $respository. Did you maybe mean $repository?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit.

Consider the following example. The parameter $ireland is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $ireland
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was changed, but the annotation was not.

Loading history...
118
     * @return bool
119
     */
120
    public function isCreated(GitRepository $repository) {
121
        return $this->getDriver()->isRepositoryCreated($this->getGitRootPath().'/'.$repository->getPath());
122
    }
123
124
    public function changeRepositoryAccess($repository) {
125
        $access   = $repository->getAccess();
126
        $repoPath = $repository->getPath();
127
        $path     = Git_Backend_Interface::GIT_ROOT_PATH .'/'.$repoPath;        
128
        $this->getDriver()->setRepositoryAccess($path, $access);
129
        $this->getDao()->save($repository);
130
        return true;
131
    }
132
133
    /**
134
     * Allow the update of the mail prefix
135
     *
136
     * @param GitRepository $repository
137
     */
138
    public function changeRepositoryMailPrefix($repository) {
139
        if ($this->getDao()->save($repository)) {
140
            $path = $this->getGitRootPath().$repository->getPath();
141
            $this->getDriver()->setConfig($path, 'hooks.emailprefix', $repository->getMailPrefix());
142
            $this->setUpMailingHook($repository);
143
            return true;
144
        }
145
        return false;
146
    }
147
148
    /**
149
     * Update list of people notified by post-receive-email hook
150
     *
151
     * @param GitRepository $repository
152
     */
153
    public function changeRepositoryMailingList($repository) {
154
        $path = $this->getGitRootPath().$repository->getPath();
155
        $this->getDriver()->setConfig($path, 'hooks.mailinglist', implode(',', $repository->getNotifiedMails()));
156
        $this->setUpMailingHook($repository);
157
        return true;
158
    }
159
160
    /**
161
     * Deploy post-receive hook into the target file
162
     *
163
     * @param String $path Path to the repository root
164
     *
165
     * @return void
166
     */
167
    public function deployPostReceive($path) {
168
        $this->getDriver()->activateHook('post-receive', $path);
169
        $hook = '. '.$GLOBALS['sys_pluginsroot'].'git/hooks/post-receive 2>/dev/null';
170
        $this->addBlock($path.'/hooks/post-receive', $hook);
171
    }
172
173
    /**
174
     * Configure mail output to link commit to gitweb 
175
     *
176
     * @param GitRepository $repository
177
     */
178
    public function setUpMailingHook($repository) {
179
        $path     = $this->getGitRootPath().$repository->getPath();
180
        $show_rev = $repository->getPostReceiveShowRev($this->url_manager);
181
        $this->getDriver()->setConfig($path, 'hooks.showrev', $show_rev);
182
    }
183
184
185
    /**
186
     * INTERNAL METHODS
187
     */
188
189
    protected function setRepositoryPermissions($repository) {
190
        $path = $this->getGitRootPath().DIRECTORY_SEPARATOR.$repository->getPath();   
191
        $this->recurseChownChgrp($path, 'codendiadm',$repository->getProject()->getUnixName() );
192
        return true;
193
    }
194
195
    protected function createGitRoot() {
196
        $gitRootPath    = $this->getGitRootPath();        
197
        //create the gitroot directory
198
        if ( !is_dir($gitRootPath) ) {
199
            if ( !mkdir($gitRootPath, 0755) ) {
200
                throw new GitBackendException( $GLOBALS['Language']->getText('plugin_git', 'backend_gitroot_mkdir_error').' -> '.$gitRootPath );
201
            }            
202
        }
203
        return true;
204
    }
205
206
    //TODO : public project
207
    protected function createProjectRoot($repository) {
208
        $gitProjectPath = $this->getGitRootPath().DIRECTORY_SEPARATOR.$repository->getRootPath();
209
        $groupName      = $repository->getProject()->getUnixName();
210
        if ( !is_dir($gitProjectPath) ) {
211
212
            if ( !mkdir($gitProjectPath, 0775, true) ) {
213
                throw new GitBackendException($GLOBALS['Language']->getText('plugin_git', 'backend_projectroot_mkdir_error').' -> '.$gitProjectPath);
214
            }
215
216
            if ( !$this->chgrp($gitProjectPath, $groupName ) ) {
217
                throw new GitBackendException($GLOBALS['Language']->getText('plugin_git', 'backend_projectroot_chgrp_error').$gitProjectPath.' group='.$groupName);
218
            }            
219
        }
220
        return true;
221
    }
222
223
    /**
224
     *@todo move the archive to another directory
225
     * @param <type> $repository
0 ignored issues
show
The doc-type <type> could not be parsed: Unknown type name "<" at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
226
     * @return <type>
0 ignored issues
show
The doc-type <type> could not be parsed: Unknown type name "<" at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
227
     */
228
    public function archive(GitRepository $repository) {
229
        chdir( $this->getGitRootPath() );
230
        $path = $repository->getPath();
231
        $archiveName = $repository->getBackupPath().'.tar.bz2';
232
        $cmd    = ' tar cjf '.$archiveName.' '.$path.' 2>&1';
233
        $rcode  = 0 ;
234
        $output = $this->system( $cmd, $rcode );        
235
        if ( $rcode != 0 ) {
236
            throw new GitBackendException($cmd.' -> '.$output);
237
        }
238
        if ( !empty($this->gitBackupDir) && is_dir($this->gitBackupDir) ) {
239
            $this->system( 'mv '.$this->getGitRootPath().'/'.$archiveName.' '.$this->gitBackupDir.'/'.$archiveName );
240
        }
241
        return true;
242
    }    
243
244
    /**
245
     * Verify if given name is not already reserved on filesystem
246
     */
247
    public function isNameAvailable($newName) {
248
        return ! $this->fileExists(Git_Backend_Interface::GIT_ROOT_PATH .'/'.$newName);
249
    }
250
251
    /**
252
     * Return URL to access the respository for remote git commands
253
     *
254
     * @param  GitRepository $repository
255
     * @return String
256
     */
257
    public function getAccessURL(GitRepository $repository) {
258
        $serverName  = $_SERVER['SERVER_NAME'];
259
        $user = UserManager::instance()->getCurrentUser();
260
        return array('ssh' => $user->getUserName() .'@'. $serverName .':/gitroot/'. $repository->getProject()->getUnixName().'/'.$repository->getName().'.git');
261
        
262
    }
263
264
    /**
265
     * Test is user can read the content of this repository and metadata
266
     *
267
     * @param PFUser          $user       The user to test
268
     * @param GitRepository $repository The repository to test
269
     *
270
     * @return Boolean
271
     */
272
    public function userCanRead($user, $repository) {
273
        if ($repository->isPrivate() && $user->isMember($repository->getProjectId())) {
274
            return true;
275
        }
276
        if ($repository->isPublic()) {
277
            if ($user->isRestricted() && $user->isMember($repository->getProjectId())) {
278
                return true;
279
            }
280
            if (!$user->isAnonymous()) {
281
                return true;
282
            }
283
        }
284
        return false;
285
    }
286
    
287
    /**
288
     * Obtain statistics about backend format for CSV export
289
     *
290
     * @param Statistics_Formatter $formatter instance of statistics formatter class
291
     *
292
     * @return String
293
     */
294
    public function getBackendStatistics(Statistics_Formatter $formatter) {
295
        $dao = $this->getDao();
296
        $formatter->clearContent();
297
        $formatter->addEmptyLine();
298
        $formatter->addHeader('Git');
299
        $gitShellIndex[]       = $GLOBALS['Language']->getText('plugin_statistics', 'scm_month');
300
        $gitShell[]            = "Git shell created repositories";
301
        $gitShellActiveIndex[] = $GLOBALS['Language']->getText('plugin_statistics', 'scm_month');
302
        $gitShellActive[]      = "Git shell created repositories (still active)";
303
        $gitoliteIndex[]       = $GLOBALS['Language']->getText('plugin_statistics', 'scm_month');
304
        $gitolite[]            = "Gitolite created repositories";
305
        $gitoliteActiveIndex[] = $GLOBALS['Language']->getText('plugin_statistics', 'scm_month');
306
        $gitoliteActive[]      = "Gitolite created repositories (still active)";
307
        $this->fillBackendStatisticsByType($formatter, 'gitshell', $gitShellIndex,       $gitShell,       false);
308
        $this->fillBackendStatisticsByType($formatter, 'gitshell', $gitShellActiveIndex, $gitShellActive, true);
309
        $this->fillBackendStatisticsByType($formatter, 'gitolite', $gitoliteIndex,       $gitolite,       false);
310
        $this->fillBackendStatisticsByType($formatter, 'gitolite', $gitoliteActiveIndex, $gitoliteActive, true);
311
        $this->retrieveLoggedPushesStatistics($formatter);
312
        $content = $formatter->getCsvContent();
313
        $formatter->clearContent();
314
        return $content;
315
    }
316
317
    /**
318
     * Fill statistics by Backend type
319
     *
320
     * @param Statistics_Formatter $formatter   instance of statistics formatter class
321
     * @param String               $type        backend type
322
     * @param Array                $typeIndex   backend type index
323
     * @param Array                $typeArray   backend type array
324
     * @param Boolean              $keepedAlive keep only reposirtories that still active
325
     *
326
     * @return Void
327
     */
328
    private function fillBackendStatisticsByType(Statistics_Formatter $formatter, $type, $typeIndex, $typeArray, $keepedAlive) {
329
        $dao = $this->getDao();
330
        $dar = $dao->getBackendStatistics($type, $formatter->startDate, $formatter->endDate, $formatter->groupId, $keepedAlive);
331
        if ($dar && !$dar->isError() && $dar->rowCount() > 0) {
332
            foreach ($dar as $row) {
333
                $typeIndex[] = $row['month']." ".$row['year'];
334
                $typeArray[]      = intval($row['count']);
335
            }
336
            $formatter->addLine($typeIndex);
337
            $formatter->addLine($typeArray);
338
            $formatter->addEmptyLine();
339
        }
340
    }
341
342
    /**
343
     * Retrieve logged pushes statistics for CSV export
344
     *
345
     * @param Statistics_Formatter $formatter instance of statistics formatter class
346
     *
347
     * @return Void
348
     */
349
    private function retrieveLoggedPushesStatistics(Statistics_Formatter $formatter) {
350
        $gitIndex[]   = $GLOBALS['Language']->getText('plugin_statistics', 'scm_month');
351
        $gitPushes[]  = $GLOBALS['Language']->getText('plugin_statistics', 'scm_git_total_pushes');
352
        $gitCommits[] = $GLOBALS['Language']->getText('plugin_statistics', 'scm_git_total_commits');
353
        $gitUsers[]   = $GLOBALS['Language']->getText('plugin_statistics', 'scm_git_users');
354
        $gitRepo[]    = $GLOBALS['Language']->getText('plugin_statistics', 'scm_git_repositories');
355
356
        $gitLogDao = new Git_LogDao();
357
        $dar       = $gitLogDao->totalPushes($formatter->startDate, $formatter->endDate, $formatter->groupId);
358
        if ($dar && !$dar->isError() && $dar->rowCount() > 0) {
359
            foreach ($dar as $row) {
360
                $gitIndex[]   = $row['month']." ".$row['year'];
361
                $gitPushes[]  = intval($row['pushes_count']);
362
                $gitCommits[] = intval($row['commits_count']);
363
                $gitUsers[]   = intval($row['users']);
364
                $gitRepo[]    = intval($row['repositories']);
365
            }
366
            $formatter->addLine($gitIndex);
367
            $formatter->addLine($gitPushes);
368
            $formatter->addLine($gitCommits);
369
            $formatter->addLine($gitUsers);
370
            $formatter->addLine($gitRepo);
371
        }
372
    }
373
374
    public function getAllowedCharsInNamePattern() {
375
        throw new Exception('not implemented');
376
    }
377
378
    public function isNameValid($name) {
379
        throw new Exception('not implemented');
380
    }
381
382
    public function deleteArchivedRepository(GitRepository $repository) {
383
384
    }
385
386
    /**
387
     * Move the archived gitolite repositories to the archiving area before purge
388
     *
389
     * @param GitRepository $repository
390
     */
391
    public function archiveBeforePurge(GitRepository $repository) {
392
        throw new Exception('not implemented');
393
    }
394
}
395