GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (4873)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

plugins/hudson/include/hudsonPlugin.class.php (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * @copyright Copyright (c) Xerox Corporation, Codendi 2007-2008.
4
 *
5
 * This file is licensed under the GNU General Public License version 2. See the file COPYING.
6
 * 
7
 * @author Marc Nazarian <[email protected]>
8
 *
9
 * HudsonPlugin
10
 */
11
12
require_once 'autoload.php';
13
14
class hudsonPlugin extends Plugin {
15
16
    function __construct($id) {
17
        parent::__construct($id);
18
        $this->_addHook('javascript_file', 'jsFile', false);
19
        $this->_addHook('cssfile', 'cssFile', false);
20
        $this->addHook(Event::SERVICE_ICON);
21
        $this->addHook(Event::SERVICES_ALLOWED_FOR_PROJECT);
22
        
23
        $this->_addHook('project_is_deleted', 'projectIsDeleted', false);
24
        
25
        $this->_addHook('widget_instance', 'widget_instance', false);
26
        $this->_addHook('widgets', 'widgets', false);
27
        
28
        $this->_addHook('get_available_reference_natures', 'getAvailableReferenceNatures', false);
29
        $this->_addHook('ajax_reference_tooltip', 'ajax_reference_tooltip', false);
30
        $this->_addHook(Event::AJAX_REFERENCE_SPARKLINE, 'ajax_reference_sparkline', false);
31
        $this->_addHook('statistics_collector',          'statistics_collector',       false);
32
    }
33
34
    function getPluginInfo() {
35
        if (!is_a($this->pluginInfo, 'hudsonPluginInfo')) {
36
            require_once('hudsonPluginInfo.class.php');
37
            $this->pluginInfo = new hudsonPluginInfo($this);
38
        }
39
        return $this->pluginInfo;
40
    }
41
42
    public function getServiceShortname() {
43
        return 'hudson';
44
    }
45
46
    public function service_icon($params) {
47
        $params['list_of_icon_unicodes'][$this->getServiceShortname()] = '\e811';
48
    }
49
    
50
    function cssFile($params) {
51
        // Only show the stylesheet if we're actually in the hudson pages.
52
        // This stops styles inadvertently clashing with the main site.
53
        if (strpos($_SERVER['REQUEST_URI'], $this->getPluginPath()) === 0 ||
54
            strpos($_SERVER['REQUEST_URI'], '/my/') === 0 ||
55
            strpos($_SERVER['REQUEST_URI'], '/projects/') === 0 ||
56
            strpos($_SERVER['REQUEST_URI'], '/widgets/') === 0 
57
        ) {
58
            echo '<link rel="stylesheet" type="text/css" href="'.$this->getThemePath().'/css/style.css" />';
59
        }
60
    }
61
    
62
    function jsFile($params) {
63
        // Only include the js files if we're actually in the IM pages.
64
        // This stops styles inadvertently clashing with the main site.
65
        if (strpos($_SERVER['REQUEST_URI'], $this->getPluginPath()) === 0) {
66
            echo '<script type="text/javascript" src="/scripts/scriptaculous/scriptaculous.js"></script>'."\n";
67
            echo '<script type="text/javascript" src="js/hudson_tab.js"></script>'."\n";
68
            echo '<script type="text/javascript" src="js/form.js"></script>'."\n";
69
        }
70
    }
71
    
72
    /**
73
     * When a project is deleted,
74
     * we delete all the hudson jobs of this project
75
     *
76
     * @param mixed $params ($param['group_id'] the ID of the deleted project)
77
     */
78
    function projectIsDeleted($params) {
79
        $group_id = $params['group_id'];
80
        $job_dao = new PluginHudsonJobDao(CodendiDataAccess::instance());
81
        $dar = $job_dao->deleteHudsonJobsByGroupID($group_id);
82
    }
83
84
    
85
    protected $hudsonJobFactory = null;
86
    
87
    protected function getHudsonJobFactory() {
88
        if (!$this->hudsonJobFactory) {
89
            $this->hudsonJobFactory = new HudsonJobFactory();
90
        }
91
        return $this->hudsonJobFactory;
92
    }
93
    
94
    function widget_instance($params) {
95
        require_once('common/widget/WidgetLayoutManager.class.php');
96
        
97
        $user = UserManager::instance()->getCurrentUser();
98
        $hf   = $this->getHudsonJobFactory();
99
        // MY
100
        if ($params['widget'] == 'plugin_hudson_my_jobs') {
101
            require_once('hudson_Widget_MyMonitoredJobs.class.php');
102
            $params['instance'] = new hudson_Widget_MyMonitoredJobs($user->getId(), $this, $hf);
103
        }
104
        if ($params['widget'] == 'plugin_hudson_my_joblastbuilds') {
105
            require_once('hudson_Widget_JobLastBuilds.class.php');
106
            $params['instance'] = new hudson_Widget_JobLastBuilds(WidgetLayoutManager::OWNER_TYPE_USER, $user->getId(), $hf);
107
        }
108
        if ($params['widget'] == 'plugin_hudson_my_jobtestresults') {
109
            require_once('hudson_Widget_JobTestResults.class.php');
110
            $params['instance'] = new hudson_Widget_JobTestResults(WidgetLayoutManager::OWNER_TYPE_USER, $user->getId(), $hf);
111
        }
112
        if ($params['widget'] == 'plugin_hudson_my_jobtesttrend') {
113
            require_once('hudson_Widget_JobTestTrend.class.php');
114
            $params['instance'] = new hudson_Widget_JobTestTrend(WidgetLayoutManager::OWNER_TYPE_USER, $user->getId(), $hf);
115
        }
116
        if ($params['widget'] == 'plugin_hudson_my_jobbuildhistory') {
117
            require_once('hudson_Widget_JobBuildHistory.class.php');
118
            $params['instance'] = new hudson_Widget_JobBuildHistory(WidgetLayoutManager::OWNER_TYPE_USER, $user->getId(), $hf);
119
        }
120
        if ($params['widget'] == 'plugin_hudson_my_joblastartifacts') {
121
            require_once('hudson_Widget_JobLastArtifacts.class.php');
122
            $params['instance'] = new hudson_Widget_JobLastArtifacts(WidgetLayoutManager::OWNER_TYPE_USER, $user->getId(), $hf);
123
        }
124
        
125
        // PROJECT
126
        if ($params['widget'] == 'plugin_hudson_project_jobsoverview') {
127
            require_once('hudson_Widget_ProjectJobsOverview.class.php');
128
            $params['instance'] = new hudson_Widget_ProjectJobsOverview($GLOBALS['group_id'], $this, $hf);
129
        }
130
        if ($params['widget'] == 'plugin_hudson_project_joblastbuilds') {
131
            require_once('hudson_Widget_JobLastBuilds.class.php');
132
            $params['instance'] = new hudson_Widget_JobLastBuilds(WidgetLayoutManager::OWNER_TYPE_GROUP, $GLOBALS['group_id'], $hf);
133
        }
134
        if ($params['widget'] == 'plugin_hudson_project_jobtestresults') {
135
            require_once('hudson_Widget_JobTestResults.class.php');
136
            $params['instance'] = new hudson_Widget_JobTestResults(WidgetLayoutManager::OWNER_TYPE_GROUP, $GLOBALS['group_id'], $hf);
137
        }
138
        if ($params['widget'] == 'plugin_hudson_project_jobtesttrend') {
139
            require_once('hudson_Widget_JobTestTrend.class.php');
140
            $params['instance'] = new hudson_Widget_JobTestTrend(WidgetLayoutManager::OWNER_TYPE_GROUP, $GLOBALS['group_id'], $hf);
141
        }
142
        if ($params['widget'] == 'plugin_hudson_project_jobbuildhistory') {
143
            require_once('hudson_Widget_JobBuildHistory.class.php');
144
            $params['instance'] = new hudson_Widget_JobBuildHistory(WidgetLayoutManager::OWNER_TYPE_GROUP, $GLOBALS['group_id'], $hf);
145
        }
146
        if ($params['widget'] == 'plugin_hudson_project_joblastartifacts') {
147
            require_once('hudson_Widget_JobLastArtifacts.class.php');
148
            $params['instance'] = new hudson_Widget_JobLastArtifacts(WidgetLayoutManager::OWNER_TYPE_GROUP, $GLOBALS['group_id'], $hf);
149
        }
150
    }
151
    function widgets($params) {
152
        require_once('common/widget/WidgetLayoutManager.class.php');
153
        if ($params['owner_type'] == WidgetLayoutManager::OWNER_TYPE_USER) {
154
            $params['codendi_widgets'][] = 'plugin_hudson_my_jobs';
155
            $params['codendi_widgets'][] = 'plugin_hudson_my_joblastbuilds';
156
            $params['codendi_widgets'][] = 'plugin_hudson_my_jobtestresults';
157
            $params['codendi_widgets'][] = 'plugin_hudson_my_jobtesttrend';
158
            $params['codendi_widgets'][] = 'plugin_hudson_my_jobbuildhistory';
159
            $params['codendi_widgets'][] = 'plugin_hudson_my_joblastartifacts';
160
        }
161
        if ($params['owner_type'] == WidgetLayoutManager::OWNER_TYPE_GROUP) {
162
            $params['codendi_widgets'][] = 'plugin_hudson_project_jobsoverview';
163
            $params['codendi_widgets'][] = 'plugin_hudson_project_joblastbuilds';
164
            $params['codendi_widgets'][] = 'plugin_hudson_project_jobtestresults';
165
            $params['codendi_widgets'][] = 'plugin_hudson_project_jobtesttrend';
166
            $params['codendi_widgets'][] = 'plugin_hudson_project_jobbuildhistory';
167
            $params['codendi_widgets'][] = 'plugin_hudson_project_joblastartifacts';
168
        }
169
    }
170
    
171
    function getAvailableReferenceNatures($params) {
172
        $hudson_plugin_reference_natures = array(
173
            'hudson_build'  => array('keyword' => 'build', 'label' => $GLOBALS['Language']->getText('plugin_hudson', 'reference_build_nature_key')),
174
            'hudson_job' => array('keyword' => 'job', 'label' => $GLOBALS['Language']->getText('plugin_hudson', 'reference_job_nature_key')));
175
        $params['natures'] = array_merge($params['natures'], $hudson_plugin_reference_natures);
176
    }
177
    
178
    function ajax_reference_tooltip($params) {
179
        require_once('HudsonJob.class.php');
180
        require_once('HudsonBuild.class.php');
181
        require_once('hudson_Widget_JobLastBuilds.class.php');
182
        
183
        $ref = $params['reference'];
184
        switch ($ref->getNature()) {
185
            case 'hudson_build':
186
                $val = $params['val'];
187
                $group_id = $params['group_id'];
188
                $job_dao = new PluginHudsonJobDao(CodendiDataAccess::instance());
189
                if (strpos($val, "/") !== false) {
190
                    $arr = explode("/", $val);
191
                    $job_name = $arr[0];
192
                    $build_id = $arr[1];
193
                    $dar = $job_dao->searchByJobName($job_name, $group_id);
194
                } else {
195
                    $build_id = $val; 
196
                    $dar = $job_dao->searchByGroupID($group_id);
197
                    if ($dar->rowCount() != 1) {
198
                        $dar = null;
199
                    }
200
                }
201
                if ($dar && $dar->valid()) {
202
                    $row = $dar->current();
203
                    $build = new HudsonBuild($row['job_url'].'/'.$build_id.'/');
204
                    echo '<strong>' . $GLOBALS['Language']->getText('plugin_hudson', 'build_time') . '</strong> ' . $build->getBuildTime() . '<br />'; 
205
                    echo '<strong>' . $GLOBALS['Language']->getText('plugin_hudson', 'status') . '</strong> ' . $build->getResult();
206
                } else {
207
                    echo '<span class="error">'.$GLOBALS['Language']->getText('plugin_hudson','error_object_not_found').'</span>';
208
                }
209
                break;
210
            case 'hudson_job':
211
                $job_dao = new PluginHudsonJobDao(CodendiDataAccess::instance());
212
                $job_name = $params['val'];
213
                $group_id = $params['group_id'];
214
                $dar = $job_dao->searchByJobName($job_name, $group_id);
215
                if ($dar->valid()) {
216
                    $row = $dar->current();
217
                    try {
218
                        $job = new HudsonJob($row['job_url']);
219
                        $job_id = $row['job_id'];
220
                        $html = '';
221
                        $html .= '<table>';
222
                        $html .= ' <tr>';
223
                        $html .= '  <td colspan="2">';
224
                        $html .= '   <img src="'.$job->getStatusIcon().'" width="10" height="10" /> '.$job->getName().':';
225
                        $html .= '  </td>';
226
                        $html .= ' </tr>';
227
                        $html .= ' <tr>';
228
                        $html .= '  <td>';
229
                        $html .= '   <ul>';
230
                        if ($job->hasBuilds()) {
231
                            $html .= ' <li>'.$GLOBALS['Language']->getText('plugin_hudson', 'last_build').' <a href="/plugins/hudson/?action=view_build&group_id='.$group_id.'&job_id='.$job_id.'&build_id='.$job->getLastBuildNumber().'"># '.$job->getLastBuildNumber().'</a></li>';
232
                            $html .= ' <li>'.$GLOBALS['Language']->getText('plugin_hudson', 'last_build_success').' <a href="/plugins/hudson/?action=view_build&group_id='.$group_id.'&job_id='.$job_id.'&build_id='.$job->getLastSuccessfulBuildNumber().'"># '.$job->getLastSuccessfulBuildNumber().'</a></li>';
233
                            $html .= ' <li>'.$GLOBALS['Language']->getText('plugin_hudson', 'last_build_failure').' <a href="/plugins/hudson/?action=view_build&group_id='.$group_id.'&job_id='.$job_id.'&build_id='.$job->getLastFailedBuildNumber().'"># '.$job->getLastFailedBuildNumber().'</a></li>';
234
                        } else {
235
                            $html .= ' <li>'. $GLOBALS['Language']->getText('plugin_hudson', 'widget_build_not_found') . '</li>';
236
                        }
237
                        $html .= '   </ul>';
238
                        $html .= '  </td>';
239
                        $html .= '  <td class="widget_lastbuilds_weather">';
240
                        $html .= $GLOBALS['Language']->getText('plugin_hudson', 'weather_report').'<img src="'.$job->getWeatherReportIcon().'" align="middle" />';
241
                        $html .= '  </td>';
242
                        $html .= ' </tr>';
243
                        $html .= '</table>';  
244
                        echo $html;    
245
                    } catch (Exception $e) {
0 ignored issues
show
Coding Style Comprehensibility introduced by
Consider adding a comment why this CATCH block is empty.
Loading history...
246
                    }
247
                } else {
248
                    echo '<span class="error">'.$GLOBALS['Language']->getText('plugin_hudson','error_object_not_found').'</span>';
249
                }
250
                break;
251
        }
252
    }
253
    
254
    function ajax_reference_sparkline($params) {
255
        require_once('HudsonJob.class.php');
256
        require_once('HudsonBuild.class.php');
257
        require_once('hudson_Widget_JobLastBuilds.class.php');
258
        
259
        $ref = $params['reference'];
260
        switch ($ref->getNature()) {
261
            case 'hudson_build':
262
                $val = $params['val'];
263
                $group_id = $params['group_id'];
264
                $job_dao = new PluginHudsonJobDao(CodendiDataAccess::instance());
265
                if (strpos($val, "/") !== false) {
266
                    $arr = explode("/", $val);
267
                    $job_name = $arr[0];
268
                    $build_id = $arr[1];
269
                    $dar = $job_dao->searchByJobName($job_name, $group_id);
270
                } else {
271
                    $build_id = $val; 
272
                    $dar = $job_dao->searchByGroupID($group_id);
273
                    if ($dar->rowCount() != 1) {
274
                        $dar = null;
275
                    }
276
                }
277
                if ($dar && $dar->valid()) {
278
                    $row = $dar->current();
279
                    try {
280
                        $build = new HudsonBuild($row['job_url'].'/'.$build_id.'/');
281
                        $params['sparkline'] = $build->getStatusIcon();
282
                    } catch (Exception $e) {
0 ignored issues
show
Coding Style Comprehensibility introduced by
Consider adding a comment why this CATCH block is empty.
Loading history...
283
                    }
284
                }
285
                break;
286
            case 'hudson_job':
287
                $job_dao = new PluginHudsonJobDao(CodendiDataAccess::instance());
288
                $job_name = $params['val'];
289
                $group_id = $params['group_id'];
290
                $dar = $job_dao->searchByJobName($job_name, $group_id);
291
                if ($dar->valid()) {
292
                    $row = $dar->current();
293
                    try {
294
                        $job = new HudsonJob($row['job_url']);
295
                        $params['sparkline'] = $job->getStatusIcon();
296
                    } catch (Exception $e) {
0 ignored issues
show
Coding Style Comprehensibility introduced by
Consider adding a comment why this CATCH block is empty.
Loading history...
297
                    }
298
                }
299
                break;
300
        }
301
    }
302
    
303
    function process() {
304
        require_once('hudson.class.php');
305
        $controler = new hudson();
306
        $controler->process();
307
    }
308
309
    /**
310
     * Display CI statistics in CSV format
311
     *
312
     * @param Array $params parameters of the event
313
     *
314
     * @return void
315
     */
316
    public function statistics_collector($params) {
317
        if (!empty($params['formatter'])) {
318
            $formatter = $params['formatter'];
319
            $jobDao = new PluginHudsonJobDao(CodendiDataAccess::instance());
320
            $dar = $jobDao->countJobs($formatter->groupId);
321
            $count = 0;
322
            if ($dar && !$dar->isError()) {
323
                    $row = $dar->getRow();
324
                    if ($row) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $row of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.

This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.

Consider making the comparison explicit by using empty(..) or ! empty(...) instead.

Loading history...
325
                        $count = $row['count'];
326
                    }
327
            }
328
            $formatter->clearContent();
329
            $formatter->addEmptyLine();
330
            $formatter->addLine(array($GLOBALS['Language']->getText('plugin_hudson', 'title')));
331
            $formatter->addLine(array($GLOBALS['Language']->getText('plugin_hudson', 'job_count', array(date('Y-m-d'))), $count));
332
            echo $formatter->getCsvContent();
333
            $formatter->clearContent();
334
        }
335
    }
336
337
}
338
339
?>