This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | // --src = source file path |
||
4 | // --dst = dest file path |
||
5 | |||
6 | ini_set('max_execution_time', 0); |
||
7 | ini_set('memory_limit', -1); |
||
8 | |||
9 | require_once('pre.php'); |
||
10 | require_once(dirname(__FILE__).'/../include/LDAP_UserManager.class.php'); |
||
11 | |||
12 | /** |
||
13 | * Extract parameters from user input |
||
14 | * |
||
15 | * This function reassamble user submitted values splited by PHP. PHP transform |
||
16 | * user input in an array, the cut is done on spaces (each space create a new |
||
17 | * entry, even when string is encapsulated between double quotes). |
||
18 | * The separator is -- and each argument must be like "--argname=" |
||
19 | * |
||
20 | * @param array $argv |
||
21 | * @return array |
||
22 | */ |
||
23 | function extract_params($argv) { |
||
24 | $arguments = array(); |
||
25 | for($i = 1; $i < count($argv); ++$i) { |
||
0 ignored issues
–
show
|
|||
26 | $arg = $argv[$i]; |
||
27 | // If arg start by "--" this is the beginning of a new option |
||
28 | if(strpos($arg, "--") === 0) { |
||
29 | $eqpos = strpos($arg,"="); |
||
30 | $argname=substr($arg,2, $eqpos-2); |
||
31 | $arguments[$argname] = substr($arg, $eqpos+1); |
||
32 | } else { |
||
33 | $arguments[$argname] .= " ".$arg; |
||
34 | } |
||
35 | } |
||
36 | return $arguments; |
||
37 | } |
||
38 | |||
39 | |||
40 | |||
41 | function getLdapFromUserName($username) { |
||
42 | static $list; |
||
43 | if(!isset($list[$username])) { |
||
44 | $user = UserManager::instance()->getUserByUserName($username); |
||
45 | if($user) { |
||
46 | $res = db_query('SELECT ldap_uid FROM plugin_ldap_user WHERE user_id = '.$user->getId()); |
||
47 | if(!db_error($res) && db_numrows($res) === 1) { |
||
48 | $list[$username] = strtolower(db_result($res, 0, 'ldap_uid')); |
||
49 | } else { |
||
50 | $list[$username] = false; |
||
51 | } |
||
52 | } else { |
||
53 | $list[$username] = false; |
||
54 | } |
||
55 | } |
||
56 | return $list[$username]; |
||
57 | } |
||
58 | |||
59 | /** |
||
60 | * Copy/paste adapted from svn_utils_parse_access_file in 'www/svn/svn_utils.php' |
||
61 | */ |
||
62 | function svn_utils_convert_access_file_to_ldap(LDAP_UserManager $ldapUm, $srcFileName, $dstFileName) { |
||
63 | |||
64 | $newContent = ''; |
||
65 | |||
66 | $f = fopen($srcFileName, "rb"); |
||
67 | if ($f === false) { |
||
68 | echo "** ERROR: $srcFileName: No such file or directory".PHP_EOL; |
||
69 | } else { |
||
70 | $path_pat = '/^\s*\[(.*)\]/'; // assume no repo name 'repo:' |
||
71 | $perm_pat = '/^\s*([^=]*)\s*=\s*(.*)$/'; |
||
72 | $group_pat = '/^\s*([^ ]*)\s*=\s*(.*)$/'; |
||
73 | $empty_pat = '/^\s*$/'; |
||
74 | $comment_pat = '/^\s*#/'; |
||
75 | |||
76 | $ST_START = 0; |
||
77 | $ST_GROUP = 1; |
||
78 | $ST_PATH = 2; |
||
79 | |||
80 | $state = $ST_START; |
||
81 | |||
82 | $content = file($srcFileName, FILE_IGNORE_NEW_LINES); |
||
83 | foreach($content as $line) { |
||
84 | if (preg_match($comment_pat, $line) || preg_match($empty_pat,$line)) { |
||
85 | $output = $line; |
||
86 | } else { |
||
87 | $m = preg_match($path_pat,$line,$matches); |
||
88 | if ($m) { |
||
89 | $path = $matches[1]; |
||
90 | if ($path == "groups") { |
||
91 | $state = $ST_GROUP; |
||
92 | } else { |
||
93 | $state = $ST_PATH; |
||
94 | } |
||
95 | } |
||
96 | |||
97 | if ($state == $ST_GROUP) { |
||
98 | $m = preg_match($group_pat,$line,$matches); |
||
99 | if ($m) { |
||
100 | $group = $matches[1]; |
||
101 | $users = $matches[2]; |
||
102 | |||
103 | $uarray = array_map('trim', split(",", strtolower($users))); |
||
104 | $ldapLogins = array(); |
||
105 | foreach($uarray as $user) { |
||
106 | if (strpos($user, '@') === 0) { |
||
107 | $ldapLogins[] = $user; |
||
108 | } else { |
||
109 | $lr = getLdapFromUserName($user); |
||
110 | if($lr !== false) { |
||
111 | $ldapLogins[] = $lr; |
||
112 | } |
||
113 | } |
||
114 | } |
||
115 | $output = $group.' = '.implode(', ', $ldapLogins); |
||
116 | } else { |
||
117 | $output = $line; |
||
118 | } |
||
119 | } else if ($state == $ST_PATH) { |
||
120 | $m = preg_match($perm_pat, $line, $matches); |
||
121 | if ($m) { |
||
122 | $who = $matches[1]; |
||
123 | $perm = $matches[2]; |
||
124 | |||
125 | if (strpos($who,'@') === 0) { |
||
126 | $output = $line; |
||
127 | } elseif (trim(rtrim($who)) != '*') { |
||
128 | $lr = getLdapFromUserName($who); |
||
129 | if ($lr !== false) { |
||
130 | $output = $lr.' = '.$perm; |
||
131 | } else { |
||
132 | $output = '#'.$line; |
||
133 | } |
||
134 | } else { |
||
135 | $output = $line; |
||
136 | } |
||
137 | } else { |
||
138 | $output = $line; |
||
139 | } |
||
140 | } else { |
||
141 | $output = $line; |
||
142 | } |
||
143 | } |
||
144 | |||
145 | $newContent .= $output."\n"; |
||
146 | //$line = strtok($separator); |
||
147 | } |
||
148 | //fclose($f); |
||
149 | |||
150 | // Write new file |
||
151 | $fd = fopen($dstFileName, "w"); |
||
152 | if(!$fd) { |
||
153 | echo "** ERROR: $dstFileName: Not writable".PHP_EOL; |
||
154 | } else { |
||
155 | fwrite($fd, $newContent); |
||
156 | fclose($fd); |
||
157 | } |
||
158 | } |
||
159 | } |
||
160 | |||
161 | $pluginManager = PluginManager::instance(); |
||
162 | $ldapPlugin = $pluginManager->getPluginByName('ldap'); |
||
163 | if ($ldapPlugin && $plugin_manager->isPluginAvailable($ldapPlugin)) { |
||
164 | $ldapUm = $ldapPlugin->getLdapUserManager(); |
||
165 | |||
166 | $args = extract_params($_SERVER['argv']); |
||
167 | if(isset($args['src']) && isset($args['dst'])) { |
||
168 | svn_utils_convert_access_file_to_ldap($ldapUm, $args['src'], $args['dst']); |
||
169 | } elseif(isset($args['all'])) { |
||
170 | $sql = 'SELECT groups.group_id, unix_group_name FROM groups LEFT JOIN plugin_ldap_svn_repository USING (group_id) WHERE status = "A" AND ldap_auth IS NULL'; |
||
171 | $res = db_query($sql); |
||
172 | while($row = db_fetch_array($res)) { |
||
173 | //foreach (new DirectoryIterator($args['all']) as $dirInfo) { |
||
174 | //if($dirInfo->isDot()) continue; |
||
175 | $svnaccessfile = new SplFileInfo('/svnroot/'.$row['unix_group_name'].'/.SVNAccessFile'); |
||
176 | if($svnaccessfile->isFile()) { |
||
177 | echo "Process ".$row['unix_group_name'].PHP_EOL; |
||
178 | if(copy($svnaccessfile->getPathname(), $svnaccessfile->getPathname().'.beforeldap')) { |
||
179 | svn_utils_convert_access_file_to_ldap($ldapUm, |
||
180 | $svnaccessfile->getPathname().'.beforeldap', |
||
181 | $svnaccessfile->getPathname()); |
||
182 | db_query('INSERT INTO plugin_ldap_svn_repository(group_id, ldap_auth) VALUES('.$row['group_id'].',1)'); |
||
183 | } |
||
184 | } |
||
185 | } |
||
186 | } else { |
||
187 | echo "** ERROR: either --src or --dst are missing".PHP_EOL; |
||
188 | } |
||
189 | } |
||
190 | ?> |
||
191 |
If the size of the collection does not change during the iteration, it is generally a good practice to compute it beforehand, and not on each iteration: