Issues in WebDAVTree.class.php (master) - Issues in master - Enalean/tuleap - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4873)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

plugins/webdav/include/WebDAVTree.class.php (1 issue)

Labels

Unused Code 1

Severity

Minor 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * Copyright (c) STMicroelectronics, 2010. All Rights Reserved.
 *
 * This file is a part of Codendi.
 *
 * Codendi is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * Codendi is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with Codendi. If not, see <http://www.gnu.org/licenses/>.
 */

/**
 * This is the WebDAV server tree it implements Sabre_DAV_ObjectTree to rewrite some methods
 */
class WebDAVTree extends Sabre_DAV_ObjectTree {

    /**
     * Tests if the release destination is a package
     * we allow moving releases only within the same project
     *
     * @param WebDAVFRSRelease $release
     * @param mixed $destination
     *
     * @return boolean
     */
    function releaseCanBeMoved($release, $destination) {
        return (($destination instanceof WebDAVFRSPackage)
        && ($release->getProject()->getGroupId() == $destination->getProject()->getGroupId()));
    }

    /**
     * Tests if the file destination is a release
     * we allow moving files only within the same project
     *
     * @param WebDAVFRSFile $file
     * @param mixed $destination
     *
     * @return boolean
     */
    function fileCanBeMoved($file, $destination) {
        return (($destination instanceof WebDAVFRSRelease)
        && ($file->getProject()->getGroupId() == $destination->getProject()->getGroupId()));
    }

    /**
     * Tests if the node can be moved or not
     *
     * @param mixed $source
     * @param mixed $destination
     *
     * @return boolean
     */
    function canBeMoved($source, $destination) {
        return(($source instanceof WebDAVFRSRelease && $this->releaseCanBeMoved($source, $destination))
        || ($source instanceof WebDAVFRSFile && $this->fileCanBeMoved($source, $destination)));
    }

    /**
     * Copy a docman item
     * We don't allow copying docman items from a project to another
     * We don't allow copying FRS items
     *
     * Copy or move of items is disabled as of today, because we need more feedback on
     * how basic (create/update/delete) features works before allowing it.
     *
     * @param String $sourcePath
     * @param String $destinationPath
     *
     * @return void
     */
    public function copy($sourcePath, $destinationPath) {
        throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
        
        // Check that write access is enabled for WebDAV
        /*if ($this->getUtils()->isWriteEnabled()) {
            list($destinationDir, $destinationName) = Sabre_DAV_URLUtil::splitPath($destinationPath);
            $destination = $this->getNodeForPath($destinationDir);
            $source = $this->getNodeForPath($sourcePath);
            // Check that the source is a docman item & the destination is a docman folder
            if ($destination instanceof WebDAVDocmanFolder
                && ($source instanceof WebDAVDocmanFolder || $source instanceof WebDAVDocmanDocument)) {
                // Check that the items are in the same project
                $sourceItem = $source->getItem();
                $destinationItem = $destination->getItem();
                if ($sourceItem->getGroupId() == $destinationItem->getGroupId()) {
                    // Check user permissions
                    $user = $source->getUser();
                    $docmanPermissionManager = $this->getUtils()->getDocmanPermissionsManager($source->getProject());
                    if ($docmanPermissionManager->userCanAccess($user, $sourceItem->getId())
                        && $docmanPermissionManager->userCanWrite($user, $destinationItem->getId())) {
                        $dataRoot = $this->getUtils()->getDocmanRoot();
                        $itemFactory = $this->getUtils()->getDocmanItemFactory();
                        $itemFactory->cloneItems($sourceItem->getGroupId(),
                                                 $destinationItem->getGroupId(),
                                                 $user,
                                                 array(),
                                                 true,
                                                 $dataRoot,
                                                 $sourceItem->getId(),
                                                 $destinationItem->getId(),
                                                 1);
                    } else {
                        throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_denied_copy'));
                    }
                } else {
                    throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_projects_copy'));
                }
            } else {
                throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_bad_item'));
            }
        } else {
            throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
        }*/
    }

    /**
     * This method moves nodes from location to another
     *
     * Move only allowed to rename a file in a given release. Otherwise as this
     * operation is not yet well supported by the FRS itself we cannot implement
     * it the right way.
     *
     * @return void
     *
     * @see lib/Sabre/DAV/Sabre_DAV_Tree#move($sourcePath, $destinationPath)
     */
    public function move($sourcePath, $destinationPath) {
        list($sourceDir, $sourceName) = Sabre_DAV_URLUtil::splitPath($sourcePath);
<?php

function returnThreeValues() {
    return array('a', 'b', 'c');
}

list($a, $b, $c) = returnThreeValues();

print $a . " - " . $c;
        list($destinationDir, $destinationName) = Sabre_DAV_URLUtil::splitPath($destinationPath);

        $source = $this->getNodeForPath($sourcePath);
        $itemFactory = $this->getUtils()->getDocmanItemFactory();
        $destination = $this->getNodeForPath($destinationDir);
        // Check that write access is enabled for WebDAV
        if ($this->getUtils()->isWriteEnabled()) {
            if ($sourceDir === $destinationDir) {
                $source->setName($destinationName);
            /*} else if ($destination instanceof WebDAVDocmanFolder
            && ($source instanceof WebDAVDocmanFolder || $source instanceof WebDAVDocmanDocument)) {
                throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
                
                $sourceItem = $source->getItem();
                $destinationItem = $destination->getItem();
                $user = $source->getUser();
                $ordering = 'beginning';
                if ($sourceItem->getGroupId() == $destinationItem->getGroupId()) {
                    $docmanPermissionManager = $this->getUtils()->getDocmanPermissionsManager($source->getProject());
                    if ($docmanPermissionManager->userCanAccess($user, $sourceItem->getId())
                    && $docmanPermissionManager->userCanWrite($user, $destinationItem->getId())) {
                        $subItemsWritable = $docmanPermissionManager->currentUserCanWriteSubItems($sourceItem->getId());
                        if($subItemsWritable) {
                            $itemFactory->setNewParent($sourceItem->getId(), $destinationItem->getId(), $ordering);
                            $event = 'plugin_docman_event_move';
                            $sourceItem->fireEvent($event, $user, $destinationItem);
                        } else {
                            throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'error_subitems_not_moved_no_w'));
                        }
                    } else {
                        throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_denied_move'));
                    }
                } else {
                    throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_projects_move'));
                }*/
            } else {
                throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'move_error'));
            }
        } else {
            throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
        }
    }

/**
     * Returns an instance of WebDAVUtils
     *
     * @return WebDAVUtils
     */
    function getUtils() {
        return WebDAVUtils::getInstance();
    }

}

?>

1			<?php
2			/**
3			* Copyright (c) STMicroelectronics, 2010. All Rights Reserved.
4			*
5			* This file is a part of Codendi.
6			*
7			* Codendi is free software; you can redistribute it and/or modify
8			* it under the terms of the GNU General Public License as published by
9			* the Free Software Foundation; either version 2 of the License, or
10			* (at your option) any later version.
11			*
12			* Codendi is distributed in the hope that it will be useful,
13			* but WITHOUT ANY WARRANTY; without even the implied warranty of
14			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15			* GNU General Public License for more details.
16			*
17			* You should have received a copy of the GNU General Public License
18			* along with Codendi. If not, see <http://www.gnu.org/licenses/>.
19			*/
20
21			/**
22			* This is the WebDAV server tree it implements Sabre_DAV_ObjectTree to rewrite some methods
23			*/
24			class WebDAVTree extends Sabre_DAV_ObjectTree {
25
26			/**
27			* Tests if the release destination is a package
28			* we allow moving releases only within the same project
29			*
30			* @param WebDAVFRSRelease $release
31			* @param mixed $destination
32			*
33			* @return boolean
34			*/
35			function releaseCanBeMoved($release, $destination) {
36			return (($destination instanceof WebDAVFRSPackage)
37			&& ($release->getProject()->getGroupId() == $destination->getProject()->getGroupId()));
38			}
39
40			/**
41			* Tests if the file destination is a release
42			* we allow moving files only within the same project
43			*
44			* @param WebDAVFRSFile $file
45			* @param mixed $destination
46			*
47			* @return boolean
48			*/
49			function fileCanBeMoved($file, $destination) {
50			return (($destination instanceof WebDAVFRSRelease)
51			&& ($file->getProject()->getGroupId() == $destination->getProject()->getGroupId()));
52			}
53
54			/**
55			* Tests if the node can be moved or not
56			*
57			* @param mixed $source
58			* @param mixed $destination
59			*
60			* @return boolean
61			*/
62			function canBeMoved($source, $destination) {
63			return(($source instanceof WebDAVFRSRelease && $this->releaseCanBeMoved($source, $destination))
64			\|\| ($source instanceof WebDAVFRSFile && $this->fileCanBeMoved($source, $destination)));
65			}
66
67			/**
68			* Copy a docman item
69			* We don't allow copying docman items from a project to another
70			* We don't allow copying FRS items
71			*
72			* Copy or move of items is disabled as of today, because we need more feedback on
73			* how basic (create/update/delete) features works before allowing it.
74			*
75			* @param String $sourcePath
76			* @param String $destinationPath
77			*
78			* @return void
79			*/
80			public function copy($sourcePath, $destinationPath) {
81			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
82
83			// Check that write access is enabled for WebDAV
84			/*if ($this->getUtils()->isWriteEnabled()) {
85			list($destinationDir, $destinationName) = Sabre_DAV_URLUtil::splitPath($destinationPath);
86			$destination = $this->getNodeForPath($destinationDir);
87			$source = $this->getNodeForPath($sourcePath);
88			// Check that the source is a docman item & the destination is a docman folder
89			if ($destination instanceof WebDAVDocmanFolder
90			&& ($source instanceof WebDAVDocmanFolder \|\| $source instanceof WebDAVDocmanDocument)) {
91			// Check that the items are in the same project
92			$sourceItem = $source->getItem();
93			$destinationItem = $destination->getItem();
94			if ($sourceItem->getGroupId() == $destinationItem->getGroupId()) {
95			// Check user permissions
96			$user = $source->getUser();
97			$docmanPermissionManager = $this->getUtils()->getDocmanPermissionsManager($source->getProject());
98			if ($docmanPermissionManager->userCanAccess($user, $sourceItem->getId())
99			&& $docmanPermissionManager->userCanWrite($user, $destinationItem->getId())) {
100			$dataRoot = $this->getUtils()->getDocmanRoot();
101			$itemFactory = $this->getUtils()->getDocmanItemFactory();
102			$itemFactory->cloneItems($sourceItem->getGroupId(),
103			$destinationItem->getGroupId(),
104			$user,
105			array(),
106			true,
107			$dataRoot,
108			$sourceItem->getId(),
109			$destinationItem->getId(),
110			1);
111			} else {
112			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_denied_copy'));
113			}
114			} else {
115			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_projects_copy'));
116			}
117			} else {
118			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_bad_item'));
119			}
120			} else {
121			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
122			}*/
123			}
124
125			/**
126			* This method moves nodes from location to another
127			*
128			* Move only allowed to rename a file in a given release. Otherwise as this
129			* operation is not yet well supported by the FRS itself we cannot implement
130			* it the right way.
131			*
132			* @return void
133			*
134			* @see lib/Sabre/DAV/Sabre_DAV_Tree#move($sourcePath, $destinationPath)
135			*/
136			public function move($sourcePath, $destinationPath) {
137			list($sourceDir, $sourceName) = Sabre_DAV_URLUtil::splitPath($sourcePath);
			0 ignored issues – show Unused Code introduced 2015-12-16 20:30 UTC by Report Bug Copy Issue Report Show Similar Issues like this The assignment to `$sourceName` is unused. Consider omitting it like so `list($first,,$third)`. This checks looks for assignemnts to variables using the `list(...)` function, where not all assigned variables are subsequently used. Consider the following code example. <?php function returnThreeValues() { return array('a', 'b', 'c'); } list($a, $b, $c) = returnThreeValues(); print $a . " - " . $c; Only the variables `$a` and `$c` are used. There was no need to assign `$b`. Instead, the list call could have been. list($a,, $c) = returnThreeValues(); Loading history...
138			list($destinationDir, $destinationName) = Sabre_DAV_URLUtil::splitPath($destinationPath);
139
140			$source = $this->getNodeForPath($sourcePath);
141			$itemFactory = $this->getUtils()->getDocmanItemFactory();
142			$destination = $this->getNodeForPath($destinationDir);
143			// Check that write access is enabled for WebDAV
144			if ($this->getUtils()->isWriteEnabled()) {
145			if ($sourceDir === $destinationDir) {
146			$source->setName($destinationName);
147			/*} else if ($destination instanceof WebDAVDocmanFolder
148			&& ($source instanceof WebDAVDocmanFolder \|\| $source instanceof WebDAVDocmanDocument)) {
149			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
150
151			$sourceItem = $source->getItem();
152			$destinationItem = $destination->getItem();
153			$user = $source->getUser();
154			$ordering = 'beginning';
155			if ($sourceItem->getGroupId() == $destinationItem->getGroupId()) {
156			$docmanPermissionManager = $this->getUtils()->getDocmanPermissionsManager($source->getProject());
157			if ($docmanPermissionManager->userCanAccess($user, $sourceItem->getId())
158			&& $docmanPermissionManager->userCanWrite($user, $destinationItem->getId())) {
159			$subItemsWritable = $docmanPermissionManager->currentUserCanWriteSubItems($sourceItem->getId());
160			if($subItemsWritable) {
161			$itemFactory->setNewParent($sourceItem->getId(), $destinationItem->getId(), $ordering);
162			$event = 'plugin_docman_event_move';
163			$sourceItem->fireEvent($event, $user, $destinationItem);
164			} else {
165			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'error_subitems_not_moved_no_w'));
166			}
167			} else {
168			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_denied_move'));
169			}
170			} else {
171			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'docman_item_projects_move'));
172			}*/
173			} else {
174			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'move_error'));
175			}
176			} else {
177			throw new Sabre_DAV_Exception_MethodNotAllowed($GLOBALS['Language']->getText('plugin_webdav_common', 'write_access_disabled'));
178			}
179			}
180
181			/**
182			* Returns an instance of WebDAVUtils
183			*
184			* @return WebDAVUtils
185			*/
186			function getUtils() {
187			return WebDAVUtils::getInstance();
188			}
189
190			}
191
192			?>

GitHub Access Token became invalid

Issues (4873)

Security Analysis not enabled

plugins/webdav/include/WebDAVTree.class.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Enalean / tuleap

GitHub Access Token became invalid

Issues (4873)

Security Analysis not enabled

plugins/webdav/include/WebDAVTree.class.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like