GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (4873)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/common/plugin/Plugin.class.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Copyright (c) Xerox Corporation, Codendi Team, 2001-2009. All rights reserved
4
 *
5
 * This file is a part of Codendi.
6
 *
7
 * Codendi is free software; you can redistribute it and/or modify
8
 * it under the terms of the GNU General Public License as published by
9
 * the Free Software Foundation; either version 2 of the License, or
10
 * (at your option) any later version.
11
 *
12
 * Codendi is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15
 * GNU General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU General Public License
18
 * along with Codendi. If not, see <http://www.gnu.org/licenses/>.
19
 */
20
21
require_once('PluginInfo.class.php');
22
23
require_once('common/collection/Map.class.php');
24
require_once('PluginManager.class.php');
25
/**
26
 * Plugin
27
 */
28
class Plugin implements PFO_Plugin {
29
    /** @var BackendLogger */
30
    private $backend_logger;
31
32
    var $id;
33
    var $pluginInfo;
34
    /** @var Map */
35
    var $hooks;
36
    protected $_scope;
37
38
    /** @var bool */
39
    private $is_custom = false;
40
41
    protected $filesystem_path = '';
42
43
    const SCOPE_SYSTEM  = 0;
44
    const SCOPE_PROJECT = 1;
45
    const SCOPE_USER    = 2;
46
    
47
    /**
48
     * @var bool True if the plugin should be disabled for all projects on installation
49
     *
50
     * Usefull only for plugins with scope == SCOPE_PROJECT
51
     */
52
    public $isRestrictedByDefault = false;
53
    
54
    /**
55
     * @var array List of allowed projects
56
     */
57
    protected $allowedForProject = array();
58
    
59
    public function Plugin($id = -1) {
60
        $this->id            = $id;
61
        $this->hooks         = new Map();
62
        
63
        $this->_scope = Plugin::SCOPE_SYSTEM;
64
    }
65
66
    /**
67
     * Callback called when the plugin is loaded
68
     *
69
     * @return void
70
     */
71
    public function loaded() {
72
    }
73
74
    public function isAllowed($group_id) {
75
        if(!isset($this->allowedForProject[$group_id])) {
76
            $this->allowedForProject[$group_id] = PluginManager::instance()->isPluginAllowedForProject($this, $group_id);
77
        }
78
        return $this->allowedForProject[$group_id];
79
    }
80
81
    /**
82
     * Hook call for @see Event::SERVICES_ALLOWED_FOR_PROJECT
83
     *
84
     * You just need to add $this->addHook(Event::SERVICES_ALLOWED_FOR_PROJECT)
85
     * to your plugin to automatically manage presence of service in projects
86
     */
87
    public function services_allowed_for_project(array $params) {
88
        $this->addServiceForProject($params['project'], $params['services']);
89
    }
90
91
    protected function addServiceForProject(Project $project, array &$services) {
92
        if ($this->isAllowed($project->getID())) {
93
            $services[] = $this->getServiceShortname();
94
        }
95
    }
96
97
    public function getId() {
98
        return $this->id;
99
    }
100
    
101
    public function getPluginInfo() {
102
        if (!is_a($this->pluginInfo, 'PluginInfo')) {
103
            $this->pluginInfo = new PluginInfo($this);
104
        }
105
        return $this->pluginInfo;
106
    }
107
    
108
    public function getHooks() {
109
        return $this->hooks->getKeys();
110
    }
111
    
112
    public function getHooksAndCallbacks() {
113
        return $this->hooks->getValues();
114
    }
115
    
116
    public function addHook($hook, $callback = null, $recallHook = false) {
117
        if ($this->hooks->containsKey($hook)) {
118
            throw new RuntimeException('A plugin cannot listen to the same hook several time. Please check '.$hook);
119
        }
120
        $value = array();
121
        $value['hook']       = $hook;
122
        $value['callback']   = $callback ? $callback : $hook;
123
        $value['recallHook'] = $recallHook;
124
        $this->hooks->put($hook, $value);
125
    }
126
    
127
    /**
128
     * @deprecated
129
     * @see addHook()
130
     */
131
    protected function _addHook($hook, $callback = null, $recallHook = false) {
132
        return $this->addHook($hook, $callback, $recallHook);
133
    }
134
135
    public function removeHook($hook) {
136
        $this->hooks->removeKey($hook);
137
    }
138
    
139
    public function CallHook($hook, $param) {
140
    }
141
    
142
    public function getScope() {
143
        return $this->_scope;
144
    }
145
146
    public function setScope($s) {
147
        $this->_scope = $s;
148
    }
149
150
    public function getPluginEtcRoot() {
151
        return $GLOBALS['sys_custompluginsroot'] . '/' . $this->getName() .'/etc';
152
    }
153
154
    public function getEtcTemplatesPath() {
155
        return $GLOBALS['sys_custompluginsroot'] . '/' . $this->getName() . '/templates';
156
    }
157
    
158
    public function _getPluginPath() {
159
        $trace = debug_backtrace();
160
        trigger_error("Plugin->_getPluginPath() is deprecated. Please use Plugin->getPluginPath() instead in ". $trace[0]['file'] ." at line ". $trace[0]['line'], E_USER_WARNING);
161
        return $this->getPluginPath();
162
    }
163
164
    /**
165
     * Return plugin's URL path from the server root
166
     *
167
     * Example: /plugins/docman
168
     *
169
     * @return String
170
     */
171
    public function getPluginPath() {
172
        $pm = $this->_getPluginManager();
173
        if (isset($GLOBALS['sys_pluginspath']))
174
            $path = $GLOBALS['sys_pluginspath'];
175
        else $path=""; 
176
        if ($pm->pluginIsCustom($this)) {
177
            $path = $GLOBALS['sys_custompluginspath'];
178
        }
179
        return $path .'/'. $this->getName();
180
    }
181
182
    public function _getThemePath() {
183
        $trace = debug_backtrace();
184
        trigger_error("Plugin->_getThemePath() is deprecated. Please use Plugin->getThemePath() instead in ". $trace[0]['file'] ." at line ". $trace[0]['line'], E_USER_WARNING);
185
        return $this->getThemePath();
186
    }
187
    
188
    public function getThemePath() {
189
        if (!isset($GLOBALS['sys_user_theme'])) {
190
            return null;
191
        }
192
        
193
        $pluginName = $this->getName();
194
        
195
        $paths  = array($GLOBALS['sys_custompluginspath'], $GLOBALS['sys_pluginspath']);
196
        $roots  = array($GLOBALS['sys_custompluginsroot'], $GLOBALS['sys_pluginsroot']);
197
        $dir    = '/'. $pluginName .'/www/themes/';
198
        $dirs   = array($dir.$GLOBALS['sys_user_theme'], $dir.'default');
199
        $dir    = '/'. $pluginName .'/themes/';
200
        $themes = array($dir.$GLOBALS['sys_user_theme'], $dir.'default');
201
        $found = false;
202
        while (!$found && (list($kd, $dir) = each($dirs))) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $found of type string|false is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === false instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
203
            reset($roots);
204
            while (!$found && (list($kr, $root) = each($roots))) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $found of type string|false is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === false instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
205
                if (is_dir($root.$dir)) {
206
                    $found = $paths[$kr].$themes[$kd];
207
                }
208
            }
209
        }
210
        return $found;
211
    }
212
213
    /**
214
     * Returns plugin's path on the server file system
215
     *
216
     * Example: /usr/share/codendi/plugins/docman
217
     *
218
     * @return String
219
     */
220
    public function getFilesystemPath() {
221
        if (!$this->filesystem_path) {
222
            $pm = $this->_getPluginManager();
223
            if ($pm->pluginIsCustom($this)) {
224
                $path = $GLOBALS['sys_custompluginsroot'];
225
            } else {
226
                $path = $GLOBALS['sys_pluginsroot'];
227
            }
228
            if ($path[strlen($path) -1 ] != '/') {
229
                $path .= '/';
230
            }
231
            $this->filesystem_path = $path . $this->getName();
232
        }
233
        return $this->filesystem_path;
234
    }
235
236
    /**
237
     * @return string the short name of the plugin (docman, tracker, …)
238
     */
239
    public function getName() {
240
        return $this->_getPluginManager()->getNameForPlugin($this);
241
    }
242
243
    /**
244
     * Wrapper for PluginManager
245
     *
246
     * @return PluginManager
247
     */
248
    protected function _getPluginManager() {
249
        $pm = PluginManager::instance();
250
        return $pm;
251
    }
252
    
253
    /**
254
     * Function called before turning a plugin to available status
255
     * Allow you to check required things (DB connection, etc...)
256
     * and to forbid plugin to be made available if requirements are not met.
257
     *
258
     * @return boolean true if the plugin can be made available, false if not
259
     */
260
    public function canBeMadeAvailable() {
261
    	return true;
262
    }
263
264
	/**
265
     * Function called when a plugin is set as available or unavailable
266
     *
267
     * @param boolean $available true if the plugin is available, false if unavailable
268
     */
269
    public function setAvailable($available) {
270
    }
271
    
272
    /**
273
     * Function executed after plugin installation
274
     */
275
    public function postInstall() {
276
    }
277
278
    public function getAdministrationOptions() {
279
        return '';
280
    }
281
282
    /**
283
     * Returns the content of the README file associated to the plugin
284
     *
285
     * @return String
286
     */
287
    public function getReadme() {
288
        return $this->getFilesystemPath().'/README';
289
    }
290
291
    /**
292
     * @return array of strings (identifier of plugins this one depends on)
293
     */
294
    public function getDependencies() {
295
        return array();
296
    }
297
298
    public function setIsCustom($is_custom) {
299
        $this->is_custom = $is_custom;
300
    }
301
302
    public function isCustom() {
303
        return $this->is_custom;
304
    }
305
306
    /**
307
     * Return the name of the service that is managed by this plugin
308
     *
309
     * @return string
310
     */
311
    public function getServiceShortname() {
312
        return '';
313
    }
314
315
    /**
316
     * @return BackendLogger
317
     */
318
    protected function getBackendLogger() {
319
        if (! $this->backend_logger) {
320
            $this->backend_logger = new BackendLogger();
321
        }
322
        return $this->backend_logger;
323
    }
324
}
325
?>