This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Copyright (c) Xerox Corporation, 2006. All Rights Reserved. |
||
4 | * |
||
5 | * Originally written by Nicolas Terray, 2006 |
||
6 | * |
||
7 | * This file is a part of Codendi. |
||
8 | * |
||
9 | * Codendi is free software; you can redistribute it and/or modify |
||
10 | * it under the terms of the GNU General Public License as published by |
||
11 | * the Free Software Foundation; either version 2 of the License, or |
||
12 | * (at your option) any later version. |
||
13 | * |
||
14 | * Codendi is distributed in the hope that it will be useful, |
||
15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
17 | * GNU General Public License for more details. |
||
18 | * |
||
19 | * You should have received a copy of the GNU General Public License |
||
20 | * along with Codendi; if not, write to the Free Software |
||
21 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||
22 | */ |
||
23 | |||
24 | require_once 'PluginInfo.class.php'; |
||
25 | require_once 'common/include/PropertyDescriptor.class.php'; |
||
26 | |||
27 | /** |
||
28 | * File based plugin options management |
||
29 | */ |
||
30 | class PluginFileInfo extends PluginInfo |
||
31 | { |
||
32 | /** @var string */ |
||
33 | private $conf_path; |
||
34 | |||
35 | /** @var string */ |
||
36 | private $default_conf_path; |
||
37 | |||
38 | /** |
||
39 | * Constructor |
||
40 | * |
||
41 | * @param Plugin $plugin The plugin on which PluginInfo applies |
||
42 | * @param String $incname Name of the '.inc' file in plugin 'etc' directory |
||
43 | */ |
||
44 | function __construct(Plugin $plugin, $incname) |
||
45 | { |
||
46 | parent::__construct($plugin); |
||
47 | |||
48 | $this->conf_path = $plugin->getPluginEtcRoot() .'/'.$incname.'.inc'; |
||
49 | $this->default_conf_path = $this->getDefaultConfPath($plugin, $incname); |
||
0 ignored issues
–
show
|
|||
50 | $this->loadProperties(); |
||
51 | } |
||
52 | |||
53 | /** |
||
54 | * Override this in order to load default variables (in .dist files). Else only /etc will be loaded. |
||
55 | * |
||
56 | * This is left intentionnaly protected so that we can deploy this feature progressively. When all concerned plugins |
||
57 | * will use it this method will not be required anymore and should be inlined. |
||
58 | */ |
||
59 | protected function getDefaultConfPath(Plugin $plugin, $incname) { |
||
60 | return null; |
||
61 | } |
||
62 | |||
63 | /** |
||
64 | * Load properties from the configuration file |
||
65 | */ |
||
66 | function loadProperties() |
||
67 | { |
||
68 | if (is_file($this->conf_path)) { |
||
69 | $this->checkConfigurationFiles($this->conf_path); |
||
70 | |||
71 | $variables = $this->getVariablesFromConfigurationFile($this->conf_path); |
||
72 | if (is_file($this->default_conf_path)) { |
||
73 | $variables = array_merge( |
||
74 | $this->getVariablesFromConfigurationFile($this->default_conf_path), |
||
75 | $variables |
||
76 | ); |
||
77 | } |
||
78 | foreach ($variables as $variable) { |
||
79 | $key = $variable['name']; |
||
80 | if (preg_match('`^"(.*)"$`', $variable['value'], $match) || |
||
81 | preg_match('`^\'(.*)\'$`', $variable['value'], $match)) { |
||
82 | $value = $match[1]; |
||
83 | } else { |
||
84 | $value = $variable['value']; |
||
85 | } |
||
86 | $descriptor = new PropertyDescriptor($key, $value); |
||
87 | $this->_addPropertyDescriptor($descriptor); |
||
88 | } |
||
89 | } |
||
90 | } |
||
91 | |||
92 | /** |
||
93 | * Save in memory properties in the configuration file |
||
94 | */ |
||
95 | public function saveProperties() |
||
96 | { |
||
97 | copy($this->conf_path, $this->conf_path .'.'. date('YmdHis')); |
||
98 | $content = file_get_contents($this->conf_path); |
||
99 | $descs =& $this->getPropertyDescriptors(); |
||
100 | $keys =& $descs->getKeys(); |
||
101 | $iter =& $keys->iterator(); |
||
102 | $content = $this->cleanContentFromClosingPHPTag($content); |
||
103 | while ($iter->valid()) { |
||
104 | $key =& $iter->current(); |
||
105 | $desc =& $descs->get($key); |
||
106 | $desc_name =& $desc->getName(); |
||
107 | |||
108 | if (is_bool($desc->getValue())) { |
||
109 | $value = ($desc->getValue() ? 'true' : 'false') .';'; |
||
110 | } else { |
||
111 | $value = '"'.addslashes($desc->getValue()).'";'; |
||
112 | } |
||
113 | |||
114 | $replace = '$1'. $value; |
||
115 | $content = preg_replace('`((?:^|\n)\$'. preg_quote($desc_name) .'\s*=\s*)(.*)\s*;`', |
||
116 | $replace, |
||
117 | $content); |
||
118 | |||
119 | if (! preg_match('`(?:^|\n)\$'. preg_quote($desc_name) .'\s*=`', $content)) { |
||
120 | $content .= '$' . $desc_name .' = '. $value . PHP_EOL; |
||
121 | } |
||
122 | $iter->next(); |
||
123 | } |
||
124 | $f = fopen($this->conf_path, 'w'); |
||
125 | if ($f) { |
||
126 | fwrite($f, $content); |
||
127 | fclose($f); |
||
128 | } |
||
129 | } |
||
130 | |||
131 | private function cleanContentFromClosingPHPTag($content) { |
||
132 | return str_replace('?>', '', $content); |
||
133 | } |
||
134 | |||
135 | /** |
||
136 | * Return the property value for given property name |
||
137 | * |
||
138 | * @param String $name Label of the property |
||
139 | * |
||
140 | * @return String |
||
141 | */ |
||
142 | function getPropertyValueForName($name) |
||
143 | { |
||
144 | $desc = $this->getPropertyDescriptorForName($name); |
||
145 | return $desc ? $desc->getValue() : $desc; |
||
146 | } |
||
147 | |||
148 | /** |
||
149 | * Alias for getPropertyValueForName |
||
150 | * |
||
151 | */ |
||
152 | function getPropVal($name) |
||
153 | { |
||
154 | return $this->getPropertyValueForName($name); |
||
155 | } |
||
156 | |||
157 | /** |
||
158 | * Extract PHP variables from the config file |
||
159 | * |
||
160 | * @param String $file Full path to the configuration file |
||
161 | * |
||
162 | * @return Array All the variables defined in the file |
||
163 | */ |
||
164 | protected function getVariablesFromConfigurationFile($file) |
||
165 | { |
||
166 | if (! is_file($file)) { |
||
167 | return array(); |
||
168 | } |
||
169 | |||
170 | $tokens = token_get_all(file_get_contents($file)); |
||
171 | |||
172 | $variables = array(); |
||
173 | $current = 0; |
||
174 | foreach ($tokens as $token) { |
||
175 | switch ($token[0]) { |
||
176 | case T_VARIABLE: |
||
177 | $variables[$current] = array('name' => substr($token[1], 1), 'value' => ''); |
||
178 | break; |
||
179 | case T_STRING: |
||
180 | case T_CONSTANT_ENCAPSED_STRING: |
||
181 | case T_DNUMBER: |
||
182 | case T_LNUMBER: |
||
183 | case T_NUM_STRING: |
||
184 | if (T_STRING == $token[0] && (!strcasecmp($token[1], "false") || !strcasecmp($token[1], "true"))) { |
||
185 | $val = (bool)strcasecmp($token[1], "false"); |
||
186 | if (isset($variables[$current])) { |
||
187 | $variables[$current]['value'] = $val; |
||
188 | } |
||
189 | } else { |
||
190 | if (isset($variables[$current])) { |
||
191 | $variables[$current]['value'] .= $token[1]; |
||
192 | } |
||
193 | } |
||
194 | break; |
||
195 | case '*': |
||
196 | if (isset($variables[$current])) { |
||
197 | $variables[$current]['value'] .= $token[0]; |
||
198 | } |
||
199 | break; |
||
200 | case ';': |
||
201 | $current++; |
||
202 | break; |
||
203 | default: |
||
204 | break; |
||
205 | } |
||
206 | } |
||
207 | return $variables; |
||
208 | } |
||
209 | |||
210 | /** |
||
211 | * Check if the configuration file is valid or not |
||
212 | * |
||
213 | */ |
||
214 | private function checkConfigurationFiles($path) |
||
215 | { |
||
216 | require $path; |
||
217 | } |
||
218 | } |
||
219 | ?> |
||
220 |
This check looks for function or method calls that always return null and whose return value is assigned to a variable.
The method
getObject()
can return nothing but null, so it makes no sense to assign that value to a variable.The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.