Issues (75)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/tools.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
use Seld\JsonLint\JsonParser;
3
/**
4
 * @author Fylhan (http://fylhan.la-bnbox.fr)
5
 * @license LGPL-2.1+
6
 */
7
define('MODE', 'dev');
8
9
function parserI($int)
10
{
11
	return intval(trim($int));
12
}
13
14
function parserF($decimal)
15
{
16
	return floatval(trim($decimal));
17
}
18
19
function parserS($str)
20
{
21
	if (! get_magic_quotes_gpc()) {
22
		return addslashes(trim($str));
23
	}
24
	return trim($str);
25
}
26
27
function deparserS($str)
28
{
29
	return stripslashes(trim($str));
30
}
31
32
/**
33
 * Test si un email est valide
34
 * 
35
 * @param $email Email
36
 *        	à tester
37
 * @return true si c'est un email
38
 * @return false sinon
39
 */
40
function isEmailValide($email)
41
{
42
	return preg_match('![a-z0-9._-]+@[a-z0-9._-]{2,}\.[a-z]{2,4}!i', $email);
43
}
44
45
/**
46
 * Test si un tel est valide
47
 * 
48
 * @param $tel tel
49
 *        	à tester
50
 * @return true si c'est un tel
51
 * @return false sinon
52
 */
53
function isTelValide($tel)
54
{
55
	return preg_match('!^0[1-9]([-. ]?[0-9]{2}){4}$!i', $tel);
56
}
57
58
// Transforme le numéro du mois en son nom en français
59
function nomMois($numMois)
60
{
61
	switch ($numMois) {
62
		case 1:
63
			return 'janvier';
64
			break;
65
		case 2:
66
			return 'février';
67
			break;
68
		case 3:
69
			return 'mars';
70
			break;
71
		case 4:
72
			return 'avril';
73
			break;
74
		case 5:
75
			return 'mai';
76
			break;
77
		case 6:
78
			return 'juin';
79
			break;
80
		case 7:
81
			return 'juillet';
82
			break;
83
		case 8:
84
			return 'août';
85
			break;
86
		case 9:
87
			return 'septembre';
88
			break;
89
		case 10:
90
			return 'octobre';
91
			break;
92
		case 11:
93
			return 'novembre';
94
			break;
95
		default:
96
			return 'décembre';
97
	}
98
}
99
100
function approximeMinute($minute)
101
{
102
	if ($minute > 00 && $minute <= 05)
103
		$minute = 05;
104
	else 
105
		if ($minute > 05 && $minute <= 10)
106
			$minute = 10;
107
		else 
108
			if ($minute > 10 && $minute <= 15)
109
				$minute = 15;
110
			else 
111
				if ($minute > 15 && $minute <= 20)
112
					$minute = 20;
113
				else 
114
					if ($minute > 20 && $minute <= 25)
115
						$minute = 25;
116
					else 
117
						if ($minute > 25 && $minute <= 30)
118
							$minute = 30;
119
						else 
120
							if ($minute > 30 && $minute <= 35)
121
								$minute = 35;
122
							else 
123
								if ($minute > 35 && $minute <= 40)
124
									$minute = 40;
125
								else 
126
									if ($minute > 40 && $minute <= 45)
127
										$minute = 45;
128
									else 
129
										if ($minute > 45 && $minute <= 50)
130
											$minute = 50;
131
										else
132
											$minute = 55;
133
	return $minute;
134
}
135
136
function filesizeHuman($filepath, $precision = 2)
137
{
138
	$unites = array(
139
		'octets',
140
		'ko',
141
		'mo',
142
		'go',
143
		'to'
144
	);
145
	$taille = filesize($filepath);
146
	$div = floor(log($taille, 1024));
147
	$taille = round($taille / pow(1024, $div), $precision);
148
	return str_replace('.', ',', $taille) . ' ' . $unites[$div];
149
}
150
151
function filetypeHuman($filepath)
152
{
153
	return substr(strrchr($filepath, '.'), 1);
154
}
155
156
function filedateHuman($filepath)
157
{
158
	return dateFr(filemtime($filepath));
159
}
160
161
/**
162
 * Formate une date en fonction de la date actuelle
163
 */
164
function dateFr($timestamp, $heure = false, $le = true)
165
{
166
	$timestampCourant = time();
167
	if (date('Y', $timestamp) == date('Y', $timestampCourant)) {
168
		if ($heure && date('z', $timestamp) == date('z', $timestampCourant)) { // Le même jour
169
			$s_date = 'aujourd\'hui à ' . date('G\hi', $timestamp);
170
		}
171
		elseif (date('z', $timestamp) == date('z', $timestampCourant) - 1) { // La veille
172
			$s_date = 'hier' . ($heure ? ' à ' . date('G\hi', $timestamp) : '');
173
		}
174 View Code Duplication
		else { // La même année
175
			$s_date = ($le ? 'le ' : '') . (date('d', $timestamp) + 0) . ' ' . nomMois(date('n', $timestamp)) . ($heure ? ' à ' . date('G\hi', $timestamp) : '');
176
		}
177
	}
178 View Code Duplication
	else { // Une année différente
179
		$s_date = ($le ? 'le ' : '') . (date('d', $timestamp) + 0) . ' ' . nomMois(date('n', $timestamp)) . date(' Y', $timestamp) . ($heure ? ' à ' . date('G\hi', $timestamp) : '');
180
	}
181
	return $s_date;
182
}
183
184
/**
185
 * Parse une date au format DATE_RFC822
186
 * Il existe date(DATE_RFC822, timestamp), mais le serveur Flamb'clair ne le connait pas
187
 * 
188
 * @param int $timestamp
189
 *        	Timestamp à parser
190
 */
191
function dateToRFC822($timestamp)
192
{
193
	return date('D\, d M Y H\:i\:s O', $timestamp);
194
}
195
196
/**
197
 * Formate la date d'un événement
198
 * 
199
 * @param $timestamp Timestamp        	
200
 * @return La date formatée
201
 */
202
function afficherDateEvenement($timestamp)
203
{
204
	return 'le ' . (date('d', $timestamp) + 0) . ' ' . nomMois(date('n', $timestamp)) . ' à ' . date('G\hi', $timestamp);
205
}
206
207
function salut()
208
{
209
	$heure = date('G\.i', time());
210
	if ($heure <= 7 || $heure >= 22) {
211
		return 'bonne nuit';
212
	}
213
	elseif ($heure <= 11.30) {
214
		return 'bonjour';
215
	}
216
	elseif ($heure <= 13.30) {
217
		return 'bon appetit';
218
	}
219
	elseif ($heure <= 18) {
220
		return 'bonne après-midi';
221
	}
222
	else {
223
		return 'bonne soirée';
224
	}
225
}
226
227
/**
228
 * Clean une chaine de caractères pour l'url rewriting
229
 * 
230
 * @param string $url
231
 *        	Chaine de caractères à cleaner
232
 * @param boolean $elag
233
 *        	True pour élaguer les petits mots (la, les, ...); false sinon
234
 * @return string La chaine de caractère rewritée
235
 *        
236
 */
237
function parserUrl($url, $elag = true, $strtolower = true)
238
{
239
	if ($strtolower) {
240
		$url = mb_strtolower($url);
241
	}
242
	
243
	// Elagage
244
	if ($elag) {
245
		$url = preg_replace('!(?:^|\s|[_-])(le|la|les|un|une|des|de|à|sa|son|ses|ces|s)(?:$|\s|[\'_-])!i', '-', $url);
246
	}
247
	
248
	// Clean accent
249
	$url = str_ireplace(array(
250
		'à',
251
		'â',
252
		'ä'
253
	), 'a', $url);
254
	$url = str_ireplace(array(
255
		'é',
256
		'è',
257
		'ê',
258
		'ë'
259
	), 'e', $url);
260
	$url = str_ireplace(array(
261
		'î',
262
		'ï'
263
	), 'i', $url);
264
	$url = str_ireplace(array(
265
		'ô',
266
		'ö'
267
	), 'o', $url);
268
	$url = str_ireplace(array(
269
		'ù',
270
		'û',
271
		'ü'
272
	), 'u', $url);
273
	$url = str_ireplace('ÿ', 'y', $url);
274
	$url = str_ireplace('ç', 'c', $url);
275
	
276
	// Clean caractère
277
	$url = preg_replace('![/@\'=_ -]!i', '-', $url);
278
	$url = preg_replace('![&~"#|`^()+{}[\]$£¤*µ%§\!:;\\\.,?°]!i', '', $url);
279
	
280
	// Elagage final
281
	$url = preg_replace('!-(d|l|m|qu|t)-!i', '-', $url);
282
	$url = preg_replace('!^(d|l|m|qu|t)-!i', '-', $url);
283
	$url = preg_replace('!-(d|l|m|qu|t)&!i', '-', $url);
284
	$url = preg_replace('!-{2,}!i', '-', $url);
285
	$url = preg_replace('!^-!i', '', $url);
286
	$url = preg_replace('!-$!i', '', $url);
287
	
288
	return $url;
289
}
290
291
function deparserUrl($url)
292
{
293
	$url = ucwords($url);
294
	$url = str_replace('-', ' ', $url);
295
	return $url;
296
}
297
298
/**
299
 * Rendre un url joli (on enlève http tout ça et on remplace par www)
300
 */
301
function cleanerUrl($url)
302
{
303
	return 'www.' . preg_replace('!(?:http://)?(?:www\.)?(.+)!i', '$1', $url);
304
}
305
306
// Met au pluriel un mot
307
function pluriel($a_i_nombreElements, $a_s_mot)
308
{
309
	if ($a_i_nombreElements > 1) {
310
		$s_motAuPluriel = $a_i_nombreElements . " " . $a_s_mot . "s";
311
	}
312
	elseif ($a_i_nombreElements == '1') {
313
		$s_motAuPluriel = "Un " . $a_s_mot;
314
	}
315
	else {
316
		$s_motAuPluriel = 'Aucun ' . $a_s_mot;
317
	}
318
	return $s_motAuPluriel;
319
}
320
321
function ajoutS($nbElmnt, $str)
322
{
323
	if ($nbElmnt > 1) {
324
		return $str . 's';
325
	}
326
	else {
327
		return $str;
328
	}
329
}
330
331
/**
332
 * Retourne l'url de l'image si une image existe dans ce dossier avec ce nom
333
 * 
334
 * @param string $dossierOuChercher)        	
0 ignored issues
show
There is no parameter named $dossierOuChercher). Did you maybe mean $dossierOuChercher?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit.

Consider the following example. The parameter $ireland is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $ireland
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was changed, but the annotation was not.

Loading history...
335
 * @param string $nomImage
336
 *        	(sans extension)
337
 * @return Url de l'image si elle existe, vide sinon
338
 */
339
function isImage($dossierOuChercher, $nomImage)
340
{
341
	// AJout d'un slash à la fin si besoin
342
	if ($dossierOuChercher[(strlen($dossierOuChercher) - 1)] != '/') {
343
		$dossierOuChercher .= '/';
344
	}
345
	// Boucle sur les extensions d'images
346
	$extensions = array(
347
		'.jpg',
348
		'.jpeg',
349
		'.gif',
350
		'.png',
351
		'.JPG',
352
		'.JPEG',
353
		'.GIF',
354
		'.PNG'
355
	);
356
	foreach ($extensions as $extension) {
357
		if (is_file($dossierOuChercher . $nomImage . $extension)) {
358
			return $nomImage . $extension;
359
		}
360
	}
361
	// Si on n'a rien trouvé, on renvoie vide
362
	return '';
363
}
364
365
/**
366
 * Tronque un texte pour qu'il fasse $longueur caractères et y ajoute "..." si besoins
367
 * 
368
 * @param string $txt
369
 *        	Texte à tronquer
370
 * @param int $longueur
371
 *        	La longueur du texte final
372
 * @return string Le texte tronqué
373
 */
374
function getExtrait($txt, $longueur = 300)
375
{
376
	if (strlen($txt) > 300)
377
		$fin = '...';
378
	return substr($txt, 0, $longueur) . @$fin;
379
}
380
381
function getUrlCourant($urlDefault)
382
{
383
	$urlCourant = explode('?', isset($_SERVER['REQUEST_URI']) ? htmlspecialchars($_SERVER['REQUEST_URI']) : $urlDefault);
384
	return $urlCourant[0];
385
}
386
387
function getUrlPagePrecedente($urlDefault)
388
{
389
	$urlCourant = explode('?', isset($_SERVER['HTTP_REFERER']) ? htmlspecialchars($_SERVER['HTTP_REFERER']) : $urlDefault);
390
	return $urlCourant[0];
391
}
392
393
function br2nl($str)
394
{
395
	return preg_replace("!<br ?/?>!i", "\n", $str);
396
}
397
398
/**
399
 * Clean a JSON string
400
 * * Remove comments ("//" and "/*")
401
 * * Add first and last braces ("{" and "}") if missing
402
 * * Remove unauthorized commas
403
 */
404
function cleanJsonString($data)
405
{
406
	$data = trim($data);
407
	$data = preg_replace('!\s*//[^\.]*\n!U', '\n', $data); // TODO: it doesn't accept the dot in comments. But without it may take into account URLs
408
	$data = preg_replace('!/\*.*\*/\s*!sU', '', $data);
409
	$data = ! startsWith('{', $data) ? '{' . $data : $data;
410
	$data = ! endsWith('}', $data) ? $data . '}' : $data;
411
	$data = preg_replace('!,(\s*[}\]])!U', '$1', $data);
412
	return $data;
413
}
414
415
/**
416
 * Retourne la signification de la dernière erreur
417
 * d'encodage / décodage json.
418
 * En français.
419
 */
420
function getJsonLastError()
421
{
422
	switch (json_last_error()) {
423
		case JSON_ERROR_NONE:
424
			return 'Aucune erreur';
425
			break;
426
		case JSON_ERROR_DEPTH:
427
			return 'Profondeur maximale atteinte';
428
			break;
429
		case JSON_ERROR_STATE_MISMATCH:
430
			return 'Inadéquation des modes ou underflow';
431
			break;
432
		case JSON_ERROR_CTRL_CHAR:
433
			return 'Erreur lors du contrôle des caractères';
434
			break;
435
		case JSON_ERROR_SYNTAX:
436
			return 'Erreur de syntaxe ; JSON malformé';
437
			break;
438
		case JSON_ERROR_UTF8:
439
			return 'Caractères UTF-8 malformés, probablement une erreur d\'encodage';
440
			break;
441
	}
442
	return 'Erreur inconnue';
443
}
444
445
function echa($var)
446
{
447
	echo '<pre>';
448
	print_r($var);
449
	echo '</pre><br />';
450
}
451
452
function startsWith($needle, $haystack)
453
{
454
	return ! strncmp($haystack, $needle, strlen($needle));
455
}
456
457
function endsWith($needle, $haystack)
458
{
459
	$length = strlen($needle);
460
	if ($length == 0)
461
		return true;
462
	return (substr($haystack, - $length) === $needle);
463
}
464
465
function logger($str, $line = -1)
466
{
467
	echo '<span style="color: red;">' . dateToRFC822(time()) . ': "' . $str . '" on line ' . $line . '</span>';
468
}
469
470
function loadJsonFile($filepath, $charset = 'UTF-8')
471
{
472
    // Load JSON file
473
    $data = @file_get_contents($filepath);
474
    if (false === $data) {
475
        return NULL;
476
    }
477
    // Encode to UTF-8
478
    if ('UTF-8' != mb_detect_encoding($data, 'UTF-8', true)) {
479
        $data = utf8_encode($data);
480
    }
481
    // Clean
482
    $data = cleanJsonString($data);
483
484
    // Parse JSON
485
    try {
486
        $parser = new JsonParser();
487
        $knowledge = $parser->parse($data, JsonParser::ALLOW_DUPLICATE_KEYS);
488
    } catch (ParsingException $e) {
489
        return NULL;
490
    }
491
    return $knowledge;
492
}