DBConnection::exec() - Code Metrics - Inspection of "code cleanup" - GEANT/CAT - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( 34b090...af3ce8 )

by Stefan

created 2016-08-26 08:32 UTC

DBConnection::exec() B

↳ Parent: DBConnection

Complexity

Conditions	4
Paths	4

Size

Total Lines	22
Code Lines	13

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

Metric	Value
cc	4
eloc	13
c	1
b	0
f	0
nc	4
nop	2
dl	0
loc	22
rs	8.9197

<?php

/* * ********************************************************************************
 * (c) 2011-15 GÉANT on behalf of the GN3, GN3plus and GN4 consortia
 * License: see the LICENSE file in the root directory
 * ********************************************************************************* */
?>
<?php

/**
 * This file contains the DBConnection singleton.
 * 
 * @author Stefan Winter <[email protected]>
 * @author Tomasz Wolniewicz <[email protected]>
 * 
 * @package Developer
 */
require_once('Helper.php');
require_once('Profile.php');
require_once('IdP.php');

/**
 * This class is a singleton for establishing a connection to the database
 *
 * @author Stefan Winter <[email protected]>
 * @author Tomasz Wolniewicz <[email protected]>
 *
 * @license see LICENSE file in root directory
 *
 * @package Developer
 */
class DBConnection {

    /**
     * This is the actual constructor for the singleton. It creates a database connection if it is not up yet, and returns a handle to the database connection on every call.
     * @return DBConnection the (only) instance of this class
     */
    private static function handle($db) {
        switch (strtoupper($db)) {
            case "INST":
                if (!isset(self::$instance_inst)) {
                    $c = __CLASS__;
                    self::$instance_inst = new $c($db);
                }
                return self::$instance_inst;
            case "USER":
                if (!isset(self::$instance_user)) {
                    $c = __CLASS__;
                    self::$instance_user = new $c($db);
                }
                return self::$instance_user;
            case "EXTERNAL":
                if (!isset(self::$instance_external)) {
                    $c = __CLASS__;
                    self::$instance_external = new $c($db);
                }
                return self::$instance_external;
            default:
                return FALSE;
class Author {
    private $name;

    public function __construct($name) {
        $this->name = $name;
    }

    public function getName() {
        return $this->name;
    }
}

abstract class Post {
    public function getAuthor() {
        return 'Johannes';
    }
}

class BlogPost extends Post {
    public function getAuthor() {
        return new Author('Johannes');
    }
}

class ForumPost extends Post { /* ... */ }

function my_function(Post $post) {
    echo strtoupper($post->getAuthor());
}
        }
    }

    /**
     * Implemented for safety reasons only. Cloning is forbidden and will tell the user so.
     */
    public function __clone() {
        trigger_error('Clone is not allowed.', E_USER_ERROR);
    }

    /**
     * 
     * @param string $db The database to do escapting for
     * @param string $value The value to escape
     * @return string
     */
    public static function escape_value($db, $value) {
        $handle = DBConnection::handle($db);
        debug(5, "Escaping $value for DB $db to get a safe query value.\n");
        $escaped = mysqli_real_escape_string($handle->connection, $value);
        debug(5, "This is the result: $escaped .\n");
        return $escaped;
    }

    /**
     * executes a query and triggers logging to the SQL audit log if it's not a SELECT
     * @param string $querystring the query to be executed
     * @return mixed the query result as mysqli_result object; or TRUE on non-return-value statements
     */
    public static function exec($db, $querystring) {
        // log exact query to debug log, if log level is at 5
        debug(5, "DB ATTEMPT: " . $querystring . "\n");

        $instance = DBConnection::handle($db);
        if ($instance->connection == FALSE) {
            debug(1, "ERROR: Cannot send query to $db database (no connection)!");
            return FALSE;
        }

        $result = mysqli_query($instance->connection, $querystring);
$stmt = mysqli_prepare("SELECT * FROM users WHERE name = ?");
$stmt->bind_param("s", $taintedUserName);
        if ($result == FALSE) {
            debug(1, "ERROR: Cannot execute query in $db database - (hopefully escaped) query was '$querystring'!");
            return FALSE;
        }

        // log exact query to audit log, if it's not a SELECT
        if (preg_match("/^SELECT/i", $querystring) == 0) {
            CAT::writeSQLAudit("[DB: " . strtoupper($db) . "] " . $querystring);
        }
        return $result;
    }

    /**
     * Retrieves data from the underlying tables, for situations where instantiating the IdP or Profile object is inappropriate
     * 
     * @param type $table institution_option or profile_option
     * @param type $row rowindex
     * @return boolean
     */
    public static function fetchRawDataByIndex($table, $row) {
        // only for select tables!
        if ($table != "institution_option" && $table != "profile_option" && $table != "federation_option") {
            return FALSE;
        }
        $blob_query = DBConnection::exec("INST", "SELECT option_value from $table WHERE row = $row");
        while ($a = mysqli_fetch_object($blob_query)) {
            $blob = $a->option_value;
        }
        if (!isset($blob)) {
            return FALSE;
        }
        return $blob;
    }

    /**
     * Checks if a raw data pointer is public data (return value FALSE) or if 
     * yes who the authorised admins to view it are (return array of user IDs)
     */
    public static function isDataRestricted($table, $row) {
        if ($table != "institution_option" && $table != "profile_option" && $table != "federation_option") {
            return []; // better safe than sorry: that's an error, so assume nobody is authorised to act on that data
        }
        switch ($table) {
            case "profile_option":
                $blob_query = DBConnection::exec("INST", "SELECT profile_id from $table WHERE row = $row");
                while ($profileIdQuery = mysqli_fetch_object($blob_query)) { // only one row
                    $blobprofile = $profileIdQuery->profile_id;
                }
                // is the profile in question public?
                $profile = new Profile($blobprofile);
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
                if ($profile->getShowtime() == TRUE) { // public data

                    return FALSE;
                } else {
                    $inst = new IdP($profile->institution);
                    return $inst->owner();
                }
                break;
function fx() {
    try {
        doSomething();
        return true;
    }
    catch (\Exception $e) {
        return false;
    }

    return false;
}
            case "institution_option":
                $blob_query = DBConnection::exec("INST", "SELECT institution_id from $table WHERE row = $row");
                while ($instIdQuery = mysqli_fetch_object($blob_query)) { // only one row
                    $blobinst = $instIdQuery->institution_id;
                }
                $inst = new IdP($blobinst);
function myFunction($a) {
    switch ($a) {
        case 'foo':
            $x = 1;
            break;

        case 'bar':
            $x = 2;
            break;
    }

    // $x is potentially undefined here.
    echo $x;
}
                // if at least one of the profiles belonging to the inst is public, the data is public
                if ($inst->isOneProfileShowtime()) { // public data
                    return FALSE;
                } else {
                    return $inst->owner();
                }
                break;
function fx() {
    try {
        doSomething();
        return true;
    }
    catch (\Exception $e) {
        return false;
    }

    return false;
}
            case "federation_option":
                // federation metadata is always public
                return FALSE;
            default:
                return []; // better safe than sorry: that's an error, so assume nobody is authorised to act on that data
        }
    }

    /**
     * Retrieves the last auto-id of an INSERT. Needs to be called immediately after the corresponding exec() call
     * @return int the last autoincrement-ID
     */
    public static function lastID($db) {
        $instance = DBConnection::handle($db);
        return mysqli_insert_id($instance->connection);
    }

    /**
     * Holds the singleton instance reference
     * 
     * @var DBConnection 
     */
    private static $instance_user;
    private static $instance_inst;
    private static $instance_external;

    /**
     * The connection to the DB server
     * 
     * @var mysqli
     */
    private $connection;

    /**
     * Class constructor. Cannot be called directly; use handle()
     */
    private function __construct($db) {
        $DB = strtoupper($db);
        $this->connection = mysqli_connect(Config::$DB[$DB]['host'], Config::$DB[$DB]['user'], Config::$DB[$DB]['pass'], Config::$DB[$DB]['db']) or die("ERROR: Unable to connect to $DB database! This is a fatal error, giving up.");
        if ($this->connection == FALSE) {
            echo "ERROR: Unable to connect to $db database! This is a fatal error, giving up.";
            exit(1);
        }

        if ($db == "EXTERNAL" && Config::$CONSORTIUM['name'] == "eduroam" && isset(Config::$CONSORTIUM['deployment-voodoo']) && Config::$CONSORTIUM['deployment-voodoo'] == "Operations Team")
            mysqli_query($this->connection, "SET NAMES 'latin1'");
    }

}

Push — master ( 34b090...af3ce8 )

DBConnection::exec() B

Complexity

Size

Duplication

Importance

11 paths for user data to reach this point

Preventing SQL Injection

General Strategies to prevent injection

Available Fixes

Available Fixes

1			<?php
2
3			/* * ********************************************************************************
4			* (c) 2011-15 GÉANT on behalf of the GN3, GN3plus and GN4 consortia
5			* License: see the LICENSE file in the root directory
6			* ********************************************************************************* */
7			?>
8			<?php
9
10			/**
11			* This file contains the DBConnection singleton.
12			*
13			* @author Stefan Winter <[email protected]>
14			* @author Tomasz Wolniewicz <[email protected]>
15			*
16			* @package Developer
17			*/
18			require_once('Helper.php');
19			require_once('Profile.php');
20			require_once('IdP.php');
21
22			/**
23			* This class is a singleton for establishing a connection to the database
24			*
25			* @author Stefan Winter <[email protected]>
26			* @author Tomasz Wolniewicz <[email protected]>
27			*
28			* @license see LICENSE file in root directory
29			*
30			* @package Developer
31			*/
32			class DBConnection {
33
34			/**
35			* This is the actual constructor for the singleton. It creates a database connection if it is not up yet, and returns a handle to the database connection on every call.
36			* @return DBConnection the (only) instance of this class
37			*/
38			private static function handle($db) {
39			switch (strtoupper($db)) {
40			case "INST":

GEANT / CAT

Push — master ( 34b090...af3ce8 )

DBConnection::exec() B

Complexity

Size

Duplication

Importance

11 paths for user data to reach this point

Preventing SQL Injection

General Strategies to prevent injection

Available Fixes

Available Fixes

Duplication Side-by-Side

Filter issues like