Issues (228)

Security Analysis    28 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting (3)
Response Splitting can be used to send arbitrary responses.
  File Manipulation (6)
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection (1)
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (16)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

core/AbstractDeployment.php (1 issue)

Labels
Severity
1
<?php
2
3
/*
4
 * *****************************************************************************
5
 * Contributions to this work were made on behalf of the GÉANT project, a 
6
 * project that has received funding from the European Union’s Framework 
7
 * Programme 7 under Grant Agreements No. 238875 (GN3) and No. 605243 (GN3plus),
8
 * Horizon 2020 research and innovation programme under Grant Agreements No. 
9
 * 691567 (GN4-1) and No. 731122 (GN4-2).
10
 * On behalf of the aforementioned projects, GEANT Association is the sole owner
11
 * of the copyright in all material which was developed by a member of the GÉANT
12
 * project. GÉANT Vereniging (Association) is registered with the Chamber of 
13
 * Commerce in Amsterdam with registration number 40535155 and operates in the 
14
 * UK as a branch of GÉANT Vereniging.
15
 * 
16
 * Registered office: Hoekenrode 3, 1102BR Amsterdam, The Netherlands. 
17
 * UK branch address: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK
18
 *
19
 * License: see the web/copyright.inc.php file in the file structure or
20
 *          <base_url>/copyright.php after deploying the software
21
 */
22
23
/**
24
 * This file contains the AbstractProfile class. It contains common methods for
25
 * both RADIUS/EAP profiles and SilverBullet profiles
26
 *
27
 * @author Stefan Winter <[email protected]>
28
 * @author Tomasz Wolniewicz <[email protected]>
29
 *
30
 * @package Developer
31
 *
32
 */
33
34
namespace core;
35
36
use \Exception;
0 ignored issues
show
The type \Exception was not found. Maybe you did not declare it correctly or list all dependencies?

The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g. excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:

filter:
    dependency_paths: ["lib/*"]

For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths

Loading history...
37
38
/**
39
 * This class represents an EAP Profile.
40
 * Profiles can inherit attributes from their IdP, if the IdP has some. Otherwise,
41
 * one can set attribute in the Profile directly. If there is a conflict between
42
 * IdP-wide and Profile-wide attributes, the more specific ones (i.e. Profile) win.
43
 * 
44
 * @author Stefan Winter <[email protected]>
45
 * @author Tomasz Wolniewicz <[email protected]>
46
 *
47
 * @license see LICENSE file in root directory
48
 *
49
 * @package Developer
50
 */
51
abstract class AbstractDeployment extends EntityWithDBProperties
52
{
53
54
    const INACTIVE = 0;
55
    const ACTIVE = 1;
56
    const DEPLOYMENTTYPE_CLASSIC = "RADIUS-SP";
57
    const DEPLOYMENTTYPE_MANAGED = "MANAGED-SP";
58
    const RADIUS_OK = 1;
59
    const RADIUS_FAILURE = 2;
60
61
    /**
62
     * status of this deployment. Defaults to INACTIVE.
63
     * 
64
     * @var integer
65
     */
66
    public $status = AbstractDeployment::INACTIVE;
67
68
    /**
69
     * which type of deployment is this. Not initialised, done by sub-classes.
70
     * 
71
     * @var string
72
     */
73
    public $type;
74
75
    /**
76
     * DB identifier of the parent institution of this profile
77
     * @var integer
78
     */
79
    public $institution;
80
81
    /**
82
     * name of the parent institution of this profile in the current language
83
     * @var string
84
     */
85
    public $instName;
86
    
87
    /**
88
     * The name of the hotspot deployment
89
     * 
90
     * @var string
91
     */
92
    public $name;
93
94
    /**
95
     * number of deployments the IdP this profile is attached to has
96
     * 
97
     * @var integer
98
     */
99
    protected $idpNumberOfDeployments;
100
101
    /**
102
     * IdP-wide attributes of the IdP this profile is attached to
103
     * 
104
     * @var array
105
     */
106
    protected $idpAttributes;
107
108
    /**
109
     * Federation level attributes that this profile is attached to via its IdP
110
     * 
111
     * @var array
112
     */
113
    protected $fedAttributes;
114
115
    /**
116
     * This class also needs to handle frontend operations, so needs its own
117
     * access to the FRONTEND database. This member stores the corresponding 
118
     * handle.
119
     * 
120
     * @var DBConnection
121
     */
122
    protected $frontendHandle;
123
124
    /**
125
     * Class constructor for existing deployments (use 
126
     * IdP::newDeployment() to actually create one). Retrieves all 
127
     * attributes from the DB and stores them in the priv_ arrays.
128
     * 
129
     * @param IdP        $idpObject       optionally, the institution to which this Profile belongs. Saves the construction of the IdP instance. If omitted, an extra query and instantiation is executed to find out.
130
     * @param string|int $deploymentIdRaw identifier of the deployment in the DB, or 
131
     */
132
    public function __construct($idpObject, $deploymentIdRaw = NULL)
133
    {
134
        $this->databaseType = "INST";
135
        parent::__construct(); // we now have access to our INST database handle and logging
136
        $connHandle = DBConnection::handle("FRONTEND");
137
        if (!$connHandle instanceof DBConnection) {
138
            throw new Exception("Frontend DB is never an array, always a single DB object.");
139
        }
140
        $this->frontendHandle = $connHandle;
141
        $idp = $idpObject;
142
        $this->institution = $idp->identifier;
143
        if ($deploymentIdRaw !== NULL && is_int($deploymentIdRaw)) {
144
            $this->identifier = $deploymentIdRaw;
145
        }
146
        $this->instName = $idp->name;
147
        $this->idpNumberOfDeployments = $idp->deploymentCount();
148
        $this->idpAttributes = $idp->getAttributes();
149
        $fedObject = new Federation($idp->federation);
150
        $this->fedAttributes = $fedObject->getAttributes();
151
        $this->loggerInstance->debug(4, "--- END Constructing new AbstractDeployment object ... ---\n");
152
    }
153
154
    /**
155
     * update the last_changed timestamp for this deployment
156
     * 
157
     * @return void
158
     */
159
    abstract public function updateFreshness();
160
161
    /**
162
     * gets the last-modified timestamp (useful for caching "dirty" check)
163
     * 
164
     * @return string the date in string form, as returned by SQL
165
     */
166
    abstract public function getFreshness();
167
168
    /**
169
     * Deletes the deployment from database
170
     * 
171
     * @return void
172
     */
173
    abstract public function remove();
174
175
    /**
176
     * Deactivates the deployment
177
     * 
178
     * @return void
179
     */
180
    abstract public function deactivate();
181
182
    /**
183
     * activates the deployment
184
     * 
185
     * @return void
186
     */
187
    abstract public function activate();
188
189
    /**
190
     * check if RADIUS configuration daemon is listening for requests
191
     *
192
     * @return array index res[1] indicate primary RADIUS status, index res[2] backup RADIUS status
193
     */
194
    abstract public function checkRADIUSHostandConfigDaemon();
195
196
    /**
197
     * prepare request to add/modify RADIUS settings for given deployment
198
     *
199
     * @param int $onlyone the flag indicating on which server to conduct modifications
200
     * @param int $notify  the flag indicating that an admin email should be sent
201
     * @return array index res[1] indicate primary RADIUS status, index res[2] backup RADIUS status
202
     */
203
    abstract public function setRADIUSconfig($onlyone = 0, $notify = 0);
204
}
205