Issues (172)

Security Analysis    13 potential vulnerabilities

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting (3)
Response Splitting can be used to send arbitrary responses.
  File Manipulation (6)
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting (1)
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

web/skins/modern/Divs.php (2 issues)

1
<?php
2
3
/*
4
 * *****************************************************************************
5
 * Contributions to this work were made on behalf of the GÉANT project, a 
6
 * project that has received funding from the European Union’s Framework 
7
 * Programme 7 under Grant Agreements No. 238875 (GN3) and No. 605243 (GN3plus),
8
 * Horizon 2020 research and innovation programme under Grant Agreements No. 
9
 * 691567 (GN4-1) and No. 731122 (GN4-2).
10
 * On behalf of the aforementioned projects, GEANT Association is the sole owner
11
 * of the copyright in all material which was developed by a member of the GÉANT
12
 * project. GÉANT Vereniging (Association) is registered with the Chamber of 
13
 * Commerce in Amsterdam with registration number 40535155 and operates in the 
14
 * UK as a branch of GÉANT Vereniging.
15
 * 
16
 * Registered office: Hoekenrode 3, 1102BR Amsterdam, The Netherlands. 
17
 * UK branch address: City House, 126-130 Hills Road, Cambridge CB2 1PQ, UK
18
 *
19
 * License: see the web/copyright.inc.php file in the file structure or
20
 *          <base_url>/copyright.php after deploying the software
21
 */
22
23
namespace web\skins\modern;
24
25
use web\lib\user;
26
27
/**
28
 * This class delivers various <div> elements for the front page.
29
 * 
30
 * @author Tomasz Wolniewicz <[email protected]>
31
 */
32
class Divs {
33
34
    /**
35
     * The Gui object we are working with.
36
     * 
37
     * @var user\Gui
38
     */
39
    private $Gui;
40
41
    /**
42
     * initialises the Divs class
43
     * 
44
     * @param \web\lib\user\Gui $Gui the Gui object to work with
45
     */
46
    public function __construct(user\Gui $Gui) {
47
        $this->Gui = $Gui;
48
    }
49
50
    /**
51
     * generates the heading div
52
     * 
53
     * @param string $visibility controls whether the full or minimal menu should be shown
54
     * @return string the HTML code
55
     */
56
    public function divHeading($visibility = 'all') {
57
        $selectedLang = $this->Gui->languageInstance->getLang();
58
        $menu = new Menu($visibility, $selectedLang);
59
        $retval = "<div id='heading'>";
60
        $location = $this->Gui->skinObject->findResourceUrl("IMAGES", "consortium_logo.png");
61
        if ($location !== FALSE) {
62
            $retval .= "<div id='cat_logo'>
63
            <a href='".\config\ConfAssistant::CONSORTIUM['homepage']."'><img id='logo_img' src='$location' alt='Consortium Logo'/></a>
64
            <span>Configuration Assistant Tool</span>
65
            </div>";
66
        }
67
        $retval .= "<div id='motd'>".(isset(\config\Master::APPEARANCE['MOTD']) ? \config\Master::APPEARANCE['MOTD'] : '&nbsp')."</div>";
68
        $loc2 = $this->Gui->skinObject->findResourceUrl("IMAGES", "icons/menu.png");
69
        if ($loc2 !== FALSE) {
70
            $retval .= "<img id='hamburger' src='$loc2' alt='Menu'/>";
71
        }
72
        $retval .= "<div id='menu_top'>";
73
        if ($visibility === 'start') {
74
            $retval .= $menu->printMinimalMenu();
75
        } else {
76
            $retval .= $menu->printMenu();
77
        }
78
        $retval .= "</div></div>\n";
79
        return $retval;
80
    }
81
82
    /**
83
     * generates the userWelcome div (shown after downloading an installer)
84
     * 
85
     * @return string the HTML code
86
     */
87
    public function divUserWelcome() {
88
        $retval = "
89
<div id='user_welcome'> <!-- this information is shown just before the download -->
90
    <strong>".$this->Gui->textTemplates->templates[user\WELCOME_ABOARD_PAGEHEADING]."</strong>
91
    <p>
92
    <span id='download_info'>
93
    <!-- the empty href is dynamically exchanged with the actual path by jQuery at runtime -->
94
        ".$this->Gui->textTemplates->templates[user\WELCOME_ABOARD_DOWNLOAD]."
95
    </span>
96
    <p>".$this->Gui->textTemplates->templates[user\WELCOME_ABOARD_HEADING]."
97
    <br/>
98
    <br/>";
99
        switch (\config\ConfAssistant::CONSORTIUM['name']) {
100
            case "eduroam":
101
                $retval .= $this->Gui->textTemplates->templates[user\EDUROAM_WELCOME_ADVERTISING];
102
                break;
103
            default:
104
        }
105
        $retval .= "
106
    </p>
107
    <p>".$this->Gui->textTemplates->templates[user\WELCOME_ABOARD_USAGE]."
108
    <p>".$this->Gui->textTemplates->templates[user\WELCOME_ABOARD_PROBLEMS]."
109
    <p>".(false ? $this->Gui->textTemplates->templates[user\WELCOME_ABOARD_TERMS] : "")."
110
    </p>
111
    <p>
112
    <a href='javascript:back_to_downloads()'><strong>".$this->Gui->textTemplates->templates[user\WELCOME_ABOARD_BACKTODOWNLOADS]."</strong></a>
113
    </p>
114
</div> <!-- id='user_welcomer_page' -->
115
";
116
        return $retval;
117
    }
118
119
    /**
120
     * generates the "go away" div when selecting a silverbullet institution
121
     * 
122
     * @return string the HTML code
123
     */
124
    public function divSilverbullet() {
125
        $retval = "
126
<div id='silverbullet'>"
127
               .$this->Gui->textTemplates->templates[user\SB_GO_AWAY] .
128
                "</div>
129
    ";
130
        return $retval;
131
    }
132
133
    /**
134
     * generates the main front page area div
135
     * 
136
     * @return string the HTML code
137
     */
138
    public function divTopWelcome() {
139
        $retval = '';
140
        if (\config\ConfAssistant::CONSORTIUM['name'] == "eduroam" && isset(\config\ConfAssistant::CONSORTIUM['deployment-voodoo']) && \config\ConfAssistant::CONSORTIUM['deployment-voodoo'] == "Operations Team") { // SW: APPROVED
141
            $retval = "<br><div id='top_invite_ad'>".$this->Gui->textTemplates->templates[user\FRONTPAGE_EDUROAM_AD]."</div>";
142
        }
143
        return "
144
<div id='welcome_top1'>
145
    ".$this->Gui->textTemplates->templates[user\HEADING_TOPLEVEL_GREET]."
146
</div>
147
<div id='top_invite'>
148
    ".$this->Gui->textTemplates->templates[user\HEADING_TOPLEVEL_PURPOSE].$retval."
149
</div>";
150
    }
151
152
    /**
153
     * generates the rolling device slideshow div
154
     * 
155
     * @return string the HTML code
156
     */
157
    public function divRoller() {
158
        $retval = "
159
<div id='roller'>
160
    <div id='slides'>
161
        <span id='line1'>".$this->Gui->textTemplates->templates[user\FRONTPAGE_ROLLER_EASY]."</span>
162
        <span id='line2'></span>
163
        <span id='line3'></span>
164
        <span id='line4'>";
165
166
        if (\config\Master::FUNCTIONALITY_LOCATIONS['CONFASSISTANT_RADIUS'] == "LOCAL") {
167
            $retval .= $this->Gui->textTemplates->templates[user\FRONTPAGE_ROLLER_CUSTOMBUILT];
168
        } elseif (\config\Master::FUNCTIONALITY_LOCATIONS['CONFASSISTANT_SILVERBULLET'] == "LOCAL") {
169
            $retval .= $this->Gui->textTemplates->templates[user\SB_FRONTPAGE_ROLLER_CUSTOMBUILT];
170
        }
171
172
        $retval .= "</span>
173
        <span id='line5'>";
174
        if (!empty(\config\ConfAssistant::CONSORTIUM['signer_name'])) {
175
            $retval .= $this->Gui->textTemplates->templates[user\FRONTPAGE_ROLLER_SIGNEDBY];
176
        }
177
        $retval .= "
178
        </span>
179
    </div>";
180
        $rollLocation = $this->Gui->skinObject->findResourceUrl("IMAGES", "empty.png");
181
        if ($rollLocation !== FALSE) {
182
            $retval .= "<div id = 'img_roll'>
183
                <img id='img_roll_0' src='$rollLocation' alt='Rollover 0'/> <img id='img_roll_1' src='$rollLocation' alt='Rollover 1'/>
184
            </div>";
185
        }
186
        $retval .= "</div>";
187
        return $retval;
188
    }
189
190
    /**
191
     * generates the div with the big download button
192
     * 
193
     * @return string the HTML code
194
     */
195
    public function divMainButton() {
196
        $retval = "<div id='user_button_td'>";
197
        $retval .= "<span id='signin'>
198
     <button class='large_button signin signin_large' id='user_button1'>
199
        <span id='user_button'>";
200
        if (\config\Master::FUNCTIONALITY_LOCATIONS['CONFASSISTANT_RADIUS'] == "LOCAL") {
201
            $retval .= $this->Gui->textTemplates->templates[user\FRONTPAGE_BIGDOWNLOADBUTTON];
202
        } elseif (\config\Master::FUNCTIONALITY_LOCATIONS['CONFASSISTANT_SILVERBULLET'] == "LOCAL") {
203
            $retval .= $this->Gui->textTemplates->templates[user\SB_FRONTPAGE_BIGDOWNLOADBUTTON];
204
        }
205
206
        $retval .= "
207
        </span>
208
     </button>
209
  </span>
210
  <span style='padding-left:50px'>&nbsp;</span>
211
</div>";
212
        return $retval;
213
    }
214
215
    /**
216
     * generates the profile selector menu div
217
     * 
218
     * @return string the HTML code
219
     */
220
    public function divProfiles() {
221
        return "
222
<div id='profiles'> <!-- this is the profile selection filled during run time -->
223
    <div id='profiles_h' class='sub_h'>".$this->Gui->textTemplates->templates[user\PROFILE_SELECTION]."
224
    </div>" .
225
                "<select id='profile_list'></select><div id='profile_desc' class='profile_desc'></div>" .
226
                "</div>";
227
    }
228
229
    /**
230
     * generates the head of the download page div
231
     * 
232
     * @param string $mainText  main text to show
233
     * @param string $extraText extra text to show
234
     * 
235
     * @return string
236
     */
237
    public function divPagetitle($mainText, $extraText = '') {
238
        return "
239
<div id='institution_name'>
240
    <span id='inst_name_span'>$mainText</span> <div id='inst_extra_text'>$extraText</div> 
241
</div>";
242
    }
243
244
    /**
245
     * generates the div for institution selection
246
     * 
247
     * @param boolean $selectButton should the "select another" be shown?
248
     * @return string
249
     */
250
    public function divInstitution($selectButton = TRUE) {
251
        $retval = "<div id='institution_name'>
252
    <span id='inst_name_span'></span> <div id='inst_extra_text'></div><!-- this will be filled with the IdP name -->" .
253
                ($selectButton ? "<a  id='select_another' class='signin' href=\"\">".$this->Gui->textTemplates->templates[user\INSTITUTION_SELECTION]."</a>" : "") .
254
                "</div>";
255
        $retval .= $this->emptyImage('idp_logo', 'IdP Logo');
256
        return $retval;
257
    }
258
259
    /**
260
     * generates the div for the federation logo display
261
     * 
262
     * @return string
263
     */
264
    public function divFederation() {
265
        $retval = $this->emptyImage('fed_logo', 'Federation Logo');
266
        return $retval;
267
    }
268
269
    /**
270
     * generates the div that lists all installer platforms
271
     * 
272
     * @return string
273
     */
274
    public function divOtherinstallers() {
275
        $retval = "
276
<div class='sub_h'>
277
    <div id='other_installers'>".$this->Gui->textTemplates->templates[user\DOWNLOAD_CHOOSE]."
278
        <table id='device_list' style='padding:0px;'>";
279
280
        foreach ($this->Gui->listDevices(isset($_REQUEST['hidden']) ? $_REQUEST['hidden'] : 0) as $group => $deviceGroup) {
281
            $groupIndex = count($deviceGroup);
282
            $deviceIndex = 0;
283
284
            $imgTag = "";
285
            $imgLocation = $this->Gui->skinObject->findResourceUrl("IMAGES", "vendorlogo/".$group.".png");
286
            if ($imgLocation !== FALSE) {
287
                $imgTag = '<img src="'.$imgLocation.'" alt="'.$group.' Device" title="'.$group.' Device">';
288
            }
289
            $retval .= '<tbody><tr><td class="vendor" rowspan="'.$groupIndex.'">'.$imgTag.'</td>';
290
            foreach ($deviceGroup as $d => $D) {
291
                if ($deviceIndex) {
292
                    $retval .= '<tr>';
293
                }
294
295
                $retval .= "<td><button name='$d' class='other_os' id='$d'>".$D['display']."</button>"
296
                       ."</td>"
297
                       ."<td><button name='$d' class='more_info_b' id='info_b_$d'>i</button></td></tr>\n";
298
                $deviceIndex++;
299
            }
300
            $retval .= "</tbody>";
301
        }
302
303
        $retval .= "    
304
        </table>
305
    </div>
306
</div>";
307
        return $retval;
308
    }
309
310
    public function OpenRoamingTou() {
0 ignored issues
show
Method name "Divs::OpenRoamingTou" is not in camel caps format
Loading history...
311
        return "<div id='openroaming_tou'  style='padding:10px'>
312
        <div id='or_text_1'></div>     
313
        <input type='checkbox' id='openroaming_check' name='openroaming_check'> <span id='or_text_2'>I want to use OpenRoaming and have read and accept <a href='https://wballiance.com/openroaming/toc-2020/' target='_blank'>OpenRoaming terms and conditions</a></span>
314
        </div>  ";
315
    }
316
    
317
    /**
318
     * generates the div with the big download button for the guessed OS
319
     * 
320
     * @param array $operatingSystem the guessed operating system
321
     * @return string
322
     */
323
    public function divGuessOs($operatingSystem) {
0 ignored issues
show
The parameter $operatingSystem is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

323
    public function divGuessOs(/** @scrutinizer ignore-unused */ $operatingSystem) {

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
324
        return "
325
<div id='guess_os_wrapper' class='sub_h guess_os' >
326
    <div id='download_text_1'></div>
327
    <div id='device_message'></div>
328
    <div id='guess_os' class='guess_os'></div>
329
</div>";
330
    }
331
332
    /**
333
     * generates the footer div
334
     * 
335
     * @return string
336
     */
337
    public function divFooter() {
338
        $retval = "
339
<div class='footer' id='footer'>
340
    <table>
341
        <tr>
342
            <td>" .
343
                $this->Gui->catVersion
344
               ."
345
            </td>";
346
347
        if (!empty(\config\Master::APPEARANCE['privacy_notice_url'])) {
348
              $retval .= "<td>".$this->Gui->catCopyrifhtAndLicense."<br><span id='privacy_notice_cons'>".\config\ConfAssistant::CONSORTIUM['display_name']."</span> <a href='".\config\Master::APPEARANCE['privacy_notice_url']."'>".sprintf(_("%s Privacy Notice"), '')."</a></td>";
349
        }
350
        $retval .= "<td>";
351
        if (\config\ConfAssistant::CONSORTIUM['name'] == "eduroam" && isset(\config\ConfAssistant::CONSORTIUM['deployment-voodoo']) && \config\ConfAssistant::CONSORTIUM['deployment-voodoo'] == "Operations Team") {
352
            $geant = $this->Gui->skinObject->findResourceUrl("IMAGES", "dante.png");
353
            $eu = $this->Gui->skinObject->findResourceUrl("IMAGES", "eu.png");
354
            if ($geant !== FALSE && $eu !== FALSE) {
355
                $retval .= "<span id='logos'><img src='$geant' alt='GEANT' style='height:23px;width:47px'/>
356
              <img src='$eu' alt='EU' style='height:23px;width:27px;border-width:0px;'/></span>";
357
            }
358
            $retval .= "<span id='eu_text'><a href='http://ec.europa.eu/dgs/connect/index_en.htm'>European Commission Communications Networks, Content and Technology</a></span>";
359
        } else {
360
            $retval .= "&nbsp;";
361
        }
362
363
        $retval .= "
364
            </td>
365
        </tr>
366
    </table>
367
</div>";
368
        return $retval;
369
    }
370
371
    /**
372
     * generates a div containing an empty image
373
     * 
374
     * @param string $id  id attribute for the div
375
     * @param string $alt alternative text for the div
376
     * @return string
377
     */
378
    private function emptyImage($id, $alt) {
379
        $empty = $this->Gui->skinObject->findResourceUrl("IMAGES", "empty.png");
380
        $retval = '';
381
        if ($empty !== FALSE) {
382
            $retval = "<div>
383
    <img id='$id' src='$empty' alt='$alt'/>
384
 </div>";
385
        }
386
        return $retval;
387
    }
388
389
}
390