SqlController::doDefault() - Code Metrics - Inspection of "scrutinizer build badge" - HuasoFoundries/phpPgAdmin6 - Measure and Improve Code Quality continuously with Scrutinizer

Test Failed
Branch — develop (db5506)

by Felipe
created 2017-10-08 18:16 UTC
SqlController::doDefault() B

↳ Parent: SqlController
Complexity

Conditions	4
Paths	5
Size

Total Lines	22
Code Lines	16
Duplication

Lines	0
Ratio	0 %
Importance

Changes
Metric	Value
cc	4
eloc	16
nc	5
nop	0
dl	0
loc	22
rs	8.9197
c	0
b	0
f	0
<?php

namespace PHPPgAdmin\Controller;

/**
 * Base controller class
 */
class SqlController extends BaseController
{
    public $_name      = 'SqlController';
    public $query      = '';
    public $subject    = '';
    public $start_time = null;
    public $duration   = null;

    public function render()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $conf = $this->conf;
        $lang = $this->lang;
        $misc = $this->misc;
        $data = $misc->getDatabaseAccessor();

        set_time_limit(0);

        // We need to store the query in a session for editing purposes
        // We avoid GPC vars to avoid truncating long queries
        if (isset($_REQUEST['subject']) && $_REQUEST['subject'] == 'history') {
            // Or maybe we came from the history popup
            $_SESSION['sqlquery'] = $_SESSION['history'][$_REQUEST['server']][$_REQUEST['database']][$_GET['queryid']]['query'];
            $this->query          = $_SESSION['sqlquery'];
        } elseif (isset($_POST['query'])) {
            // Or maybe we came from an sql form
            $_SESSION['sqlquery'] = $_POST['query'];
            $this->query          = $_SESSION['sqlquery'];
        } else {
            echo 'could not find the query!!';
        }

        // Pagination maybe set by a get link that has it as FALSE,
        // if that's the case, unset the variable.
        if (isset($_REQUEST['paginate']) && $_REQUEST['paginate'] == 'f') {
            unset($_REQUEST['paginate']);
            unset($_POST['paginate']);
            unset($_GET['paginate']);
        }

        if (isset($_REQUEST['subject'])) {
            $this->subject = $_REQUEST['subject'];
        }

        // Check to see if pagination has been specified. In that case, send to display
        // script for pagination
        /* if a file is given or the request is an explain, do not paginate */
        if (isset($_REQUEST['paginate']) && !(isset($_FILES['script']) && $_FILES['script']['size'] > 0) && (preg_match('/^\s*explain/i', $this->query) == 0)) {
            //if (!(isset($_FILES['script']) && $_FILES['script']['size'] > 0)) {

            $display_controller = new DisplayController($this->getContainer());

            return $display_controller->render();
        }

        $this->printHeader($lang['strqueryresults'], null, true, 'header_sqledit.twig');
        $this->printBody();
        $this->printTrail('database');
        $this->printTitle($lang['strqueryresults']);

        // Set the schema search path
        if (isset($_REQUEST['search_path'])) {

            if ($data->setSearchPath(array_map('trim', explode(',', $_REQUEST['search_path']))) != 0) {
                return $this->printFooter();
            }
        }

        // May as well try to time the query
        if (function_exists('microtime')) {
            list($usec, $sec) = explode(' ', microtime());
            $this->start_time = ((float) $usec + (float) $sec);
        }

        $this->doDefault();

        $this->doFooter(true, 'footer_sqledit.twig');
    }

    public function doDefault()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $conf        = $this->conf;
        $misc        = $this->misc;
        $lang        = $this->lang;
        $data        = $misc->getDatabaseAccessor();
        $_connection = $misc->getConnection();

        try {
            // Execute the query.  If it's a script upload, special handling is necessary
            if (isset($_FILES['script']) && $_FILES['script']['size'] > 0) {
                return $this->execute_script();
            } else {
                return $this->execute_query();
            }
        } catch (\PHPPgAdmin\ADOdbException $e) {
            $message   = $e->getMessage();
            $trace     = $e->getTraceAsString();
            $lastError = $_connection->getLastError();
            $this->prtrace(['message' => $message, 'trace' => $trace, 'lastError' => $lastError]);

            return null;
        }
    }

    private function execute_script()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $conf        = $this->conf;
        $misc        = $this->misc;
        $lang        = $this->lang;
        $data        = $misc->getDatabaseAccessor();
        $_connection = $misc->getConnection();

        /**
         * This is a callback function to display the result of each separate query
         * @param ADORecordSet $rs The recordset returned by the script execetor
         */
        $sqlCallback = function ($query, $rs, $lineno) use ($data, $misc, $lang, $_connection) {

            // Check if $rs is false, if so then there was a fatal error
            if ($rs === false) {
                echo htmlspecialchars($_FILES['script']['name']), ':', $lineno, ': ', nl2br(htmlspecialchars($_connection->getLastError())), "<br/>\n";
            } else {
                // Print query results
                switch (pg_result_status($rs)) {
                    case PGSQL_TUPLES_OK:
                        // If rows returned, then display the results
                        $num_fields = pg_numfields($rs);
                        echo "<p><table>\n<tr>";
                        for ($k = 0; $k < $num_fields; $k++) {
                            echo '<th class="data">', $misc->printVal(pg_fieldname($rs, $k)), '</th>';
                        }

                        $i   = 0;
                        $row = pg_fetch_row($rs);
                        while ($row !== false) {
                            $id = (($i % 2) == 0 ? '1' : '2');
                            echo "<tr class=\"data{$id}\">\n";
                            foreach ($row as $k => $v) {
                                echo '<td style="white-space:nowrap;">', $misc->printVal($v, pg_fieldtype($rs, $k), ['null' => true]), '</td>';
                            }
                            echo "</tr>\n";
                            $row = pg_fetch_row($rs);
                            $i++;
                        }
                        ;
                        echo "</table><br/>\n";
                        echo $i, " {$lang['strrows']}</p>\n";
                        break;
                    case PGSQL_COMMAND_OK:
                        // If we have the command completion tag
                        if (version_compare(phpversion(), '4.3', '>=')) {
                            echo htmlspecialchars(pg_result_status($rs, PGSQL_STATUS_STRING)), "<br/>\n";
                        }
                        // Otherwise if any rows have been affected
                        elseif ($data->conn->Affected_Rows() > 0) {
                            echo $data->conn->Affected_Rows(), " {$lang['strrowsaff']}<br/>\n";
                        }
                        // Otherwise output nothing...
                        break;
                    case PGSQL_EMPTY_QUERY:
                        break;
                    default:
                        break;
                }
            }
        };

        return $data->executeScript('script', $sqlCallback);
    }

    private function execute_query()
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $conf = $this->conf;
        $misc = $this->misc;
        $lang = $this->lang;
        $data = $misc->getDatabaseAccessor();

        // Set fetch mode to NUM so that duplicate field names are properly returned
        $data->conn->setFetchMode(ADODB_FETCH_NUM);

        $rs = $data->conn->Execute($this->query);

        echo '<form method="post" id="sqlform" action="' . $_SERVER['REQUEST_URI'] . '">';
// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);
        echo '<textarea width="90%" name="query"  id="query" rows="5" cols="100" resizable="true">';

        echo htmlspecialchars($this->query);
        echo '</textarea><br>';
        echo $misc->setForm();
        echo '<input type="submit"/></form>';

        // $rs will only be an object if there is no error
        if (is_object($rs)) {
            // Request was run, saving it in history
            if (!isset($_REQUEST['nohistory'])) {
                $misc->saveScriptHistory($this->query);
            }

            // Now, depending on what happened do various things

            // First, if rows returned, then display the results
            if ($rs->recordCount() > 0) {
                echo "<table>\n<tr>";
                foreach ($rs->fields as $k => $v) {

                    $finfo = $rs->fetchField($k);
                    echo '<th class="data">', $misc->printVal($finfo->name), '</th>';
                }
                echo "</tr>\n";
                $i = 0;
                while (!$rs->EOF) {
                    $id = (($i % 2) == 0 ? '1' : '2');
                    echo "<tr class=\"data{$id}\">\n";
                    foreach ($rs->fields as $k => $v) {

                        $finfo = $rs->fetchField($k);
                        echo '<td style="white-space:nowrap;">', $misc->printVal($v, $finfo->type, ['null' => true]), '</td>';
                    }
                    echo "</tr>\n";
                    $rs->moveNext();
                    $i++;
                }
                echo "</table>\n";
                echo '<p>', $rs->recordCount(), " {$lang['strrows']}</p>\n";
            } elseif ($data->conn->Affected_Rows() > 0) {
                // Otherwise if any rows have been affected
                echo '<p>', $data->conn->Affected_Rows(), " {$lang['strrowsaff']}</p>\n";
            } else {
                // Otherwise nodata to print
                echo '<p>', $lang['strnodata'], "</p>\n";
            }
        }
    }

    private function doFooter($doBody = true, $template = 'footer.twig')
// Bad
class Router
{
    public function generate($path)
    {
        return $_SERVER['HOST'].$path;
    }
}

// Better
class Router
{
    private $host;

    public function __construct($host)
    {
        $this->host = $host;
    }

    public function generate($path)
    {
        return $this->host.$path;
    }
}

class Controller
{
    public function myAction(Request $request)
    {
        // Instead of
        $page = isset($_GET['page']) ? intval($_GET['page']) : 1;

        // Better (assuming you use the Symfony2 request)
        $page = $request->query->get('page', 1);
    }
}
    {
        $conf = $this->conf;
        $misc = $this->misc;
        $lang = $this->lang;
        $data = $misc->getDatabaseAccessor();

        // May as well try to time the query
        if ($this->start_time !== null) {
            list($usec, $sec) = explode(' ', microtime());
            $end_time         = ((float) $usec + (float) $sec);
            // Get duration in milliseconds, round to 3dp's
            $this->duration = number_format(($end_time - $this->start_time) * 1000, 3);
        }

        // Reload the browser as we may have made schema changes
        $misc->setReloadBrowser(true);

        // Display duration if we know it
        if ($this->duration !== null) {
            echo '<p>', sprintf($lang['strruntime'], $this->duration), "</p>\n";
        }

        echo "<p>{$lang['strsqlexecuted']}</p>\n";

        $navlinks = [];
        $fields   = [
            'server'   => $_REQUEST['server'],
            'database' => $_REQUEST['database'],
        ];

        if (isset($_REQUEST['schema'])) {
            $fields['schema'] = $_REQUEST['schema'];
        }

        // Return
        if (isset($_REQUEST['return'])) {

            $urlvars          = $misc->getSubjectParams($_REQUEST['return']);
            $navlinks['back'] = [
                'attr'    => [
                    'href' => [
                        'url'     => $urlvars['url'],
                        'urlvars' => $urlvars['params'],
                    ],
                ],
                'content' => $lang['strback'],
            ];
        }

        // Edit
        $navlinks['alter'] = [
            'attr'    => [
                'href' => [
                    'url'     => 'database.php',
                    'urlvars' => array_merge($fields, [
                        'action' => 'sql',
                    ]),
                ],
            ],
            'content' => $lang['streditsql'],
        ];

        // Create view and download
        if ($this->query !== '' && isset($rs) && is_object($rs) && $rs->recordCount() > 0) {
            // Report views don't set a schema, so we need to disable create view in that case
            if (isset($_REQUEST['schema'])) {

                $navlinks['createview'] = [
                    'attr'    => [
                        'href' => [
                            'url'     => 'views.php',
                            'urlvars' => array_merge($fields, [
                                'action' => 'create',
                            ]),
                        ],
                    ],
                    'content' => $lang['strcreateview'],
                ];
            }

            if (isset($_REQUEST['search_path'])) {
                $fields['search_path'] = $_REQUEST['search_path'];
            }

            $navlinks['download'] = [
                'attr'    => [
                    'href' => [
                        'url'     => 'dataexport.php',
                        'urlvars' => $fields,
                    ],
                ],
                'content' => $lang['strdownload'],
            ];
        }

        $this->printNavLinks($navlinks, 'sql-form', get_defined_vars());

        return $this->printFooter($doBody, $template);
    }
}

Branch — develop (db5506)

SqlController::doDefault() B

Complexity

Size

Duplication

Importance

1 path for user data to reach this point

Preventing Cross-Site-Scripting Attacks

General Strategies to prevent injection

HuasoFoundries / phpPgAdmin6

Branch — develop (db5506)

SqlController::doDefault() B

Complexity

Size

Duplication

Importance

1 path for user data to reach this point

Preventing Cross-Site-Scripting Attacks

General Strategies to prevent injection

Duplication Side-by-Side

Filter issues like
