Issues (3948)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

app/Helpers/UrlHelper.php (9 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/*
4
 * This file is part of Jitamin.
5
 *
6
 * Copyright (C) Jitamin Team
7
 *
8
 * For the full copyright and license information, please view the LICENSE
9
 * file that was distributed with this source code.
10
 */
11
12
namespace Jitamin\Helper;
13
14
use Jitamin\Foundation\Base;
15
16
/**
17
 * Url Helper.
18
 */
19
class UrlHelper extends Base
20
{
21
    private $base = '';
22
    private $directory = '';
23
24
    /**
25
     * Helper to generate a link to the documentation.
26
     *
27
     * @param string $label
28
     * @param string $file
29
     *
30
     * @return string
31
     */
32
    public function doc($label, $file)
33
    {
34
        return $this->link($label, 'DocumentationController', 'show', ['file' => $file], false, '', '', true);
35
    }
36
37
    /**
38
     * Button Link Element.
39
     *
40
     * @param string $icon       Font-Awesome icon
41
     * @param string $label      Link label
42
     * @param string $controller Controller name
43
     * @param string $action     Action name
44
     * @param array  $params     Url parameters
45
     * @param string $class      CSS class attribute
46
     *
47
     * @return string
48
     */
49
    public function button($icon, $label, $controller, $action, array $params = [], $class = '')
50
    {
51
        $icon = '<i class="fa '.$icon.' fa-fw"></i> ';
52
        $class = 'btn '.$class;
53
54
        return $this->link($icon.$label, $controller, $action, $params, false, $class);
55
    }
56
57
    /**
58
     * Link element.
59
     *
60
     * @param string $label      Link label
61
     * @param string $controller Controller name
62
     * @param string $action     Action name
63
     * @param array  $params     Url parameters
64
     * @param bool   $csrf       Add a CSRF token
65
     * @param string $class      CSS class attribute
66
     * @param string $title      Link title
67
     * @param bool   $new_tab    Open the link in a new tab
68
     * @param string $anchor     Link Anchor
69
     * @param bool   $absolute
70
     *
71
     * @return string
72
     */
73
    public function link($label, $controller, $action, array $params = [], $csrf = false, $class = '', $title = '', $new_tab = false, $anchor = '', $absolute = false)
74
    {
75
        return '<a href="'.$this->href($controller, $action, $params, $csrf, $anchor, $absolute).'" class="'.$class.'" title=\''.$title.'\' '.($new_tab ? 'target="_blank"' : '').'>'.$label.'</a>';
76
    }
77
78
    /**
79
     * Absolute link.
80
     *
81
     * @param string $label
82
     * @param string $controller
83
     * @param string $action
84
     * @param array  $params
85
     *
86
     * @return string
87
     */
88
    public function absoluteLink($label, $controller, $action, array $params = [])
89
    {
90
        return $this->link($label, $controller, $action, $params, false, '', '', true, '', true);
91
    }
92
93
    /**
94
     * HTML Hyperlink.
95
     *
96
     * @param string $controller Controller name
97
     * @param string $action     Action name
98
     * @param array  $params     Url parameters
99
     * @param bool   $csrf       Add a CSRF token
100
     * @param string $anchor     Link Anchor
101
     * @param bool   $absolute   Absolute or relative link
102
     *
103
     * @return string
104
     */
105
    public function href($controller, $action, array $params = [], $csrf = false, $anchor = '', $absolute = false)
106
    {
107
        if (isset($params['q']) && $params['q'] === 'status:open') {
108
            unset($params['q']);
109
        }
110
111
        return $this->build('&amp;', $controller, $action, $params, $csrf, $anchor, $absolute);
112
    }
113
114
    /**
115
     * Generate controller/action url.
116
     *
117
     * @param string $controller Controller name
118
     * @param string $action     Action name
119
     * @param array  $params     Url parameters
120
     * @param string $anchor     Link Anchor
121
     * @param bool   $absolute   Absolute or relative link
122
     *
123
     * @return string
124
     */
125
    public function to($controller, $action, array $params = [], $anchor = '', $absolute = false)
126
    {
127
        return $this->build('&', $controller, $action, $params, false, $anchor, $absolute);
128
    }
129
130
    /**
131
     * Get application base url.
132
     *
133
     * @return string
134
     */
135
    public function base()
136
    {
137
        if (empty($this->base)) {
138
            $this->base = $this->settingModel->get('application_url') ?: $this->server();
0 ignored issues
show
The property settingModel does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
139
        }
140
141
        return $this->base;
142
    }
143
144
    /**
145
     * Get application base directory.
146
     *
147
     * @return string
148
     */
149
    public function dir()
150
    {
151
        if ($this->directory === '' && $this->request->getMethod() !== '') {
0 ignored issues
show
The property request does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
152
            $this->directory = str_replace('\\', '/', dirname($this->request->getServerVariable('PHP_SELF')));
0 ignored issues
show
The property request does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
153
            $this->directory = $this->directory !== '/' ? $this->directory.'/' : '/';
154
            $this->directory = str_replace('//', '/', $this->directory);
155
        }
156
157
        return $this->directory;
158
    }
159
160
    /**
161
     * Get current server base url.
162
     *
163
     * @return string
164
     */
165
    public function server()
166
    {
167
        if ($this->request->getServerVariable('SERVER_NAME') === '') {
0 ignored issues
show
The property request does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
168
            return 'http://localhost/';
169
        }
170
171
        $url = $this->request->isHTTPS() ? 'https://' : 'http://';
0 ignored issues
show
The property request does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
172
        $url .= $this->request->getServerVariable('SERVER_NAME');
0 ignored issues
show
The property request does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
173
        $url .= $this->request->getServerVariable('SERVER_PORT') == 80 || $this->request->getServerVariable('SERVER_PORT') == 443 ? '' : ':'.$this->request->getServerVariable('SERVER_PORT');
0 ignored issues
show
The property request does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
174
        $url .= $this->dir() ?: '/';
175
176
        return $url;
177
    }
178
179
    /**
180
     * Build relative url.
181
     *
182
     * @param string $separator  Querystring argument separator
183
     * @param string $controller Controller name
184
     * @param string $action     Action name
185
     * @param array  $params     Url parameters
186
     * @param bool   $csrf       Add a CSRF token
187
     * @param string $anchor     Link Anchor
188
     * @param bool   $absolute   Absolute or relative link
189
     *
190
     * @return string
191
     */
192
    protected function build($separator, $controller, $action, array $params = [], $csrf = false, $anchor = '', $absolute = false)
193
    {
194
        $path = $this->route->findUrl($controller, $action, $params);
0 ignored issues
show
The property route does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
195
        $qs = [];
196
197
        if (empty($path)) {
198
            $qs['controller'] = $controller;
199
            $qs['action'] = $action;
200
            $qs += $params;
201
        } else {
202
            unset($params['plugin']);
203
        }
204
205
        if ($csrf) {
206
            $qs['csrf_token'] = $this->token->getCSRFToken();
0 ignored issues
show
The property token does not exist on object<Jitamin\Helper\UrlHelper>. Since you implemented __get, maybe consider adding a @property annotation.

Since your code implements the magic getter _get, this function will be called for any read access on an undefined variable. You can add the @property annotation to your class or interface to document the existence of this variable.

<?php

/**
 * @property int $x
 * @property int $y
 * @property string $text
 */
class MyLabel
{
    private $properties;

    private $allowedProperties = array('x', 'y', 'text');

    public function __get($name)
    {
        if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
            return $properties[$name];
        } else {
            return null;
        }
    }

    public function __set($name, $value)
    {
        if (in_array($name, $this->allowedProperties)) {
            $properties[$name] = $value;
        } else {
            throw new \LogicException("Property $name is not defined.");
        }
    }

}

If the property has read access only, you can use the @property-read annotation instead.

Of course, you may also just have mistyped another name, in which case you should fix the error.

See also the PhpDoc documentation for @property.

Loading history...
207
        }
208
209
        if (!empty($qs)) {
210
            $prefix = '';
211
            if (isset($qs['controller'])) {
212
                unset($qs['controller']);
213
                $prefix = 'controller='.$controller.$separator;
214
            }
215
            $path .= '?'.$prefix.http_build_query($qs, '', $separator);
216
        }
217
218
        return ($absolute ? $this->base() : $this->dir()).$path.(empty($anchor) ? '' : '#'.$anchor);
219
    }
220
}
221