Issues (24)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

classes/Migration.php (5 issues)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php defined('SYSPATH') OR die('No direct script access.');
2
3
/**
4
 * Migration.
5
 */
6
abstract class Migration
7
{
8
	private $driver = null;
9
	private $config = null;
10
	private $dry_run = false;
11
12
	abstract public function up();
13
	abstract public function down();
14
15
16
	public function __construct($config = null)
17
	{
18
		$this->config = arr::merge(Kohana::$config->load('migrations')->as_array(), (array) $config);
19
		$this->driver(Migration_Driver::factory(Arr::get($this->config, 'database', 'default')));
20
	}
21 13
22
	/**
23 13
	 * Get or set the current driver
24 13
	 */
25 13
	public function driver(Migration_Driver $driver = NULL)
26
	{
27
		if ($driver !== NULL)
28
		{
29
			$this->driver = $driver;
30 13
			return $this;
31
		}
32 13
		return $this->driver;
33 13
	}
34 13
35 13
	public function log($message)
36
	{
37 1
		if ($this->config['log'])
38
		{
39
			call_user_func($this->config['log'], $message);
40 11
		}
41
		else
42 11
		{
43 11
			echo $message."\n";
44 11
			ob_flush();
45 11
		}
46
	}
47
48
	public function dry_run($dry_run = NULL)
49
	{
50
		if ($dry_run !== NULL)
51 11
		{
52
			$this->dry_run = $dry_run;
53 11
			return $this;
54
		}
55 11
56 11
		return $this->dry_run;
57 11
	}
58 11
59
	protected function run_driver($title, $method, $args, $will_return = FALSE)
60
	{
61
		if ($title)
62
		{
63
			$this->log("-- ".($this->dry_run ? "[dry-run]" : '')."$title");
64 11
		}
65
		$start = microtime(TRUE);
66
		$return = NULL;
67 11
68 11
		if ( ! $this->dry_run)
69 11
		{
70 11
			$return = call_user_func_array(array($this->driver, $method), $args);
71 11
		}
72
		$end = microtime(TRUE);
73 11
74 11
		if ($title)
75 11
		{
76 11
			$this->log('   --> '.number_format($end-$start, 4).'s'.($method == 'execute' ? ', affected rows: '.$this->driver->affected_rows() : ''));
77 11
		}
78
		return $will_return ? $return : $this;
79
	}
80 11
81 11
	public function execute($sql, $params = NULL, $display = NULL)
0 ignored issues
show
The parameter $params is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
82 11
	{
83 11
		$args = func_get_args();
84
		if ($display === NULL)
85
		{
86 1
			$display = str_replace("\n", '↵', $sql);
87
			$display = preg_replace("/[\s]+/", " ", $display);
88 1
			$display = "execute( ".Text::limit_chars($display, 80)." )";
89 1
		}
90 1
		return $this->run_driver($display, __FUNCTION__, $args);
91 1
	}
92 1
93 1
	public function query($sql, $params = NULL)
0 ignored issues
show
The parameter $params is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
94 1
	{
95 1
		$args = func_get_args();
96 1
		$display = str_replace("\n", '↵', $sql);
97
		$display = preg_replace("/[\s]+/", " ", $display);
98
		$display = Text::limit_chars($display, 60);
99
		return $this->run_driver("query( $display )", __FUNCTION__, $args, TRUE);
100
	}
101
102
103
	public function quote($value)
104
	{
105
		if (is_array($value))
106
		{
107
			return '('.join(', ', array_map(array($this->driver(), 'quote'), $value)).')';
108
		}
109
		else
110
		{
111
			return $this->driver()->quote($value);
112
		}
113
	}
114
115
	/**
116
	 * Create Table
117
	 *
118
	 * Creates a new table
119
	 *
120
	 * $fields:
121
	 *
122
	 * 		Associative array containing the name of the field as a key and the
123
	 * 		value could be either a string indicating the type of the field, or an
124
	 * 		array containing the field type at the first position and any optional
125
	 * 		arguments the field might require in the remaining positions.
126
	 * 		Refer to the TYPES function for valid type arguments.
127
	 * 		Refer to the FIELD_ARGUMENTS function for valid optional arguments for a
128
	 * 		field.
129
	 *
130
	 * @code
131
	 *
132
	 *		create_table (
133
	 * 			'blog',
134
	 * 			array (
135
	 * 				'title' => array ( 'string[50]', default => "The blog's title." ),
136
	 * 				'date' => 'date',
137
	 * 				'content' => 'text'
138
	 * 			),
139
	 * 		)
140
	 * @endcode
141
	 * @param	string   Name of the table to be created
142
	 * @param	array
143
	 * @param	array    array of options - 'primary_key', false if not desired, not specified sets to 'id' column. Will be set to auto_increment, serial, etc. , 'if_not_exists' - bool, and all the others will be added as options to the end of the create table clause.
144
	 * @param bool if_not_exists
145
	 * @return	boolean
146
	 */
147
	public function create_table($table_name, $fields, $options = NULL)
0 ignored issues
show
The parameter $options is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
148
	{
149
		$args = func_get_args();
150
		return $this->run_driver("create_table( $table_name, array(".join(", ", array_keys($fields)).") )", __FUNCTION__, $args);
151
	}
152 1
153
	/**
154 1
	 * Drop a table
155 1
	 *
156
	 * @param string    Name of the table
157
	 * @return boolean
158
	 */
159
	public function drop_table($table_name)
160
	{
161
		$args = func_get_args();
162
		return $this->run_driver("drop_table( $table_name )", __FUNCTION__, $args);
163
	}
164 1
165
	/**
166 1
	 * Change table options (passed directly to alter table)
167 1
	 *
168
	 * @param string $table_name
169
	 * @param array $options an array of options
170
	 * @return boolean
171
	 */
172
	public function change_table($table_name, $options)
173
	{
174
		$args = func_get_args();
175
		return $this->run_driver("change_table( $table_name , array(".join(", ", array_keys((array) $options))."))", __FUNCTION__, $args);
176
	}
177 1
178
	/**
179 1
	 * Rename a table
180 1
	 *
181
	 * @param   string    Old table name
182
	 * @param   string    New name
183
	 * @return  boolean
184
	 */
185
	public function rename_table($old_name, $new_name)
186
	{
187
		$args = func_get_args();
188
		return $this->run_driver("rename_table( $old_name, $new_name )", __FUNCTION__, $args);
189
	}
190 1
191
	/**
192 1
	 * Add a column to a table
193 1
	 *
194
	 * @code
195
	 * add_column ( "the_table", "the_field", array('string', 'limit[25]', 'not_null') );
196
	 * add_coumnn ( "the_table", "int_field", "integer" );
197
	 * @endcode
198
	 *
199
	 * @param   string  Name of the table
200
	 * @param   string  Name of the column
201
	 * @param   array   Column arguments array
202
	 * @return  bool
203
	 */
204
	public function add_column($table_name, $column_name, $params)
0 ignored issues
show
The parameter $params is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
205
	{
206
		$args = func_get_args();
207
		return $this->run_driver("add_column( $table_name, $column_name )", __FUNCTION__, $args);
208
	}
209 1
210
	/**
211 1
	 * Rename a column
212 1
	 *
213
	 * @param   string  Name of the table
214
	 * @param   string  Name of the column
215
	 * @param   string  New name
216
	 * @return  bool
217
	 */
218
	public function rename_column($table_name, $column_name, $new_column_name)
219
	{
220
		$args = func_get_args();
221
		return $this->run_driver("rename_column( $table_name, $column_name, $new_column_name )", __FUNCTION__, $args);
222
	}
223 1
224
	/**
225 1
	 * Alter a column
226 1
	 *
227
	 * @param   string  Table name
228
	 * @param   string  Columnn ame
229
	 * @param   array   Column arguments
230
	 * @return  bool
231
	 */
232
	public function change_column($table_name, $column_name, $params)
0 ignored issues
show
The parameter $params is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
233
	{
234
		$args = func_get_args();
235
		return $this->run_driver("change_column( $table_name, $column_name )", __FUNCTION__, $args);
236
	}
237 1
238
	/**
239 1
	 * Remove a column from a table
240 1
	 *
241
	 * @param   string  Name of the table
242
	 * @param   string  Name of the column
243
	 * @return  bool
244
	 */
245
	public function remove_column($table_name, $column_name)
246
	{
247
		$args = func_get_args();
248
		return $this->run_driver("remove_column( $table_name, $column_name )", __FUNCTION__, $args);
249
	}
250 1
251
	/**
252 1
	 * Add an index
253 1
	 *
254
	 * @param   string  Name of the table
255
	 * @param   string  Name of the index
256
	 * @param   string|array  Name(s) of the column(s)
257
	 * @param   string  Type of the index (unique/normal/primary)
258
	 * @return  bool
259
	 */
260
	public function add_index($table_name, $index_name, $columns, $index_type = 'normal')
261
	{
262
		$args = func_get_args();
263
		return $this->run_driver("add_index( $table_name, $index_name, array(".join(', ',(array) $columns)."), $index_type )", __FUNCTION__, $args);
264
	}
265 1
266
	/**
267 1
	 * Remove an index
268 1
	 *
269
	 * @param   string  Name of the table
270
	 * @param   string  Name of the index
271
	 * @return  bool
272
	 */
273
	public function remove_index($table_name, $index_name)
274
	{
275
		$args = func_get_args();
276
		return $this->run_driver("remove_index( $table_name, $index_name )", __FUNCTION__, $args);
277
	}
278 1
279
}
280