Passed
Push — development ( 171f18...98bd13 )
by Thomas
02:07
created

htdocs/lib2/logic/picture.class.php (7 issues)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/***************************************************************************
3
 * for license information see doc/license.txt
4
 *
5
 *
6
 *   get/set has to be commited with save
7
 *   add/remove etc. is executed instantly
8
 ***************************************************************************/
9
10
require_once __DIR__ . '/const.inc.php';
11
12
class picture
13
{
14
    public $nPictureId = 0;
15
    public $rePicture;
16
    public $sFileExtension = '';
17
    public $bFilenamesSet = false;
18
19
    public static function pictureIdFromUUID($uuid)
20
    {
21
        return sql_value("SELECT `id` FROM `pictures` WHERE `uuid`='&1'", 0, $uuid);
22
    }
23
24
    public static function fromUUID($uuid)
25
    {
26
        $pictureId = picture::pictureIdFromUUID($uuid);
27
        if ($pictureId == 0) {
28
            return null;
29
        }
30
31
        return new picture($pictureId);
32
    }
33
34
    public function __construct($nNewPictureId = ID_NEW)
35
    {
36
        global $opt;
37
38
        $this->rePicture = new rowEditor('pictures');
39
        $this->rePicture->addPKInt('id', null, false, RE_INSERT_AUTOINCREMENT);
40
        $this->rePicture->addString('uuid', '', false, RE_INSERT_AUTOUUID);
41
        $this->rePicture->addInt('node', 0, false);
42
        $this->rePicture->addDate('date_created', time(), true, RE_INSERT_IGNORE);
43
        $this->rePicture->addDate('last_modified', time(), true, RE_INSERT_IGNORE);
44
        $this->rePicture->addString('url', '', false);
45
        $this->rePicture->addString('title', '', false);
46
        $this->rePicture->addDate('last_url_check', 0, true);
47
        $this->rePicture->addInt('object_id', null, false);
48
        $this->rePicture->addInt('object_type', null, false);
49
        $this->rePicture->addString('thumb_url', '', false);
50
        $this->rePicture->addDate('thumb_last_generated', 0, false);
51
        $this->rePicture->addInt('spoiler', 0, false);
52
        $this->rePicture->addInt('local', 0, false);
53
        $this->rePicture->addInt('unknown_format', 0, false);
54
        $this->rePicture->addInt('display', 1, false);
55
        $this->rePicture->addInt('mappreview', 0, false);
56
        $this->rePicture->addInt('seq', 0, false);
57
58
        $this->nPictureId = $nNewPictureId + 0;
59
60
        if ($nNewPictureId == ID_NEW) {
61
            $this->rePicture->addNew(null);
62
63
            $sUUID = mb_strtoupper(sql_value("SELECT UUID()", ''));
64
            $this->rePicture->setValue('uuid', $sUUID);
65
            $this->rePicture->setValue('node', $opt['logic']['node']['id']);
66
        } else {
67
            $this->rePicture->load($this->nPictureId);
68
69
            $sFilename = $this->getFilename();
70
            $fna = mb_split('\\.', $sFilename);
71
            $this->sFileExtension = mb_strtolower($fna[count($fna) - 1]);
72
73
            $this->bFilenamesSet = true;
74
        }
75
    }
76
77
    /**
78
     * @return bool
79
     */
80
    public function exist()
81
    {
82
        return $this->rePicture->exist();
83
    }
84
85
    /**
86
     * @param $sFilename
87
     * @return bool
88
     */
89
    public static function allowedExtension($sFilename)
90
    {
91
        global $opt;
92
93
        if (strpos($sFilename, ';') !== false) {
94
            return false;
95
        }
96
        if (strpos($sFilename, '.') === false) {
97
            return false;
98
        }
99
100
        $sExtension = mb_strtolower(substr($sFilename, strrpos($sFilename, '.') + 1));
101
102
        if (strpos(';' . $opt['logic']['pictures']['extensions'] . ';', ';' . $sExtension . ';') !== false) {
103
            return true;
104
        } else {
105
            return false;
106
        }
107
    }
108
109
    /**
110
     * @param string $sFilename
111
     */
112
    public function setFilenames($sFilename)
113
    {
114
        global $opt;
115
116
        if ($this->bFilenamesSet == true) {
117
            return;
118
        }
119
        if (strpos($sFilename, '.') === false) {
120
            return;
121
        }
122
123
        $sExtension = mb_strtolower(substr($sFilename, strrpos($sFilename, '.') + 1));
124
        $this->sFileExtension = $sExtension;
125
126
        $sUUID = $this->getUUID();
127
128
        $this->setUrl($opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension);
129
130
        $this->bFilenamesSet = true;
131
    }
132
133
    /**
134
     * @return int
135
     */
136
    public function getPictureId()
137
    {
138
        return $this->nPictureId;
139
    }
140
141
    /**
142
     * @param boolean $bRestoring
143
     * @param int $original_id
144
     */
145
    private function setArchiveFlag($bRestoring, $original_id = 0)
146
    {
147
        global $login;
148
149
        // This function determines if an insert, update oder deletion at pictures table
150
        // ist to be recorded for vandalism recovery, depending on WHO OR WHY the
151
        // operation is done. Other conditions, depending on the data, are handled
152
        // by triggers.
153
        //
154
        // Data is passed by ugly global DB variables, so try call this function as
155
        // close before the targetet DB operation as possible.
156
157
        if ($this->getObjectType() == 1) {
158
            $logger_id = sql_value(
159
                "SELECT
160
                    IFNULL((SELECT `user_id` FROM `cache_logs` WHERE `id`='&1'),
161
                           (SELECT `user_id` FROM `cache_logs_archived` WHERE `id`='&1'))",
162
                0,
163
                $this->getObjectId()
164
            );
165
            $archive = ($bRestoring || $login->userid != $logger_id);
166
        } else {
167
            $archive = true;
168
        }
169
170
        sql("SET @archive_picop=" . ($archive ? "TRUE" : "FALSE"));
171
        sql_slave("SET @archive_picop=" . ($archive ? "TRUE" : "FALSE"));
172
173
        sql("SET @original_picid='&1'", $original_id);
174
        sql_slave("SET @original_picid='&1'", $original_id);
175
176
        // @archive_picop and @original_picid are evaluated by trigger functions
177
    }
178
179
    private function resetArchiveFlag()
180
    {
181
        sql("SET @archive_picop=FALSE");
182
        sql("SET @original_picid=0");
183
        sql_slave("SET @archive_picop=FALSE");
184
        sql_slave("SET @original_picid=0");
185
    }
186
187
    /**
188
     * @return string
189
     */
190
    public function getUrl()
191
    {
192
        return $this->rePicture->getValue('url');
193
    }
194
195
    /**
196
     * @param string $value
197
     * @return bool
198
     */
199
    public function setUrl($value)
200
    {
201
        return $this->rePicture->setValue('url', $value);
202
    }
203
204
    /**
205
     * @return mixed
206
     */
207
    public function getThumbUrl()
208
    {
209
        return $this->rePicture->getValue('thumb_url');
210
    }
211
212
    /**
213
     * @param $value
214
     * @return bool
215
     */
216
    public function setThumbUrl($value)
217
    {
218
        return $this->rePicture->setValue('thumb_url', $value);
219
    }
220
221
    /**
222
     * @return mixed
223
     */
224
    public function getTitle()
225
    {
226
        return $this->rePicture->getValue('title');
227
    }
228
229
    /**
230
     * @param $value
231
     * @return bool
232
     */
233
    public function setTitle($value)
234
    {
235
        if ($value != '') {
236
            return $this->rePicture->setValue('title', $value);
237
        } else {
238
            return false;
239
        }
240
    }
241
242
    /**
243
     * @return bool
244
     */
245
    public function getSpoiler()
246
    {
247
        return $this->rePicture->getValue('spoiler') != 0;
248
    }
249
250
    /**
251
     * @param $value
252
     * @return bool
253
     */
254
    public function setSpoiler($value)
255
    {
256
        return $this->rePicture->setValue('spoiler', $value ? 1 : 0);
257
    }
258
259
    /**
260
     * @return bool
261
     */
262
    public function getLocal()
263
    {
264
        return $this->rePicture->getValue('local') != 0;
265
    }
266
267
    /**
268
     * @param integer $value
269
     * @return bool
270
     */
271
    public function setLocal($value)
272
    {
273
        return $this->rePicture->setValue('local', $value ? 1 : 0);
274
    }
275
276
    /**
277
     * @return bool
278
     */
279
    public function getUnknownFormat()
280
    {
281
        return $this->rePicture->getValue('unknown_format') != 0;
282
    }
283
284
    /**
285
     * @param $value
286
     * @return bool
287
     */
288
    public function setUnknownFormat($value)
289
    {
290
        return $this->rePicture->setValue('unknown_format', $value ? 1 : 0);
291
    }
292
293
    /**
294
     * @return bool
295
     */
296
    public function getDisplay()
297
    {
298
        return $this->rePicture->getValue('display') != 0;
299
    }
300
301
    /**
302
     * @param $value
303
     * @return bool
304
     */
305
    public function setDisplay($value)
306
    {
307
        return $this->rePicture->setValue('display', $value ? 1 : 0);
308
    }
309
310
    /**
311
     * @return bool
312
     */
313
    public function getMapPreview()
314
    {
315
        return $this->rePicture->getValue('mappreview') != 0;
316
    }
317
318
    /**
319
     * @param $value
320
     * @return bool
321
     */
322
    public function setMapPreview($value)
323
    {
324
        return $this->rePicture->setValue('mappreview', $value ? 1 : 0);
325
    }
326
327
    /**
328
     * @return string
329
     */
330
    public function getFilename()
331
    {
332
        // works intendently before bFilenameSet == true !
333
        global $opt;
334
335 View Code Duplication
        if (mb_substr($opt['logic']['pictures']['dir'], -1, 1) != '/') {
336
            $opt['logic']['pictures']['dir'] .= '/';
337
        }
338
339
        $url = $this->getUrl();
340
        $fna = mb_split('\\/', $url);
341
342
        return $opt['logic']['pictures']['dir'] . end($fna);
343
    }
344
345
    /**
346
     * @return string
347
     */
348
    public function getThumbFilename()
349
    {
350
        global $opt;
351
352 View Code Duplication
        if (mb_substr($opt['logic']['pictures']['thumb_dir'], -1, 1) != '/') {
353
            $opt['logic']['pictures']['thumb_dir'] .= '/';
354
        }
355
356
        $url = $this->getUrl();
357
        $fna = mb_split('\\/', $url);
358
        $filename = end($fna);
359
360
        $dir1 = mb_strtoupper(mb_substr($filename, 0, 1));
361
        $dir2 = mb_strtoupper(mb_substr($filename, 1, 1));
362
363
        return $opt['logic']['pictures']['thumb_dir'] . $dir1 . '/' . $dir2 . '/' . $filename;
364
    }
365
366
    /**
367
     * @return string
368
     */
369
    public function getLogId()
370
    {
371
        if ($this->getObjectType() == OBJECT_CACHELOG) {
372
            return $this->getObjectId();
373
        } else {
374
            return false;
375
        }
376
    }
377
378
    /**
379
     * @return bool|null
380
     */
381
    public function isVisibleOnCachePage()
382
    {
383
        if ($this->getObjectType() != OBJECT_CACHELOG) {
384
            return null;
385
        } else {
386
            $rs = sql(
387
                "SELECT `id`
388
                 FROM `cache_logs`
389
                 WHERE `cache_id`='&1'
390
                 ORDER BY `date`, `id` DESC
391
                 LIMIT &2",
392
                $this->getCacheId(),
393
                MAX_LOGENTRIES_ON_CACHEPAGE
394
            );
395
        }
396
        $firstlogs = false;
397
        while ($r = sql_fetch_assoc($rs)) {
398
            if ($r['id'] == $this->getLogId()) {
399
                $firstlogs = true;
400
            }
401
        }
402
403
        sql_free_result($rs);
404
405
        return $firstlogs;
406
    }
407
408
    /**
409
     * @return string
410
     */
411 View Code Duplication
    public function getCacheId()
412
    {
413
        if ($this->getObjectType() == OBJECT_CACHELOG) {
414
            return sql_value("SELECT `cache_id` FROM `cache_logs` WHERE `id`='&1'", false, $this->getObjectId());
415
        } elseif ($this->getObjectType() == OBJECT_CACHE) {
416
            return $this->getObjectId();
417
        } else {
418
            return false;
419
        }
420
    }
421
422
    /**
423
     * @return mixed
424
     */
425
    public function getObjectId()
426
    {
427
        return $this->rePicture->getValue('object_id');
428
    }
429
430
    /**
431
     * @param $value
432
     * @return bool
433
     */
434
    public function setObjectId($value)
435
    {
436
        return $this->rePicture->setValue('object_id', $value + 0);
437
    }
438
439
    /**
440
     * @return mixed
441
     */
442
    public function getObjectType()
443
    {
444
        return $this->rePicture->getValue('object_type');
445
    }
446
447
    /**
448
     * @param $value
449
     * @return bool
450
     */
451
    public function setObjectType($value)
452
    {
453
        return $this->rePicture->setValue('object_type', $value + 0);
454
    }
455
456
    /**
457
     * @return bool|mixed
458
     */
459 View Code Duplication
    public function getUserId()
460
    {
461
        if ($this->getObjectType() == OBJECT_CACHE) {
462
            return sql_value(
463
                "SELECT `caches`.`user_id` FROM `caches` WHERE `caches`.`cache_id`='&1'",
464
                false,
465
                $this->getObjectId()
466
            );
467
        } elseif ($this->getObjectType() == OBJECT_CACHELOG) {
468
            return sql_value(
469
                "SELECT `cache_logs`.`user_id` FROM `cache_logs` WHERE `cache_logs`.`id`='&1'",
470
                false,
471
                $this->getObjectId()
472
            );
473
        } else {
474
            return false;
475
        }
476
    }
477
478
    /**
479
     * @return mixed
480
     */
481
    public function getNode()
482
    {
483
        return $this->rePicture->getValue('node');
484
    }
485
486
    /**
487
     * @param $value
488
     * @return bool
489
     */
490
    public function setNode($value)
491
    {
492
        return $this->rePicture->setValue('node', $value);
493
    }
494
495
    /**
496
     * @return mixed
497
     */
498
    public function getUUID()
499
    {
500
        return $this->rePicture->getValue('uuid');
501
    }
502
503
    /**
504
     * @return mixed
505
     */
506
    public function getLastModified()
507
    {
508
        return $this->rePicture->getValue('last_modified');
509
    }
510
511
    /**
512
     * @return mixed
513
     */
514
    public function getDateCreated()
515
    {
516
        return $this->rePicture->getValue('date_created');
517
    }
518
519
    /**
520
     * @return mixed
521
     */
522
    public function getPosition()
523
    {
524
        return $this->rePicture->getValue('seq');
525
    }
526
527
    /**
528
     * @return bool|null
529
     */
530
    public function getAnyChanged()
531
    {
532
        return $this->rePicture->getAnyChanged();
533
    }
534
535
    // Test if the picture can be discarded as duplicate.
536
    // This is a quick test for Ocprop dups and may be extended for any
537
    // picture uploads by comparing the file sizes and contents.
538
539
    /**
540
     * @return bool
541
     */
542
    public function is_duplicate()
543
    {
544
        global $ocpropping;
545
546
        return $ocpropping &&
547
        sql_value(
548
            "
549
            SELECT COUNT(*) FROM `pictures`
550
            WHERE `object_type`='&1' AND `object_id`='&2' AND `title`='&3'",
551
            0,
552
            $this->getObjectType(),
553
            $this->getObjectId(),
554
            $this->getTitle()
555
        ) > 0;
556
    }
557
558
    /**
559
     * return true if successful (with insert)
560
     *
561
     * @param bool $restore
562
     * @param int $original_id
563
     * @param string $original_url
564
     * @return bool
565
     */
566
    public function save($restore = false, $original_id = 0, $original_url = "")
567
    {
568
        $undelete = ($original_id != 0);
569
570
        if ($undelete) {
571
            if ($this->bFilenamesSet == true) {
572
                return false;
573
            } else {
574
                // restore picture file
575
                $this->setUrl($original_url);     // set the url, so that we can
576
                $filename = $this->getFilename(); // .. retrieve the file path+name
577
                $this->setFilenames($filename);   // now set url(s) from the new uuid
578
                try {
579
                    rename($this->deletedFilename($filename), $this->getFilename());
0 ignored issues
show
Security File Manipulation introduced by
$this->deletedFilename($filename) can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  13. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  14. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  15. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  10. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  11. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  12. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  13. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  14. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  15. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  16. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  13. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  14. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  15. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 576
  13. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  14. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  15. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
Security File Manipulation introduced by
$this->getFilename() can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  10. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  11. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  12. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  13. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 579

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
580
                } catch (Exception $e) {
581
                    // @todo implement logging
582
                }
583
            }
584
        }
585
586
        if ($this->bFilenamesSet == false) {
587
            return false;
588
        }
589
590
        $this->setArchiveFlag($restore, $original_id);
591
        $bRetVal = $this->rePicture->save();
592
        $this->resetArchiveFlag();
593
594
        if ($bRetVal) {
595
            $this->nPictureId = $this->rePicture->getValue('id');
596
            if ($this->getObjectType() == OBJECT_CACHE && $this->getMapPreview()) {
597
                sql(
598
                    "UPDATE `pictures` SET `mappreview`= 0
599
                     WHERE `object_type`='&1' AND `object_id`='&2' AND `id`!='&3'",
600
                    OBJECT_CACHE,
601
                    $this->getObjectId(),
602
                    $this->getPictureId()
603
                );
604
            }
605
            sql_slave_exclude();
606
        }
607
608
        return $bRetVal;
609
    }
610
611
    /**
612
     * @param bool $restore
613
     * @return bool
614
     */
615
    public function delete($restore = false)
616
    {
617
        // see also removelog.php, 'remove log pictures'
618
        // delete record, image and thumb
619
        $this->setArchiveFlag($restore);
620
        sql("DELETE FROM `pictures` WHERE `id`='&1'", $this->nPictureId);
621
        $this->resetArchiveFlag();
622
        $filename = $this->getFilename();
623
624
        // archive picture if picture record has been archived
625
        if (sql_value("SELECT `id` FROM `pictures_modified` WHERE `id`='&1'", 0, $this->getPictureId()) != 0) {
626
            try {
627
                rename($filename, $this->deletedFilename($filename));
0 ignored issues
show
Security File Manipulation introduced by
$filename can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  10. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  11. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  12. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  13. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
Security File Manipulation introduced by
$this->deletedFilename($filename) can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  13. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  14. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  15. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  10. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  11. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  12. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  13. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  14. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  15. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  16. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  11. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  12. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  13. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  13. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  14. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  13. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  14. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  15. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  13. Data is passed through mb_split()
    in vendor/htdocs/lib2/logic/picture.class.php on line 655
  14. $fp is assigned
    in vendor/htdocs/lib2/logic/picture.class.php on line 659
  15. Data is passed through substr()
    in vendor/htdocs/lib2/logic/picture.class.php on line 663

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
628
            } catch (Exception $e) {
629
                // @todo implement logging
630
            }
631
        } else {
632
            try {
633
                unlink($filename);
0 ignored issues
show
Security File Manipulation introduced by
$filename can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  10. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  11. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  12. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  13. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data, and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 622

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
634
            } catch (Exception $e) {
635
                // @todo implement logging
636
            }
637
        }
638
639
        try {
640
            unlink($this->getThumbFilename());
0 ignored issues
show
Security File Manipulation introduced by
$this->getThumbFilename() can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  11. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  12. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  9. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  10. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  9. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  10. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  10. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  11. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  12. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  13. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  10. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  11. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  10. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  11. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  10. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  11. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  9. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  10. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  10. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  11. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  9. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  10. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  10. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  11. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  10. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  11. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  9. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  10. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  10. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  11. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  11. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  12. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 356
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 357
  11. $fna is passed through end(), and $filename is assigned
    in htdocs/lib2/logic/picture.class.php on line 358
  12. picture::getThumbFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 640

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
641
        } catch (Exception $e) {
642
            // @todo implement logging
643
        }
644
645
        return true;
646
    }
647
648
    /**
649
     * @param string $filename
650
     *
651
     * @return string
652
     */
653
    private function deletedFilename($filename)
654
    {
655
        $fna = mb_split('\\/', $filename);
656
        $fna[] = end($fna);
657
        $fna[count($fna) - 2] = 'deleted';
658
        $dp = '';
659
        foreach ($fna as $fp) {
660
            $dp .= '/' . $fp;
661
        }
662
663
        return substr($dp, 1);
664
    }
665
666 View Code Duplication
    public function allowEdit()
667
    {
668
        global $login;
669
670
        $login->verify();
671
672
        if (sql_value(
673
            "SELECT COUNT(*)
674
            FROM `caches`
675
            INNER JOIN `cache_status` ON `caches`.`status`=`cache_status`.`id`
676
            WHERE (`cache_status`.`allow_user_view`=1 OR `caches`.`user_id`='&1')
677
            AND `caches`.`cache_id`='&2'",
678
            0,
679
            $login->userid,
680
            $this->getCacheId()
681
        ) == 0) {
682
            return false;
683
        } elseif ($this->getUserId() == $login->userid) {
684
            return true;
685
        }
686
687
        return false;
688
    }
689
690
    /**
691
     * @return bool|string
692
     */
693
    public function getPageLink()
694
    {
695
        if ($this->getObjectType() == OBJECT_CACHELOG) {
696
            $pl = 'viewcache.php?cacheid=' . urlencode($this->getCacheId());
697
            if (!$this->isVisibleOnCachePage()) {
698
                $pl .= "&log=A";
699
            }
700
            $pl .= "#log" . urlencode($this->getLogId());
701
        } elseif ($this->getObjectType() == OBJECT_CACHE) {
702
            $pl = 'editcache.php?cacheid=' . urlencode($this->getCacheId()) . '#pictures';
703
        } else {
704
            $pl = false;
705
        }
706
707
        return $pl;
708
    }
709
710
    /*
711
        Shrink picture to a specified maximum size. If present Imagemagick extension will be used, if not gd.
712
        Imagick is sharper, faster, need less memory and supports more types.
713
        For gd size is limited to 5000px (memory consumption).
714
        i prefer FILTER_CATROM because its faster but similiar to lanczos see http://de1.php.net/manual/de/imagick.resizeimage.php
715
        parameter:
716
        $tmpfile: full name of uploaded file
717
        $longSideSize:  if longer side of picture > $longSideSize, then it will be prop. shrinked to
718
        returns: true if no error occur, otherwise false
719
    */
720
    /**
721
     * @param $tmpFile
722
     * @param $longSideSize
723
     * @return bool
724
     */
725
    public function rotate_and_shrink($tmpFile, $longSideSize)
726
    {
727
        global $opt;
728
        if (extension_loaded('imagick')) {
729
            try {
730
                $image = new Imagick();
731
                $image->readImage($tmpFile);
732
                $this->imagick_rotate($image);
733
                $w = $image->getImageWidth();
734
                $h = $image->getImageHeight();
735
                $image->setImageResolution(PICTURE_RESOLUTION, PICTURE_RESOLUTION);
736
                $image->setImageCompression(Imagick::COMPRESSION_JPEG);
737
                $image->setImageCompressionQuality(PICTURE_QUALITY);
738
                $image->stripImage(); //clears exif, private data
739
                //$newSize=$w<$h?array($w*$longSideSize/$h,$longSideSize):array($longSideSize,$h*$longSideSize/$w);
740
                if (max($w, $h) > $longSideSize) {
741
                    $image->resizeImage($longSideSize, $longSideSize, imagick::FILTER_CATROM, 1, true);
742
                }
743
                $result = $image->writeImage($this->getFilename());
744
                $image->clear();
745
            } catch (Exception $e) {
746
                if ($image) {
747
                    $image->clear();
748
                }
749
                if ($opt['debug'] & DEBUG_DEVELOPER) {
750
                    die($e);
751
                }
752
                $result = false;
753
            }
754
755
            return $result;
756
        } elseif (extension_loaded('gd')) {
757
            $imageNew = null;
758
            try {
759
                $image = imagecreatefromstring(file_get_contents($tmpFile));
760
                $w = imagesx($image);
761
                $h = imagesy($image);
762
                if (max($w, $h) > 5000) {
763
                    throw new Exception("Image too large >5000px");
764
                }
765
                if (max($w, $h) <= $longSideSize) {
766
                    $result = imagejpeg($image, $this->getFilename(), PICTURE_QUALITY);
767
                } else {
768
                    $newSize = $w < $h ? [
769
                        $w * $longSideSize / $h,
770
                        $longSideSize
771
                    ] : [
772
                        $longSideSize,
773
                        $h * $longSideSize / $w
774
                    ];
775
                    $imageNew = imagecreatetruecolor($newSize[0], $newSize[1]);
776
                    imagecopyresampled($imageNew, $image, 0, 0, 0, 0, $newSize[0], $newSize[1], $w, $h);
777
                    $result = imagejpeg($imageNew, $this->getFilename(), PICTURE_QUALITY);
778
                    imagedestroy($imageNew);
779
                }
780
                imagedestroy($image);
781
            } catch (Exception $e) {
782
                if ($image) {
783
                    imagedestroy($image);
784
                }
785
                if ($imageNew) {
786
                    imagedestroy($imageNew);
787
                }
788
                if ($opt['debug'] & DEBUG_DEVELOPER) {
789
                    die($e);
790
                }
791
                $result = false;
792
            }
793
794
            return $result;
795
        } else {
796
            return false;
797
        }
798
    }
799
800
    /**
801
     * rotate image according to EXIF orientation
802
     *
803
     * @param $tmpFile
804
     * @return bool
805
     */
806
    public function rotate($tmpFile)
807
    {
808
        if (extension_loaded('imagick')) {
809
            try {
810
                $image = new Imagick();
811
                $image->readImage($tmpFile);
812
                if ($this->imagick_rotate($image)) {
813
                    $image->stripImage(); // clears exif, private data
814
                    $image->writeImage($this->getFilename());
815
                    $image->clear();
816
817
                    return true;
818
                } else {
819
                    $image->clear();
820
                }
821
            } catch (Exception $e) {
822
                if ($image) {
823
                    $image->clear();
824
                }
825
            }
826
        }
827
828
        return move_uploaded_file($tmpFile, $this->getFilename());
0 ignored issues
show
Security File Manipulation introduced by
$this->getFilename() can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned in htdocs/addtolist.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newListName is assigned
    in htdocs/addtolist.php on line 26
  2. $newListName is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 38
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 33
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 33
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 26
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 26
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  4. Path: Read from $_POST, and $logText is assigned in htdocs/log.php on line 111
  1. Read from $_POST, and $logText is assigned
    in htdocs/log.php on line 111
  2. Data is escaped by htmlspecialchars() for html (no single-quotes) context(s), and Data is passed through nl2br()
    in vendor/htdocs/lib2/edithelper.inc.php on line 50
  3. $logText is assigned
    in htdocs/log.php on line 206
  4. $logText is passed to cachelog::setText()
    in htdocs/log.php on line 301
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelog.class.php on line 211
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  9. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  10. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  11. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  12. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  13. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  5. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 20
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 20
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 58
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  7. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  8. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 60
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 60
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  9. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 17
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 40
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  10. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 68
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 68
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  11. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 16
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 44
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  12. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 20
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 20
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 30
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  13. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 52
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 52
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  6. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  7. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  8. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  9. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  10. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  14. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 15
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 15
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 35
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  7. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  8. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  9. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  10. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  11. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 18
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 18
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 53
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 521
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 531
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 475
  8. rowEditor::getValue() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 192
  9. picture::getUrl() returns tainted data, and $url is assigned
    in htdocs/lib2/logic/picture.class.php on line 339
  10. $url is passed through mb_split(), and $fna is assigned
    in htdocs/lib2/logic/picture.class.php on line 340
  11. $fna is passed through end()
    in htdocs/lib2/logic/picture.class.php on line 342
  12. picture::getFilename() returns tainted data
    in htdocs/lib2/logic/picture.class.php on line 828

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
829
    }
830
831
    /**
832
     * @param Imagick $image
833
     *
834
     * @return bool
835
     */
836
    public function imagick_rotate(&$image)
837
    {
838
        $exif = $image->getImageProperties();
839
        if (isset($exif['exif:Orientation'])) {
840
            switch ($exif['exif:Orientation']) {
841
                case 3:
842
                    return $image->rotateImage(new ImagickPixel(), 180);
843
                case 6:
844
                    return $image->rotateImage(new ImagickPixel(), 90);
845
                case 8:
846
                    return $image->rotateImage(new ImagickPixel(), -90);
847
            }
848
        }
849
850
        return false;
851
    }
852
853
    /**
854
     * @return bool
855
     */
856
    public function up()
857
    {
858
        $prevPos = sql_value(
859
            "
860
            SELECT MAX(`seq`)
861
            FROM `pictures`
862
            WHERE `object_type`='&1' AND `object_id`='&2' AND `seq`<'&3'",
863
            0,
864
            $this->getObjectType(),
865
            $this->getObjectId(),
866
            $this->getPosition()
867
        );
868
869
        if ($prevPos) {
870
            $maxPos = sql_value(
871
                "
872
                SELECT MAX(`seq`)
873
                FROM `pictures`
874
                WHERE `object_type`='&1' AND `object_id`='&2'",
875
                0,
876
                $this->getObjectType(),
877
                $this->getObjectId()
878
            );
879
880
            // swap positions with the previous pic
881
            sql(
882
                "
883
                UPDATE `pictures`
884
                SET `seq`='&2'
885
                WHERE `id`='&1'",
886
                $this->getPictureId(),
887
                $maxPos + 1
888
            );
889
            sql(
890
                "
891
                UPDATE `pictures` SET `seq`='&4'
892
                WHERE `object_type`='&1' AND `object_id`='&2' AND `seq`='&3'",
893
                $this->getObjectType(),
894
                $this->getObjectId(),
895
                $prevPos,
896
                $this->getPosition()
897
            );
898
            sql(
899
                "
900
                UPDATE `pictures`
901
                SET `seq`='&2'
902
                WHERE `id`='&1'",
903
                $this->getPictureId(),
904
                $prevPos
905
            );
906
            $this->rePicture->setValue('seq', $prevPos);
907
908
            return true;
909
        }
910
911
        return false;
912
    }
913
}
914