Passed
Push — development ( 2c0f7a...866d79 )
by Thomas
01:59
created

PictureCleanup::run()   C

Complexity

Conditions 8
Paths 9

Size

Total Lines 52
Code Lines 29

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 8
eloc 29
nc 9
nop 0
dl 0
loc 52
rs 6.8493
c 0
b 0
f 0

How to fix   Long Method   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php
2
/***************************************************************************
3
 * For license information see doc/license.txt *
4
 *
5
 * Delete duplicate log pictures (produced e.g. by Ocprop)
6
 ***************************************************************************/
7
8
checkJob(new PictureCleanup());
9
10
class PictureCleanup
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

You can fix this by adding a namespace to your class:

namespace YourVendor;

class YourClass { }

When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.

Loading history...
11
{
12
    public $name = 'picture_cleanup';
13
    public $interval = 86400;
14
15
    public function run()
16
    {
17
        $rsDuplicatePic = sql(
18
            'SELECT `object_id`, `title`
19
             FROM `pictures`
20
             WHERE `object_type`=1
21
             GROUP BY `object_id`, `title`
22
             HAVING COUNT(*) > 1'
23
        );
24
25
        while ($rDuplicatePic = sql_fetch_assoc($rsDuplicatePic)) {
26
            $rsInstances = sql(
27
                "SELECT `pictures`.`id` `picid`, `cache_logs`.`cache_id` `cache_id`
28
                 FROM `pictures`
29
                 LEFT JOIN `cache_logs` ON `cache_logs`.`id` = `pictures`.`object_id`
30
                 WHERE `pictures`.`object_type`=1 AND `pictures`.`object_id`='&1' AND `pictures`.`title`='&2'
31
                 ORDER BY `pictures`.`date_created`",
32
                $rDuplicatePic['object_id'],
33
                $rDuplicatePic['title']
34
            );
35
36
            $instances = sql_fetch_assoc_table($rsInstances);
37
            foreach ($instances as &$instance) {
38
                $instance['pic'] = new picture($instance['picid']);
39
                $instance['filesize'] = @filesize($instance['pic']->getFilename());
40
            }
41
            $countInstances = count($instances);
42
            for ($n = 1; $n < $countInstances; ++ $n) {
43
                if ($instances[$n]['filesize'] !== false) {
44
                    // ensure that pic is stored locally
45
                    for ($nn = $n - 1; $nn >= 0; -- $nn) {
46
                        if ($instances[$nn]['filesize'] === $instances[$n]['filesize']
47
                            && file_get_contents($instances[$nn]['pic']->getFilename())
48
                                === file_get_contents($instances[$n]['pic']->getFilename())
49
                        ) {
50
                            $picture = $instances[$n]['pic'];
51
                            echo
52
                                'deleting duplicate picture '
0 ignored issues
show
Security Cross-Site Scripting introduced by
'deleting duplicate pict...s[$n]['cache_id'] . ' ' can contain request data and is used in output context(s) leading to a potential security vulnerability.

16 paths for user data to reach this point

  1. Path: Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newlist_name is assigned in htdocs/addtolist.php on line 27
  1. Read from $_REQUEST, and $_REQUEST['newlist_name'] is passed through trim(), and $newlist_name is assigned
    in htdocs/addtolist.php on line 27
  2. $newlist_name is passed to cachelist::setNameAndVisibility()
    in htdocs/addtolist.php on line 39
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  8. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  9. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  10. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  2. Path: Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle() in htdocs/change_statpic.php on line 34
  1. Read from $_REQUEST, and $_REQUEST['statpic_style'] is passed to statpic::setStyle()
    in htdocs/change_statpic.php on line 34
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 31
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  6. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  7. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  8. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  3. Path: Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText() in htdocs/change_statpic.php on line 27
  1. Read from $_REQUEST, and $_REQUEST['statpic_text'] is passed to statpic::setText()
    in htdocs/change_statpic.php on line 27
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/statpic.class.php on line 47
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  6. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  7. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  8. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  4. Path: Read from $_REQUEST, and $list_password is assigned in htdocs/mylists.php on line 21
  1. Read from $_REQUEST, and $list_password is assigned
    in htdocs/mylists.php on line 21
  2. $list_password is passed to cachelist::setPassword()
    in htdocs/mylists.php on line 59
  3. $pw is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 151
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  7. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  8. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  9. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  5. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 82
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 82
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 87
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  7. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  8. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  9. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  6. Path: Read from $_REQUEST, and $title is assigned in htdocs/picture.php on line 169
  1. Read from $_REQUEST, and $title is assigned
    in htdocs/picture.php on line 169
  2. $title is passed to picture::setTitle()
    in htdocs/picture.php on line 173
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 236
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  7. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  8. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  9. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  7. Path: Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName() in htdocs/myprofile.php on line 61
  1. Read from $_REQUEST, and $_REQUEST['firstName'] is passed through trim(), and trim($_REQUEST['firstName']) is passed to user::setFirstName()
    in htdocs/myprofile.php on line 61
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  6. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  7. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  8. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  8. Path: Read from $_POST, and $first_name is assigned in htdocs/register.php on line 18
  1. Read from $_POST, and $first_name is assigned
    in htdocs/register.php on line 18
  2. $first_name is passed to user::setFirstName()
    in htdocs/register.php on line 41
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 230
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  7. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  8. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  9. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  9. Path: Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName() in htdocs/myprofile.php on line 69
  1. Read from $_REQUEST, and $_REQUEST['lastName'] is passed through trim(), and trim($_REQUEST['lastName']) is passed to user::setLastName()
    in htdocs/myprofile.php on line 69
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  6. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  7. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  8. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  10. Path: Read from $_POST, and $last_name is assigned in htdocs/register.php on line 17
  1. Read from $_POST, and $last_name is assigned
    in htdocs/register.php on line 17
  2. $last_name is passed to user::setLastName()
    in htdocs/register.php on line 45
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 250
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  7. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  8. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  9. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  11. Path: Read from $_POST, and $email is assigned in htdocs/register.php on line 21
  1. Read from $_POST, and $email is assigned
    in htdocs/register.php on line 21
  2. $email is passed to user::setEMail()
    in htdocs/register.php on line 31
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 180
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  7. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  8. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  9. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  12. Path: Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername() in htdocs/myprofile.php on line 53
  1. Read from $_REQUEST, and $_REQUEST['username'] is passed through trim(), and trim($_REQUEST['username']) is passed to user::setUsername()
    in htdocs/myprofile.php on line 53
  2. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  3. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  4. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  5. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  6. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  7. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  8. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  13. Path: Read from $_POST, and $username is assigned in htdocs/register.php on line 16
  1. Read from $_POST, and $username is assigned
    in htdocs/register.php on line 16
  2. $username is passed to user::setUsername()
    in htdocs/register.php on line 36
  3. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/user.class.php on line 161
  4. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  5. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  6. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  7. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  8. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  9. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  14. Path: Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames() in htdocs/picture.php on line 124
  1. Read from $_FILES, and $_FILES['file']['name'] is passed to picture::setFilenames()
    in htdocs/picture.php on line 124
  2. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  3. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  4. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  8. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  9. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  10. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  15. Path: Read from $_FILES, and $_FILES['file']['name'] is escaped by pathinfo() for file context(s), and $fname is assigned in htdocs/picture.php on line 117
  1. Read from $_FILES, and $_FILES['file']['name'] is escaped by pathinfo() for file context(s), and $fname is assigned
    in htdocs/picture.php on line 117
  2. $fname is passed through mb_strtolower(), and mb_strtolower($fname) . '.jpg' is passed to picture::setFilenames()
    in htdocs/picture.php on line 130
  3. $sFilename is passed through substr(), and substr($sFilename, strrpos($sFilename, '.') + 1) is passed through mb_strtolower(), and $sExtension is assigned
    in htdocs/lib2/logic/picture.class.php on line 123
  4. $opt['logic']['pictures']['url'] . $sUUID . '.' . $sExtension is passed to picture::setUrl()
    in htdocs/lib2/logic/picture.class.php on line 128
  5. $value is passed to rowEditor::setValue()
    in htdocs/lib2/logic/picture.class.php on line 201
  6. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  7. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  8. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  9. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  10. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  11. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53
  16. Path: Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned in htdocs/mylists.php on line 19
  1. Read from $_REQUEST, and $_REQUEST['list_name'] is passed through trim(), and $list_name is assigned
    in htdocs/mylists.php on line 19
  2. $list_name is passed to cachelist::setNameAndVisibility()
    in htdocs/mylists.php on line 54
  3. $name is passed through trim(), and $name is assigned
    in htdocs/lib2/logic/cachelist.class.php on line 97
  4. $name is passed through trim(), and trim($name) is passed to rowEditor::setValue()
    in htdocs/lib2/logic/cachelist.class.php on line 117
  5. $sFormatedValue is assigned
    in htdocs/lib2/rowEditor.class.php on line 522
  6. rowEditor::$fields is assigned
    in htdocs/lib2/rowEditor.class.php on line 532
  7. Tainted property rowEditor::$fields is read
    in htdocs/lib2/rowEditor.class.php on line 476
  8. rowEditor::getValue() returns tainted data, and picture::$nPictureId is assigned
    in htdocs/lib2/logic/picture.class.php on line 595
  9. Tainted property picture::$nPictureId is read
    in htdocs/lib2/logic/picture.class.php on line 138
  10. picture::getPictureId() returns tainted data
    in htdocs/util2/cron/modules/picture_cleanup.class.php on line 53

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
53
                                . $picture->getPictureId() . ' ("' . $picture->getTitle() . '")'
54
                                . ' from log ' . $rDuplicatePic['object_id']
55
                                . ' of cache ' . $instances[$n]['cache_id'] . "\n";
56
                            $picture->delete(false);
57
                            $instances[$n]['filesize'] = false;
58
                            break;
59
                        }
60
                    }
61
                }
62
            }
63
        }
64
65
        sql_free_result($rsDuplicatePic);
66
    }
67
}
68