Issues (16)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

apps/default.app/configs/application.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
return array(
4
5
	/*
6
	|--------------------------------------------------------------------------
7
	| View Engines
8
	|--------------------------------------------------------------------------
9
	| 
10
	| Phalcon\Mvc\View is a class for working with the “view” portion of the 
11
	| model-view-controller pattern. That is, it exists to help keep the view 
12
	| script separate from the model and controller scripts. It provides a 
13
	|system of helpers, output filters, and variable escaping.
14
	|
15
	*/
16
17
	'view_engines' => array(
18
		'.volt' => array(
19
			'type' => '\Phalcon\Mvc\View\Engine\Volt',
20
			'options' => array(
21
			'compiledPath' => STORAGE_PATH . 'framework/views/',
22
			'compiledSeparator' => '_',
23
			'compiledExtension' => '.compiled',
24
			'stat' => TRUE
25
			)
26
		)
27
	),
28
29
	/*
30
	|--------------------------------------------------------------------------
31
	| View Layout Name
32
	|--------------------------------------------------------------------------
33
	|
34
	| View Layout name is default layout which is used by this application as 
35
	| a view master layout which must be put in the application layout folder.
36
	|
37
	*/
38
39
	'view_layout_name' => 'main',
40
41
	/*
42
	|--------------------------------------------------------------------------
43
	| Application Name
44
	|--------------------------------------------------------------------------
45
	|
46
	| Application name is used for console and mvc applications for defining 
47
	| which application folder we are in. It must be unique folder name.
48
	|
49
	*/
50
51
	'name' => "default.app",
52
53
	/*
54
	|--------------------------------------------------------------------------
55
	| Theme Layout Name
56
	|--------------------------------------------------------------------------
57
	|
58
	| Theme Layout name is default layout which is used by this application. Because 
59
	| of being many application assets which are unique for this application
60
	| must be put in the public folder.
61
	|
62
	*/
63
64
	'theme_layout_name' => "default",
65
66
	/*
67
	|--------------------------------------------------------------------------
68
	| * Default Language
69
	|--------------------------------------------------------------------------
70
	|
71
	| Apllication is working with the language files which is in the folder
72
	| that you can set with this variable. 
73
	|
74
	*/
75
76
	'default_language' => 'en',
77
78
	/*
79
	|--------------------------------------------------------------------------
80
	| Registering Namespaces
81
	|--------------------------------------------------------------------------
82
	|
83
	| If you’re organizing your code using namespaces, or external libraries 
84
	| do so, the registerNamespaces() provides the autoloading mechanism. It 
85
	| takes an associative array, which keys are namespace prefixes and their 
86
	| values are directories where the classes are located in. The namespace 
87
	| separator will be replaced by the directory separator when the loader 
88
	| try to find the classes. Remember always to add a trailing slash at the 
89
	| end of the paths.
90
	|
91
	| Example Usage:
92
	|
93
	| array(
94
	| 	'Example\Base' => "vendor/example/base/"
95
	| )  
96
	|
97
	*/
98
99
	'namespaces' => array(
100
		'Modules\Common' => APPLICATION_PATH . 'modules/common/',
101
	),
102
103
	/*
104
	|--------------------------------------------------------------------------
105
	| Module Registration
106
	|--------------------------------------------------------------------------
107
	|
108
	| Module registration is used for setting all installed modules.
109
	|		
110
	| Example Usage:
111
	|
112
	| array(
113
	| 	'dashboard' => array(
114
	| 		'className' => 'Modules\Default\Module',
115
	|		'path' => APPLICATION_PATH . 'modules/dashboard/Module.php'
116
	| 	)
117
	| )
118
	|
119
	*/
120
121
	'modules' => array(
122
		'common' => array(
123
			'className' => 'Modules\Common\Module',
124
			'path' => APPLICATION_PATH . 'modules/common/module.php'
125
		)
126
	),
127
128
	/*
129
	|--------------------------------------------------------------------------
130
	| Default settings (MVC)
131
	|--------------------------------------------------------------------------
132
	|
133
	| Default controller and method name which are used to execute the 
134
	| controller from the browser
135
	|
136
	*/
137
138
	'default_namespace' 	=> 'Modules\Common\Controllers',
139
	'default_module' 		=> 'common',
140
	'default_controller' 	=> 'index',
141
	'default_method' 		=> 'index',
142
143
	
144
	/*
145
	|--------------------------------------------------------------------------
146
	| Default settings (Task)
147
	|--------------------------------------------------------------------------
148
	|
149
	| Default task and action name which are used to execute the task from 
150
	| the command line. 
151
	|
152
	*/
153
154
	'default_task' 			=> 'main',
155
	'default_action' 		=> 'main',
156
157
	/*
158
	|--------------------------------------------------------------------------
159
	| Extra/Trailing slashes
160
	|--------------------------------------------------------------------------
161
	|
162
	| Sometimes a route could be accessed with extra/trailing slashes and the 
163
	| end of the route, those extra slashes would lead to produce a not-found 
164
	| status in the dispatcher. You can set up the router to automatically 
165
	| remove the slashes from the end of handled route:
166
	|
167
	*/
168
169
	'extra_slashes' => TRUE,
170
171
	/*
172
	|--------------------------------------------------------------------------
173
	| Application Debug Mode
174
	|--------------------------------------------------------------------------
175
	|
176
	| When your application is in debug mode, detailed error messages with
177
	| stack traces will be shown on every error that occurs within your
178
	| application. If disabled, a simple generic error page is shown.
179
	|
180
	*/
181
182
	'debug' => FALSE,
183
184
	/*
185
	|--------------------------------------------------------------------------
186
	| Do you need HTML Minification ?
187
	|--------------------------------------------------------------------------
188
	|
189
	| HTML Minification is used for minify HTML buffer. U need Output 
190
	| Control Function is enabled like ob_start
191
	|
192
	*/
193
194
	'html_minify' => FALSE,
195
196
	/*
197
	|--------------------------------------------------------------------------
198
	| Application URL
199
	|--------------------------------------------------------------------------
200
	|
201
	| Phalcon automatically may detect your baseUri, but if you want to 
202
	| increase the performance of your application is recommended setting up 
203
	| it manually:
204
	|
205
	*/
206
207
	'base_url' => NULL,
208
209
	/*
210
	|--------------------------------------------------------------------------
211
	| Application Timezone
212
	|--------------------------------------------------------------------------
213
	|
214
	| Here you may specify the default timezone for your application, which
215
	| will be used by the PHP date and date-time functions. We have gone
216
	| ahead and set this to a sensible default for you out of the box.
217
	|
218
	*/
219
220
	'timezone' => 'UTC',
221
222
	/*
223
	|--------------------------------------------------------------------------
224
	| Encryption of Cookies
225
	|--------------------------------------------------------------------------
226
	|
227
	| By default, cookies are automatically encrypted before be sent to the 
228
	| client and decrypted when retrieved. This protection allow unauthorized 
229
	| users to see the cookies’ contents in the client (browser). Although 
230
	| this protection, sensitive data should not be stored on cookies.
231
	|
232
	*/
233
234
	'cookie_encryption' => TRUE,
235
236
	/*
237
	|--------------------------------------------------------------------------
238
	| Encryption Key
239
	|--------------------------------------------------------------------------
240
	|
241
	| This key is used by the encrypting configuration file and should be set
242
	| to a random, 32 character string, otherwise these encrypted strings
243
	| will not be safe. Please do this before deploying an application!
244
	|
245
	*/
246
247
	'key' => 'this-is-my-secret-key',
248
249
	/*
250
	|--------------------------------------------------------------------------
251
	| Encryption Type
252
	|--------------------------------------------------------------------------
253
	|
254
	| This type is used by the encrypting configuration file and should be set
255
	| form http://php.net/manual/en/mcrypt.ciphers.php
256
	|
257
	*/
258
259
	'cipher' => MCRYPT_RIJNDAEL_256,
260
261
	/*
262
	|--------------------------------------------------------------------------
263
	| Encryption Type
264
	|--------------------------------------------------------------------------
265
	|
266
	| One of the encryption modes supported by libmcrypt (ecb, cbc, cfb, ofb)
267
	|
268
	*/
269
270
	'encryption_mode' => 'ecb',
271
272
	/*
273
	|--------------------------------------------------------------------------
274
	| Work Factor
275
	|--------------------------------------------------------------------------
276
	|
277
	| Sets the default working factor for bcrypts password’s salts
278
	|
279
	*/
280
281
	'work_factor' => 12,
282
283
	/*
284
	|--------------------------------------------------------------------------
285
	| Application Path Registration
286
	|--------------------------------------------------------------------------
287
	|
288
	| The third option is to register directories, in which classes could be 
289
	| found. This option is not recommended in terms of performance, since 
290
	| Phalcon will need to perform a significant number of file stats on each 
291
	| folder, looking for the file with the same name as the class. It’s  
292
	| important to register the directories in relevance order. 
293
	|
294
	| Remember always add a trailing slash at the end of the paths.
295
	|
296
	| Example Usage:
297
	|
298
	| array(
299
	|  	"library/MyComponent/",
300
	|  	"library/OtherComponent/Other/",
301
	|	"vendor/example/adapters/",
302
	|	"vendor/example/"
303
	| )    
304
	|
305
	*/
306
307
	'paths' => array(
308
		APPLICATION_PATH . 'controllers/',
309
		APPLICATION_PATH . 'models/',
310
		APPLICATION_PATH . 'tasks/'
311
	),
312
313
	/*
314
	|--------------------------------------------------------------------------
315
	| Application Classes Registration
316
	|--------------------------------------------------------------------------
317
	|
318
	| The last option is to register the class name and its path. This 
319
	| autoloader can be very useful when the folder convention of the project 
320
	| does not allow for easy retrieval of the file using the path and the 
321
	| class name. This is the fastest method of autoloading. However the more 
322
	| your application grows, the more classes/files need to be added to this 
323
	| autoloader, which will effectively make maintenance of the class list 
324
	| very cumbersome and it is not recommended.
325
	|
326
	| Example Usage:
327
	|
328
	| array(
329
	| 	"Some"         => "library/OtherComponent/Other/Some.php",
330
	| 	"Example\Base" => "vendor/example/adapters/Example/BaseClass.php",
331
	| )  
332
	|
333
	*/
334
335
	'classes' => array(),
336
337
	/*
338
	|--------------------------------------------------------------------------
339
	| Registering Prefixes
340
	|--------------------------------------------------------------------------
341
	|
342
	| This strategy is similar to the namespaces strategy. It takes an 
343
	| associative array, which keys are prefixes and their values are 
344
	| directories where the classes are located in. The namespace separator 
345
	| and the “_” underscore character will be replaced by the directory 
346
	| separator when the loader try to find the classes. Remember always to 
347
	| add a trailing slash at the end of the paths.
348
	|
349
	| Example Usage:
350
	|
351
	| array(
352
	| 	"Example_Base"     => "vendor/example/base/",
353
	| 	"Example_Adapter"  => "vendor/example/adapter/",
354
	| 	"Example_"         => "vendor/example/",
355
	| )
356
	|
357
	*/
358
359
	'prefixes' => array(),
360
361
	/*
362
	|--------------------------------------------------------------------------
363
	| Additional File Extensions
364
	|--------------------------------------------------------------------------
365
	|
366
	| Some autoloading strategies such as “prefixes”, “namespaces” or 
367
	| “directories” automatically append the “php” extension at the end of the 
368
	| checked file. If you are using additional extensions you could set it 
369
	| with the method “setExtensions”. 
370
	|
371
	*/
372
373
	'extensions' => array("php"),
374
375
	/*
0 ignored issues
show
Unused Code Comprehensibility introduced by
38% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
376
	|--------------------------------------------------------------------------
377
	| Default libraries
378
	|--------------------------------------------------------------------------
379
	|
380
	|
381
	*/
382
383
	'libraries' => array(
384
		'session' => '\Phalcon\Session\Adapter\Files'
385
	)
386
);