Issues (733)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/dbupdater.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * Contains the classes for updating database tables
5
 *
6
 * @license    GNU
7
 * @author     marcan <[email protected]>
8
 * @link       http://www.smartfactory.ca The SmartFactory
9
 * @package    SmartPartner
10
 * @subpackage dbUpdater
11
 */
12
13
/**
14
 * SmartpartnerTable class
15
 *
16
 * Information about an individual table
17
 *
18
 * @package SmartPartner
19
 * @author  marcan <[email protected]>
20
 * @link    http://www.smartfactory.ca The SmartFactory
21
 */
22
// defined('XOOPS_ROOT_PATH') || exit('XOOPS root path not defined');
0 ignored issues
show
Unused Code Comprehensibility introduced by
70% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
23
24
class SmartpartnerTable
25
{
26
    /**
27
     * @var string $_name name of the table
28
     */
29
    public $_name;
30
31
    /**
32
     * @var string $_structure structure of the table
33
     */
34
    public $_structure;
35
36
    /**
37
     * @var array $_data containing valued of each records to be added
38
     */
39
    public $_data;
40
41
    /**
42
     * @var array $_alteredFields containing fields to be altered
43
     */
44
    public $_alteredFields;
45
46
    /**
47
     * @var array $_newFields containing new fields to be added
48
     */
49
    public $_newFields;
50
51
    /**
52
     * @var array $_droppedFields containing fields to be dropped
53
     */
54
    public $_droppedFields;
55
56
    /**
57
     * @var array $_flagForDrop flag table to drop it
58
     */
59
    public $_flagForDrop = false;
60
61
    /**
62
     * @var array $_updatedFields containing fields which values will be updated
63
     */
64
    public $_updatedFields;
65
66
    /**
67
     * Constructor
68
     *
69
     * @param string $name name of the table
70
     *
71
     */
72
    public function __construct($name)
73
    {
74
        $this->_name = $name;
75
        $this->_data = array();
76
    }
77
78
    /**
79
     * Return the table name, prefixed with site table prefix
80
     *
81
     * @return string table name
82
     *
83
     */
84
    public function name()
85
    {
86
        global $xoopsDB;
87
88
        return $xoopsDB->prefix($this->_name);
89
    }
90
91
    /**
92
     * Set the table structure
93
     *
94
     * @param string $structure table structure
95
     *
96
     */
97
    public function setStructure($structure)
98
    {
99
        $this->_structure = $structure;
100
    }
101
102
    /**
103
     * Return the table structure
104
     *
105
     * @return string table structure
106
     *
107
     */
108
    public function getStructure()
109
    {
110
        return sprintf($this->_structure, $this->name());
111
    }
112
113
    /**
114
     * Add values of a record to be added
115
     *
116
     * @param string $data values of a record
117
     *
118
     */
119
    public function setData($data)
120
    {
121
        $this->_data[] = $data;
122
    }
123
124
    /**
125
     * Get the data array
126
     *
127
     * @return array containing the records values to be added
128
     *
129
     */
130
    public function getData()
131
    {
132
        return $this->_data;
133
    }
134
135
    /**
136
     * Use to insert data in a table
137
     *
138
     * @return bool true if success, false if an error occured
139
     *
140
     */
141 View Code Duplication
    public function addData()
142
    {
143
        global $xoopsDB;
144
145
        foreach ($this->getData() as $data) {
146
            $query = sprintf('INSERT INTO %s VALUES (%s)', $this->name(), $data);
147
            $ret   = $xoopsDB->query($query);
148
            if (!$ret) {
149
                echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_ADD_DATA_ERR, $this->name()) . '</li>';
150
            } else {
151
                echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_ADD_DATA, $this->name()) . '</li>';
152
            }
153
        }
154
155
        return $ret;
156
    }
157
158
    /**
159
     * Add a field to be added
160
     *
161
     * @param string $name       name of the field
162
     * @param string $properties properties of the field
163
     *
164
     */
165
    public function addAlteredField($name, $properties)
166
    {
167
        $field['name']          = $name;
168
        $field['properties']    = $properties;
169
        $this->_alteredFields[] = $field;
170
    }
171
172
    /**
173
     * Add new field of a record to be added
174
     *
175
     * @param string $name       name of the field
176
     * @param string $properties properties of the field
177
     *
178
     */
179
    public function addNewField($name, $properties)
180
    {
181
        $field['name']       = $name;
182
        $field['properties'] = $properties;
183
        $this->_newFields[]  = $field;
184
    }
185
186
    /**
187
     * Get fields that need to be altered
188
     *
189
     * @return array fields that need to be altered
190
     *
191
     */
192
    public function getAlteredFields()
193
    {
194
        return $this->_alteredFields;
195
    }
196
197
    /**
198
     * Add field for which the value will be updated
199
     *
200
     * @param string $name  name of the field
201
     * @param string $value value to be set
202
     *
203
     */
204
    public function addUpdatedField($name, $value)
205
    {
206
        $field['name']          = $name;
207
        $field['value']         = $value;
208
        $this->_updatedFields[] = $field;
209
    }
210
211
    /**
212
     * Get new fields to be added
213
     *
214
     * @return array fields to be added
215
     *
216
     */
217
    public function getNewFields()
218
    {
219
        return $this->_newFields;
220
    }
221
222
    /**
223
     * Get fields which values need to be updated
224
     *
225
     * @return array fields which values need to be updated
226
     *
227
     */
228
    public function getUpdatedFields()
229
    {
230
        return $this->_updatedFields;
231
    }
232
233
    /**
234
     * Add values of a record to be added
235
     *
236
     * @param string $name name of the field
237
     *
238
     */
239
    public function addDroppedField($name)
240
    {
241
        $this->_droppedFields[] = $name;
242
    }
243
244
    /**
245
     * Get fields that need to be dropped
246
     *
247
     * @return array fields that need to be dropped
248
     *
249
     */
250
    public function getDroppedFields()
251
    {
252
        return $this->_droppedFields;
253
    }
254
255
    /**
256
     * Set the flag to drop the table
257
     *
258
     */
259
    public function setFlagForDrop()
260
    {
261
        $this->_flagForDrop = true;
262
    }
263
264
    /**
265
     * Use to create a table
266
     *
267
     * @return bool true if success, false if an error occured
268
     *
269
     */
270 View Code Duplication
    public function createTable()
271
    {
272
        global $xoopsDB;
273
274
        $query = $this->getStructure();
275
276
        $ret = $xoopsDB->query($query);
277
        if (!$ret) {
278
            echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_CREATE_TABLE_ERR, $this->name()) . '</li>';
279
        } else {
280
            echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_CREATE_TABLE, $this->name()) . '</li>';
281
        }
282
283
        return $ret;
284
    }
285
286
    /**
287
     * Use to drop a table
288
     *
289
     * @return bool true if success, false if an error occured
290
     *
291
     */
292 View Code Duplication
    public function dropTable()
293
    {
294
        global $xoopsDB;
295
296
        $query = sprintf('DROP TABLE %s', $this->name());
297
        $ret   = $xoopsDB->query($query);
298
        if (!$ret) {
299
            echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_DROP_TABLE_ERR, $this->name()) . '</li>';
300
301
            return false;
302
        } else {
303
            echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_DROP_TABLE, $this->name()) . '</li>';
304
305
            return true;
306
        }
307
    }
308
309
    /**
310
     * Use to alter a table
311
     *
312
     * @return bool true if success, false if an error occured
313
     *
314
     */
315 View Code Duplication
    public function alterTable()
316
    {
317
        global $xoopsDB;
318
319
        $ret = true;
320
321
        foreach ($this->getAlteredFields() as $alteredField) {
322
            $query = sprintf('ALTER TABLE `%s` CHANGE `%s` %s', $this->name(), $alteredField['name'], $alteredField['properties']);
323
            //echo $query;
324
            $ret = $ret && $xoopsDB->query($query);
325
            if (!$ret) {
326
                echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_CHGFIELD_ERR, $alteredField['name'], $this->name()) . '</li>';
327
            } else {
328
                echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_CHGFIELD, $alteredField['name'], $this->name()) . '</li>';
329
            }
330
        }
331
332
        return $ret;
333
    }
334
335
    /**
336
     * Use to add new fileds in the table
337
     *
338
     * @return bool true if success, false if an error occured
339
     *
340
     */
341 View Code Duplication
    public function addNewFields()
342
    {
343
        global $xoopsDB;
344
        $ret = true;
345
346
        foreach ($this->getNewFields() as $newField) {
347
            $query = sprintf('ALTER TABLE `%s` ADD `%s` %s', $this->name(), $newField['name'], $newField['properties']);
348
            $ret   = $ret && $xoopsDB->query($query);
349
            if (!$ret) {
350
                echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_NEWFIELD_ERR, $newField['name'], $this->name()) . '</li>';
351
            } else {
352
                echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_NEWFIELD, $newField['name'], $this->name()) . '</li>';
353
            }
354
        }
355
356
        return $ret;
357
    }
358
359
    /**
360
     * Use to update fields values
361
     *
362
     * @return bool true if success, false if an error occured
363
     *
364
     */
365 View Code Duplication
    public function updateFieldsValues()
366
    {
367
        global $xoopsDB;
368
369
        $ret = true;
370
371
        foreach ($this->getUpdatedFields() as $updatedField) {
372
            $query = sprintf('UPDATE %s SET %s = %s', $this->name(), $updatedField['name'], $updatedField['value']);
373
            $ret   = $ret && $xoopsDB->query($query);
374
            if (!$ret) {
375
                echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_UPDATE_TABLE_ERR, $this->name()) . '</li>';
376
            } else {
377
                echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_UPDATE_TABLE, $this->name()) . '</li>';
378
            }
379
        }
380
381
        return $ret;
382
    }
383
384
    /**
385
     * Use to drop fields
386
     *
387
     * @return bool true if success, false if an error occured
388
     *
389
     */
390 View Code Duplication
    public function dropFields()
391
    {
392
        global $xoopsDB;
393
394
        $ret = true;
395
396
        foreach ($this->getDroppedFields() as $droppedField) {
397
            $query = sprintf('ALTER TABLE %s DROP %s', $this->name(), $droppedField);
398
399
            $ret = $ret && $xoopsDB->query($query);
400
            if (!$ret) {
401
                echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_DROPFIELD_ERR, $droppedField, $this->name()) . '</li>';
402
            } else {
403
                echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_DROPFIELD, $droppedField, $this->name()) . '</li>';
404
            }
405
        }
406
407
        return $ret;
408
    }
409
}
410
411
/**
412
 * SmartpartnerDbupdater class
413
 *
414
 * Class performing the database update for the module
415
 *
416
 * @package SmartPartner
417
 * @author  marcan <[email protected]>
418
 * @link    http://www.smartfactory.ca The SmartFactory
419
 */
420
class SmartpartnerDbupdater
421
{
422
    /**
423
     * SmartpartnerDbupdater constructor.
424
     */
425
    public function __construct()
426
    {
427
    }
428
429
    /**
430
     * Use to execute a general query
431
     *
432
     * @param string $query   query that will be executed
433
     * @param string $goodmsg message displayed on success
434
     * @param string $badmsg  message displayed on error
435
     *
436
     * @return bool true if success, false if an error occured
437
     *
438
     */
439 View Code Duplication
    public function runQuery($query, $goodmsg, $badmsg)
440
    {
441
        global $xoopsDB;
442
        $ret = $xoopsDB->query($query);
443
        if (!$ret) {
444
            echo "<li class='err'>$badmsg</li>";
445
446
            return false;
447
        } else {
448
            echo "<li class='ok'>$goodmsg</li>";
449
450
            return true;
451
        }
452
    }
453
454
    /**
455
     * Use to rename a table
456
     *
457
     * @param string $from name of the table to rename
458
     * @param string $to   new name of the renamed table
459
     *
460
     * @return bool true if success, false if an error occured
461
     */
462 View Code Duplication
    public function renameTable($from, $to)
463
    {
464
        global $xoopsDB;
465
466
        $from = $xoopsDB->prefix($from);
467
        $to   = $xoopsDB->prefix($to);
468
469
        $query = sprintf('ALTER TABLE %s RENAME %s', $from, $to);
470
        $ret   = $xoopsDB->query($query);
471
        if (!$ret) {
472
            echo "<li class='err'>" . sprintf(_AM_SPARTNER_DB_MSG_RENAME_TABLE_ERR, $from) . '</li>';
473
474
            return false;
475
        } else {
476
            echo "<li class='ok'>" . sprintf(_AM_SPARTNER_DB_MSG_RENAME_TABLE, $from, $to) . '</li>';
477
478
            return true;
479
        }
480
    }
481
482
    /**
483
     * Use to update a table
484
     *
485
     * @param object $table {@link SmartpartnerTable} that will be updated
486
     *
487
     * @see SmartpartnerTable
488
     *
489
     * @return bool true if success, false if an error occured
490
     */
491
    public function updateTable($table)
492
    {
493
        global $xoopsDB;
494
495
        $ret = true;
496
497
        // If table has a structure, create the table
498
        if ($table->getStructure()) {
499
            $ret = $table->createTable() && $ret;
500
        }
501
502
        // If table is flag for drop, drop it
503
        if ($table->_flagForDrop) {
504
            $ret = $table->dropTable() && $ret;
505
        }
506
507
        // If table has data, insert it
508
        if ($table->getData()) {
509
            $ret = $table->addData() && $ret;
510
        }
511
512
        // If table has new fields to be added, add them
513
        if ($table->getNewFields()) {
514
            $ret = $table->addNewFields() && $ret;
515
        }
516
517
        // If table has altered field, alter the table
518
        if ($table->getAlteredFields()) {
519
            $ret = $table->alterTable() && $ret;
520
        }
521
522
        // If table has updated field values, update the table
523
        if ($table->getUpdatedFields()) {
524
            $ret = $table->updateFieldsValues($table) && $ret;
525
        }
526
527
        // If table has dropped field, alter the table
528
        if ($table->getDroppedFields()) {
529
            $ret = $table->dropFields($table) && $ret;
530
        }
531
532
        return $ret;
533
    }
534
}
535