Issues (411)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/DbupdaterTable.php (1 issue)

1
<?php
2
3
namespace XoopsModules\Wfdownloads;
4
5
/*
6
 You may not change or alter any portion of this comment or credits
7
 of supporting developers from this source code or any supporting source code
8
 which is considered copyrighted (c) material of the original comment or credit authors.
9
10
 This program is distributed in the hope that it will be useful,
11
 but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
 */
14
/**
15
 * Wfdownloads module
16
 *
17
 * @copyright       XOOPS Project (https://xoops.org)
18
 * @license         GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html)
19
 * @package         wfdownload
20
 * @since           3.23
21
 * @author          marcan <[email protected]>, Xoops Development Team
22
 */
23
/**
24
 * Contains the classes for updating database tables
25
 *
26
 * @license    GNU
27
 * @author     marcan <[email protected]>
28
 * @link       http://www.smartfactory.ca The SmartFactory
29
 * @package    Wfdownloads
30
 * @subpackage dbUpdater
31
 */
32
33
/**
34
 * DbupdaterTable class
35
 *
36
 * Information about an individual table
37
 *
38
 * @package Wfdownloads
39
 * @author  marcan <[email protected]>
40
 * @link    http://www.smartfactory.ca The SmartFactory
41
 */
42
43
use XoopsModules\Wfdownloads;
44
45
/**
46
 * Class DbupdaterTable
47
 */
48
class DbupdaterTable
49
{
50
    /**
51
     * @var string $_name name of the table
52
     */
53
    public $_name;
54
    /**
55
     * @var string $_structure structure of the table
56
     */
57
    public $_structure;
58
    /**
59
     * @var array $_data containing valued of each records to be added
60
     */
61
    public $_data;
62
    /**
63
     * @var array $_alteredFields containing fields to be altered
64
     */
65
    public $_alteredFields;
66
    /**
67
     * @var array $_newFields containing new fields to be added
68
     */
69
    public $_newFields;
70
    /**
71
     * @var array $_dropedFields containing fields to be droped
72
     */
73
    public $_dropedFields;
74
    /**
75
     * @var array $_flagForDrop flag table to drop it
76
     */
77
    public $_flagForDrop = false;
78
    /**
79
     * @var array $_updatedFields containing fields which values will be updated
80
     */
81
    public $_updatedFields;
82
    /**
83
     * @var array $_updatedFields containing fields which values will be updated
84
     */ //felix
85
    public $_updatedWhere;
86
87
    /**
88
     * Constructor
89
     *
90
     * @param string $name name of the table
91
     */
92
    public function __construct($name)
93
    {
94
        $this->_name = $name;
95
        $this->_data = [];
96
    }
97
98
    /**
99
     * Return the table name, prefixed with site table prefix
100
     *
101
     * @return string table name
102
     */
103
    public function name()
104
    {
105
        return $GLOBALS['xoopsDB']->prefix($this->_name);
106
    }
107
108
    /**
109
     * Set the table structure
110
     *
111
     * @param string $structure table structure
112
     */
113
    public function setStructure($structure)
114
    {
115
        $this->_structure = $structure;
116
    }
117
118
    /**
119
     * Return the table structure
120
     *
121
     * @return string table structure
122
     */
123
    public function getStructure()
124
    {
125
        return \sprintf($this->_structure, $this->name());
126
    }
127
128
    /**
129
     * Add values of a record to be added
130
     *
131
     * @param string $data values of a record
132
     */
133
    public function setData($data)
134
    {
135
        $this->_data[] = $data;
136
    }
137
138
    /**
139
     * Get the data array
140
     *
141
     * @return array containing the records values to be added
142
     */
143
    public function getData()
144
    {
145
        return $this->_data;
146
    }
147
148
    /**
149
     * Use to insert data in a table
150
     *
151
     * @return bool true if success, false if an error occured
152
     */
153
    public function addData()
154
    {
155
        $ret = null;
156
        foreach ($this->getData() as $data) {
157
            $query = \sprintf('INSERT INTO `%s` VALUES (%s)', $this->name(), $data);
158
            $ret   = $GLOBALS['xoopsDB']->query($query);
159
            if (!$ret) {
160
                echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_ADD_DATA_ERR, $this->name()) . '</li>';
161
            } else {
162
                echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_ADD_DATA, $this->name()) . '</li>';
163
            }
164
        }
165
166
        return $ret;
167
    }
168
169
    /**
170
     * Add a field to be added
171
     *
172
     * @param string $name       name of the field
173
     * @param string $properties properties of the field
174
     */
175
    public function addAlteredField($name, $properties)
176
    {
177
        $field                  = [];
178
        $field['name']          = $name;
179
        $field['properties']    = $properties;
180
        $this->_alteredFields[] = $field;
181
    }
182
183
    /**
184
     * Invert values 0 to 1 and 1 to 0
185
     *
186
     * @param string $name name of the field
187
     * @param string $newValue
188
     * @param string $oldValue
189
     */ //felix
190
191
    public function addUpdatedWhere($name, $newValue, $oldValue)
192
    {
193
        $field                 = [];
194
        $field['name']         = $name;
195
        $field['value']        = $newValue;
196
        $field['where']        = $oldValue;
197
        $this->_updatedWhere[] = $field;
198
    }
199
200
    /**
201
     * Add new field of a record to be added
202
     *
203
     * @param string $name       name of the field
204
     * @param string $properties properties of the field
205
     */
206
    public function addNewField($name, $properties)
207
    {
208
        $field               = [];
209
        $field['name']       = $name;
210
        $field['properties'] = $properties;
211
        $this->_newFields[]  = $field;
212
    }
213
214
    /**
215
     * Get fields that need to be altered
216
     *
217
     * @return array fields that need to be altered
218
     */
219
    public function getAlteredFields()
220
    {
221
        return $this->_alteredFields;
222
    }
223
224
    /**
225
     * Add field for which the value will be updated
226
     *
227
     * @param string $name  name of the field
228
     * @param string $value value to be set
229
     */
230
    public function addUpdatedField($name, $value)
231
    {
232
        $field                  = [];
233
        $field['name']          = $name;
234
        $field['value']         = $value;
235
        $this->_updatedFields[] = $field;
236
    }
237
238
    /**
239
     * Get new fields to be added
240
     *
241
     * @return array fields to be added
242
     */
243
    public function getNewFields()
244
    {
245
        return $this->_newFields;
246
    }
247
248
    /**
249
     * Get fields which values need to be updated
250
     *
251
     * @return array fields which values need to be updated
252
     */
253
    public function getUpdatedFields()
254
    {
255
        return $this->_updatedFields;
256
    }
257
258
    /**
259
     * Get fields which values need to be updated
260
     *
261
     * @return array fields which values need to be updated
262
     */ //felix
263
264
    public function getUpdatedWhere()
265
    {
266
        return $this->_updatedWhere;
267
    }
268
269
    /**
270
     * Add values of a record to be added
271
     *
272
     * @param string $name name of the field
273
     */
274
    public function addDropedField($name)
275
    {
276
        $this->_dropedFields[] = $name;
277
    }
278
279
    /**
280
     * Get fields that need to be droped
281
     *
282
     * @return array fields that need to be droped
283
     */
284
    public function getDropedFields()
285
    {
286
        return $this->_dropedFields;
287
    }
288
289
    /**
290
     * Set the flag to drop the table
291
     */
292
    public function setFlagForDrop()
293
    {
294
        $this->_flagForDrop = true;
0 ignored issues
show
Documentation Bug introduced by
It seems like true of type true is incompatible with the declared type array of property $_flagForDrop.

Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property.

Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property..

Loading history...
295
    }
296
297
    /**
298
     * Use to create a table
299
     *
300
     * @return bool true if success, false if an error occured
301
     */
302
    public function createTable()
303
    {
304
        $query = $this->getStructure();
305
306
        $ret = $GLOBALS['xoopsDB']->query($query);
307
        if (!$ret) {
308
            echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_CREATE_TABLE_ERR, $this->name()) . '</li>';
309
        } else {
310
            echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_CREATE_TABLE, $this->name()) . '</li>';
311
        }
312
313
        return $ret;
314
    }
315
316
    /**
317
     * Use to drop a table
318
     *
319
     * @return bool true if success, false if an error occured
320
     */
321
    public function dropTable()
322
    {
323
        $query = \sprintf('DROP TABLE %s', $this->name());
324
        $ret   = $GLOBALS['xoopsDB']->query($query);
325
        if (!$ret) {
326
            echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_DROP_TABLE_ERR, $this->name()) . '</li>';
327
328
            return false;
329
        }
330
        echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_DROP_TABLE, $this->name()) . '</li>';
331
332
        return true;
333
    }
334
335
    /**
336
     * Use to alter a table
337
     *
338
     * @return bool true if success, false if an error occured
339
     */
340
    public function alterTable()
341
    {
342
        $ret = true;
343
344
        foreach ($this->getAlteredFields() as $alteredField) {
345
            $query = \sprintf('ALTER TABLE `%s` CHANGE `%s` %s', $this->name(), $alteredField['name'], $alteredField['properties']);
346
            //echo $query;
347
            $ret = $ret && $GLOBALS['xoopsDB']->query($query);
348
            if (!$ret) {
349
                echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_CHGFIELD_ERR, $alteredField['name'], $this->name()) . '</li>';
350
            } else {
351
                echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_CHGFIELD, $alteredField['name'], $this->name()) . '</li>';
352
            }
353
        }
354
355
        return $ret;
356
    }
357
358
    /**
359
     * Use to add new fileds in the table
360
     *
361
     * @return bool true if success, false if an error occured
362
     */
363
    public function addNewFields()
364
    {
365
        $ret = true;
366
        foreach ($this->getNewFields() as $newField) {
367
            $query = \sprintf('ALTER TABLE `%s` ADD `%s` %s', $this->name(), $newField['name'], $newField['properties']);
368
            //echo $query;
369
            $ret = $ret && $GLOBALS['xoopsDB']->query($query);
370
            if (!$ret) {
371
                echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_NEWFIELD_ERR, $newField['name'], $this->name()) . '</li>';
372
            } else {
373
                echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_NEWFIELD, $newField['name'], $this->name()) . '</li>';
374
            }
375
        }
376
377
        return $ret;
378
    }
379
380
    /**
381
     * Use to update fields values
382
     *
383
     * @return bool true if success, false if an error occured
384
     */
385
    public function updateFieldsValues()
386
    {
387
        $ret = true;
388
389
        foreach ($this->getUpdatedFields() as $updatedField) {
390
            $query = \sprintf('UPDATE `%s` SET %s = %s', $this->name(), $updatedField['name'], $updatedField['value']);
391
            $ret   = $ret && $GLOBALS['xoopsDB']->query($query);
392
            if (!$ret) {
393
                echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_UPDATE_TABLE_ERR, $this->name()) . '</li>';
394
            } else {
395
                echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_UPDATE_TABLE, $this->name()) . '</li>';
396
            }
397
        }
398
399
        return $ret;
400
    }
401
402
    /**
403
     * Use to update fields values
404
     *
405
     * @return bool true if success, false if an error occured
406
     */ //felix
407
408
    public function updateWhereValues()
409
    {
410
        $ret = true;
411
412
        foreach ($this->getUpdatedWhere() as $updatedWhere) {
413
            $query = \sprintf('UPDATE `%s` SET %s = %s WHERE %s  %s', $this->name(), $updatedWhere['name'], $updatedWhere['value'], $updatedWhere['name'], $updatedWhere['where']);
414
            //echo $query."<br>";
415
            $ret = $ret && $GLOBALS['xoopsDB']->query($query);
416
            if (!$ret) {
417
                echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_UPDATE_TABLE_ERR, $this->name()) . '</li>';
418
            } else {
419
                echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_UPDATE_TABLE, $this->name()) . '</li>';
420
            }
421
        }
422
423
        return $ret;
424
    }
425
426
    /**
427
     * Use to drop fields
428
     *
429
     * @return bool true if success, false if an error occured
430
     */
431
    public function dropFields()
432
    {
433
        $ret = true;
434
435
        foreach ($this->getDropedFields() as $dropedField) {
436
            $query = \sprintf('ALTER TABLE %s DROP %s', $this->name(), $dropedField);
437
438
            $ret = $ret && $GLOBALS['xoopsDB']->query($query);
439
            if (!$ret) {
440
                echo "<li class='err'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_DROPFIELD_ERR, $dropedField, $this->name()) . '</li>';
441
            } else {
442
                echo "<li class='ok'>" . \sprintf(\_AM_WFDOWNLOADS_DB_MSG_DROPFIELD, $dropedField, $this->name()) . '</li>';
443
            }
444
        }
445
446
        return $ret;
447
    }
448
}
449