Issues (1844)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/TicketFieldDepartmentHandler.php (16 issues)

1
<?php declare(strict_types=1);
2
3
namespace XoopsModules\Xhelp;
4
5
/*
6
 * You may not change or alter any portion of this comment or credits
7
 * of supporting developers from this source code or any supporting source code
8
 * which is considered copyrighted (c) material of the original comment or credit authors.
9
 *
10
 * This program is distributed in the hope that it will be useful,
11
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
 */
14
15
/**
16
 * @copyright    {@link https://xoops.org/ XOOPS Project}
17
 * @license      {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later}
18
 * @author       Brian Wahoff <[email protected]>
19
 * @author       XOOPS Development Team
20
 */
21
22
/**
23
 * class TicketFieldDepartmentHandler
24
 */
25
class TicketFieldDepartmentHandler // extends BaseObjectHandler
26
{
27
    private $db;
28
    private $ticketFieldHandler;
29
    private $departmentHandler;
30
31
//    private const TABLE = 'xhelp_ticket_field_departments';
32
//    private const ENTITY = TicketFieldDepartment::class;
33
//    private const ENTITYNAME = 'TicketFieldDepartment';
34
//    private const KEYNAME = 'fieldid';
35
//    private const IDENTIFIER = 'deptid';
36
37
    /**
38
     * Constructor
39
     */
40
    public function __construct(\XoopsMySQLDatabase $db = null)
41
    {
42
        $this->db     = $db;
43
        $this->helper = Helper::getInstance();
0 ignored issues
show
Bug Best Practice introduced by
The property helper does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
44
45
        /** @var \XoopsModules\Xhelp\TicketFieldHandler $this- >ticketFieldHandler */
46
        $this->ticketFieldHandler = $this->helper->getHandler('TicketField');
47
        /** @var \XoopsModules\Xhelp\DepartmentHandler $this- >ticketFieldHandler */
48
        $this->departmentHandler = $this->helper->getHandler('Department');
49
50
//        parent::__construct($db, static::TABLE, static::ENTITY, static::KEYNAME, static::IDENTIFIER);
51
    }
52
53
    /**
54
     * Get every department a field is "in"
55
     *
56
     * @param int  $field     Field ID
57
     * @param bool $id_as_key Should object ID be used as array key?
58
     * @return array array of {@Link Department} objects
59
     */
60
    public function departmentsByField(int $field, bool $id_as_key = false): array
61
    {
62
        $field = $field;
63
        $sql   = \sprintf('SELECT d.* FROM `%s` d INNER JOIN %s j ON d.id = j.deptid WHERE j.fieldid = %u', $this->db->prefix('xhelp_departments'), $this->db->prefix('xhelp_ticket_field_departments'), $field);
0 ignored issues
show
The method prefix() does not exist on null. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

63
        $sql   = \sprintf('SELECT d.* FROM `%s` d INNER JOIN %s j ON d.id = j.deptid WHERE j.fieldid = %u', $this->db->/** @scrutinizer ignore-call */ prefix('xhelp_departments'), $this->db->prefix('xhelp_ticket_field_departments'), $field);

This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.

This is most likely a typographical error or the method has been renamed.

Loading history...
64
        $ret   = $this->db->query($sql);
65
        $arr   = [];
66
67
        if ($ret) {
68
            while (false !== ($temp = $this->db->fetchArray($ret))) {
0 ignored issues
show
It seems like $ret can also be of type true; however, parameter $result of XoopsMySQLDatabase::fetchArray() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

68
            while (false !== ($temp = $this->db->fetchArray(/** @scrutinizer ignore-type */ $ret))) {
Loading history...
69
                $dept = $this->departmentHandler->create();
70
                $dept->assignVars($temp);
71
                if ($id_as_key) {
72
                    $arr[$dept->getVar('id')] = $dept;
73
                } else {
74
                    $arr[] = $dept;
75
                }
76
                unset($temp);
77
            }
78
        }
79
80
        return $arr;
81
    }
82
83
    /**
84
     * Get every field in a department
85
     *
86
     * @param int  $dept      Department ID
87
     * @param bool $id_as_key Should object ID be used as array key?
88
     * @return array array of {@Link TicketField} objects
89
     */
90
    public function fieldsByDepartment(int $dept, bool $id_as_key = false): array
91
    {
92
        $dept   = $dept;
93
        $sql    = \sprintf('SELECT f.* FROM `%s` f INNER JOIN %s j ON f.id = j.fieldid WHERE j.deptid = %u ORDER BY f.weight', $this->db->prefix('xhelp_ticket_fields'), $this->db->prefix('xhelp_ticket_field_departments'), $dept);
94
        $result = $this->db->query($sql);
95
        $arr    = [];
96
97
        if ($this->db->getRowsNum($result) > 0) {
0 ignored issues
show
It seems like $result can also be of type boolean; however, parameter $result of XoopsMySQLDatabase::getRowsNum() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

97
        if ($this->db->getRowsNum(/** @scrutinizer ignore-type */ $result) > 0) {
Loading history...
98
            while (false !== ($temp = $this->db->fetchArray($result))) {
0 ignored issues
show
It seems like $result can also be of type boolean; however, parameter $result of XoopsMySQLDatabase::fetchArray() does only seem to accept mysqli_result, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

98
            while (false !== ($temp = $this->db->fetchArray(/** @scrutinizer ignore-type */ $result))) {
Loading history...
99
                $field = $this->ticketFieldHandler->create();
100
                $field->assignVars($temp);
101
                if ($id_as_key) {
102
                    $arr[$field->getVar('id')] = $field;
103
                } else {
104
                    $arr[] = $field;
105
                }
106
                unset($temp);
107
            }
108
        }
109
110
        return $arr;
111
    }
112
113
    /**
114
     * Add the given field to the given department
115
     *
116
     * @param array|TicketField $field
117
     * @param int               $deptid Department ID
118
     * @return bool True if successful, False if not
119
     * @internal param mixed $staff single or array of uids or TicketField object
120
     */
121
    public function addFieldToDepartment($field, int $deptid): bool
122
    {
123
        $ret = false;
124
        if (\is_array($field)) {
125
            foreach ($field as $var) {
126
                $ret = $this->addMembership($var, $deptid);
127
                if (!$ret) {
128
                    break;
129
                }
130
            }
131
        } else {
132
            $ret = $this->addMembership($field, $deptid);
133
        }
134
135
        return $ret;
136
    }
137
138
    /**
139
     * Add the given department(s) to the given field
140
     *
141
     * @param mixed $dept  single or array of department id's or {@Link Department} objects
142
     * @param int   $field Field ID
143
     * @retnr  bool True if successful, False if not
144
     * @return bool
145
     */
146
    public function addDepartmentToField($dept, int $field): bool
147
    {
148
        $ret = false;
149
        if (\is_array($dept)) {
150
            foreach ($dept as $var) {
151
                $ret = $this->addMembership($field, $var);
152
                if (!$ret) {
153
                    break;
154
                }
155
            }
156
        } else {
157
            $ret = $this->addMembership($field, $dept);
158
        }
159
160
        return $ret;
161
    }
162
163
    /**
164
     * Remove the given field(s) from the given department
165
     *
166
     * @param mixed $field  single or array of field ids or {@link TicketField} objects
167
     * @param int   $deptid Department ID
168
     * @return bool  True if successful, False if not
169
     */
170
    public function removeFieldFromDept($field, int $deptid): bool
171
    {
172
        $ret = false;
173
        if (\is_array($field)) {
174
            foreach ($field as $var) {
175
                $ret = $this->removeMembership($var, $deptid);
176
                if (!$ret) {
177
                    break;
178
                }
179
            }
180
        } else {
181
            $ret = $this->removeMembership($field, $deptid);
182
        }
183
184
        return $ret;
0 ignored issues
show
Bug Best Practice introduced by
The expression return $ret could return the type mysqli_result which is incompatible with the type-hinted return boolean. Consider adding an additional type-check to rule them out.
Loading history...
185
    }
186
187
    /**
188
     * Remove the given department(s) from the given field
189
     *
190
     * @param mixed $dept  single or array of department id's or {@link Department} objects
191
     * @param int   $field Field ID
192
     * @return bool  True if successful, False if not
193
     */
194
    public function removeDeptFromField($dept, int $field): bool
195
    {
196
        $ret = false;
197
        if (\is_array($dept)) {
198
            foreach ($dept as $var) {
199
                $ret = $this->removeMembership($field, $var);
200
                if (!$ret) {
201
                    break;
202
                }
203
            }
204
        } else {
205
            $ret = $this->removeMembership($field, $dept);
206
        }
207
208
        return $ret;
0 ignored issues
show
Bug Best Practice introduced by
The expression return $ret could return the type mysqli_result which is incompatible with the type-hinted return boolean. Consider adding an additional type-check to rule them out.
Loading history...
209
    }
210
211
    /**
212
     * Remove All Departments from a particular field
213
     * @param int $fieldId Field ID
214
     * @return bool True if successful, False if not
215
     */
216
    public function removeFieldFromAllDept(int $fieldId): bool
217
    {
218
        $ret = false;
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
219
        //        $field    = $field;
220
        $criteria = new \Criteria('fieldid', $fieldId);
221
        $ret      = $this->deleteAll($criteria);
222
223
        return $ret;
224
    }
225
226
    /**
227
     * Remove All Departments from a particular field
228
     * @param int $dept
229
     * @return bool True if successful, False if not
230
     * @internal param int $field Field ID
231
     */
232
    public function removeDeptFromAllFields(int $dept): bool
233
    {
234
        $ret      = false;
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
235
        $dept     = $dept;
236
        $criteria = new \Criteria('deptid', $dept);
237
        $ret      = $this->deleteAll($criteria);
238
239
        return $ret;
240
    }
241
242
    /**
243
     * @param \CriteriaElement|\CriteriaCompo|null $criteria
244
     * @param bool                                 $force
245
     * @return bool
246
     */
247
    public function deleteAll(\CriteriaElement $criteria = null, bool $force = false): bool
248
    {
249
        $sql = 'DELETE FROM ' . $this->db->prefix('xhelp_ticket_field_departments');
250
        if (($criteria instanceof \CriteriaCompo) || ($criteria instanceof \Criteria)) {
251
            $sql .= ' ' . $criteria->renderWhere();
252
        }
253
254
        if ($force) {
255
            $result = $this->db->queryF($sql);
256
        } else {
257
            $result = $this->db->query($sql);
258
        }
259
        if (!$result) {
260
            return false;
261
        }
262
263
        return true;
264
    }
265
266
    /**
267
     * Add a field to a department
268
     *
269
     * @param mixed $field fieldid or {@Link TicketField} object
270
     * @param mixed $dept  deptid or {@Link Department} object
271
     * @return bool  True if Successful, False if not
272
     */
273
    public function addMembership($field, $dept): bool
274
    {
275
        $ret     = false;
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
276
        $fieldid = $deptid = 0;
0 ignored issues
show
The assignment to $fieldid is dead and can be removed.
Loading history...
277
278
        if (\is_object($field)) {
279
            $fieldid = $field->getVar('id');
280
        } else {
281
            $fieldid = (int)$field;
282
        }
283
284
        if (\is_object($dept)) {
285
            $deptid = $dept->getVar('id');
286
        } else {
287
            $deptid = (int)$dept;
288
        }
289
290
        $ret = $this->addJoinerRecord($fieldid, $deptid);
291
292
        return $ret;
0 ignored issues
show
Bug Best Practice introduced by
The expression return $ret could return the type mysqli_result which is incompatible with the type-hinted return boolean. Consider adding an additional type-check to rule them out.
Loading history...
293
    }
294
295
    /**
296
     * @param int $fieldid
297
     * @param int $deptid
298
     * @return bool|\mysqli_result
299
     */
300
    private function addJoinerRecord(int $fieldid, int $deptid)
301
    {
302
        $ret = false;
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
303
        $sql = \sprintf('INSERT INTO `%s` (fieldid, deptid) VALUES (%u, %u)', $this->db->prefix('xhelp_ticket_field_departments'), $fieldid, $deptid);
304
        $ret = $this->db->query($sql);
305
306
        return $ret;
307
    }
308
309
    /**
310
     * @param int|\XoopsModules\Xhelp\TicketField $field
311
     * @param int|\XoopsModules\Xhelp\Department  $dept
312
     * @return mixed
313
     */
314
    private function removeMembership($field, $dept)
315
    {
316
        $ret     = false;
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
317
        $fieldid = $deptid = 0;
0 ignored issues
show
The assignment to $fieldid is dead and can be removed.
Loading history...
318
        if (\is_object($field)) {
319
            $fieldid = $field->getVar('id');
320
        } else {
321
            $fieldid = (int)$field;
322
        }
323
324
        if (\is_object($dept)) {
325
            $deptid = $dept->getVar('id');
326
        } else {
327
            $deptid = (int)$dept;
328
        }
329
330
        $ret = $this->removeJoinerRecord($fieldid, $deptid);
331
332
        return $ret;
333
    }
334
335
    /**
336
     * @param int $fieldid
337
     * @param int $deptid
338
     * @return bool|\mysqli_result
339
     */
340
    private function removeJoinerRecord(int $fieldid, int $deptid)
341
    {
342
        $ret = false;
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
343
        $sql = \sprintf('DELETE FROM `%s` WHERE fieldid = %u AND deptid = %u', $this->db->prefix('xhelp_ticket_field_departments'), $fieldid, $deptid);
344
        $ret = $this->db->query($sql);
345
346
        return $ret;
347
    }
348
}
349