This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * XML Generator class |
||
4 | * |
||
5 | * PHP version 5 |
||
6 | * |
||
7 | * @category PHP |
||
8 | * @package PSI_XML |
||
9 | * @author Michael Cramer <[email protected]> |
||
10 | * @copyright 2009 phpSysInfo |
||
11 | * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License |
||
12 | * @version SVN: $Id: class.WebpageXML.inc.php 661 2012-08-27 11:26:39Z namiltd $ |
||
13 | * @link http://phpsysinfo.sourceforge.net |
||
14 | */ |
||
15 | /** |
||
16 | * class for xml output |
||
17 | * |
||
18 | * @category PHP |
||
19 | * @package PSI_XML |
||
20 | * @author Michael Cramer <[email protected]> |
||
21 | * @copyright 2009 phpSysInfo |
||
22 | * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License |
||
23 | * @version Release: 3.0 |
||
24 | * @link http://phpsysinfo.sourceforge.net |
||
25 | */ |
||
26 | class WebpageXML extends Output implements PSI_Interface_Output |
||
0 ignored issues
–
show
|
|||
27 | { |
||
28 | /** |
||
29 | * xml object that holds the generated xml |
||
30 | * |
||
31 | * @var XML |
||
32 | */ |
||
33 | private $_xml; |
||
34 | |||
35 | /** |
||
36 | * only plugin xml |
||
37 | * |
||
38 | * @var boolean |
||
39 | */ |
||
40 | private $_pluginRequest = false; |
||
41 | |||
42 | /** |
||
43 | * complete xml |
||
44 | * |
||
45 | * @var boolean |
||
46 | */ |
||
47 | private $_completeXML = false; |
||
48 | |||
49 | /** |
||
50 | * name of the plugin |
||
51 | * |
||
52 | * @var string |
||
53 | */ |
||
54 | private $_pluginName = null; |
||
55 | |||
56 | /** |
||
57 | * generate the output |
||
58 | * |
||
59 | * @return void |
||
60 | */ |
||
61 | private function _prepare() |
||
62 | { |
||
63 | if (!$this->_pluginRequest) { |
||
64 | // Figure out which OS we are running on, and detect support |
||
65 | if (!file_exists(APP_ROOT.'/includes/os/class.'.PSI_OS.'.inc.php')) { |
||
66 | $this->error->addError("file_exists(class.".PSI_OS.".inc.php)", PSI_OS." is not currently supported"); |
||
67 | } |
||
68 | |||
69 | // check if there is a valid sensor configuration in phpsysinfo.ini |
||
70 | $foundsp = array(); |
||
71 | View Code Duplication | if (defined('PSI_SENSOR_PROGRAM') && is_string(PSI_SENSOR_PROGRAM)) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
72 | if (preg_match(ARRAY_EXP, PSI_SENSOR_PROGRAM)) { |
||
73 | $sensorprograms = eval(strtolower(PSI_SENSOR_PROGRAM)); |
||
0 ignored issues
–
show
It is generally not recommended to use
eval unless absolutely required.
On one hand, ![]() |
|||
74 | } else { |
||
75 | $sensorprograms = array(strtolower(PSI_SENSOR_PROGRAM)); |
||
76 | } |
||
77 | foreach ($sensorprograms as $sensorprogram) { |
||
78 | if (!file_exists(APP_ROOT.'/includes/mb/class.'.$sensorprogram.'.inc.php')) { |
||
79 | $this->error->addError("file_exists(class.".htmlspecialchars($sensorprogram).".inc.php)", "specified sensor program is not supported"); |
||
80 | } else { |
||
81 | $foundsp[] = $sensorprogram; |
||
82 | } |
||
83 | } |
||
84 | } |
||
85 | |||
86 | /** |
||
87 | * motherboard information |
||
88 | * |
||
89 | * @var serialized array |
||
90 | */ |
||
91 | define('PSI_MBINFO', serialize($foundsp)); |
||
92 | |||
93 | // check if there is a valid ups configuration in phpsysinfo.ini |
||
94 | $foundup = array(); |
||
95 | View Code Duplication | if (defined('PSI_UPS_PROGRAM') && is_string(PSI_UPS_PROGRAM)) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
96 | if (preg_match(ARRAY_EXP, PSI_UPS_PROGRAM)) { |
||
97 | $upsprograms = eval(strtolower(PSI_UPS_PROGRAM)); |
||
0 ignored issues
–
show
It is generally not recommended to use
eval unless absolutely required.
On one hand, ![]() |
|||
98 | } else { |
||
99 | $upsprograms = array(strtolower(PSI_UPS_PROGRAM)); |
||
100 | } |
||
101 | foreach ($upsprograms as $upsprogram) { |
||
102 | if (!file_exists(APP_ROOT.'/includes/ups/class.'.$upsprogram.'.inc.php')) { |
||
103 | $this->error->addError("file_exists(class.".htmlspecialchars($upsprogram).".inc.php)", "specified UPS program is not supported"); |
||
104 | } else { |
||
105 | $foundup[] = $upsprogram; |
||
106 | } |
||
107 | } |
||
108 | } |
||
109 | /** |
||
110 | * ups information |
||
111 | * |
||
112 | * @var serialized array |
||
113 | */ |
||
114 | define('PSI_UPSINFO', serialize($foundup)); |
||
115 | |||
116 | // if there are errors stop executing the script until they are fixed |
||
117 | if ($this->error->errorsExist()) { |
||
118 | $this->error->errorsAsXML(); |
||
119 | } |
||
120 | } |
||
121 | |||
122 | // Create the XML |
||
123 | if ($this->_pluginRequest) { |
||
124 | $this->_xml = new XML(false, $this->_pluginName); |
||
125 | } else { |
||
126 | $this->_xml = new XML($this->_completeXML); |
||
127 | } |
||
128 | } |
||
129 | |||
130 | /** |
||
131 | * render the output |
||
132 | * |
||
133 | * @return void |
||
134 | */ |
||
135 | public function run() |
||
136 | { |
||
137 | header("Cache-Control: no-cache, must-revalidate\n"); |
||
138 | header("Content-Type: text/xml\n\n"); |
||
139 | $xml = $this->_xml->getXml(); |
||
140 | echo $xml->asXML(); |
||
141 | } |
||
142 | |||
143 | /** |
||
144 | * get XML as pure string |
||
145 | * |
||
146 | * @return string |
||
0 ignored issues
–
show
|
|||
147 | */ |
||
148 | public function getXMLString() |
||
149 | { |
||
150 | $xml = $this->_xml->getXml(); |
||
151 | |||
152 | return $xml->asXML(); |
||
153 | } |
||
154 | |||
155 | /** |
||
156 | * set parameters for the XML generation process |
||
157 | * |
||
158 | * @param boolean $completeXML switch for complete xml with all plugins |
||
159 | * @param string $plugin name of the plugin |
||
0 ignored issues
–
show
Should the type for parameter
$plugin not be string|null ?
This check looks for It makes a suggestion as to what type it considers more descriptive. Most often this is a case of a parameter that can be null in addition to its declared types. ![]() |
|||
160 | * |
||
161 | * @return void |
||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Adding a
@return annotation to constructors is generally not recommended as a constructor does not have a meaningful return value.
Adding a Please refer to the PHP core documentation on constructors. ![]() |
|||
162 | */ |
||
163 | public function __construct($completeXML, $plugin = null) |
||
164 | { |
||
165 | parent::__construct(); |
||
166 | if ($completeXML) { |
||
167 | $this->_completeXML = true; |
||
168 | } |
||
169 | if ($plugin) { |
||
0 ignored issues
–
show
The expression
$plugin of type string|null is loosely compared to true ; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.
In PHP, under loose comparison (like For '' == false // true
'' == null // true
'ab' == false // false
'ab' == null // false
// It is often better to use strict comparison
'' === false // false
'' === null // false
![]() |
|||
170 | if (in_array(strtolower($plugin), CommonFunctions::getPlugins())) { |
||
171 | $this->_pluginName = $plugin; |
||
172 | $this->_pluginRequest = true; |
||
173 | } |
||
174 | } |
||
175 | $this->_prepare(); |
||
176 | } |
||
177 | } |
||
178 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.