This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
3 | /********************************************************************************* |
||
4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
6 | |||
7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
9 | * |
||
10 | * This program is free software; you can redistribute it and/or modify it under |
||
11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
12 | * Free Software Foundation with the addition of the following permission added |
||
13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
16 | * |
||
17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
20 | * details. |
||
21 | * |
||
22 | * You should have received a copy of the GNU Affero General Public License along with |
||
23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
25 | * 02110-1301 USA. |
||
26 | * |
||
27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
29 | * |
||
30 | * The interactive user interfaces in modified source and object code versions |
||
31 | * of this program must display Appropriate Legal Notices, as required under |
||
32 | * Section 5 of the GNU Affero General Public License version 3. |
||
33 | * |
||
34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
39 | ********************************************************************************/ |
||
40 | |||
41 | /********************************************************************************* |
||
42 | |||
43 | * Description: Defines the English language pack for the base application. |
||
44 | * Portions created by SugarCRM are Copyright (C) SugarCRM, Inc. |
||
45 | * All Rights Reserved. |
||
46 | * Contributor(s): ______________________________________.. |
||
47 | ********************************************************************************/ |
||
48 | require_once('include/SugarLogger/LoggerManager.php'); |
||
49 | require_once('include/SugarLogger/LoggerTemplate.php'); |
||
50 | |||
51 | /** |
||
52 | * Default SugarCRM Logger |
||
53 | * @api |
||
54 | */ |
||
55 | class SugarLogger implements LoggerTemplate |
||
56 | { |
||
57 | /** |
||
58 | * properties for the SugarLogger |
||
59 | */ |
||
60 | protected $logfile = 'sugarcrm'; |
||
61 | protected $ext = '.log'; |
||
62 | protected $dateFormat = '%c'; |
||
63 | protected $logSize = '10MB'; |
||
64 | protected $maxLogs = 10; |
||
65 | protected $filesuffix = ""; |
||
66 | protected $date_suffix = ""; |
||
67 | protected $log_dir = '.'; |
||
68 | |||
69 | |||
70 | /** |
||
71 | * used for config screen |
||
72 | */ |
||
73 | public static $filename_suffix = array( |
||
74 | //bug#50265: Added none option for previous version users |
||
75 | "" => "None", |
||
76 | "%m_%Y" => "Month_Year", |
||
77 | "%d_%m" => "Day_Month", |
||
78 | "%m_%d_%y" => "Month_Day_Year", |
||
79 | ); |
||
80 | |||
81 | /** |
||
82 | * Let's us know if we've initialized the logger file |
||
83 | */ |
||
84 | protected $initialized = false; |
||
85 | |||
86 | /** |
||
87 | * Logger file handle |
||
88 | */ |
||
89 | protected $fp = false; |
||
90 | |||
91 | public function __get( |
||
92 | $key |
||
93 | ) |
||
94 | { |
||
95 | return $this->$key; |
||
96 | } |
||
97 | |||
98 | /** |
||
99 | * Used by the diagnostic tools to get SugarLogger log file information |
||
100 | */ |
||
101 | public function getLogFileNameWithPath() |
||
102 | { |
||
103 | return $this->full_log_file; |
||
0 ignored issues
–
show
|
|||
104 | } |
||
105 | |||
106 | /** |
||
107 | * Used by the diagnostic tools to get SugarLogger log file information |
||
108 | */ |
||
109 | public function getLogFileName() |
||
110 | { |
||
111 | return ltrim($this->full_log_file, "./"); |
||
0 ignored issues
–
show
The property
full_log_file does not exist on object<SugarLogger> . Since you implemented __get , maybe consider adding a @property annotation.
Since your code implements the magic getter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
If the property has read access only, you can use the @property-read annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
112 | } |
||
113 | |||
114 | /** |
||
115 | * Constructor |
||
116 | * |
||
117 | * Reads the config file for logger settings |
||
118 | */ |
||
119 | public function __construct() |
||
120 | { |
||
121 | $config = SugarConfig::getInstance(); |
||
122 | $this->ext = $config->get('logger.file.ext', $this->ext); |
||
123 | $this->logfile = $config->get('logger.file.name', $this->logfile); |
||
124 | $this->dateFormat = $config->get('logger.file.dateFormat', $this->dateFormat); |
||
125 | $this->logSize = $config->get('logger.file.maxSize', $this->logSize); |
||
126 | $this->maxLogs = $config->get('logger.file.maxLogs', $this->maxLogs); |
||
127 | $this->filesuffix = $config->get('logger.file.suffix', $this->filesuffix); |
||
128 | $log_dir = $config->get('log_dir' , $this->log_dir); |
||
129 | $this->log_dir = $log_dir . (empty($log_dir)?'':'/'); |
||
130 | unset($config); |
||
131 | $this->_doInitialization(); |
||
132 | LoggerManager::setLogger('default','SugarLogger'); |
||
133 | } |
||
134 | |||
135 | /** |
||
136 | * Handles the SugarLogger initialization |
||
137 | */ |
||
138 | protected function _doInitialization() |
||
139 | { |
||
140 | |||
141 | if( $this->filesuffix && array_key_exists($this->filesuffix, self::$filename_suffix) ) |
||
142 | { //if the global config contains date-format suffix, it will create suffix by parsing datetime |
||
143 | $this->date_suffix = "_" . date(str_replace("%", "", $this->filesuffix)); |
||
144 | } |
||
145 | $this->full_log_file = $this->log_dir . $this->logfile . $this->date_suffix . $this->ext; |
||
146 | $this->initialized = $this->_fileCanBeCreatedAndWrittenTo(); |
||
147 | $this->rollLog(); |
||
148 | } |
||
149 | |||
150 | /** |
||
151 | * Checks to see if the SugarLogger file can be created and written to |
||
152 | */ |
||
153 | protected function _fileCanBeCreatedAndWrittenTo() |
||
154 | { |
||
155 | $this->_attemptToCreateIfNecessary(); |
||
156 | return file_exists($this->full_log_file) && is_writable($this->full_log_file); |
||
157 | } |
||
158 | |||
159 | /** |
||
160 | * Creates the SugarLogger file if it doesn't exist |
||
161 | */ |
||
162 | protected function _attemptToCreateIfNecessary() |
||
163 | { |
||
164 | if (file_exists($this->full_log_file)) { |
||
165 | return; |
||
166 | } |
||
167 | @touch($this->full_log_file); |
||
0 ignored issues
–
show
It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.
If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of
@mkdir($dir);
// Better use
if (@mkdir($dir) === false) {
throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
![]() |
|||
168 | } |
||
169 | |||
170 | /** |
||
171 | * see LoggerTemplate::log() |
||
172 | */ |
||
173 | 16 | public function log( |
|
174 | $level, |
||
175 | $message |
||
176 | ) |
||
177 | { |
||
178 | 16 | if (!$this->initialized) { |
|
179 | return; |
||
180 | } |
||
181 | //lets get the current user id or default to -none- if it is not set yet |
||
182 | 16 | $userID = (!empty($GLOBALS['current_user']->id))?$GLOBALS['current_user']->id:'-none-'; |
|
183 | |||
184 | //if we haven't opened a file pointer yet let's do that |
||
185 | 16 | if (! $this->fp)$this->fp = fopen ($this->full_log_file , 'a' ); |
|
186 | |||
187 | |||
188 | // change to a string if there is just one entry |
||
189 | 16 | if ( is_array($message) && count($message) == 1 ) |
|
190 | 16 | $message = array_shift($message); |
|
191 | // change to a human-readable array output if it's any other array |
||
192 | 16 | if ( is_array($message) ) |
|
193 | $message = print_r($message,true); |
||
194 | |||
195 | //write out to the file including the time in the dateFormat the process id , the user id , and the log level as well as the message |
||
196 | 16 | fwrite($this->fp, |
|
197 | 16 | strftime($this->dateFormat) . ' [' . getmypid () . '][' . $userID . '][' . strtoupper($level) . '] ' . $message . "\n" |
|
198 | ); |
||
199 | 16 | } |
|
200 | |||
201 | /** |
||
202 | * rolls the logger file to start using a new file |
||
203 | */ |
||
204 | protected function rollLog( |
||
205 | $force = false |
||
206 | ) |
||
207 | { |
||
208 | if (!$this->initialized || empty($this->logSize)) { |
||
209 | return; |
||
210 | } |
||
211 | // bug#50265: Parse the its unit string and get the size properly |
||
212 | $units = array( |
||
213 | 'b' => 1, //Bytes |
||
214 | 'k' => 1024, //KBytes |
||
215 | 'm' => 1024 * 1024, //MBytes |
||
216 | 'g' => 1024 * 1024 * 1024, //GBytes |
||
217 | ); |
||
218 | if( preg_match('/^\s*([0-9]+\.[0-9]+|\.?[0-9]+)\s*(k|m|g|b)(b?ytes)?/i', $this->logSize, $match) ) { |
||
219 | $rollAt = ( int ) $match[1] * $units[strtolower($match[2])]; |
||
220 | } |
||
221 | //check if our log file is greater than that or if we are forcing the log to roll if and only if roll size assigned the value correctly |
||
222 | if ( $force || ($rollAt && filesize ( $this->full_log_file ) >= $rollAt) ) { |
||
223 | //now lets move the logs starting at the oldest and going to the newest |
||
224 | for($i = $this->maxLogs - 2; $i > 0; $i --) { |
||
225 | if (file_exists ( $this->log_dir . $this->logfile . $this->date_suffix . '_'. $i . $this->ext )) { |
||
226 | $to = $i + 1; |
||
227 | $old_name = $this->log_dir . $this->logfile . $this->date_suffix . '_'. $i . $this->ext; |
||
228 | $new_name = $this->log_dir . $this->logfile . $this->date_suffix . '_'. $to . $this->ext; |
||
229 | //nsingh- Bug 22548 Win systems fail if new file name already exists. The fix below checks for that. |
||
230 | //if/else branch is necessary as suggested by someone on php-doc ( see rename function ). |
||
231 | sugar_rename($old_name, $new_name); |
||
232 | |||
233 | //rename ( $this->logfile . $i . $this->ext, $this->logfile . $to . $this->ext ); |
||
234 | } |
||
235 | } |
||
236 | //now lets move the current .log file |
||
237 | sugar_rename ($this->full_log_file, $this->log_dir . $this->logfile . $this->date_suffix . '_1' . $this->ext); |
||
238 | |||
239 | } |
||
240 | } |
||
241 | |||
242 | /** |
||
243 | * This is needed to prevent unserialize vulnerability |
||
244 | */ |
||
245 | public function __wakeup() |
||
246 | { |
||
247 | // clean all properties |
||
248 | foreach(get_object_vars($this) as $k => $v) { |
||
249 | $this->$k = null; |
||
250 | } |
||
251 | throw new Exception("Not a serializable object"); |
||
252 | } |
||
253 | |||
254 | /** |
||
255 | * Destructor |
||
256 | * |
||
257 | * Closes the SugarLogger file handle |
||
258 | */ |
||
259 | public function __destruct() |
||
260 | { |
||
261 | if ($this->fp) |
||
262 | { |
||
263 | fclose($this->fp); |
||
264 | $this->fp = FALSE; |
||
265 | } |
||
266 | } |
||
267 | } |
||
268 |
Since your code implements the magic getter
_get
, this function will be called for any read access on an undefined variable. You can add the@property
annotation to your class or interface to document the existence of this variable.If the property has read access only, you can use the @property-read annotation instead.
Of course, you may also just have mistyped another name, in which case you should fix the error.
See also the PhpDoc documentation for @property.