Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

include/SugarXHprof/SugarXHprof.php (6 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
3
/*********************************************************************************
4
 * SugarCRM Community Edition is a customer relationship management program developed by
5
 * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc.
6
7
 * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd.
8
 * Copyright (C) 2011 - 2014 Salesagility Ltd.
9
 *
10
 * This program is free software; you can redistribute it and/or modify it under
11
 * the terms of the GNU Affero General Public License version 3 as published by the
12
 * Free Software Foundation with the addition of the following permission added
13
 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
14
 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
15
 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
16
 *
17
 * This program is distributed in the hope that it will be useful, but WITHOUT
18
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
19
 * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
20
 * details.
21
 *
22
 * You should have received a copy of the GNU Affero General Public License along with
23
 * this program; if not, see http://www.gnu.org/licenses or write to the Free
24
 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
25
 * 02110-1301 USA.
26
 *
27
 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
28
 * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected].
29
 *
30
 * The interactive user interfaces in modified source and object code versions
31
 * of this program must display Appropriate Legal Notices, as required under
32
 * Section 5 of the GNU Affero General Public License version 3.
33
 *
34
 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
35
 * these Appropriate Legal Notices must retain the display of the "Powered by
36
 * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not
37
 * reasonably feasible for  technical reasons, the Appropriate Legal Notices must
38
 * display the words  "Powered by SugarCRM" and "Supercharged by SuiteCRM".
39
 ********************************************************************************/
40
41
42
/**
43
 * Class allows us to use XHprof for profiling
44
 * To enable profiling you should add next properties to config_override.php
45
 *
46
 * @see SugarXHprof::$enable            for $sugar_config['xhprof_config']['enable']
47
 * @see SugarXHprof::$manager           for $sugar_config['xhprof_config']['manager']
48
 * @see SugarXHprof::$log_to            for $sugar_config['xhprof_config']['log_to']
49
 * @see SugarXHprof::$sample_rate       for $sugar_config['xhprof_config']['sample_rate']
50
 * @see SugarXHprof::$ignored_functions for $sugar_config['xhprof_config']['ignored_functions']
51
 * @see SugarXHprof::$flags             for $sugar_config['xhprof_config']['flags']
52
 *
53
 * To run profiler you should call SugarXHprof::getInstance()->start();
54
 * To stop profiler you should call SugarXHprof::getInstance()->end();
55
 * 'start' method registers 'end' method as shutdown function because of it call of 'end' method is unnecessary if you want profile all calls
56
 * Also 'start' method is called automatically in entryPoint.php file
57
 *
58
 * Names of generated files are prefix.microtime.module.action for modules and prefix.microtime.'entryPoint'.entryPoint for entry points
59
 * If you want to see reports you should install https://github.com/facebook/xhprof to some directory and run it as http://your.domain/path2xhprof/xhprof_html/?run=prefix.microtime&source=module.action
60
 * For 507bf986e44d9.1350302086.9285.Leads.listview.xhprof file url will be look like http://your.domain/path2xhprof/xhprof_html/?run=507bf986e44d9.1350302086.9285&source=Leads.listview
61
 *
62
 * If you want to customize SugarXHprof you should create file in custom/include/SugarXHprof/ folder and name file as name of your custom class
63
 * Change $sugar_config['xhprof_config']['manager'] to be name of your custom class
64
 * Custom class has to extend from SugarXHprof
65
 * If custom class doesn't exist or doesn't extend from SugarXHprof then SugarXHprof be used
66
 */
67
class SugarXHprof
68
{
69
    /**
70
     * @var SugarXHprof instance of profiler
71
     */
72
    protected static $instance = null;
73
74
    /**
75
     * Because of unregister_shutdown_function is not present in php we have to skip calls of 'end' method if that property equals to false
76
     *
77
     * @var bool is shutdown function registered or not
78
     */
79
    protected $registered = false;
80
81
    /**
82
     * @var bool enable profiler or not, it will be disabled by some reasons
83
     * @see SugarXHprof::loadConfig()
84
     */
85
    protected static $enable = false;
86
87
    /**
88
     * @var string class of manager for customization, has to extend from SugarXHprof class
89
     */
90
    protected static $manager = __CLASS__;
91
92
    /**
93
     * @var string path to directory for logs, if log_to is empty then xhprof.output_dir be used
94
     */
95
    protected static $log_to = '';
96
97
    /**
98
     * @var int where value is a number and 1/value requests are profiled. So to sample all requests set it to 1
99
     */
100
    protected static $sample_rate = 10;
101
102
    /**
103
     * @var array array of function names to ignore from the profile (pass into xhprof_enable)
104
     */
105
    protected static $ignored_functions = array();
106
107
    /**
108
     * @var int flags for xhprof
109
     * @see http://www.php.net/manual/xhprof.constants.php
110
     */
111
    protected static $flags = 0;
112
113
    /**
114
     * Populates configuration from $sugar_config to self properties
115
     */
116
    protected static function loadConfig()
117
    {
118
        if (!empty($GLOBALS['sugar_config']['xhprof_config']))
119
        {
120
            foreach($GLOBALS['sugar_config']['xhprof_config'] as $k => $v)
121
            {
122
                if (isset($v) && property_exists(__CLASS__, $k))
123
                {
124
                    self::${$k} = $v;
125
                }
126
            }
127
        }
128
129
        // disabling profiler if XHprof extension is not loaded
130
        if (extension_loaded('xhprof') == false)
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
131
        {
132
            self::$enable = false;
133
        }
134
135
        // using default directory for profiler if it is not set
136
        if (empty(self::$log_to))
137
        {
138
            self::$log_to = ini_get('xhprof.output_dir');
139
        }
140
141
        // disabling profiler if directory is not exist or is not writable
142
        if (is_dir(self::$log_to) == false || is_writable(self::$log_to) == false)
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
143
        {
144
            self::$enable = false;
145
        }
146
    }
147
148
    /**
149
     * Tries to load custom profiler. If it doesn't exist then use itself
150
     *
151
     * @return SugarXHprof
152
     */
153
    public static function getInstance()
154
    {
155
        if (self::$instance != null)
156
        {
157
            return self::$instance;
158
        }
159
160
        self::loadConfig();
161
162
        if (is_file('custom/include/SugarXHprof/' . self::$manager . '.php'))
163
        {
164
            require_once 'custom/include/SugarXHprof/' . self::$manager . '.php';
165
        }
166
        elseif (is_file('include/SugarXHprof/' . self::$manager . '.php'))
167
        {
168
            require_once 'include/SugarXHprof/' . self::$manager . '.php';
169
        }
170
        if (class_exists(self::$manager) && is_subclass_of(self::$manager, __CLASS__))
171
        {
172
            self::$instance = new self::$manager();
173
        }
174
        else
175
        {
176
            self::$instance = new self();
177
        }
178
        return self::$instance;
179
    }
180
181
    /**
182
     * Method tries to detect entryPoint, service, module & action and returns it as string
183
     *
184
     * @return string action
185
     */
186
    static public function detectAction()
0 ignored issues
show
As per PSR2, the static declaration should come after the visibility declaration.
Loading history...
187
    {
188
        $action = '';
189
190
        // index.php
191
        if (!empty($GLOBALS['app']) && $GLOBALS['app'] instanceof SugarApplication && $GLOBALS['app']->controller instanceof SugarController)
192
        {
193
            if (!empty($_REQUEST['entryPoint']))
194
            {
195
                if (!empty($GLOBALS['app']->controller->entry_point_registry) && !empty($GLOBALS['app']->controller->entry_point_registry[$_REQUEST['entryPoint']]))
196
                {
197
                    $action .= '.entryPoint.' . $_REQUEST['entryPoint'];
198
                }
199
                else
200
                {
201
                    $action .= '.entryPoint.unknown';
202
                }
203
            }
204
            else
205
            {
206
                $action .= '.' . $GLOBALS['app']->controller->module . '.' . $GLOBALS['app']->controller->action;
207
            }
208
        }
209
        // soap.php
210
        elseif (!empty($GLOBALS['server']) && $GLOBALS['server'] instanceof soap_server)
211
        {
212
            if ($GLOBALS['server']->methodname)
213
            {
214
                $action .= '.soap.' . $GLOBALS['server']->methodname;
215
            }
216
            else
217
            {
218
                $action .= '.soap.wsdl';
219
            }
220
        }
221
        // service soap
222
        elseif (!empty($GLOBALS['service_object']) && $GLOBALS['service_object'] instanceof SugarSoapService)
223
        {
224
            $action .= '.soap.' . $GLOBALS['service_object']->getRegisteredClass();
225
            if ($GLOBALS['service_object']->getServer() instanceof soap_server)
226
            {
227
                if ($GLOBALS['service_object']->getServer()->methodname)
228
                {
229
                    $action .= '.' . $GLOBALS['service_object']->getServer()->methodname;
230
                }
231
                else
232
                {
233
                    $action .= '.wsdl';
234
                }
235
            }
236
            else
237
            {
238
                $action .= '.unknown';
239
            }
240
        }
241
        // service rest
242
        elseif (!empty($GLOBALS['service_object']) && $GLOBALS['service_object'] instanceof SugarRestService)
243
        {
244
            $action .= '.rest.' . $GLOBALS['service_object']->getRegisteredImplClass();
245
            if (!empty($_REQUEST['method']) && method_exists($GLOBALS['service_object']->implementation, $_REQUEST['method']))
246
            {
247
                $action .= '.' . $_REQUEST['method'];
248
            }
249
            elseif (empty($_REQUEST['method']))
250
            {
251
                $action .= '.index';
252
            }
253
            else
254
            {
255
                $action .= '.unknown';
256
            }
257
        }
258
        // unknown
259
        else
260
        {
261
            $action .= '.' . basename($_SERVER['SCRIPT_FILENAME']);
262
        }
263
264
        return $action;
265
    }
266
267
    /**
268
     * Tries to enabled xhprof if all settings were passed
269
     */
270
    public function start()
271
    {
272
        if (self::$enable == false)
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
273
        {
274
            return;
275
        }
276
277
        if (self::$sample_rate == 0)
278
        {
279
            return;
280
        }
281
282
        $rate = 1 / self::$sample_rate * 100;
283
        if (rand(0, 100) > $rate)
284
        {
285
            return;
286
        }
287
288
        register_shutdown_function(array(
289
            $this,
290
            'end'
291
        ));
292
        $this->registered = true;
293
294
        xhprof_enable(self::$flags, array(
295
            'ignored_functions' => self::$ignored_functions
296
        ));
297
    }
298
299
    /**
300
     * Tries to collect data from XHprof after call of 'start' method
301
     */
302
    public function end()
303
    {
304
        if ($this->registered == false)
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
305
        {
306
            return;
307
        }
308
        $this->registered = false;
309
310
        if (self::$enable == false)
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
311
        {
312
            return;
313
        }
314
315
        $data = xhprof_disable();
316
        $namespace = microtime(1) . self::detectAction();
317
318
        require_once 'include/SugarXHprof/xhprof_lib/utils/xhprof_runs.php';
319
        $xhprof_runs = new XHProfRuns_Default(self::$log_to);
320
        $xhprof_runs->save_run($data, $namespace);
321
    }
322
}
323