Issues (4069)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

include/nusoap/class.wsdlcache.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/*
4
5
Modification information for LGPL compliance
6
7
r57813 - 2010-08-19 10:34:44 -0700 (Thu, 19 Aug 2010) - kjing - Author: John Mertic <[email protected]>
8
    Bug 39085 - When loading the opposite search panel via ajax on the ListViews, call the index action instead of the ListView action to avoid touching pre-MVC code by accident.
9
10
r56990 - 2010-06-16 13:05:36 -0700 (Wed, 16 Jun 2010) - kjing - snapshot "Mango" svn branch to a new one for GitHub sync
11
12
r56989 - 2010-06-16 13:01:33 -0700 (Wed, 16 Jun 2010) - kjing - defunt "Mango" svn dev branch before github cutover
13
14
r55980 - 2010-04-19 13:31:28 -0700 (Mon, 19 Apr 2010) - kjing - create Mango (6.1) based on windex
15
16
r51719 - 2009-10-22 10:18:00 -0700 (Thu, 22 Oct 2009) - mitani - Converted to Build 3  tags and updated the build system 
17
18
r51634 - 2009-10-19 13:32:22 -0700 (Mon, 19 Oct 2009) - mitani - Windex is the branch for Sugar Sales 1.0 development
19
20
r50375 - 2009-08-24 18:07:43 -0700 (Mon, 24 Aug 2009) - dwong - branch kobe2 from tokyo r50372
21
22
r42807 - 2008-12-29 11:16:59 -0800 (Mon, 29 Dec 2008) - dwong - Branch from trunk/sugarcrm r42806 to branches/tokyo/sugarcrm
23
24
r13782 - 2006-06-06 10:58:55 -0700 (Tue, 06 Jun 2006) - majed - changes entry point code
25
26
r11115 - 2006-01-17 14:54:45 -0800 (Tue, 17 Jan 2006) - majed - add entry point validation
27
28
r8846 - 2005-10-31 11:01:12 -0800 (Mon, 31 Oct 2005) - majed - new version of nusoap
29
30
r5462 - 2005-05-25 13:50:11 -0700 (Wed, 25 May 2005) - majed - upgraded nusoap to .6.9
31
32
r573 - 2004-09-04 13:03:32 -0700 (Sat, 04 Sep 2004) - sugarclint - undoing copyrights added in inadvertantly.  --clint
33
34
r546 - 2004-09-03 11:49:38 -0700 (Fri, 03 Sep 2004) - sugarmsi - removed echo count
35
36
r354 - 2004-08-02 23:00:37 -0700 (Mon, 02 Aug 2004) - sugarjacob - Adding Soap
37
38
39
*/
40
41
42
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
43
44
/*
45
The NuSOAP project home is:
46
http://sourceforge.net/projects/nusoap/
47
48
The primary support for NuSOAP is the mailing list:
49
[email protected]
50
*/
51
52
/**
53
* caches instances of the wsdl class
54
* 
55
* @author   Scott Nichol <[email protected]>
56
* @author	Ingo Fischer <[email protected]>
57
58
* @access public 
59
*/
60
class nusoap_wsdlcache {
61
	/**
62
	 *	@var resource
63
	 *	@access private
64
	 */
65
	var $fplock;
66
	/**
67
	 *	@var integer
68
	 *	@access private
69
	 */
70
	var $cache_lifetime;
71
	/**
72
	 *	@var string
73
	 *	@access private
74
	 */
75
	var $cache_dir;
76
	/**
77
	 *	@var string
78
	 *	@access public
79
	 */
80
	var $debug_str = '';
81
82
	/**
83
	* constructor
84
	*
85
	* @param string $cache_dir directory for cache-files
86
	* @param integer $cache_lifetime lifetime for caching-files in seconds or 0 for unlimited
87
	* @access public
88
	*/
89
	function nusoap_wsdlcache($cache_dir='.', $cache_lifetime=0) {
90
		$this->fplock = array();
91
		$this->cache_dir = $cache_dir != '' ? $cache_dir : '.';
92
		$this->cache_lifetime = $cache_lifetime;
93
	}
94
95
	/**
96
	* creates the filename used to cache a wsdl instance
97
	*
98
	* @param string $wsdl The URL of the wsdl instance
99
	* @return string The filename used to cache the instance
100
	* @access private
101
	*/
102
	function createFilename($wsdl) {
103
		return $this->cache_dir.'/wsdlcache-' . md5($wsdl);
104
	}
105
106
	/**
107
	* adds debug data to the class level debug string
108
	*
109
	* @param    string $string debug data
110
	* @access   private
111
	*/
112
	function debug($string){
113
		$this->debug_str .= get_class($this).": $string\n";
114
	}
115
116
	/**
117
	* gets a wsdl instance from the cache
118
	*
119
	* @param string $wsdl The URL of the wsdl instance
120
	* @return object wsdl The cached wsdl instance, null if the instance is not in the cache
121
	* @access public
122
	*/
123
	function get($wsdl) {
124
		$filename = $this->createFilename($wsdl);
125
		if ($this->obtainMutex($filename, "r")) {
126
			// check for expired WSDL that must be removed from the cache
127
 			if ($this->cache_lifetime > 0) {
128
				if (file_exists($filename) && (time() - filemtime($filename) > $this->cache_lifetime)) {
129
					unlink($filename);
130
					$this->debug("Expired $wsdl ($filename) from cache");
131
					$this->releaseMutex($filename);
132
					return null;
133
  				}
134
			}
135
			// see what there is to return
136
			if (!file_exists($filename)) {
137
				$this->debug("$wsdl ($filename) not in cache (1)");
138
				$this->releaseMutex($filename);
139
				return null;
140
			}
141
			$fp = @fopen($filename, "r");
142
			if ($fp) {
143
				$s = implode("", @file($filename));
144
				fclose($fp);
145
				$this->debug("Got $wsdl ($filename) from cache");
146
			} else {
147
				$s = null;
148
				$this->debug("$wsdl ($filename) not in cache (2)");
149
			}
150
			$this->releaseMutex($filename);
151
			return (!is_null($s)) ? unserialize($s) : null;
152
		} else {
153
			$this->debug("Unable to obtain mutex for $filename in get");
154
		}
155
		return null;
156
	}
157
158
	/**
159
	* obtains the local mutex
160
	*
161
	* @param string $filename The Filename of the Cache to lock
162
	* @param string $mode The open-mode ("r" or "w") or the file - affects lock-mode
163
	* @return boolean Lock successfully obtained ?!
164
	* @access private
165
	*/
166
	function obtainMutex($filename, $mode) {
167
		if (isset($this->fplock[md5($filename)])) {
168
			$this->debug("Lock for $filename already exists");
169
			return false;
170
		}
171
		$this->fplock[md5($filename)] = fopen($filename.".lock", "w");
172
		if ($mode == "r") {
173
			return flock($this->fplock[md5($filename)], LOCK_SH);
174
		} else {
175
			return flock($this->fplock[md5($filename)], LOCK_EX);
176
		}
177
	}
178
179
	/**
180
	* adds a wsdl instance to the cache
181
	*
182
	* @param object wsdl $wsdl_instance The wsdl instance to add
183
	* @return boolean WSDL successfully cached
184
	* @access public
185
	*/
186
	function put($wsdl_instance) {
187
		$filename = $this->createFilename($wsdl_instance->wsdl);
188
		$s = serialize($wsdl_instance);
189
		if ($this->obtainMutex($filename, "w")) {
190
			$fp = fopen($filename, "w");
191
			if (! $fp) {
192
				$this->debug("Cannot write $wsdl_instance->wsdl ($filename) in cache");
193
				$this->releaseMutex($filename);
194
				return false;
195
			}
196
			fputs($fp, $s);
197
			fclose($fp);
198
			$this->debug("Put $wsdl_instance->wsdl ($filename) in cache");
199
			$this->releaseMutex($filename);
200
			return true;
201
		} else {
202
			$this->debug("Unable to obtain mutex for $filename in put");
203
		}
204
		return false;
205
	}
206
207
	/**
208
	* releases the local mutex
209
	*
210
	* @param string $filename The Filename of the Cache to lock
211
	* @return boolean Lock successfully released
212
	* @access private
213
	*/
214
	function releaseMutex($filename) {
215
		$ret = flock($this->fplock[md5($filename)], LOCK_UN);
216
		fclose($this->fplock[md5($filename)]);
217
		unset($this->fplock[md5($filename)]);
218
		if (! $ret) {
219
			$this->debug("Not able to release lock for $filename");
220
		}
221
		return $ret;
222
	}
223
224
	/**
225
	* removes a wsdl instance from the cache
226
	*
227
	* @param string $wsdl The URL of the wsdl instance
228
	* @return boolean Whether there was an instance to remove
229
	* @access public
230
	*/
231
	function remove($wsdl) {
232
		$filename = $this->createFilename($wsdl);
233
		if (!file_exists($filename)) {
234
			$this->debug("$wsdl ($filename) not in cache to be removed");
235
			return false;
236
		}
237
		// ignore errors obtaining mutex
238
		$this->obtainMutex($filename, "w");
239
		$ret = unlink($filename);
240
		$this->debug("Removed ($ret) $wsdl ($filename) from cache");
241
		$this->releaseMutex($filename);
242
		return $ret;
243
	}
244
}
245
246
/**
247
 * For backward compatibility
248
 */
249
class wsdlcache extends nusoap_wsdlcache {
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class should be in its own file to aid autoloaders.

Having each class in a dedicated file usually plays nice with PSR autoloaders and is therefore a well established practice. If you use other autoloaders, you might not want to follow this rule.

Loading history...
250
}
251
?>
252