This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point'); |
||
3 | /********************************************************************************* |
||
4 | * SugarCRM Community Edition is a customer relationship management program developed by |
||
5 | * SugarCRM, Inc. Copyright (C) 2004-2013 SugarCRM Inc. |
||
6 | |||
7 | * SuiteCRM is an extension to SugarCRM Community Edition developed by Salesagility Ltd. |
||
8 | * Copyright (C) 2011 - 2014 Salesagility Ltd. |
||
9 | * |
||
10 | * This program is free software; you can redistribute it and/or modify it under |
||
11 | * the terms of the GNU Affero General Public License version 3 as published by the |
||
12 | * Free Software Foundation with the addition of the following permission added |
||
13 | * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK |
||
14 | * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY |
||
15 | * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS. |
||
16 | * |
||
17 | * This program is distributed in the hope that it will be useful, but WITHOUT |
||
18 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
||
19 | * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more |
||
20 | * details. |
||
21 | * |
||
22 | * You should have received a copy of the GNU Affero General Public License along with |
||
23 | * this program; if not, see http://www.gnu.org/licenses or write to the Free |
||
24 | * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
||
25 | * 02110-1301 USA. |
||
26 | * |
||
27 | * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road, |
||
28 | * SW2-130, Cupertino, CA 95014, USA. or at email address [email protected]. |
||
29 | * |
||
30 | * The interactive user interfaces in modified source and object code versions |
||
31 | * of this program must display Appropriate Legal Notices, as required under |
||
32 | * Section 5 of the GNU Affero General Public License version 3. |
||
33 | * |
||
34 | * In accordance with Section 7(b) of the GNU Affero General Public License version 3, |
||
35 | * these Appropriate Legal Notices must retain the display of the "Powered by |
||
36 | * SugarCRM" logo and "Supercharged by SuiteCRM" logo. If the display of the logos is not |
||
37 | * reasonably feasible for technical reasons, the Appropriate Legal Notices must |
||
38 | * display the words "Powered by SugarCRM" and "Supercharged by SuiteCRM". |
||
39 | ********************************************************************************/ |
||
40 | |||
41 | |||
42 | |||
43 | //to_string methods to get strings for values |
||
44 | |||
45 | // var_export gets rid of the empty values that we use to display None |
||
46 | // thishelper function fixes that |
||
47 | // *This is no longer the case in php 5. var_export will now preserve empty keys. |
||
48 | function var_export_helper($tempArray) { |
||
49 | 36 | return var_export($tempArray, true); |
|
50 | } |
||
51 | |||
52 | |||
53 | |||
54 | /* |
||
55 | * this function is used to overide a value in an array and returns the string code to write |
||
56 | * @params : $array_name - a String containing the name of an array. |
||
57 | * @params : $value_name - a String containing the name of a variable in the array. |
||
58 | * @params : $value - a String containing the associated value with $value_name. |
||
59 | * |
||
60 | * @returns: String. Example - override_value_to_string($name, 'b', 1) = '$name['b'] = 1;' |
||
61 | */ |
||
62 | |||
63 | function override_value_to_string($array_name, $value_name, $value){ |
||
64 | 1 | $string = "\${$array_name}[". var_export($value_name, true). "] = "; |
|
65 | 1 | $string .= var_export_helper($value,true); |
|
0 ignored issues
–
show
|
|||
66 | 1 | return $string . ";"; |
|
67 | } |
||
68 | |||
69 | function add_blank_option($options){ |
||
70 | 1 | if(is_array($options)) { |
|
71 | 1 | if(!isset($options['']) && !isset($options['0'])) { |
|
72 | 1 | $options = array_merge(array(''=>''), $options); |
|
73 | } |
||
74 | } else { |
||
75 | $options = array(''=>''); |
||
76 | } |
||
77 | 1 | return $options; |
|
78 | } |
||
79 | |||
80 | /* |
||
81 | * Given an array and key names, return a string in the form of $array_name[$key_name[0]][$key_name[1]]... = $value recursively. |
||
82 | * @params : $key_names - array of keys |
||
83 | * $array_name- name of the array |
||
84 | * $value -value of the array |
||
85 | * $eval - evals the generated string if true, note that the array name must be in the global space! |
||
86 | * @return : example - string $array_name['a']['b']['c'][.] = 'hello' |
||
0 ignored issues
–
show
The doc-type
: could not be parsed: Unknown type name ":" at position 0. (view supported doc-types)
This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types. ![]() |
|||
87 | */ |
||
88 | function override_value_to_string_recursive($key_names, $array_name, $value, $eval=false){ |
||
89 | 1 | if ($eval) return eval( "\${$array_name}". override_recursive_helper($key_names, $array_name, $value)); |
|
0 ignored issues
–
show
The function override_value_to_string_recursive() contains an eval expression.
On one hand, ![]() |
|||
90 | 1 | else return "\${$array_name}". override_recursive_helper($key_names, $array_name, $value); |
|
91 | } |
||
92 | |||
93 | function override_recursive_helper($key_names, $array_name, $value){ |
||
94 | 2 | if( empty( $key_names ) ) |
|
95 | 2 | return "=".var_export_helper($value,true).";"; |
|
0 ignored issues
–
show
The call to
var_export_helper() has too many arguments starting with true .
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. In this case you can add the ![]() |
|||
96 | else{ |
||
97 | 2 | $key = array_shift($key_names); |
|
98 | 2 | return "[".var_export($key,true)."]". override_recursive_helper($key_names, $array_name,$value); |
|
99 | } |
||
100 | } |
||
101 | |||
102 | function override_value_to_string_recursive2($array_name, $value_name, $value, $save_empty = true) { |
||
103 | 1 | $quoted_vname = var_export($value_name, true); |
|
104 | 1 | if (is_array($value)) { |
|
105 | 1 | $str = ''; |
|
106 | 1 | $newArrayName = $array_name . "[$quoted_vname]"; |
|
107 | 1 | foreach($value as $key=>$val) { |
|
108 | 1 | $str.= override_value_to_string_recursive2($newArrayName, $key, $val, $save_empty); |
|
109 | } |
||
110 | 1 | return $str; |
|
111 | } else { |
||
112 | 1 | if(!$save_empty && empty($value)){ |
|
113 | 1 | return; |
|
114 | }else{ |
||
115 | 1 | return "\$$array_name" . "[$quoted_vname] = " . var_export($value, true) . ";\n"; |
|
116 | } |
||
117 | } |
||
118 | } |
||
119 | |||
120 | /** |
||
121 | * This function will attempt to convert an object to an array. |
||
122 | * Loops are not checked for so this function should be used with caution. |
||
123 | * |
||
124 | * @param $obj |
||
125 | * @return array representation of $obj |
||
126 | */ |
||
127 | function object_to_array_recursive($obj) |
||
128 | { |
||
129 | 1 | if (!is_object($obj)) |
|
130 | 1 | return $obj; |
|
131 | |||
132 | 1 | $ret = get_object_vars($obj); |
|
133 | 1 | foreach($ret as $key => $val) |
|
134 | { |
||
135 | 1 | if (is_object($val)) { |
|
136 | 1 | $ret[$key] = object_to_array_recursive($val); |
|
137 | } |
||
138 | |||
139 | } |
||
140 | 1 | return $ret; |
|
141 | } |
||
142 | /** |
||
143 | * This function returns an array of all the key=>value pairs in $array1 |
||
144 | * that are wither not present, or different in $array2. |
||
145 | * If a key exists in $array2 but not $array1, it will not be reported. |
||
146 | * Values which are arrays are traced further and reported only if thier is a difference |
||
147 | * in one or more of thier children. |
||
148 | * |
||
149 | * @param array $array1, the array which contains all the key=>values you wish to check againts |
||
0 ignored issues
–
show
There is no parameter named
$array1, . Did you maybe mean $array1 ?
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit. Consider the following example. The parameter /**
* @param array $germany
* @param array $ireland
*/
function finale($germany, $island) {
return "2:1";
}
The most likely cause is that the parameter was changed, but the annotation was not. ![]() |
|||
150 | * @param array $array2, the array which |
||
0 ignored issues
–
show
There is no parameter named
$array2, . Did you maybe mean $array2 ?
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit. Consider the following example. The parameter /**
* @param array $germany
* @param array $ireland
*/
function finale($germany, $island) {
return "2:1";
}
The most likely cause is that the parameter was changed, but the annotation was not. ![]() |
|||
151 | * @param array $allowEmpty, will return the value if it is empty in $array1 and not in $array2, |
||
0 ignored issues
–
show
There is no parameter named
$allowEmpty, . Did you maybe mean $allowEmpty ?
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function. It has, however, found a similar but not annotated parameter which might be a good fit. Consider the following example. The parameter /**
* @param array $germany
* @param array $ireland
*/
function finale($germany, $island) {
return "2:1";
}
The most likely cause is that the parameter was changed, but the annotation was not. ![]() |
|||
152 | * otherwise empty values in $array1 are ignored. |
||
153 | * @return array containing the differences between the two arrays |
||
154 | */ |
||
155 | function deepArrayDiff($array1, $array2, $allowEmpty = false) { |
||
156 | 1 | $diff = array(); |
|
157 | 1 | foreach($array1 as $key=>$value) { |
|
158 | 1 | if (is_array($value)) { |
|
159 | 1 | if ((!isset($array2[$key]) || !is_array($array2[$key])) && (isset($value) || $allowEmpty)) { |
|
160 | 1 | $diff[$key] = $value; |
|
161 | } else { |
||
162 | 1 | $value = deepArrayDiff($array1[$key], $array2[$key], $allowEmpty); |
|
163 | 1 | if (!empty($value) || $allowEmpty) |
|
164 | 1 | $diff[$key] = $value; |
|
165 | } |
||
166 | 1 | } else if ((!isset($array2[$key]) || $value != $array2[$key]) && (isset($value) || $allowEmpty)){ |
|
167 | 1 | $diff[$key] = $value; |
|
168 | } |
||
169 | } |
||
170 | 1 | return $diff; |
|
171 | } |
||
172 | |||
173 | /** |
||
174 | * Recursivly set a value in an array, creating sub arrays as necessary |
||
175 | * |
||
176 | * @param unknown_type $array |
||
177 | * @param unknown_type $key |
||
178 | */ |
||
179 | function setDeepArrayValue(&$array, $key, $value) { |
||
180 | //if _ is at position zero, that is invalid. |
||
181 | 1 | if (strrpos($key, "_")) { |
|
182 | 1 | list ($key, $remkey) = explode('_', $key, 2); |
|
183 | 1 | if (!isset($array[$key]) || !is_array($array[$key])) { |
|
184 | 1 | $array[$key] = array(); |
|
185 | } |
||
186 | 1 | setDeepArrayValue($array[$key], $remkey, $value); |
|
187 | } |
||
188 | else { |
||
189 | 1 | $array[$key] = $value; |
|
190 | } |
||
191 | 1 | } |
|
192 | |||
193 | |||
194 | // This function iterates through the given arrays and combines the values of each key, to form one array |
||
195 | // Returns FALSE if number of elements in the arrays do not match; otherwise, returns merged array |
||
196 | // Example: array("a", "b", "c") and array("x", "y", "z") are passed in; array("ax", "by", "cz") is returned |
||
197 | function array_merge_values($arr1, $arr2) { |
||
198 | 1 | if (count($arr1) != count($arr2)) { |
|
199 | 1 | return FALSE; |
|
200 | } |
||
201 | |||
202 | 1 | for ($i = 0; $i < count($arr1); $i++) { |
|
0 ignored issues
–
show
It seems like you are calling the size function
count() as part of the test condition. You might want to compute the size beforehand, and not on each iteration.
If the size of the collection does not change during the iteration, it is generally a good practice to compute it beforehand, and not on each iteration: for ($i=0; $i<count($array); $i++) { // calls count() on each iteration
}
// Better
for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once
}
![]() |
|||
203 | 1 | $arr1[$i] .= $arr2[$i]; |
|
204 | } |
||
205 | |||
206 | 1 | return $arr1; |
|
207 | } |
||
208 | |||
209 | /** |
||
210 | * Search an array for a given value ignorning case sensitivity |
||
211 | * |
||
212 | * @param unknown_type $key |
||
213 | * @param unknown_type $haystack |
||
214 | */ |
||
215 | function array_search_insensitive($key, $haystack) |
||
216 | { |
||
217 | 1 | if(!is_array($haystack)) |
|
218 | 1 | return FALSE; |
|
219 | |||
220 | 1 | $found = FALSE; |
|
221 | 1 | foreach($haystack as $k => $v) |
|
222 | { |
||
223 | 1 | if(strtolower($v) == strtolower($key)) |
|
224 | { |
||
225 | 1 | $found = TRUE; |
|
226 | 1 | break; |
|
227 | } |
||
228 | } |
||
229 | |||
230 | 1 | return $found; |
|
231 | } |
||
232 | |||
233 | /** |
||
234 | * Wrapper around PHP's ArrayObject class that provides dot-notation recursive searching |
||
235 | * for multi-dimensional arrays |
||
236 | */ |
||
237 | class SugarArray extends ArrayObject |
||
238 | { |
||
239 | /** |
||
240 | * Return the value matching $key if exists, otherwise $default value |
||
241 | * |
||
242 | * This method uses dot notation to look through multi-dimensional arrays |
||
243 | * |
||
244 | * @param string $key key to look up |
||
245 | * @param mixed $default value to return if $key does not exist |
||
246 | * @return mixed |
||
247 | */ |
||
248 | 5 | public function get($key, $default = null) { |
|
249 | 5 | return $this->_getFromSource($key, $default); |
|
250 | } |
||
251 | |||
252 | /** |
||
253 | * Provided as a convinience method for fetching a value within an existing |
||
254 | * array without instantiating a SugarArray |
||
255 | * |
||
256 | * NOTE: This should only used where refactoring an array into a SugarArray |
||
257 | * is unfeasible. This operation is more expensive than a direct |
||
258 | * SugarArray as each time it creates and throws away a new instance |
||
259 | * |
||
260 | * @param array $haystack haystack |
||
261 | * @param string $needle needle |
||
262 | * @param mixed $default default value to return |
||
263 | * @return mixed |
||
264 | */ |
||
265 | 4 | static public function staticGet($haystack, $needle, $default = null) { |
|
0 ignored issues
–
show
|
|||
266 | 4 | if (empty($haystack)) { |
|
267 | return $default; |
||
268 | } |
||
269 | 4 | $array = new self($haystack); |
|
270 | 4 | return $array->get($needle, $default); |
|
271 | } |
||
272 | |||
273 | 5 | private function _getFromSource($key, $default) { |
|
274 | 5 | if (strpos($key, '.') === false) { |
|
275 | 5 | return isset($this[$key]) ? $this[$key] : $default; |
|
276 | } |
||
277 | |||
278 | 3 | $exploded = explode('.', $key); |
|
279 | 3 | $current_key = array_shift($exploded); |
|
280 | 3 | return $this->_getRecursive($this->_getFromSource($current_key, $default), $exploded, $default); |
|
281 | } |
||
282 | |||
283 | 3 | private function _getRecursive($raw_config, $children, $default) { |
|
284 | 3 | if ($raw_config === $default) { |
|
285 | return $default; |
||
286 | 3 | } elseif (count($children) == 0) { |
|
287 | 3 | return $raw_config; |
|
288 | } else { |
||
289 | 3 | $next_key = array_shift($children); |
|
290 | 3 | return isset($raw_config[$next_key]) ? |
|
291 | 3 | $this->_getRecursive($raw_config[$next_key], $children, $default) : |
|
292 | 3 | $default; |
|
293 | } |
||
294 | } |
||
295 | } |
||
296 | |||
297 |
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.
If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.
In this case you can add the
@ignore
PhpDoc annotation to the duplicate definition and it will be ignored.