Issues (115)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

classes/ElggRole.php (6 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * Class to implement Role objects
5
 * 
6
 * @package Roles
7
 * @author Andras Szepeshazi
8
 * @copyright Arck Interactive, LLC 2012
9
 * @link http://www.arckinteractive.com/
10
 *
11
 * @property string   $name        Role name
12
 * @property string   $title       Human readable role title
13
 */
14
class ElggRole extends ElggObject {
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

You can fix this by adding a namespace to your class:

namespace YourVendor;

class YourClass { }

When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.

Loading history...
15
16
	/**
17
	 * Protected permissions metadata
18
	 * @var string
19
	 */
20
	protected $permissions;
21
22
	/**
23
	 * Protected extends metdata
24
	 * @var string[]
25
	 */
26
	protected $extends;
27
28
	/**
29
	 * {@inheritdoc}
30
	 */
31 27
	protected function initializeAttributes() {
32 27
		parent::initializeAttributes();
33
34 27
		$this->attributes['subtype'] = "role";
35 27
	}
36
37
	/**
38
	 * {@inheritdoc}
39
	 */
40
	public function getDisplayName() {
41
		return elgg_echo($this->title);
42
	}
43
44
	/**
45
	 * Sets role permissions
46
	 * @return void
47
	 */
48 27
	public function setPermissions($permissions = array()) {
49 27
		$this->setMetadata('permissions', serialize($permissions));
50 27
	}
51
52
	/**
53
	 * Returns an array of permissions for this role
54
	 * @return array
55
	 */
56 24
	public function getPermissions() {
57 24
		$permissions = unserialize($this->getMetadata('permissions'));
58 24
		if (!is_array($permissions)) {
59
			return array();
60
		}
61 24
		foreach ($permissions as $type => $rules) {
62 24
			if (!is_array($rules)) {
63
				continue;
64
			}
65 24
			foreach ($rules as $name => $opts) {
66 24
				if (is_string($opts)) {
67 24
					$permissions[$type][$name] = array('rule' => $opts);
68 24
				}
69 24
			}
70 24
		}
71 24
		return $permissions;
72
	}
73
74
	/**
75
	 * Set extends
76
	 * @param string[] $extends
77
	 * @return void
78
	 */
79 27
	public function setExtends($extends = array()) {
80 27
		$this->setMetadata('extends', $extends);
81 27
	}
82
83
	/**
84
	 * Get extends
85
	 * @return string[]
86
	 */
87 24
	public function getExtends() {
88 24
		return (array) $this->getMetadata('extends');
89
	}
90
91
	/**
92
	 * Gets all reserved role names
93
	 * @return array The list of reserved role names
94
	 * @deprecated 2.0
95
	 */
96
	public static function getReservedRoleNames() {
97
		return roles()->getReservedRoleNames();
98
	}
99
100
	/**
101
	 * 
102
	 * Checks if a role name is reserved in the system
103
	 * 
104
	 * @param string $role_name The name of the role to check
105
	 * @return boolean True if the passed $role_name is a reserved role name
106
	 * @deprecated 2.0
107
	 */
108
	public static function isReservedRoleName($role_name) {
109
		return roles()->isReservedRoleName($role_name);
110
	}
111
112
	/**
113
	 * 
114
	 * Checks if this role is a reserved role
115
	 * @return boolean True if the current role is a reserved role
116
	 */
117 2
	public function isReservedRole() {
118 2
		return roles()->isReservedRoleName($this->name);
119
	}
120
121
	/**
122
	 * Obtain the list of users for the current role object
123
	 *
124
	 * @param array $options An array of $key => $value pairs accepted by {@link elgg_get_entities()}
125
	 * @return ElggUser[]|false The array of users having this role, false if no user found
126
	 */
127
	public function getUsers($options) {
128
129
		switch ($this->name) {
130 View Code Duplication
			case DEFAULT_ROLE :
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
There must be no space before the colon in a CASE statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.

switch ($selector) {
    case "A": //right
        doSomething();
        break;
    case "B" : //wrong
        doSomethingElse();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
131
				$dbprefix = elgg_get_config('dbprefix');
132
				$defaults = array(
133
					'type' => 'user',
134
					'joins' => array(
135
						"INNER JOIN {$dbprefix}users_entity u ON (u.guid = e.guid)",
136
						"LEFT JOIN {$dbprefix}entity_relationships r ON (r.guid_one = e.guid AND r.relationship = 'has_role')",
137
					),
138
					'wheres' => array(
139
						'r.guid_two IS NULL',
140
						'u.admin = "no"'
141
					)
142
				);
143
				$options = array_merge($defaults, $options);
144
				$users = elgg_get_entities($options);
145
				break;
146 View Code Duplication
			case ADMIN_ROLE :
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
There must be no space before the colon in a CASE statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in case statements.

switch ($selector) {
    case "A": //right
        doSomething();
        break;
    case "B" : //wrong
        doSomethingElse();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
147
				$dbprefix = elgg_get_config('dbprefix');
148
				$defaults = array(
149
					'type' => 'user',
150
					'joins' => array(
151
						"INNER JOIN {$dbprefix}users_entity u ON (u.guid = e.guid)",
152
						"LEFT JOIN {$dbprefix}entity_relationships r ON (r.guid_one = e.guid AND r.relationship = 'has_role')",
153
					),
154
					'wheres' => array(
155
						'r.guid_two IS NULL',
156
						'u.admin = "yes"'
157
					)
158
				);
159
				$options = array_merge($defaults, $options);
160
				$users = elgg_get_entities($options);
161
				break;
162
			default :
0 ignored issues
show
There must be no space before the colon in a DEFAULT statement

As per the PSR-2 coding standard, there must not be a space in front of the colon in the default statement.

switch ($expr) {
    default : //wrong
        doSomething();
        break;
}

switch ($expr) {
    default: //right
        doSomething();
        break;
}

To learn more about the PSR-2 coding standard, please refer to the PHP-Fig.

Loading history...
163
				$defaults = array(
164
					'type' => 'user',
165
					'relationship' => 'has_role',
166
					'relationship_guid' => $this->get('guid'),
167
					'inverse_relationship' => true
168
				);
169
				$options = array_merge($defaults, $options);
170
				$users = elgg_get_entities_from_relationship($options);
171
				break;
172
		}
173
174
		return $users;
175
	}
176
177
}
178