Issues (81)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

services/fields.php (3 issues)

1
<?php
2
/**
3
 *
4
 * @package sitemaker
5
 * @copyright (c) 2016 Daniel A. (blitze)
6
 * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
7
 *
8
 */
9
10
namespace blitze\content\services;
11
12
class fields extends topic
13
{
14
	/** @var \blitze\content\services\comments\factory */
15
	protected $comments_factory;
16
17
	/** @var \blitze\content\services\form\fields_factory */
18
	protected $fields_factory;
19
20
	/** @var string */
21
	protected $content_type;
22
23
	/** @var \blitze\content\services\comments\comments_inferface */
0 ignored issues
show
The type blitze\content\services\...ents\comments_inferface was not found. Maybe you did not declare it correctly or list all dependencies?

The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g. excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:

filter:
    dependency_paths: ["lib/*"]

For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths

Loading history...
24
	protected $comments;
25
26
	/** @var string */
27
	protected $board_url = '';
28
29
	/** @var string */
30
	protected $tpl_name = '';
31
32
	/** @var string */
33
	protected $display_mode = 'detail';
34
35
	/** @var string */
36
	protected $view_mode = 'detail';
37
38
	/** @var array */
39
	protected $content_fields = array();
40
41
	/** @var array */
42
	protected $db_fields = array();
43
44
	/** @var array */
45
	protected $form_fields = array();
46
47
	/** @var array */
48
	protected $label = array('', 'label-hidden', 'label-inline', 'label-newline');
49
50
	/**
51
	 * Construct
52
	 *
53
	 * @param \phpbb\config\db										$config					Config object
54
	 * @param \phpbb\controller\helper								$controller_helper		Controller Helper object
55
	 * @param \phpbb\event\dispatcher_interface						$phpbb_dispatcher		Event dispatcher object
56
	 * @param \phpbb\language\language								$language				Language object
57
	 * @param \phpbb\template\template								$template				Template object
58
	 * @param \phpbb\user											$user					User object
59
	 * @param \blitze\content\services\helper						$helper					Content helper object
60
	 * @param \blitze\content\services\comments\factory				$comments_factory		Comments Factory
61
	 * @param \blitze\content\services\form\fields_factory			$fields_factory			Form fields factory
62
	 */
63
	public function __construct(\phpbb\config\db $config, \phpbb\controller\helper $controller_helper, \phpbb\event\dispatcher_interface $phpbb_dispatcher, \phpbb\language\language $language, \phpbb\template\template $template, \phpbb\user $user, \blitze\content\services\helper $helper, \blitze\content\services\comments\factory $comments_factory, \blitze\content\services\form\fields_factory $fields_factory)
64
	{
65
		parent::__construct($config, $controller_helper, $phpbb_dispatcher, $language, $template, $user, $helper);
66
67
		$this->comments_factory = $comments_factory;
68
		$this->fields_factory = $fields_factory;
69
	}
70
71
	/**
72
	 * Set type data needed to display topics. This should only run once
73
	 *
74
	 * @param \blitze\content\model\entity\type $entity
75
	 * @param array $topic_ids
76
	 * @param array $view_mode_fields	array of form array([field_name] => [field_type])
77
	 * @param string $custom_tpl
78
	 * @param string $view_mode		summary|detail|block
79
	 * @param string $tpl_name
80
	 * @return void
81
	 */
82
	public function prepare_to_show(\blitze\content\model\entity\type $entity, array $topic_ids, array $view_mode_fields, $custom_tpl, $view_mode, $tpl_name = null)
83
	{
84
		$this->reset();
85
		$db_fields = array_fill_keys($topic_ids, array());
86
87
		/**
88
		 * Event to set the values for fields that are stored in the database as opposed to post text e.g. categories
89
		 * We do this here so that we can get all values with one query instead of multiple queries for each field for each topic
90
		 *
91
		 * @event blitze.content.fields.set_values
92
		 * @var string								view_mode			The current view mode (summary|detail|block)
93
		 * @var	array								view_mode_fields	Array containing fields for current view_mode
94
		 * @var \blitze\content\model\entity\type	entity				Content type entity
95
		 * @var array								db_fields			This array allows extensions that provide fields to list field values for current topic ids.
96
		 *																Ex. array([topic_id] => array([field_name] => [field_value]))
97
		 */
98
		$vars = array('view_mode', 'view_mode_fields', 'entity', 'db_fields');
99
		extract($this->phpbb_dispatcher->trigger_event('blitze.content.fields.set_values', compact($vars)));
100
101
		$this->content_type = $entity->get_content_name();
102
		$this->set_view_mode($view_mode);
103
		$this->set_form_fields($view_mode_fields);
104
		$this->set_content_fields($view_mode_fields, $entity->get_content_fields());
105
		$this->set_comments_type($entity->get_comments());
106
107
		$this->board_url = generate_board_url(true);
108
		$this->tpl_name	= ($custom_tpl) ? ($tpl_name ?: $this->content_type . '_' . $view_mode) : '';
109
		$this->db_fields = $db_fields;
110
	}
111
112
	/**
113
	 * @param string $type
114
	 * @param array $topic_data
115
	 * @param array $post_data
116
	 * @param array $users_cache
117
	 * @param array $attachments
118
	 * @param array $update_count
119
	 * @param array $topic_tracking_info
120
	 * @param array $topic_data_overwrite
121
	 * @param string $redirect_url
122
	 * @return array
123
	 */
124
	public function show($type, array &$topic_data, array $post_data, array $users_cache, array &$attachments, array &$update_count, array $topic_tracking_info, array $topic_data_overwrite = array(), $redirect_url = '')
125
	{
126
		$callable = 'get_' . $this->view_mode . '_template_data';
127
		$tpl_data = array_merge(array(
128
				'TOPIC_COMMENTS'	=> !empty($this->comments) ? $this->comments->count($topic_data) : 0,
129
				'S_USER_LOGGED_IN'	=> $this->user->data['is_registered'],
130
			),
131
			$this->{$callable}($type, $topic_data, $post_data, $users_cache, $attachments, $topic_tracking_info, $update_count, $redirect_url),
132
			$topic_data_overwrite
133
		);
134
135
		return $this->build_content($tpl_data);
136
	}
137
138
	/**
139
	 * @param array $tpl_data
140
	 * @return array
141
	 */
142
	public function build_content(array $tpl_data)
143
	{
144
		$fields_data = $this->get_fields_data_for_display($tpl_data);
145
146
		$tpl_data['FIELDS'] = $fields_data;
147
148
		if ($this->tpl_name)
149
		{
150
			$this->template->assign_vars(array_change_key_case(array_merge($tpl_data, (array) $fields_data['all']), CASE_UPPER));
151
			$this->template->set_filenames(array('content' => $this->tpl_name));
152
			$tpl_data['CUSTOM_DISPLAY'] = $this->template->assign_display('content');
153
		}
154
		unset($fields_data);
155
156
		return $tpl_data;
157
	}
158
159
	/**
160
	 * @param string $type
161
	 * @return $this
162
	 */
163
	public function set_content_type($type)
164
	{
165
		$this->content_type = $type;
166
		return $this;
167
	}
168
169
	/**
170
	 * @param string $view_mode		summary|detail|print|block|preview
171
	 * @return $this
172
	 */
173
	public function set_view_mode($view_mode)
174
	{
175
		$this->display_mode = $view_mode;
176
		$this->view_mode = (in_array($view_mode, array('summary', 'detail'))) ? $view_mode : 'summary';
177
		return $this;
178
	}
179
180
	/**
181
	 * @param string $service
182
	 * @return $this
183
	 */
184
	public function set_comments_type($service)
185
	{
186
		$this->comments = $this->comments_factory->get($service);
0 ignored issues
show
Documentation Bug introduced by
It seems like $this->comments_factory->get($service) can also be of type blitze\content\services\...ents\comments_interface. However, the property $comments is declared as type blitze\content\services\...ents\comments_inferface. Maybe add an additional type check?

Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.

For example, imagine you have a variable $accountId that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the id property of an instance of the Account class. This class holds a proper account, so the id value must no longer be false.

Either this assignment is in error or a type check should be added for that assignment.

class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
Loading history...
187
		return $this;
188
	}
189
190
	/**
191
	 * @param array $view_mode_fields	array of form array([field_name] => [field_type])
192
	 * @param array $fields_data
193
	 * @return $this
194
	 */
195
	public function set_content_fields(array $view_mode_fields, array $fields_data)
196
	{
197
		foreach ($view_mode_fields as $name => $field_type)
198
		{
199
			if (isset($this->form_fields[$field_type]))
200
			{
201
				$this->content_fields[$name] = $fields_data[$name];
202
			}
203
		}
204
		return $this;
205
	}
206
207
	/**
208
	 * @param string $field
209
	 * @param array $prop
210
	 * @return $this
211
	 */
212
	public function overwrite_field_data($field, array $data)
213
	{
214
		if (isset($this->content_fields[$field]))
215
		{
216
			$this->content_fields[$field] = array_replace_recursive($this->content_fields[$field], $data);
217
		}
218
		return $this;
219
	}
220
221
	/**
222
	 * @param array $view_mode_fields	array of form array([field_name] => [field_type])
223
	 * @return $this
224
	 */
225
	public function set_form_fields(array $view_mode_fields)
226
	{
227
		$this->form_fields = array_intersect_key($this->fields_factory->get_all(), array_flip($view_mode_fields));
228
		return $this;
229
	}
230
231
	/**
232
	 * @param array $tpl_data
233
	 * @return array
234
	 */
235
	protected function get_fields_data_for_display(array &$tpl_data)
236
	{
237
		$field_values = $this->get_field_values($tpl_data);
238
		$display_data = array_fill_keys(array('all', 'above', 'body', 'inline', 'footer', 'raw'), array());
239
		$tpl_data['PERMA_LINK'] = $this->board_url . parse_url($tpl_data['TOPIC_URL'], PHP_URL_PATH);
240
241
		foreach ($this->content_fields as $field_name => $field_data)
242
		{
243
			$field_type = $field_data['field_type'];
244
			$field_data['content_type'] = $this->content_type;
245
			$field_data['field_props'] = array_replace_recursive($this->form_fields[$field_type]->get_default_props(), $field_data['field_props']);
246
			$field_data['field_value'] = &$field_values[$field_name];
247
			$field_data['field_value'] = $this->form_fields[$field_type]->get_field_value($field_data);
248
249
			$field_contents	= $this->form_fields[$field_type]->display_field($field_data, $tpl_data, $this->display_mode);
250
			$display_data['raw'][$field_name] = $field_data['field_value'];
251
252
			// this essentially hides other fields if the field returns an array
253
			if (is_array($field_contents))
254
			{
255
				$display_data['all'] = $field_contents;
256
				$display_data[$field_data['field_' . $this->view_mode . '_show']] = $field_contents;
257
				break;
258
			}
259
260
			if (!empty($field_contents))
261
			{
262
				$field = $this->get_field_label($field_data['field_' . $this->view_mode . '_ldisp'], $field_data['field_label']) . $field_contents;
263
				$display_data['all'][$field_name] = $field;
264
				$display_data[$field_data['field_' . $this->view_mode . '_show']][$field_name] = $field;
265
			}
266
		}
267
268
		return $display_data;
269
	}
270
271
	/**
272
	 * @param int $label_type
273
	 * @param string $label_text
274
	 * @return string
275
	 */
276
	protected function get_field_label($label_type, $label_text)
277
	{
278
		$html = '';
279
		if ($label_type)
280
		{
281
			$html = '<div class="field-label ' . $this->label[$label_type] . '">' . $label_text . $this->language->lang('COLON') . ' </div>';
282
		}
283
		return $html;
284
	}
285
286
	/**
287
	 * @param array $tpl_data
288
	 * @return array
289
	 */
290
	protected function get_field_values(array &$tpl_data)
291
	{
292
		$message = $tpl_data['MESSAGE'];
293
		unset($tpl_data['MESSAGE']);
294
295
		return array_merge(
296
			isset($this->db_fields[$tpl_data['TOPIC_ID']]) ? $this->db_fields[$tpl_data['TOPIC_ID']] : array(),
297
			$this->get_fields_data_from_post($message)
298
		);
299
	}
300
301
	/**
302
	 * @param string $post_text
303
	 * @return array
304
	 */
305
	protected function get_fields_data_from_post($post_text)
306
	{
307
		$fields_data = array();
308
		$find_fields = join('|', array_keys($this->content_fields));
309
		if (preg_match_all("#<div data-field=\"($find_fields)\">(.*?)</div><br><!-- end field -->#s", $post_text, $matches))
310
		{
311
			$fields_data = array_combine($matches[1], $matches[2]);
312
		}
313
314
		return array_intersect_key($fields_data, $this->content_fields);
0 ignored issues
show
It seems like $fields_data can also be of type false; however, parameter $array1 of array_intersect_key() does only seem to accept array, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

314
		return array_intersect_key(/** @scrutinizer ignore-type */ $fields_data, $this->content_fields);
Loading history...
315
	}
316
317
	/**
318
	 * @return void
319
	 */
320
	protected function reset()
321
	{
322
		$this->content_fields = array();
323
		$this->form_fields = array();
324
		$this->tpl_name = '';
325
		$this->view_mode = '';
326
	}
327
}
328