Issues (40)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/View/ViewHelperFunctions.php (1 issue)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Anax\View;
4
5
/**
6
 * Define helper functions to include before processing the view template.
7
 * The functions here are exposed to the view and can be used in the view.
8
 */
9
10
/**
11
 * Shortcut to create an url for a static asset.
12
 *
13
 * @param string $url url to use when creating the url.
14
 *
15
 * @return string as resulting url.
16
 */
17
function asset($url = "")
18
{
19
    global $di;
20
    return $di->get("url")->asset($url);
21
}
22
23
24
25
/**
26
 * Shortcut to create an url for routing in the framework.
27
 *
28
 * @param null|string $url url to use when creating the url.
29
 *
30
 * @return string as resulting url.
31
 */
32
function url($url = "")
33
{
34
    global $di;
35
    return $di->get("url")->create($url);
36
}
37
38
39
40
/**
41
 * Shortcut to create an url for routing in the framework,
42
 * use current controller as the base for the url.
43
 *
44
 * @param null|string $url url, relative controller mount point,
45
 *                         to use when creating the url.
46
 *
47
 * @return string as resulting url.
48
 */
49
function urlController($url = "")
50
{
51
    global $di;
52
    $mount = rtrim($di->get("router")->getLastRoute(), "/");
53
54
    return $di->get("url")->create("$mount/$url");
55
}
56
57
58
59
/**
60
 * Render a view with an optional data set of variables.
61
 *
62
 * @param string $template the template file, or array
63
 * @param array  $data     variables to make available to the
64
 *                         view, default is empty
65
 *
66
 * @return void
67
 */
68
function renderView($template, $data = [])
69
{
70
    global $di;
71
    $view = new View();
72
    $template = $di->get("view")->getTemplateFile($template);
73
    $view->set($template, $data);
74
    $view->render($di);
75
}
76
77
78
79
/**
80
 * Check if the region in the view container has views to render.
81
 *
82
 * @param string $region to check
83
 *
84
 * @return boolean true or false
85
 */
86
function regionHasContent($region)
87
{
88
    global $di;
89
    return $di->get("view")->hasContent($region);
90
}
91
92
93
94
/**
95
 * Render views, from the view container, in the region.
96
 *
97
 * @param string $region to render in
98
 *
99
 * @return boolean true or false
100
 */
101
function renderRegion($region)
102
{
103
    global $di;
104
    return $di->get("view")->render($region);
105
}
106
107
108
109
/**
110
 * Create a class attribute from a string or array.
111
 *
112
 * @param string|array $args variable amount of classlists.
113
 *
114
 * @return string as complete class attribute
115
 */
116
function classList(...$args)
117
{
118 5
    $classes = [];
119
120 5
    foreach ($args as $arg) {
121 5
        if (empty($arg)) {
122 2
            continue;
123 4
        } elseif (is_string($arg)) {
124 4
            $arg = explode(" ", $arg);
125
        }
126 4
        $classes = array_merge($classes, $arg);
127
    }
128
129 5
    return "class=\"" . e(implode(" ", $classes)) . "\"";
130
}
131
132
133
134
/**
135
 * Get current url, without querystring.
136
 *
137
 * @return string as resulting url.
138
 */
139
function currentUrl()
140
{
141
    global $di;
142
    return $di->get("request")->getCurrentUrl(false);
143
}
144
145
146
147
/**
148
 * Get current route.
149
 *
150
 * @return string as resulting route.
151
 */
152
function currentRoute()
153
{
154
    global $di;
155
    return $di->get("request")->getRoute();
156
}
157
158
159
160
/**
161
 * Redirect to another url.
162
 *
163
 * @param string $url to be redirected to.
164
 *
165
 * @return void.
0 ignored issues
show
The doc-type void. could not be parsed: Unknown type name "void." at position 0. (view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
166
 *
167
 * @SuppressWarnings(PHPMD.ExitExpression)
168
 *
169
 */
170
function redirect(string $url) : void
171
{
172
    global $di;
173
    $di->get("response")->redirect($url)->send();
174
    exit;
175
}
176
177
178
179
/**
180
 * Escape HTML entities.
181
 *
182
 * @param string $string to be escaped.
183
 *
184
 * @return string as resulting route.
185
 */
186
function e($string) : string
187
{
188 5
    return htmlentities($string);
189
}
190
191
192
193
/**
194
 * Show variables/functions that are currently defined and can
195
 * be used within the view. Call the function with get_defined_vars()
196
 * as the parameter.
197
 *
198
 * @param array $variables should be the returned value from
199
 *                         get_defined_vars()
200
 * @param array $functions should be the returned value from
201
 *                         get_defined_functions()
202
 *
203
 * @return string showing variables and functions.
204
 */
205
function showEnvironment($variables, $functions)
206
{
207
    $all = array_keys($variables);
208
    sort($all);
209
    $res = "<pre>\n"
210
        . "VIEW DEVELOPMENT INFORMATION\n"
211
        . "----------------------------\n"
212
        . "Variables available:\n"
213
        . " (var_dump each for more information):\n";
214
    foreach ($all as $var) {
215
        $variable = $variables[$var];
216
        $res .= "* $var (" . gettype($variable) . ")";
217
        if (is_integer($variable) || is_double($variable)) {
218
            $res .= ": $variable";
219
        } elseif (is_string($variable)) {
220
            $res .= ": \"$variable\"";
221
        } elseif (is_bool($variable)) {
222
            $res .= ": " . ( $variable ? "true" : "false" );
223
        }
224
        $res .= "\n";
225
    }
226
227
    $res .= "\nView helper functions available:\n (see " . __FILE__ . ")\n";
228
    $namespace = strtolower(__NAMESPACE__);
229
    $matches = array_filter(
230
        $functions["user"],
231
        function ($function) use ($namespace) {
232
            return substr($function, 0, strlen($namespace)) === $namespace;
233
        }
234
    );
235
    sort($matches);
236
    $res .= "* " . implode(",\n* ", $matches);
237
    $res .= "</pre>";
238
239
    return $res;
240
}
241
242
243
244
/**
245
 * Extract the publish or update date for the article.
246
 *
247
 * @param array $dates a collection of possible date values.
248
 *
249
 * @return array with values for showing the date.
250
 */
251
function getPublishedDate($dates)
252
{
253
    $defaults = [
254
        "revision" => [],
255
        "published" => null,
256
        "updated" => null,
257
        "created" => null,
258
    ];
259
    $dates = array_merge($defaults, $dates);
260
261
    if ($dates["revision"]) {
262
        return [t("Latest revision"), key($dates["revision"])];
263
    } elseif ($dates["published"]) {
264
        return [t("Published"), $dates["published"]];
265
    } elseif ($dates["updated"]) {
266
        return [t("Updated"), $dates["updated"]];
267
    } elseif ($dates["created"]) {
268
        return [t("Created"), $dates["created"]];
269
    }
270
271
    return [t("Missing pubdate."), null];
272
}
273
274
275
276
/**
277
 * Load content from a route and return details to view.
278
 *
279
 * @param string $route to load content from.
280
 *
281
 * @return array with values to extract in view.
282
 */
283
function getContentForRoute($route)
284
{
285
    global $di;
286
    $content = $di->get("content")->contentForInternalRoute($route);
287
    return $content->views["main"]["data"];
288
}
289
290
291
292
/**
293
 * Wrap a HTML element with start and end.
294
 *
295
 * @param string  $text  with content
296
 * @param string  $tag   HTML tag to search for
297
 * @param string  $start wrap start part
298
 * @param string  $end   wrap end part
299
 * @param number  $count hits to search for
300
 *
301
 * @return array with values to extract in view.
302
 */
303
function wrapElementWithStartEnd($text, $tag, $start, $end, $count)
304
{
305
    global $di;
306
    return $di->get("textfilter")->wrapElementWithStartEnd($text, $tag, $start, $end, $count);
307
}
308
309
310
311
/**
312
 * Wrap content of a HTML element with start and end.
313
 *
314
 * @param string  $text  with content
315
 * @param string  $tag   HTML tag to search for
316
 * @param string  $start wrap start part
317
 * @param string  $end   wrap end part
318
 * @param number  $count hits to search for
319
 *
320
 * @return array with values to extract in view.
321
 */
322
function wrapElementContentWithStartEnd($text, $tag, $start, $end, $count)
323
{
324
    global $di;
325
    return $di->get("textfilter")->wrapElementContentWithStartEnd($text, $tag, $start, $end, $count);
326
}
327