GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (423)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

myth/Controllers/BaseController.php (6 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php namespace Myth\Controllers;
0 ignored issues
show
Coding Style Compatibility introduced by
For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 88 and the first side effect is on line 34.

The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.

The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.

To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.

Loading history...
2
/**
3
 * Sprint
4
 *
5
 * A set of power tools to enhance the CodeIgniter framework and provide consistent workflow.
6
 *
7
 * Permission is hereby granted, free of charge, to any person obtaining a copy
8
 * of this software and associated documentation files (the "Software"), to deal
9
 * in the Software without restriction, including without limitation the rights
10
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11
 * copies of the Software, and to permit persons to whom the Software is
12
 * furnished to do so, subject to the following conditions:
13
 *
14
 * The above copyright notice and this permission notice shall be included in
15
 * all copies or substantial portions of the Software.
16
 *
17
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23
 * THE SOFTWARE.
24
 *
25
 * @package     Sprint
26
 * @author      Lonnie Ezell
27
 * @copyright   Copyright 2014-2015, New Myth Media, LLC (http://newmythmedia.com)
28
 * @license     http://opensource.org/licenses/MIT  (MIT)
29
 * @link        http://sprintphp.com
30
 * @since       Version 1.0
31
 */
32
33
/* PHP5 spl_autoload */
34
spl_autoload_register( '\Myth\Modules::autoload' );
35
36
/**
37
 * The following properties are used to provide autocomplete for IDE's.
38
 *
39
 * Thanks to:  https://gist.github.com/topdown/1697338
40
 *
41
 * @property \CI_DB_query_builder    $db
42
 * @property \CI_DB_utility          $dbutil
43
 * @property \CI_DB_forge            $dbforge
44
 * @property \CI_Benchmark           $benchmark
45
 * @property \CI_Calendar            $calendar
46
 * @property \CI_Cart                $cart
47
 * @property \CI_Config              $config
48
 * @property \CI_Controller          $controller
49
 * @property \CI_Email               $email
50
 * @property \CI_Encrypt             $encrypt
51
 * @property \CI_Exceptions          $exceptions
52
 * @property \CI_Form_validation     $form_validation
53
 * @property \CI_Ftp                 $ftp
54
 * @property \CI_Hooks               $hooks
55
 * @property \CI_Image_lib           $image_lib
56
 * @property \CI_Input               $input
57
 * @property \CI_Lang                $lang
58
 * @property \CI_Loader              $load
59
 * @property \CI_Log                 $log
60
 * @property \CI_Model               $model
61
 * @property \CI_Output              $output
62
 * @property \CI_Pagination          $pagination
63
 * @property \CI_Parser              $parser
64
 * @property \CI_Profiler            $profiler
65
 * @property \CI_Router              $router
66
 * @property \CI_Session             $session
67
 * @property \CI_Table               $table
68
 * @property \CI_Trackback           $trackback
69
 * @property \CI_Typography          $typography
70
 * @property \CI_Unit_test           $unit_test
71
 * @property \CI_Upload              $upload
72
 * @property \CI_URI                 $uri
73
 * @property \CI_User_agent          $user_agent
74
 * @property \CI_Xmlrpc              $xmlrpc
75
 * @property \CI_Xmlrpcs             $xmlrpcs
76
 * @property \CI_Zip                 $zip
77
 * @property \CI_Javascript          $javascript
78
 * @property \CI_Jquery              $jquery
79
 * @property \CI_Utf8                $utf8
80
 * @property \CI_Security            $security
81
 */
82
83
/**
84
 * Class BaseController
85
 *
86
 * @package Myth\Controllers
87
 */
88
class BaseController extends \CI_Controller {
89
	/**
90
	 * The type of caching to use. The default values are
91
	 * set globally in the environment's start file, but
92
	 * these will override if they are set.
93
	 */
94
	protected $cache_type = NULL;
95
	protected $backup_cache = NULL;
96
97
	// If set, this language file will automatically be loaded.
98
	protected $language_file = NULL;
99
100
	// If set, this model file will automatically be loaded.
101
	protected $model_file = NULL;
102
103
	//--------------------------------------------------------------------
104
105
	public function __construct()
106
	{
107
		parent::__construct();
108
109
        $this->load->library('session');
0 ignored issues
show
The property load does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
110
111
		$this->setupCache();
112
113
		$this->autoload();
114
115
		$this->autoMigrate();
116
117
		$this->setupProfiler();
118
119
		log_message( 'debug', get_class( $this ) . ' controller loaded.' );
120
	}
121
122
	//--------------------------------------------------------------------
123
124
	//--------------------------------------------------------------------
125
	// Setup Methods
126
	//--------------------------------------------------------------------
127
	// These methods are used during the initial constructor, but split out
128
	// here so that child controllers can easily override individual methods
129
	// if they need to customize that aspect of the startup.
130
131
	/**
132
	 * Gets the cache up and running. The site-wide cache settings can be
133
	 * set in the application config file. Each controller can override these
134
	 * settings using the 'cache_type' and 'backup_cache' class vars.
135
	 */
136
	protected function setupCache()
137
	{
138
		// If the controller doesn't override cache type, grab the values from
139
		// the defaults set in the start file.
140
		if ( empty( $this->cache_type ) )
141
		{
142
			$this->cache_type = $this->config->item( 'cache_type' );
0 ignored issues
show
The property config does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
143
		}
144
		if ( empty( $this->backup_cache ) )
145
		{
146
			$this->backup_cache = $this->config->item( 'backup_cache_type' );
147
		}
148
149
		// Make sure that caching is ALWAYS available throughout the app
150
		// though it defaults to 'dummy' which won't actually cache.
151
		$this->load->driver( 'cache', array( 'adapter' => $this->cache_type, 'backup' => $this->backup_cache ) );
152
	}
153
154
	//--------------------------------------------------------------------
155
156
	/**
157
	 * Handles any autoloading of files, like language or model files,
158
	 * that can be used throughout the controller.
159
	 */
160
	protected function autoload()
161
	{
162
		if ( ! is_null( $this->language_file ) )
163
		{
164
			$this->lang->load( $this->language_file );
0 ignored issues
show
The property lang does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
165
		}
166
167
		if ( ! is_null( $this->model_file ) )
168
		{
169
			$this->load->database();
170
			$this->load->model( $this->model_file );
171
		}
172
	}
173
174
	//--------------------------------------------------------------------
175
176
	/**
177
	 * If settings allow, will auto-migrate the system to the latest
178
	 * available migrations.
179
	 */
180
	protected function autoMigrate()
181
	{
182
		$migrations = config_item( 'auto_migrate' );
183
184
		if ( ! is_array( $migrations ) || ! count( $migrations ) )
185
		{
186
			return;
187
		}
188
189
		$this->load->library( 'migration' );
190
191
		// Run all of our migrations for each group.
192
		foreach ( $migrations as $group )
193
		{
194
			$this->migration->latest( $group );
195
		}
196
	}
197
198
	//--------------------------------------------------------------------
199
200
	/**
201
	 * Handles setting up the profiler.
202
	 */
203
	protected function setupProfiler()
204
	{
205
		// The profiler is dealt with twice so that we can set
206
		// things up to work correctly in AJAX methods using $this->render_json
207
		// and it's cousins.
208
		if ( $this->config->item( 'show_profiler' ) == TRUE )
209
		{
210
			$this->output->enable_profiler( TRUE );
0 ignored issues
show
The property output does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
211
		}
212
	}
213
214
	//--------------------------------------------------------------------
215
216
217
	//--------------------------------------------------------------------
218
	// Simple Rendering Methods
219
	//--------------------------------------------------------------------
220
221
	/**
222
	 * Renders a string of aribritrary text. This is best used during an AJAX
223
	 * call or web service request that are expecting something other then
224
	 * proper HTML.
225
	 *
226
	 * @param  string $text The text to render.
227
	 * @param  bool $typography If TRUE, will run the text through 'Auto_typography'
228
	 *                          before outputting to the browser.
229
	 *
230
	 * @return void [type]       [description]
231
	 */
232
	public function renderText( $text, $typography = FALSE )
233
	{
234
		// Note that, for now anyway, we don't do any cleaning of the text
235
		// and leave that up to the client to take care of.
236
237
		// However, we can auto_typogrify the text if we're asked nicely.
238
		if ( $typography === TRUE )
239
		{
240
			$this->load->helper( 'typography' );
241
			$text = auto_typography( $text );
242
		}
243
244
		$this->output->enable_profiler( FALSE )
245
		             ->set_content_type( 'text/plain' )
246
		             ->set_output( $text );
247
	}
248
249
	//--------------------------------------------------------------------
250
251
	/**
252
	 * Converts the provided array or object to JSON, sets the proper MIME type,
253
	 * and outputs the data.
254
	 *
255
	 * Do NOT do any further actions after calling this action.
256
	 *
257
	 * @param  mixed $json The data to be converted to JSON.
258
	 *
259
	 * @throws RenderException
260
	 * @return void
261
	 */
262
	public function renderJSON( $json )
263
	{
264
		if ( is_resource( $json ) )
265
		{
266
			throw new \RuntimeException( lang('bad_json_encode') );
267
		}
268
269
		if ( $this->config->item( 'show_profiler' ) )
270
		{
271
			$this->load->library( 'profiler' );
272
			$json['#sprint-profiler'] = $this->profiler->run();
0 ignored issues
show
The property profiler does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
273
		}
274
275
		$this->output->enable_profiler( FALSE )
276
		             ->set_content_type( 'application/json' )
277
		             ->set_output( json_encode( $json ) );
278
	}
279
280
	//--------------------------------------------------------------------
281
282
	/**
283
	 * Sends the supplied string to the browser with a MIME type of text/javascript.
284
	 *
285
	 * Do NOT do any further processing after this command or you may receive a
286
	 * Headers already sent error.
287
	 *
288
	 * @param  mixed $js The javascript to output.
289
	 *
290
	 * @throws RenderException
291
	 * @return void
292
	 */
293
	public function renderJS( $js = NULL )
294
	{
295
		if ( ! is_string( $js ) )
296
		{
297
			throw new \RuntimeException( lang('bad_javascript') );
298
		}
299
300
		$this->output->enable_profiler( FALSE )
301
		             ->set_content_type( 'application/x-javascript' )
302
		             ->set_output( $js );
303
	}
304
305
	//--------------------------------------------------------------------
306
307
	/**
308
	 * Breaks us out of any output buffering so that any content echo'd out
309
	 * will echo out as it happens, instead of waiting for the end of all
310
	 * content to echo out. This is especially handy for long running
311
	 * scripts like might be involved in cron scripts.
312
	 *
313
	 * @return void
314
	 */
315
	public function renderRealtime()
316
	{
317
		if ( ob_get_level() > 0 )
318
		{
319
			end_end_flush();
320
		}
321
		ob_implicit_flush( TRUE );
322
	}
323
324
	//--------------------------------------------------------------------
325
326
	/**
327
	 * Integrates with the bootstrap-ajax javascript file to
328
	 * redirect the user to a new url.
329
	 *
330
	 * If the URL is a relative URL, it will be converted to a full URL for this site
331
	 * using site_url().
332
	 *
333
	 * @param  string $location [description]
334
	 */
335
	public function ajaxRedirect( $location = '' )
336
	{
337
		$location = empty( $location ) ? '/' : $location;
338
339
		if ( strpos( $location, '/' ) !== 0 || strpos( $location, '://' ) !== FALSE )
340
		{
341
			if ( ! function_exists( 'site_url' ) )
342
			{
343
				$this->load->helper( 'url' );
344
			}
345
346
			$location = site_url( $location );
347
		}
348
349
		$this->render_json( array( 'location' => $location ) );
350
	}
351
352
	//--------------------------------------------------------------------
353
354
	/**
355
	 * Attempts to get any information from php://input and return it
356
	 * as JSON data. This is useful when your javascript is sending JSON data
357
	 * to the application.
358
	 *
359
	 * @param  strign $format The type of element to return, either 'object' or 'array'
360
	 * @param  int $depth The number of levels deep to decode
361
	 *
362
	 * @return mixed    The formatted JSON data, or NULL.
363
	 */
364
	public function getJSON( $format = 'object', $depth = 512 )
365
	{
366
		$as_array = $format == 'array' ? TRUE : FALSE;
367
368
		return json_decode( file_get_contents( 'php://input' ), $as_array, $depth );
369
	}
370
371
	//--------------------------------------------------------------------
372
373
}
374