GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (423)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

myth/Controllers/ThemedController.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php namespace Myth\Controllers;
0 ignored issues
show
Coding Style Compatibility introduced by
For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 42 and the first side effect is on line 35.

The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.

The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.

To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.

Loading history...
2
/**
3
 * Sprint
4
 *
5
 * A set of power tools to enhance the CodeIgniter framework and provide consistent workflow.
6
 *
7
 * Permission is hereby granted, free of charge, to any person obtaining a copy
8
 * of this software and associated documentation files (the "Software"), to deal
9
 * in the Software without restriction, including without limitation the rights
10
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11
 * copies of the Software, and to permit persons to whom the Software is
12
 * furnished to do so, subject to the following conditions:
13
 *
14
 * The above copyright notice and this permission notice shall be included in
15
 * all copies or substantial portions of the Software.
16
 *
17
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23
 * THE SOFTWARE.
24
 *
25
 * @package     Sprint
26
 * @author      Lonnie Ezell
27
 * @copyright   Copyright 2014-2015, New Myth Media, LLC (http://newmythmedia.com)
28
 * @license     http://opensource.org/licenses/MIT  (MIT)
29
 * @link        http://sprintphp.com
30
 * @since       Version 1.0
31
 */
32
use Myth\Themers\MetaCollection;
33
use Zend\Escaper\Escaper;
34
35
require_once dirname(__FILE__) .'/../Themers/escape.php';
36
37
/**
38
 * Class ThemedController
39
 *
40
 * @package Myth\Controllers
41
 */
42
class ThemedController extends BaseController
43
{
44
    /**
45
     * Stores data variables to be sent to the view.
46
     * @var array
47
     */
48
    protected $vars = array();
49
50
    /**
51
     * Stores current status message.
52
     * @var
53
     */
54
    protected $message;
55
56
    /**
57
     * The UIKit to make available to the template views.
58
     * @var string
59
     */
60
    protected $uikit = '';
61
62
    /**
63
     * An instance of an active Themer to use.
64
     * @var null
65
     */
66
    protected $themer = null;
67
68
    /**
69
     * Allows per-controller override of theme.
70
     * @var null
71
     */
72
    protected $theme = null;
73
74
    /**
75
     * Per-controller override of the current layout file.
76
     * @var null
77
     */
78
    protected $layout = null;
79
80
    /**
81
     * Stores an array of javascript files.
82
     * @var array
83
     */
84
    protected $external_scripts = array();
85
86
    /**
87
     * Stores an array of CSS stylesheets.
88
     * @var array
89
     */
90
    protected $stylesheets = array();
91
92
    /**
93
     * A MenuCollection instance
94
     * @var
95
     */
96
    protected $meta;
97
98
    /**
99
     * Whether set() should escape the output...
100
     * @var bool
101
     */
102
    protected $auto_escape = null;
103
104
    /**
105
     * An instance of ZendFrameworks Escaper
106
     * @var null
107
     */
108
    protected $escaper = null;
109
110
    //--------------------------------------------------------------------
111
112
    /**
113
     * Constructor takes care of getting the template engine up and running
114
     * and bound to our DI object, as well as any other preliminary needs,
115
     * like detecting the variant to use, etc.
116
     */
117
    public function __construct()
118
    {
119
        parent::__construct();
120
121
        // Setup our Template Engine
122
        $themer = config_item('active_themer');
123
124
        if (empty($themer)) {
125
            throw new \RuntimeException( lang('no_themer') );
126
        }
127
128
        $this->themer = new $themer( get_instance() );
129
130
        // Register our paths with the themer
131
        $paths = config_item('theme.paths');
132
133
        foreach ($paths as $key => $path) {
134
            $this->themer->addThemePath($key, $path);
135
        }
136
137
        // Set our default theme.
138
        $this->themer->setDefaultTheme( config_item('theme.default_theme') );
139
140
        // Register our variants with the engine.
141
        $variants = config_item('theme.variants');
142
143
        foreach ($variants as $key => $value) {
144
            $this->themer->addVariant($key, $value);
145
        }
146
147
        $this->detectVariant();
148
149
        // Ensure that our UIKit is loaded up if we're using one.
150
        $uikit = config_item('theme.uikit');
151
152
        if ($uikit)
153
        {
154
            $this->uikit = new $uikit();
155
        }
156
157
        // Load up our meta collection
158
        $this->meta = new MetaCollection( get_instance() );
159
160
        // Should we autoescape vars?
161
        if (is_null($this->auto_escape))
162
        {
163
            $this->auto_escape = config_item( 'theme.auto_escape' );
164
        }
165
    }
166
167
    //--------------------------------------------------------------------
168
169
    /**
170
     * Provides a common interface with the other rendering methods to
171
     * set the output of the method. Uses the current instance of $this->template.
172
     * Ensures that any data we've stored through $this->setVar() are present
173
     * and includes the status messages into the data.
174
     *
175
     * @param array $data
176
     * @param int   $cache_time
177
     */
178
    public function render($data = array(), $cache_time=0)
179
    {
180
	    if ($cache_time > 0)
181
	    {
182
		    $this->output->cache( (int)$cache_time );
0 ignored issues
show
The property output does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
183
	    }
184
185
        // Determine the correct theme to use
186
        $theme = ! empty($this->theme) ? $this->theme : config_item('theme.default_theme');
187
        $this->themer->setTheme($theme);
188
189
        // Determine the correct layout to use
190
        $layout = !empty($this->layout) ? $this->layout : null;
191
        $this->themer->setLayout($layout);
192
193
        // Merge any saved vars into the data
194
        // But first, escape the data if needed
195
        if ($this->auto_escape)
196
        {
197
            $data = esc($data, 'html');
198
        }
199
        $data = array_merge($data, $this->vars);
200
201
        // Make sure the MetaCollection is available in the view.
202
        $data['html_meta'] = $this->meta;
203
204
        // Include our UIKit so views can use it
205
        if (! empty($this->uikit)) {
206
            $data['uikit'] = $this->uikit;
207
        }
208
209
        // Build our notices from the theme's view file.
210
        $data['notice'] = $this->themer->display($this->themer->theme() . ':notice', ["notice" => $this->message()]);
211
212
        // Make sure any scripts/stylesheets are available to the view
213
        $data['external_scripts'] = $this->external_scripts;
214
        $data['stylesheets'] = $this->stylesheets;
215
216
        $this->themer->set($data);
217
218
        $this->output->set_content_type('html')
219
                     ->set_output($this->themer->render());
220
    }
221
222
    //--------------------------------------------------------------------
223
224
    /**
225
     * Sets a data variable to be sent to the view during the render() method.
226
     * Will auto-escape data on the way in, unless specifically told not to.
227
     *
228
     * Uses ZendFramework's Escaper to handle the data escaping,
229
     * based on context. Valid contexts are:
230
     *      - html
231
     *      - htmlAttr
232
     *      - js
233
     *      - css
234
     *      - url
235
     *
236
     * @param string $name
237
     * @param mixed $value
238
     * @param string $context
239
     * @param bool $do_escape
240
     */
241
    public function setVar($name, $value = null, $context='html', $do_escape=null)
242
    {
243
        $escape = $do_escape == true ? true : $this->auto_escape;
244
245
        if (is_null($this->escaper))
246
        {
247
            $this->escaper = new Escaper(config_item('charset'));
248
        }
249
250
        if (is_array($name))
251
        {
252
            foreach ($name as $k => $v)
253
            {
254
                $this->vars[$k] = $escape ? esc($v, $context, $this->escaper) : $v;
255
            }
256
        }
257
        else
258
        {
259
            $this->vars[$name] = $escape ? esc($value, $context, $this->escaper) : $value;
260
        }
261
    }
262
263
    //--------------------------------------------------------------------
264
265
    //--------------------------------------------------------------------
266
    // Status Messages
267
    //--------------------------------------------------------------------
268
269
    /**
270
     * Sets a status message (for displaying small success/error messages).
271
     * This is used in place of the session->flashdata functions since you
272
     * don't always want to have to refresh the page to show the message.
273
     *
274
     * @param string $message The message to save.
275
     * @param string $type The string to be included as the CSS class of the containing div.
276
     */
277
    public function setMessage($message = '', $type = 'info')
278
    {
279
        if (! empty($message)) {
280
            if (isset($this->session)) {
281
                $this->session->set_flashdata('message', $type . '::' . $message);
0 ignored issues
show
The property session does not exist. Did you maybe forget to declare it?

In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:

class MyClass { }

$x = new MyClass();
$x->foo = true;

Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion:

class MyClass {
    public $foo;
}

$x = new MyClass();
$x->foo = true;
Loading history...
282
            }
283
284
            $this->message = array(
285
                'type' => $type,
286
                'message' => $message
287
            );
288
        }
289
    }
290
291
    //--------------------------------------------------------------------
292
293
    /**
294
     * Retrieves the status message to display (if any).
295
     *
296
     * @param  string $message [description]
297
     * @param  string $type [description]
298
     * @return array
299
     */
300
    public function message($message = '', $type = 'info')
301
    {
302
        $return = array(
303
            'message' => $message,
304
            'type' => $type
305
        );
306
307
        // Does session data exist?
308
        if (empty($message) && class_exists('CI_Session')) {
309
            $message = $this->session->flashdata('message');
310
311
            if (! empty($message)) {
312
                // Split out our message parts
313
                $temp_message = explode('::', $message);
314
                $return['type'] = $temp_message[0];
315
                $return['message'] = $temp_message[1];
316
317
                unset($temp_message);
318
            }
319
        }
320
321
        // If message is empty, we need to check our own storage.
322
        if (empty($message)) {
323
            if (empty($this->message['message'])) {
324
                return '';
325
            }
326
327
            $return = $this->message;
328
        }
329
330
        // Clear our session data so we don't get extra messages on rare occasions.
331
        if (class_exists('CI_Session')) {
332
            $this->session->set_flashdata('message', '');
333
        }
334
335
        return $return;
336
    }
337
338
    //--------------------------------------------------------------------
339
340
    //--------------------------------------------------------------------
341
    // Utility Methods
342
    //--------------------------------------------------------------------
343
344
    /**
345
     * Detects whether the item is being displayed on a desktop, phone,
346
     * or tablet device.
347
     */
348
    protected function detectVariant()
349
    {
350
        // Variant Detection and setup
351
        if (config_item('autodetect_variant') === true) {
352
            $detect = new \Mobile_Detect();
353
354
            if ($detect->isMobile()) {
355
                $this->template->setVariant('phone');
356
            } else if ($detect->isTablet()) {
357
                $this->template->setVariant('tablet');
358
            }
359
        }
360
    }
361
362
    //--------------------------------------------------------------------
363
364
    //--------------------------------------------------------------------
365
    // 'Asset' functions
366
    //--------------------------------------------------------------------
367
368
    /**
369
     * Adds an external javascript file to the 'external_scripts' array.
370
     *
371
     * @param [type] $filename [description]
372
     */
373 View Code Duplication
    public function addScript($filename)
374
    {
375
        if (strpos($filename, 'http') === FALSE) {
376
            $filename = base_url() . 'assets/js/' . $filename;
377
        }
378
379
        $this->external_scripts[] = $filename;
380
    }
381
382
    //--------------------------------------------------------------------
383
384
    /**
385
     * Adds an external stylesheet file to the 'stylesheets' array.
386
     */
387 View Code Duplication
    public function addStyle($filename)
388
    {
389
        if (strpos($filename, 'http') === FALSE) {
390
            $filename = base_url() . 'assets/css/' . $filename;
391
        }
392
393
        $this->stylesheets[] = $filename;
394
    }
395
396
    //--------------------------------------------------------------------
397
}
398
399