Issues (71)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

entity_browser.module (1 issue)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/**
4
 * @file
5
 * Allows to flexibly create, browse and select entities.
6
 */
7
8
use \Drupal\Core\Form\FormStateInterface;
9
use \Drupal\Core\Render\Element;
10
use Drupal\Core\Url;
11
use \Drupal\file\FileInterface;
12
use Drupal\Core\Routing\RouteMatchInterface;
13
14
/**
15
 * Implements hook_help().
16
 */
17
function entity_browser_help($route_name, RouteMatchInterface $arg) {
0 ignored issues
show
The parameter $arg is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
18
  switch ($route_name) {
19
    case 'help.page.entity_browser':
20
      $output = '';
21
      $output .= '<h3>' . t('About') . '</h3>';
22
      $output .= '<p>' . t('The Entity Browser module provides a generic entity browser/picker/selector. It can be used in any context where one needs to select a few entities and do something with them. For more information, see the online documentation for <a href=":entity_browser-documentation">Entity Browser</a>.', [':entity_browser-documentation' => 'https://drupal-media.gitbooks.io/drupal8-guide/content/modules/entity_browser/intro.html']) . '</p>';
23
      $output .= '<h3>' . t('Uses') . '</h3>';
24
      $output .= '<dl>';
25
      $output .= '<dt>' . t('General') . '</dt>';
26
      $output .= '<dd>' . t('Entity browser comes with an example module that can be used as a starting point.') . '</dd>';
27
      $output .= '<dt>' . t('Example use cases') . '</dt>';
28
      $output .= '<dd>' . t('Powerfull entity reference widget') . '</dd>';
29
      $output .= '<dd>' . t('Embedding entities into wysiwyg') . '</dd>';
30
      $output .= '</dl>';
31
32
      return $output;
33
  }
34
}
35
36
/**
37
 * Implements hook_theme().
38
 *
39
 * Overrides the core html theme to use a custom template for iframes.
40
 */
41
function entity_browser_theme() {
42
  return [
43
    'html__entity_browser__iframe' => [
44
      'template' => 'html--entity-browser--iframe',
45
      'render element' => 'html',
46
      'preprocess functions' => ['template_preprocess_html'],
47
    ],
48
    'html__entity_browser__modal' => [
49
      'template' => 'html--entity-browser--iframe',
50
      'render element' => 'html',
51
      'preprocess functions' => ['template_preprocess_html'],
52
    ],
53
    'page__entity_browser__iframe' => [
54
      'template' => 'page--entity-browser--iframe',
55
      'render element' => 'html',
56
      'preprocess functions' => ['template_preprocess_page'],
57
    ],
58
    'page__entity_browser__modal' => [
59
      'template' => 'page--entity-browser--iframe',
60
      'render element' => 'html',
61
      'preprocess functions' => ['template_preprocess_page'],
62
    ],
63
  ];
64
}
65
66
/**
67
 * Implements hook_form_alter().
68
 */
69
function entity_browser_form_alter(&$form, FormStateInterface &$form_state) {
70
  $entity_browser_dialog_edit = \Drupal::service('request_stack')->getCurrentRequest()->get('_route');
71
  if ($entity_browser_dialog_edit == 'entity_browser.edit_form') {
72
    // Let's allow the save button only.
73
    foreach (Element::children($form['actions']) as $key) {
74
      $form['actions'][$key]['#access'] = $key == 'submit';
75
    }
76
    // Use Ajax.
77
    $form['actions']['submit']['#ajax'] = [
78
      'url' => Url::fromRoute('entity_browser.edit_form', ['entity_type' => $form_state->getFormObject()->getEntity()->getEntityTypeId(), 'entity' => $form_state->getFormObject()->getEntity()->id()]),
79
      'options' => [
80
        'query' => [
81
          'details_id' => \Drupal::request()->query->get('details_id'),
82
        ],
83
      ],
84
    ];
85
  }
86
}
87
88
/**
89
 * Implements hook_preprocess_page__entity_browser__iframe().
90
 *
91
 * Tries to figure out where messages block lives and display it separately.
92
 */
93
function entity_browser_preprocess_page__entity_browser__iframe(&$variables) {
94
  if (!\Drupal::moduleHandler()->moduleExists('block')) {
95
    return;
96
  }
97
  $variables['messages'] = '';
98
  $blocks = \Drupal::entityTypeManager()->getStorage('block')->loadByProperties([
99
    'theme' => \Drupal::theme()->getActiveTheme()->getName(),
100
    'plugin' => 'system_messages_block',
101
  ]);
102
103
  if (($messages = current($blocks)) && !empty($variables['page'][$messages->getRegion()][$messages->id()])) {
104
    $variables['messages'] = $variables['page'][$messages->getRegion()][$messages->id()];
105
  }
106
}
107
108
/**
109
 * Implements hook_preprocess_page__entity_browser__modal().
110
 *
111
 * Tries to figure out where messages block lives and display it separately.
112
 */
113
function entity_browser_preprocess_page__entity_browser__modal(&$variables) {
114
  entity_browser_preprocess_page__entity_browser__iframe($variables);
115
}
116
117
/**
118
 * Validates image resolution for the given File.
119
 *
120
 * Drupal core does not allow users to use existing images. As a result,
121
 * calling the normal file_validate_image_resolution() function on a file that
122
 * may be used elsewhere would resize it for all of its uses. We copy the
123
 * normal validation here so that we can stop this from occurring.
124
 *
125
 * @param \Drupal\file\FileInterface $file
126
 *   The file being evaluated.
127
 * @param int $maximum_dimensions
128
 *   The maximum dimensions.
129
 * @param int $minimum_dimensions
130
 *   The minimum dimensions.
131
 *
132
 * @return array
133
 *   See file_validate_image_resolution()
134
 */
135
function entity_browser_file_validate_image_resolution(FileInterface $file, $maximum_dimensions = 0, $minimum_dimensions = 0) {
136
  $errors = [];
137
138
  // Check first that the file is an image.
139
  $image_factory = \Drupal::service('image.factory');
140
  $image = $image_factory->get($file->getFileUri());
141
  if ($image->isValid()) {
142
    if ($maximum_dimensions) {
143
      // Check that it is smaller than the given dimensions.
144
      list($width, $height) = explode('x', $maximum_dimensions);
145
      if ($image->getWidth() > $width || $image->getHeight() > $height) {
146
        // Try to resize the image to fit the dimensions.
147
        // This $file->isPermanent() check is the only part of the function
148
        // body that is significantly different.
149
        if (!$file->isPermanent() && $image->scale($width, $height)) {
150
          $image->save();
151
          $file->filesize = $image->getFileSize();
152
          drupal_set_message(t('The image was resized to fit within the maximum allowed dimensions of %dimensions pixels.', ['%dimensions' => $maximum_dimensions]));
153
        }
154
        else {
155
          $errors[] = t('The image exceeds the maximum allowed dimensions.');
156
        }
157
      }
158
    }
159
160
    if ($minimum_dimensions) {
161
      // Check that it is larger than the given dimensions.
162
      list($width, $height) = explode('x', $minimum_dimensions);
163
      if ($image->getWidth() < $width || $image->getHeight() < $height) {
164
        $errors[] = t('The image is too small; the minimum dimensions are %dimensions pixels.', ['%dimensions' => $minimum_dimensions]);
165
      }
166
    }
167
  }
168
169
  return $errors;
170
}
171