GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.
Completed
Push — master ( 35efb6...ee0423 )
by François
02:44
created

OtpSecret::getOtpSecrets()   A

Complexity

Conditions 2
Paths 2

Size

Total Lines 9
Code Lines 5

Duplication

Lines 9
Ratio 100 %

Importance

Changes 1
Bugs 0 Features 0
Metric Value
c 1
b 0
f 0
dl 9
loc 9
rs 9.6666
cc 2
eloc 5
nc 2
nop 0
1
<?php
2
/**
3
 * Copyright 2016 François Kooman <[email protected]>.
4
 *
5
 * Licensed under the Apache License, Version 2.0 (the "License");
6
 * you may not use this file except in compliance with the License.
7
 * You may obtain a copy of the License at
8
 *
9
 * http://www.apache.org/licenses/LICENSE-2.0
10
 *
11
 * Unless required by applicable law or agreed to in writing, software
12
 * distributed under the License is distributed on an "AS IS" BASIS,
13
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
 * See the License for the specific language governing permissions and
15
 * limitations under the License.
16
 */
17
18
namespace fkooman\VPN\Server;
19
20
use fkooman\IO\IOInterface;
21
use fkooman\IO\IO;
22
23
class OtpSecret
24
{
25
    /** @var string */
26
    private $configDir;
27
28
    /** @var \fkooman\IO\IOInterface */
29
    private $io;
30
31 View Code Duplication
    public function __construct($configDir, IOInterface $io = null)
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
32
    {
33
        $this->configDir = $configDir;
34
        if (is_null($io)) {
35
            $io = new IO();
36
        }
37
        $this->io = $io;
38
    }
39
40
    /**
41
     * Get a list of users that have an OTP secret set.
42
     */
43 View Code Duplication
    public function getOtpSecrets()
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
44
    {
45
        $otpSecrets = [];
46
        foreach ($this->io->readFolder($this->configDir, '*') as $f) {
47
            $otpSecrets[] = basename($f);
48
        }
49
50
        return $otpSecrets;
51
    }
52
53
    /**
54
     * Check whether a particular user has an OTP secret set.
55
     */
56
    public function getOtpSecret($userId)
57
    {
58
        $otpSecretFile = sprintf('%s/%s', $this->configDir, $userId);
59
60
        if ($this->io->isFile($otpSecretFile)) {
61
            return $this->io->readFile($otpSecretFile);
62
        }
63
64
        return false;
65
    }
66
67
    /**
68
     * Set or delete the OTP secret for a particular user.
69
     */
70
    public function setOtpSecret($userId, $otpSecret)
71
    {
72
        $otpSecretFile = sprintf('%s/%s', $this->configDir, $userId);
73
74
        if (false === $otpSecret) {
75
            // remove the secret
76
            if ($this->io->isFile($otpSecretFile)) {
77
                $this->io->deleteFile($otpSecretFile);
78
79
                return true;
80
            }
81
82
            return false;
83
        }
84
85
        // set the secret, if it is not yet set, do not allow override
86
        if ($this->io->isFile($otpSecretFile)) {
87
            return false;
88
        }
89
90
        $this->io->writeFile($otpSecretFile, $otpSecret, true);
0 ignored issues
show
Security File Manipulation introduced by
$otpSecret can contain request data and is used in file manipulation context(s) leading to a potential security vulnerability.

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
91
92
        return true;
93
    }
94
}
95