This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | //------------------------------------------------------------------------------ |
||
4 | // |
||
5 | // eTraxis - Records tracking web-based system |
||
6 | // Copyright (C) 2005-2012 Artem Rodygin |
||
7 | // |
||
8 | // This program is free software: you can redistribute it and/or modify |
||
9 | // it under the terms of the GNU General Public License as published by |
||
10 | // the Free Software Foundation, either version 3 of the License, or |
||
11 | // (at your option) any later version. |
||
12 | // |
||
13 | // This program is distributed in the hope that it will be useful, |
||
14 | // but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
15 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
16 | // GNU General Public License for more details. |
||
17 | // |
||
18 | // You should have received a copy of the GNU General Public License |
||
19 | // along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
20 | // |
||
21 | //------------------------------------------------------------------------------ |
||
22 | |||
23 | /** |
||
24 | * @package eTraxis |
||
25 | * @ignore |
||
26 | */ |
||
27 | |||
28 | /**#@+ |
||
29 | * Dependency. |
||
30 | */ |
||
31 | require_once('../engine/engine.php'); |
||
32 | require_once('../dbo/projects.php'); |
||
33 | /**#@-*/ |
||
34 | |||
35 | init_page(LOAD_TAB, GUEST_IS_ALLOWED); |
||
0 ignored issues
–
show
|
|||
36 | |||
37 | // check that requested project exists |
||
38 | |||
39 | $id = ustr2int(try_request('id')); |
||
40 | $project = project_find($id); |
||
41 | |||
42 | if (!$project) |
||
0 ignored issues
–
show
The expression
$project of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using
Loading history...
|
|||
43 | { |
||
44 | debug_write_log(DEBUG_NOTICE, 'Project cannot be found.'); |
||
45 | exit; |
||
46 | } |
||
47 | |||
48 | // prepare charts data |
||
49 | |||
50 | $first_week = intval(floor($project['start_time'] / SECS_IN_WEEK)); |
||
51 | $last_week = intval(floor(time() / SECS_IN_WEEK)); |
||
52 | |||
53 | $created = array_fill($first_week, $last_week - $first_week + 1, 0); |
||
54 | $closed = array_fill($first_week, $last_week - $first_week + 1, 0); |
||
55 | |||
56 | $rso = record_opened($id); |
||
57 | $rsc = record_closed($id); |
||
58 | |||
59 | View Code Duplication | while (($row = $rso->fetch())) |
|
60 | { |
||
61 | if (!is_null($row['amount'])) |
||
62 | { |
||
63 | $created[$row['week']] = $row['amount']; |
||
64 | } |
||
65 | } |
||
66 | |||
67 | View Code Duplication | while (($row = $rsc->fetch())) |
|
68 | { |
||
69 | if (!is_null($row['amount'])) |
||
70 | { |
||
71 | $closed[$row['week']] = $row['amount']; |
||
72 | } |
||
73 | } |
||
74 | |||
75 | $opened = array(); |
||
76 | $count = 0; |
||
77 | |||
78 | for ($i = $first_week; $i <= $last_week; $i++) |
||
79 | { |
||
80 | $count += $created[$i]; |
||
81 | $count -= $closed[$i]; |
||
82 | |||
83 | $opened[$i] = $count; |
||
84 | } |
||
85 | |||
86 | // determine best maximum value and tick interval |
||
87 | |||
88 | $maxvalue = max(max($opened), max($created), max($closed)); |
||
89 | $interval = ceil($maxvalue / 20); |
||
90 | |||
91 | $digit = intval(substr($interval, 0, 1)); |
||
92 | |||
93 | switch ($digit) |
||
94 | { |
||
95 | case 3: |
||
96 | case 4: |
||
97 | $digit = 5; |
||
98 | break; |
||
99 | case 6: |
||
100 | case 7: |
||
101 | case 8: |
||
102 | case 9: |
||
103 | $digit = 10; |
||
104 | break; |
||
105 | } |
||
106 | |||
107 | $interval = intval($digit . str_pad('', ustrlen($interval) - 1, '0', STR_PAD_RIGHT)); |
||
108 | $maxvalue = ceil($maxvalue / max($interval, 1)) * $interval; |
||
109 | |||
110 | // prepare date formatting string |
||
111 | |||
112 | global $locale_info; |
||
113 | |||
114 | $lang = (isset($_SESSION[VAR_LOCALE]) ? $_SESSION[VAR_LOCALE] : LANG_DEFAULT); |
||
115 | $format = $locale_info[$lang][LOCALE_DATE_FORMAT]; |
||
116 | |||
117 | $format = str_replace('d', '%d', $format); |
||
118 | $format = str_replace('j', '%#d', $format); |
||
119 | $format = str_replace('m', '%m', $format); |
||
120 | $format = str_replace('n', '%#m', $format); |
||
121 | $format = str_replace('Y', '%Y', $format); |
||
122 | $format = str_replace('y', '%y', $format); |
||
123 | |||
124 | // generate charts |
||
125 | |||
126 | $xml = '<div id="chart"></div>'; |
||
127 | |||
128 | $titleChart = get_html_resource(RES_CREATION_VS_CLOSURE_ID); |
||
129 | $titleOpened = ustrtolower(get_html_resource(RES_OPENED_RECORDS_ID)); |
||
130 | $titleCreated = get_html_resource(RES_CREATED_RECORDS_ID); |
||
131 | $titleClosed = get_html_resource(RES_CLOSED_RECORDS_ID); |
||
132 | |||
133 | if (stripos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== FALSE) |
||
134 | { |
||
135 | $xml .= '<script type="text/javascript" src="../scripts/get.php?name=excanvas.min.js"></script>'; |
||
136 | } |
||
137 | |||
138 | $xml .= '<script type="text/javascript" src="../scripts/get.php?name=jqplot/jquery.jqplot.min.js"></script>' |
||
139 | . '<script type="text/javascript" src="../scripts/get.php?name=jqplot/jqplot.cursor.min.js"></script>' |
||
140 | . '<script type="text/javascript" src="../scripts/get.php?name=jqplot/jqplot.dateAxisRenderer.min.js"></script>' |
||
141 | . '<script type="text/javascript" src="../scripts/get.php?name=jqplot/jqplot.highlighter.min.js"></script>' |
||
142 | . '<script>' |
||
143 | . 'var dataOpened = [];' |
||
144 | . 'var dataCreated = [];' |
||
145 | . 'var dataClosed = [];'; |
||
146 | |||
147 | for ($i = $first_week; $i <= $last_week; $i++) |
||
148 | { |
||
149 | $date = date('Y-m-d', $i * SECS_IN_WEEK + 4 * SECS_IN_DAY); |
||
150 | |||
151 | $xml .= sprintf("dataOpened.push(['%s',%d]);", $date, $opened[$i]); |
||
152 | $xml .= sprintf("dataCreated.push(['%s',%d]);", $date, $created[$i]); |
||
153 | $xml .= sprintf("dataClosed.push(['%s',%d]);", $date, $closed[$i]); |
||
154 | } |
||
155 | |||
156 | $xml .= <<<jqPlot |
||
157 | |||
158 | $('#chart').css('height', 0); // workaround for excanvas bug in IE |
||
159 | |||
160 | var chart = $.jqplot('chart', [dataOpened, dataCreated, dataClosed], { |
||
161 | |||
162 | title: '{$titleChart}', |
||
163 | |||
164 | legend: { |
||
165 | show: true, |
||
166 | location: 'nw' |
||
167 | }, |
||
168 | |||
169 | axes: { |
||
170 | xaxis: { |
||
171 | renderer: $.jqplot.DateAxisRenderer, |
||
172 | tickOptions: {formatString:'{$format}'} |
||
173 | }, |
||
174 | yaxis: { |
||
175 | min: 0, |
||
176 | max: {$maxvalue}, |
||
177 | tickInterval: {$interval}, |
||
178 | tickOptions: {formatString:'%d'} |
||
179 | } |
||
180 | }, |
||
181 | |||
182 | cursor: { |
||
183 | show: true, |
||
184 | showVerticalLine: true, |
||
185 | showHorizontalLine: false, |
||
186 | showCursorLegend: false, |
||
187 | showTooltip: false, |
||
188 | zoom: false |
||
189 | }, |
||
190 | |||
191 | highlighter: { |
||
192 | show: true, |
||
193 | sizeAdjust: 1 |
||
194 | }, |
||
195 | |||
196 | series: [ |
||
197 | {label:'{$titleOpened}', showMarker:false}, |
||
198 | {label:'{$titleCreated}', showMarker:false, color:'#FF6347'}, |
||
199 | {label:'{$titleClosed}', showMarker:false, color:'#1E90FF'} |
||
200 | ] |
||
201 | |||
202 | }); |
||
203 | |||
204 | jqPlot; |
||
205 | |||
206 | $xml .= '</script>'; |
||
207 | |||
208 | echo(xml2html($xml)); |
||
209 | |||
210 | ?> |
||
211 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: