Completed
Push — develop ( e80729...78b87e )
by Greg
09:14
created
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * webtrees: online genealogy
4
 * Copyright (C) 2017 webtrees development team
5
 * This program is free software: you can redistribute it and/or modify
6
 * it under the terms of the GNU General Public License as published by
7
 * the Free Software Foundation, either version 3 of the License, or
8
 * (at your option) any later version.
9
 * This program is distributed in the hope that it will be useful,
10
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
 * GNU General Public License for more details.
13
 * You should have received a copy of the GNU General Public License
14
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
15
 */
16
namespace Fisharebest\Webtrees;
17
18
use Fisharebest\Webtrees\Controller\RepositoryController;
19
use Fisharebest\Webtrees\Functions\FunctionsPrint;
20
use Fisharebest\Webtrees\Functions\FunctionsPrintFacts;
21
use Fisharebest\Webtrees\Functions\FunctionsPrintLists;
22
23
/** @global Tree $WT_TREE */
24
global $WT_TREE;
25
26
require 'includes/session.php';
27
28
$record     = Repository::getInstance(Filter::get('rid', WT_REGEX_XREF), $WT_TREE);
29
$controller = new RepositoryController($record);
30
31 View Code Duplication
if ($controller->record && $controller->record->canShow()) {
32
	if ($controller->record->isPendingDeletion()) {
33
		if (Auth::isModerator($controller->record->getTree())) {
34
			FlashMessages::addMessage(/* I18N: %1$s is “accept”, %2$s is “reject”. These are links. */ I18N::translate(
35
				'This repository has been deleted. You should review the deletion and then %1$s or %2$s it.',
36
				'<a href="#" onclick="accept_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the deletion and then accept or reject it.', 'accept') . '</a>',
37
				'<a href="#" onclick="reject_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the deletion and then accept or reject it.', 'reject') . '</a>'
38
			) . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning');
39
		} elseif (Auth::isEditor($controller->record->getTree())) {
40
			FlashMessages::addMessage(I18N::translate('This repository has been deleted. The deletion will need to be reviewed by a moderator.') . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning');
41
		}
42
	} elseif ($controller->record->isPendingAddtion()) {
43
		if (Auth::isModerator($controller->record->getTree())) {
44
			FlashMessages::addMessage(/* I18N: %1$s is “accept”, %2$s is “reject”. These are links. */ I18N::translate(
45
				'This repository has been edited. You should review the changes and then %1$s or %2$s them.',
46
				'<a href="#" onclick="accept_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the changes and then accept or reject them.', 'accept') . '</a>',
47
				'<a href="#" onclick="reject_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the changes and then accept or reject them.', 'reject') . '</a>'
48
			) . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning');
49
		} elseif (Auth::isEditor($controller->record->getTree())) {
50
			FlashMessages::addMessage(I18N::translate('This repository has been edited. The changes need to be reviewed by a moderator.') . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning');
51
		}
52
	}
53
	$controller->pageHeader();
54
} else {
55
	FlashMessages::addMessage(I18N::translate('This repository does not exist or you do not have permission to view it.'), 'danger');
56
	http_response_code(404);
57
	$controller->pageHeader();
58
59
	return;
60
}
61
62
$sources = $controller->record->linkedSources('REPO');
63
$facts   = $controller->record->getFacts();
64
65
usort(
66
	$facts,
67
	function (Fact $x, Fact $y) {
68
		static $order = [
69
			'NAME' => 0,
70
			'ADDR' => 1,
71
			'NOTE' => 2,
72
			'WWW'  => 3,
73
			'REFN' => 4,
74
			'RIN'  => 5,
75
			'_UID' => 6,
76
			'CHAN' => 7,
77
		];
78
79
		return
80
			(array_key_exists($x->getTag(), $order) ? $order[$x->getTag()] : PHP_INT_MAX)
81
			-
82
			(array_key_exists($y->getTag(), $order) ? $order[$y->getTag()] : PHP_INT_MAX);
83
	}
84
);
85
86
?>
87
<h2 class="wt-page-title">
88
	<?= $controller->record->getFullName() ?>
89
</h2>
90
91
<div class="wt-page-content">
92
	<ul class="nav nav-tabs" role="tablist">
93
		<li class="nav-item">
94
			<a class="nav-link active" data-toggle="tab" role="tab" href="#details">
95
				<?= I18N::translate('Details') ?>
96
			</a>
97
		</li>
98
		<li class="nav-item">
99
			<a class="nav-link<?= empty($sources) ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#sources">
100
				<?= I18N::translate('Sources') ?>
101
				<?= Bootstrap4::badgeCount($sources) ?>
102
			</a>
103
		</li>
104
	</ul>
105
106
	<div class="tab-content">
107
		<div class="tab-pane fade show active" role="tabpanel" id="details">
108
			<table class="facts_table">
109
				<?php foreach ($facts as $fact): ?>
110
					<?php FunctionsPrintFacts::printFact($fact, $controller->record) ?>
111
				<?php endforeach ?>
112
113
				<?php if ($controller->record->canEdit()): ?>
114
					<?php FunctionsPrint::printAddNewFact($controller->record->getXref(), $facts, 'REPO') ?>
115
				<?php endif ?>
116
			</table>
117
		</div>
118
119
		<div class="tab-pane fade" role="tabpanel" id="sources">
120
			<?= FunctionsPrintLists::sourceTable($sources) ?>
0 ignored issues
show
Security Cross-Site Scripting introduced by
\Fisharebest\Webtrees\Fu...::sourceTable($sources) can contain request data and is used in output context(s) leading to a potential security vulnerability.

4 paths for user data to reach this point

  1. Path: Read from $_FILES, and $file is assigned in action.php on line 112
  1. Read from $_FILES, and $file is assigned
    in action.php on line 112
  2. $gedcom is assigned
    in action.php on line 148
  3. $gedcom is passed to Tree::createRecord()
    in action.php on line 158
  4. $gedcom is passed to GedcomRecord::getInstance()
    in app/Tree.php on line 782
  5. $gedcom is passed to GedcomRecord::__construct()
    in app/GedcomRecord.php on line 202
  6. GedcomRecord::$gedcom is assigned
    in app/GedcomRecord.php on line 80
  7. Tainted property GedcomRecord::$gedcom is read
    in app/GedcomRecord.php on line 495
  8. GedcomRecord::privatizeGedcom() returns tainted data, and $newgedrec is assigned
    in app/Report/ReportParserGenerate.php on line 594
  9. ReportParserGenerate::$gedrec is assigned
    in app/Report/ReportParserGenerate.php on line 618
  10. Tainted property ReportParserGenerate::$gedrec is read
    in app/Report/ReportParserGenerate.php on line 1262
  11. Data is passed through explode()
    in vendor/app/Functions/Functions.php on line 160
  12. $thisSubrecord is assigned
    in vendor/app/Functions/Functions.php on line 161
  13. Data is passed through substr()
    in vendor/app/Functions/Functions.php on line 167
  14. ReportParserGenerate::$desc is assigned
    in app/Report/ReportParserGenerate.php on line 1262
  15. Tainted property ReportParserGenerate::$desc is read, and $value is assigned
    in app/Report/ReportParserGenerate.php on line 1308
  16. ReportParserGenerate::$vars is assigned
    in app/Report/ReportParserGenerate.php on line 1358
  17. Tainted property ReportParserGenerate::$vars is read, and $id is assigned
    in app/Report/ReportParserGenerate.php on line 827
  18. $id is passed to GedcomRecord::getInstance()
    in app/Report/ReportParserGenerate.php on line 841
  19. $xref is passed to GedcomRecord::__construct()
    in app/GedcomRecord.php on line 202
  20. GedcomRecord::$xref is assigned
    in app/GedcomRecord.php on line 79
  21. Tainted property GedcomRecord::$xref is read
    in app/GedcomRecord.php on line 280
  22. GedcomRecord::getXref() returns tainted data
    in app/GedcomRecord.php on line 351
  23. GedcomRecord::getLinkUrl() returns tainted data
    in app/GedcomRecord.php on line 330
  24. GedcomRecord::getHtmlUrl() returns tainted data, and $html is assigned
    in app/Functions/FunctionsPrintLists.php on line 1017
  25. FunctionsPrintLists::sourceTable() returns tainted data
    in repo.php on line 120
  2. Path: Read from $_POST, and $newged is assigned in edit_interface.php on line 426
  1. Read from $_POST, and $newged is assigned
    in edit_interface.php on line 426
  2. $newged is assigned
    in edit_interface.php on line 446
  3. $newged is passed through substr(), and $newged is assigned
    in edit_interface.php on line 459
  4. $newged is passed to GedcomRecord::updateFact()
    in edit_interface.php on line 467
  5. $gedcom is passed through preg_replace(), and $gedcom is assigned
    in app/GedcomRecord.php on line 1192
  6. $gedcom is passed through trim(), and $gedcom is assigned
    in app/GedcomRecord.php on line 1193
  7. $new_gedcom is assigned
    in app/GedcomRecord.php on line 1230
  8. GedcomRecord::$gedcom is assigned
    in app/GedcomRecord.php on line 1249
  9. Tainted property GedcomRecord::$gedcom is read
    in app/GedcomRecord.php on line 495
  10. GedcomRecord::privatizeGedcom() returns tainted data, and $newgedrec is assigned
    in app/Report/ReportParserGenerate.php on line 594
  11. ReportParserGenerate::$gedrec is assigned
    in app/Report/ReportParserGenerate.php on line 618
  12. Tainted property ReportParserGenerate::$gedrec is read
    in app/Report/ReportParserGenerate.php on line 1262
  13. Data is passed through explode()
    in vendor/app/Functions/Functions.php on line 160
  14. $thisSubrecord is assigned
    in vendor/app/Functions/Functions.php on line 161
  15. Data is passed through substr()
    in vendor/app/Functions/Functions.php on line 167
  16. ReportParserGenerate::$desc is assigned
    in app/Report/ReportParserGenerate.php on line 1262
  17. Tainted property ReportParserGenerate::$desc is read, and $value is assigned
    in app/Report/ReportParserGenerate.php on line 1308
  18. ReportParserGenerate::$vars is assigned
    in app/Report/ReportParserGenerate.php on line 1358
  19. Tainted property ReportParserGenerate::$vars is read, and $id is assigned
    in app/Report/ReportParserGenerate.php on line 827
  20. $id is passed to GedcomRecord::getInstance()
    in app/Report/ReportParserGenerate.php on line 841
  21. $xref is passed to GedcomRecord::__construct()
    in app/GedcomRecord.php on line 202
  22. GedcomRecord::$xref is assigned
    in app/GedcomRecord.php on line 79
  23. Tainted property GedcomRecord::$xref is read
    in app/GedcomRecord.php on line 280
  24. GedcomRecord::getXref() returns tainted data
    in app/GedcomRecord.php on line 351
  25. GedcomRecord::getLinkUrl() returns tainted data
    in app/GedcomRecord.php on line 330
  26. GedcomRecord::getHtmlUrl() returns tainted data, and $html is assigned
    in app/Functions/FunctionsPrintLists.php on line 1017
  27. FunctionsPrintLists::sourceTable() returns tainted data
    in repo.php on line 120
  3. Path: Read from $_POST, and $newged is assigned in edit_interface.php on line 430
  1. Read from $_POST, and $newged is assigned
    in edit_interface.php on line 430
  2. $newged is assigned
    in edit_interface.php on line 446
  3. $newged is passed through substr(), and $newged is assigned
    in edit_interface.php on line 459
  4. $newged is passed to GedcomRecord::updateFact()
    in edit_interface.php on line 467
  5. $gedcom is passed through preg_replace(), and $gedcom is assigned
    in app/GedcomRecord.php on line 1192
  6. $gedcom is passed through trim(), and $gedcom is assigned
    in app/GedcomRecord.php on line 1193
  7. $new_gedcom is assigned
    in app/GedcomRecord.php on line 1230
  8. GedcomRecord::$gedcom is assigned
    in app/GedcomRecord.php on line 1249
  9. Tainted property GedcomRecord::$gedcom is read
    in app/GedcomRecord.php on line 495
  10. GedcomRecord::privatizeGedcom() returns tainted data, and $newgedrec is assigned
    in app/Report/ReportParserGenerate.php on line 594
  11. ReportParserGenerate::$gedrec is assigned
    in app/Report/ReportParserGenerate.php on line 618
  12. Tainted property ReportParserGenerate::$gedrec is read
    in app/Report/ReportParserGenerate.php on line 1262
  13. Data is passed through explode()
    in vendor/app/Functions/Functions.php on line 160
  14. $thisSubrecord is assigned
    in vendor/app/Functions/Functions.php on line 161
  15. Data is passed through substr()
    in vendor/app/Functions/Functions.php on line 167
  16. ReportParserGenerate::$desc is assigned
    in app/Report/ReportParserGenerate.php on line 1262
  17. Tainted property ReportParserGenerate::$desc is read, and $value is assigned
    in app/Report/ReportParserGenerate.php on line 1308
  18. ReportParserGenerate::$vars is assigned
    in app/Report/ReportParserGenerate.php on line 1358
  19. Tainted property ReportParserGenerate::$vars is read, and $id is assigned
    in app/Report/ReportParserGenerate.php on line 827
  20. $id is passed to GedcomRecord::getInstance()
    in app/Report/ReportParserGenerate.php on line 841
  21. $xref is passed to GedcomRecord::__construct()
    in app/GedcomRecord.php on line 202
  22. GedcomRecord::$xref is assigned
    in app/GedcomRecord.php on line 79
  23. Tainted property GedcomRecord::$xref is read
    in app/GedcomRecord.php on line 280
  24. GedcomRecord::getXref() returns tainted data
    in app/GedcomRecord.php on line 351
  25. GedcomRecord::getLinkUrl() returns tainted data
    in app/GedcomRecord.php on line 330
  26. GedcomRecord::getHtmlUrl() returns tainted data, and $html is assigned
    in app/Functions/FunctionsPrintLists.php on line 1017
  27. FunctionsPrintLists::sourceTable() returns tainted data
    in repo.php on line 120
  4. Path: Read from $_POST, and $newged is assigned in edit_interface.php on line 454
  1. Read from $_POST, and $newged is assigned
    in edit_interface.php on line 454
  2. $newged is passed through substr(), and $newged is assigned
    in edit_interface.php on line 459
  3. $newged is passed to GedcomRecord::updateFact()
    in edit_interface.php on line 467
  4. $gedcom is passed through preg_replace(), and $gedcom is assigned
    in app/GedcomRecord.php on line 1192
  5. $gedcom is passed through trim(), and $gedcom is assigned
    in app/GedcomRecord.php on line 1193
  6. $new_gedcom is assigned
    in app/GedcomRecord.php on line 1230
  7. GedcomRecord::$gedcom is assigned
    in app/GedcomRecord.php on line 1249
  8. Tainted property GedcomRecord::$gedcom is read
    in app/GedcomRecord.php on line 495
  9. GedcomRecord::privatizeGedcom() returns tainted data, and $newgedrec is assigned
    in app/Report/ReportParserGenerate.php on line 594
  10. ReportParserGenerate::$gedrec is assigned
    in app/Report/ReportParserGenerate.php on line 618
  11. Tainted property ReportParserGenerate::$gedrec is read
    in app/Report/ReportParserGenerate.php on line 1262
  12. Data is passed through explode()
    in vendor/app/Functions/Functions.php on line 160
  13. $thisSubrecord is assigned
    in vendor/app/Functions/Functions.php on line 161
  14. Data is passed through substr()
    in vendor/app/Functions/Functions.php on line 167
  15. ReportParserGenerate::$desc is assigned
    in app/Report/ReportParserGenerate.php on line 1262
  16. Tainted property ReportParserGenerate::$desc is read, and $value is assigned
    in app/Report/ReportParserGenerate.php on line 1308
  17. ReportParserGenerate::$vars is assigned
    in app/Report/ReportParserGenerate.php on line 1358
  18. Tainted property ReportParserGenerate::$vars is read, and $id is assigned
    in app/Report/ReportParserGenerate.php on line 827
  19. $id is passed to GedcomRecord::getInstance()
    in app/Report/ReportParserGenerate.php on line 841
  20. $xref is passed to GedcomRecord::__construct()
    in app/GedcomRecord.php on line 202
  21. GedcomRecord::$xref is assigned
    in app/GedcomRecord.php on line 79
  22. Tainted property GedcomRecord::$xref is read
    in app/GedcomRecord.php on line 280
  23. GedcomRecord::getXref() returns tainted data
    in app/GedcomRecord.php on line 351
  24. GedcomRecord::getLinkUrl() returns tainted data
    in app/GedcomRecord.php on line 330
  25. GedcomRecord::getHtmlUrl() returns tainted data, and $html is assigned
    in app/Functions/FunctionsPrintLists.php on line 1017
  26. FunctionsPrintLists::sourceTable() returns tainted data
    in repo.php on line 120

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
121
		</div>
122
	</div>
123
</div>
124