Issues in config.php (master) - Issues in master - fwolf/fwlib - Measure and Improve Code Quality continuously with Scrutinizer

Issues (1752)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

func/config.php (6 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * Provide GetCfg and SetCfg function
 * @package     fwolflib
 * @copyright   Copyright 2007, Fwolf
 * @author      Fwolf <[email protected]>
 * @since		2007-10-23
 * @version		$Id$
 */

require_once(dirname(__FILE__) . '/../fwolflib.php');


/**
 * Get global config setting from global var $config
 *
 * String split by '.' means multidimensional array.
 *
 * @deprecated      Use Fwlib\Config\Config
 * @see		SetCfg()
 * @param	string	$key
 * @return	mixed
 */
function GetCfg ($key) {
	global $config;
	if (false === strpos($key, '.')) {
		if (isset($config[$key]))
			return($config[$key]);
		else
			return null;
	} else {
		// Recoginize the dot
		$ar = explode('.', $key);
		$c = $config;
		foreach ($ar as $val) {
			// Every dimision will go 1 level deeper
			if (isset($c[$val]))
				$c = &$c[$val];
			else
				return null;
		}
		return($c);
	}
} // end of func GetCfg


/**
 * Limit program can only run on prefered server, identify by serverid
 * If check failed, die and exit.
 * SetCfg('serverid', 0);
 *
 * @deprecated      Use Fwlib\Config\Config
 * @param	mixed	$id		string/int -> on this server, array -> in any of these server
 * @param	boolean	$die	If check false, true -> die(), false -> return false and continue, default is true.
 * @see	SetCfg()
 * @see GetCfg()
 * @return	boolean
 */
function LimitServerId($id, $die = true) {
	$serverid = GetCfg('server.id');

	if (empty($serverid))
		$serverid = GetCfg('serverid');


	$msg = '';
	if (is_array($id)) {
		if (!in_array($serverid, $id))
			$msg = 'This program can only run on these servers: ' . implode(',', $id) . '.';
	} elseif ($serverid != $id)
		$msg = 'This program can only run on server ' . $id . '.';

	if (!empty($msg))
		if (true == $die)

			die($msg);
		else
			return false;
	else
		return true;
} // end of func LimitServerId


/**
 * Set global config var $config
 *
 * Multidimensional array style setting supported,
 * If $key is string including '.', its converted to array by it recurrently.
 * eg: system.format.time => $config['system']['format']['time']
 *
 * @deprecated      Use Fwlib\Config\Config
 * @param	string	$key
 * @param	mixed	$val
 */
function SetCfg ($key, $val) {
	global $config;
	if (false === strpos($key, '.')) {
		$config[$key] = $val;
	} else {
		// Recoginize the dot
		$ar = explode('.', $key);
		$c = &$config;
		$j = count($ar) - 1;
		// Every loop will go 1 level sub array
		for ($i = 0; $i < $j; $i ++) {
			// 'a.b.c', if b is not set, create it as an empty array
			if (!isset($c[$ar[$i]]))
				$c[$ar[$i]] = array();
			$c = &$c[$ar[$i]];
		}
		// Set the value
		$c[$ar[$i]] = $val;
	}
} // end of func SetCfg


/**
 * Set default value of global config var $config
 *
 * Same with SetCfg() except: SetCfgDefault() will only change setting
 * if the config key is not setted before.
 *
 * @param	string	$key
 * @param	mixed	$val
 */
function SetCfgDefault ($key, $val) {
	if (is_null(GetCfg($key)))

		SetCfg($key, $val);

} // end of func SetCfgDefault


// Debug
/*
require_once('config.default.php');
require_once('fwolflib/func/ecl.php');
ecl(GetCfg('serverid'));
ecl(GetCfg('dbserver.default.type'));
SetCfg('test.1.2.3', 3);
SetCfg('test.1.2.4', 4);
ecl(GetCfg('test.1.2.3'));
ecl(GetCfg('test.1.2.4'));
print_r(GetCfg('dbserver.default'));
*/
?>



1			<?php
2			/**
3			* Provide GetCfg and SetCfg function
4			* @package fwolflib
5			* @copyright Copyright 2007, Fwolf
6			* @author Fwolf <[email protected]>
7			* @since 2007-10-23
8			* @version $Id$
9			*/
10
11			require_once(dirname(__FILE__) . '/../fwolflib.php');
12
13
14			/**
15			* Get global config setting from global var $config
16			*
17			* String split by '.' means multidimensional array.
18			*
19			* @deprecated Use Fwlib\Config\Config
20			* @see SetCfg()
21			* @param string $key
22			* @return mixed
23			*/
24			function GetCfg ($key) {
25			global $config;
26			if (false === strpos($key, '.')) {
27			if (isset($config[$key]))
28			return($config[$key]);
29			else
30			return null;
31			} else {
32			// Recoginize the dot
33			$ar = explode('.', $key);
34			$c = $config;
35			foreach ($ar as $val) {
36			// Every dimision will go 1 level deeper
37			if (isset($c[$val]))
38			$c = &$c[$val];
39			else
40			return null;
41			}
42			return($c);
43			}
44			} // end of func GetCfg
45
46
47			/**
48			* Limit program can only run on prefered server, identify by serverid
49			* If check failed, die and exit.
50			* SetCfg('serverid', 0);
51			*
52			* @deprecated Use Fwlib\Config\Config
53			* @param mixed $id string/int -> on this server, array -> in any of these server
54			* @param boolean $die If check false, true -> die(), false -> return false and continue, default is true.
55			* @see SetCfg()
56			* @see GetCfg()
57			* @return boolean
58			*/
59			function LimitServerId($id, $die = true) {
60			$serverid = GetCfg('server.id');
			0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `GetCfg()` has been deprecated with message: Use Fwlib\Config\Config This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
61			if (empty($serverid))
62			$serverid = GetCfg('serverid');
			0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `GetCfg()` has been deprecated with message: Use Fwlib\Config\Config This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
63
64			$msg = '';
65			if (is_array($id)) {
66			if (!in_array($serverid, $id))
67			$msg = 'This program can only run on these servers: ' . implode(',', $id) . '.';
68			} elseif ($serverid != $id)
69			$msg = 'This program can only run on server ' . $id . '.';
70
71			if (!empty($msg))
72			if (true == $die)
			0 ignored issues – show Coding Style Best Practice introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you are loosely comparing two booleans. Considering using the strict comparison `===` instead. When comparing two booleans, it is generally considered safer to use the strict comparison operator. Loading history...
73			die($msg);
74			else
75			return false;
76			else
77			return true;
78			} // end of func LimitServerId
79
80
81			/**
82			* Set global config var $config
83			*
84			* Multidimensional array style setting supported,
85			* If $key is string including '.', its converted to array by it recurrently.
86			* eg: system.format.time => $config['system']['format']['time']
87			*
88			* @deprecated Use Fwlib\Config\Config
89			* @param string $key
90			* @param mixed $val
91			*/
92			function SetCfg ($key, $val) {
93			global $config;
94			if (false === strpos($key, '.')) {
95			$config[$key] = $val;
96			} else {
97			// Recoginize the dot
98			$ar = explode('.', $key);
99			$c = &$config;
100			$j = count($ar) - 1;
101			// Every loop will go 1 level sub array
102			for ($i = 0; $i < $j; $i ++) {
103			// 'a.b.c', if b is not set, create it as an empty array
104			if (!isset($c[$ar[$i]]))
105			$c[$ar[$i]] = array();
106			$c = &$c[$ar[$i]];
107			}
108			// Set the value
109			$c[$ar[$i]] = $val;
110			}
111			} // end of func SetCfg
112
113
114			/**
115			* Set default value of global config var $config
116			*
117			* Same with SetCfg() except: SetCfgDefault() will only change setting
118			* if the config key is not setted before.
119			*
120			* @param string $key
121			* @param mixed $val
122			*/
123			function SetCfgDefault ($key, $val) {
124			if (is_null(GetCfg($key)))
			0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `GetCfg()` has been deprecated with message: Use Fwlib\Config\Config This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
125			SetCfg($key, $val);
			0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `SetCfg()` has been deprecated with message: Use Fwlib\Config\Config This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
126			} // end of func SetCfgDefault
127
128
129			// Debug
130			/*
131			require_once('config.default.php');
132			require_once('fwolflib/func/ecl.php');
133			ecl(GetCfg('serverid'));
134			ecl(GetCfg('dbserver.default.type'));
135			SetCfg('test.1.2.3', 3);
136			SetCfg('test.1.2.4', 4);
137			ecl(GetCfg('test.1.2.3'));
138			ecl(GetCfg('test.1.2.4'));
139			print_r(GetCfg('dbserver.default'));
140			*/
141			?>
			0 ignored issues – show Best Practice introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this It is not recommended to use PHP's closing tag `?>` in files other than templates. Using a closing tag in PHP files that only contain PHP code is not recommended as you might accidentally add whitespace after the closing tag which would then be output by PHP. This can cause severe problems, for example headers cannot be sent anymore. A simple precaution is to leave off the closing tag as it is not required, and it also has no negative effects whatsoever. Loading history...
142

fwolf / fwlib

Issues (1752)

Security Analysis not enabled

func/config.php (6 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like