Issues in filesystem.php (master) - Issues in master - fwolf/fwlib - Measure and Improve Code Quality continuously with Scrutinizer

Issues (1752)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

func/filesystem.php (15 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
/**
 * @package		fwolflib
 * @subpackage	func
 * @copyright	Copyright 2006-2010, Fwolf
 * @author		Fwolf <[email protected]>
 * @since		2006-10-07
 */


require_once(dirname(__FILE__) . '/../fwolflib.php');


/**
 * Manual get basename instead of using pathinfo()
 *
 * @deprecated      Use native basename()
 * @param	string	$filename
 * @return	string
 */
function BaseName1 ($filename) {

	$i = strrpos($filename, '/');
	if (false === $i)
		return $filename;
	else
		return substr($filename, $i + 1);
} // end of func BaseName1


/**
 * Delete a dir or file completedly
 * 	When del a dir, del all dir and files under it also.
 *
 * @deprecated      Use Fwlib\Util\FileSystem::del()
 * @param	string	$name
 */
function DelFile ($name) {
	//:Notice: Lost link file will got nothing using realpath, basename, dirname
	//	So trans in full path as $name all the time.
	if(!is_link($name))
		$name = realpath($name);
	if (is_dir($name) && !is_link($name))
	{
		foreach (scandir($name) as $file)

		{
			if (('.' == $file) || ('..' == $file))
				continue;
			DelFile($name . '/' . $file);

		}
		rmdir($name);
	}
	else
	{
		//echo "unlink($name)\n";
		//:Notice: Only del trash files is allowed.
		if (0 < stripos($name, 'trash'))
			unlink($name);
		else
			echo "Error!!! No trash files included!\n";
	}
} // end of func DelFile


/**
 * Manual get dirname instead of using pathinfo()
 * Result didn't include ending '/'
 *
 * @deprecated      Use native dirname()
 * @param	string	$filename
 * @return	string
 */
function DirName1 ($filename) {

	$i = strrpos($filename, '/');
	if (false === $i)
		return '';
	else
		return substr($filename, 0, $i);
} // end of func DirName1


/**
 * Count size of a directory, recursive
 * 	 This func also recursive executed automatic
 *
 * @deprecated      Use Fwlib\Util\FileSystem::getDirSize()
 * @param	string	$path
 * @return	long
 */
function DirSize ($path) {
	$i = 0;
	$files = scandir($path);
	foreach ($files as $file)
	{
		if (('.' != $file) && ('..' != $file))
		{
			$pathfull = $path . '/' . $file;
			if (is_dir($pathfull))
			{
				$i += DirSize($pathfull);

			}
			else
				$i += FileSize1($pathfull);

		}
	}
	return $i;
}// end of func DirSize


/**
 * Manual get extension instead of using pathinfo()
 *
 * @deprecated      Use Fwlib\Util\FileSystem::getFileExt()
 * @param	string	$filename
 * @return	string
 */
function FileExt1 ($filename) {
	$i1 = strrpos($filename, '.');
	$i2 = strrpos($filename, '/');
	if ($i1 < $i2)
		return '';
	else
		return substr($filename, $i1 +1);
} // end of func FileExt1


/**
 * Manual get filename instead of using pathinfo()
 *
 * @deprecated      Use Fwlib\Util\FileSystem::getFileName()
 * @param	string	$filename
 * @return	string
 */
function FileName1 ($filename) {

	$basename = Basename1($filename);

	$i = strrpos($basename, '.');
	if (false === $i)
		return $basename;
	else
		return substr($basename, 0, $i);
} // end of func FileName1


/**
 * Count size of a file
 * 	 This func is diffrence to php func filesize,
 *		It use stat & count blksize & blocks file used.
 *		11 = blksize, blocksize of filesystem IO *
 *		12 = blocks, number of blocks allocated
 *
 * @deprecated      Use Fwlib\Util\FileSystem::getFileSize()
 * @param	string	$file
 * @return	long
 */
function FileSize1 ($file) {
	if (is_link($file))
		$s = lstat($file);
	else
		$s = stat($file);
	if (-1 == $s['blksize'])
		$size = $s['size'];
	else
		$size = $s['blksize'] * $s['blocks'] / 8;
	return($size);
} // end of func FileSize1


/**
 * Get/gen a filename to write as a new file.
 *
 * Before write, there is a filename, but if file exists,
 * need plus -1, -2, -nnn at end of filename but before file extention,
 * this func will do this job and return suitable filename.
 *
 * Will remove special chars in filename.
 *
 * Can use with dir as well as regular file.
 *
 * @deprecated      Use Fwlib\Util\FileSystem::getNewFile()
 * @param	string	$s_file	Path to dest file.
 * @return	string
 */
function GetFilenameToWrite ($s_file) {
	// Remove special chars in filename
	$ar = array('?', '&', ';', '=', ':', "\\");
	$s_file = str_replace($ar, '_', $s_file);
	$s_file = trim($s_file);

	$s_dir = DirName1($s_file) . '/';

	$s_name = FileName1($s_file);

	$s_ext = FileExt1($s_file);


	// Auto skip exists file, no overwrite.(-1, -2...-9, -10, -11.ext)
	$i = 1;
	while (file_exists($s_file)) {
		$s_file = $s_dir . $s_name;
		$s_file .= '-' . strval($i++);
		if (!empty($s_ext))
			$s_file .= '.' . $s_ext;
	}

	return $s_file;
} // end of func GetFilenameToWrite


/**
 * List files and file-information of a directory
 * 	By default, sort files by mtime asc
 *  Returned array is started from 1
 *
 * @deprecated      Use Fwlib\Util\FileSystem::listDir()
 * @param	string	$dir
 * @return	array
 */
function ListDir ($dir) {
	//List files
	$dir = realpath($dir);
	if (empty($dir))
		return(false);
	if (!is_dir($dir))
		return(false);
	$dirfiles = scandir($dir);
	if (empty($dirfiles))
		return(false);

	$filename=array();
	$filemtime=array();
	// Parallel arrays (ignore the ".", "..")
	foreach ($dirfiles as $s)
	{
		if (('.' != $s) && ('..' != $s))
		{
			$filename[] = $s;
			$filemtime[] = filemtime($dir . '/' . $s);
		}
	}
	// Gen array
	// Mtime maybe same, so index by name temporary
	$ar_t = array();
	foreach ($filename as $k => $v) {
		$ar_t[$v] = $filemtime[$k];
	}
	// Sort by mtime
	asort($ar_t, SORT_NUMERIC);
	// Build result array, count file or dir size
	$i = 0;
	$files = array();
	foreach ($ar_t as $key=>$value)
	{
		$i++;
		$files[$i]['name'] = $key;
		$files[$i]['mtime'] = $value;
		//file or dir's size
		//If not use pathfull, same-named file and '..' will be so bad
		$pathfull = $dir . '/' . $key;
		if (is_link($pathfull))
		{
			$files[$i]['size'] = FileSize1($pathfull);

		}
		elseif (is_dir($pathfull))
		{
			$files[$i]['size'] = DirSize($pathfull);

		}
		else
		{
			$files[$i]['size'] = FileSize1($pathfull);

		}
	}
	// Some maintainence
	unset($dirfiles, $filename, $filemtime, $ar_t);
	return($files);
} // end of func ListDir

?>



1		<?php
2		/**
3		* @package fwolflib
4		* @subpackage func
5		* @copyright Copyright 2006-2010, Fwolf
6		* @author Fwolf <[email protected]>
7		* @since 2006-10-07
8		*/
9
10
11		require_once(dirname(__FILE__) . '/../fwolflib.php');
12
13
14		/**
15		* Manual get basename instead of using pathinfo()
16		*
17		* @deprecated Use native basename()
18		* @param string $filename
19		* @return string
20		*/
21	View Code Duplication	function BaseName1 ($filename) {
		0 ignored issues – show Duplication introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this This function seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
22		$i = strrpos($filename, '/');
23		if (false === $i)
24		return $filename;
25		else
26		return substr($filename, $i + 1);
27		} // end of func BaseName1
28
29
30		/**
31		* Delete a dir or file completedly
32		* When del a dir, del all dir and files under it also.
33		*
34		* @deprecated Use Fwlib\Util\FileSystem::del()
35		* @param string $name
36		*/
37		function DelFile ($name) {
38		//:Notice: Lost link file will got nothing using realpath, basename, dirname
39		// So trans in full path as $name all the time.
40		if(!is_link($name))
41		$name = realpath($name);
42		if (is_dir($name) && !is_link($name))
43		{
44	View Code Duplication	foreach (scandir($name) as $file)
		0 ignored issues – show Duplication introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
45		{
46		if (('.' == $file) \|\| ('..' == $file))
47		continue;
48		DelFile($name . '/' . $file);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `DelFile()` has been deprecated with message: Use Fwlib\Util\FileSystem::del() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
49		}
50		rmdir($name);
51		}
52		else
53		{
54		//echo "unlink($name)\n";
55		//:Notice: Only del trash files is allowed.
56		if (0 < stripos($name, 'trash'))
57		unlink($name);
58		else
59		echo "Error!!! No trash files included!\n";
60		}
61		} // end of func DelFile
62
63
64		/**
65		* Manual get dirname instead of using pathinfo()
66		* Result didn't include ending '/'
67		*
68		* @deprecated Use native dirname()
69		* @param string $filename
70		* @return string
71		*/
72	View Code Duplication	function DirName1 ($filename) {
		0 ignored issues – show Duplication introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this This function seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
73		$i = strrpos($filename, '/');
74		if (false === $i)
75		return '';
76		else
77		return substr($filename, 0, $i);
78		} // end of func DirName1
79
80
81		/**
82		* Count size of a directory, recursive
83		* This func also recursive executed automatic
84		*
85		* @deprecated Use Fwlib\Util\FileSystem::getDirSize()
86		* @param string $path
87		* @return long
88		*/
89		function DirSize ($path) {
90		$i = 0;
91		$files = scandir($path);
92		foreach ($files as $file)
93		{
94		if (('.' != $file) && ('..' != $file))
95		{
96		$pathfull = $path . '/' . $file;
97		if (is_dir($pathfull))
98		{
99		$i += DirSize($pathfull);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `DirSize()` has been deprecated with message: Use Fwlib\Util\FileSystem::getDirSize() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
100		}
101		else
102		$i += FileSize1($pathfull);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `FileSize1()` has been deprecated with message: Use Fwlib\Util\FileSystem::getFileSize() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
103		}
104		}
105		return $i;
106		}// end of func DirSize
107
108
109		/**
110		* Manual get extension instead of using pathinfo()
111		*
112		* @deprecated Use Fwlib\Util\FileSystem::getFileExt()
113		* @param string $filename
114		* @return string
115		*/
116		function FileExt1 ($filename) {
117		$i1 = strrpos($filename, '.');
118		$i2 = strrpos($filename, '/');
119		if ($i1 < $i2)
120		return '';
121		else
122		return substr($filename, $i1 +1);
123		} // end of func FileExt1
124
125
126		/**
127		* Manual get filename instead of using pathinfo()
128		*
129		* @deprecated Use Fwlib\Util\FileSystem::getFileName()
130		* @param string $filename
131		* @return string
132		*/
133	View Code Duplication	function FileName1 ($filename) {
		0 ignored issues – show Duplication introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this This function seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
134		$basename = Basename1($filename);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `BaseName1()` has been deprecated with message: Use native basename() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
135		$i = strrpos($basename, '.');
136		if (false === $i)
137		return $basename;
138		else
139		return substr($basename, 0, $i);
140		} // end of func FileName1
141
142
143		/**
144		* Count size of a file
145		* This func is diffrence to php func filesize,
146		* It use stat & count blksize & blocks file used.
147		* 11 = blksize, blocksize of filesystem IO *
148		* 12 = blocks, number of blocks allocated
149		*
150		* @deprecated Use Fwlib\Util\FileSystem::getFileSize()
151		* @param string $file
152		* @return long
153		*/
154		function FileSize1 ($file) {
155		if (is_link($file))
156		$s = lstat($file);
157		else
158		$s = stat($file);
159		if (-1 == $s['blksize'])
160		$size = $s['size'];
161		else
162		$size = $s['blksize'] * $s['blocks'] / 8;
163		return($size);
164		} // end of func FileSize1
165
166
167		/**
168		* Get/gen a filename to write as a new file.
169		*
170		* Before write, there is a filename, but if file exists,
171		* need plus -1, -2, -nnn at end of filename but before file extention,
172		* this func will do this job and return suitable filename.
173		*
174		* Will remove special chars in filename.
175		*
176		* Can use with dir as well as regular file.
177		*
178		* @deprecated Use Fwlib\Util\FileSystem::getNewFile()
179		* @param string $s_file Path to dest file.
180		* @return string
181		*/
182		function GetFilenameToWrite ($s_file) {
183		// Remove special chars in filename
184		$ar = array('?', '&', ';', '=', ':', "\\");
185		$s_file = str_replace($ar, '_', $s_file);
186		$s_file = trim($s_file);
187
188		$s_dir = DirName1($s_file) . '/';
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `DirName1()` has been deprecated with message: Use native dirname() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
189		$s_name = FileName1($s_file);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `FileName1()` has been deprecated with message: Use Fwlib\Util\FileSystem::getFileName() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
190		$s_ext = FileExt1($s_file);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `FileExt1()` has been deprecated with message: Use Fwlib\Util\FileSystem::getFileExt() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
191
192		// Auto skip exists file, no overwrite.(-1, -2...-9, -10, -11.ext)
193		$i = 1;
194		while (file_exists($s_file)) {
195		$s_file = $s_dir . $s_name;
196		$s_file .= '-' . strval($i++);
197		if (!empty($s_ext))
198		$s_file .= '.' . $s_ext;
199		}
200
201		return $s_file;
202		} // end of func GetFilenameToWrite
203
204
205		/**
206		* List files and file-information of a directory
207		* By default, sort files by mtime asc
208		* Returned array is started from 1
209		*
210		* @deprecated Use Fwlib\Util\FileSystem::listDir()
211		* @param string $dir
212		* @return array
213		*/
214		function ListDir ($dir) {
215		//List files
216		$dir = realpath($dir);
217		if (empty($dir))
218		return(false);
219		if (!is_dir($dir))
220		return(false);
221		$dirfiles = scandir($dir);
222		if (empty($dirfiles))
223		return(false);
224
225		$filename=array();
226		$filemtime=array();
227		// Parallel arrays (ignore the ".", "..")
228		foreach ($dirfiles as $s)
229		{
230		if (('.' != $s) && ('..' != $s))
231		{
232		$filename[] = $s;
233		$filemtime[] = filemtime($dir . '/' . $s);
234		}
235		}
236		// Gen array
237		// Mtime maybe same, so index by name temporary
238		$ar_t = array();
239		foreach ($filename as $k => $v) {
240		$ar_t[$v] = $filemtime[$k];
241		}
242		// Sort by mtime
243		asort($ar_t, SORT_NUMERIC);
244		// Build result array, count file or dir size
245		$i = 0;
246		$files = array();
247		foreach ($ar_t as $key=>$value)
248		{
249		$i++;
250		$files[$i]['name'] = $key;
251		$files[$i]['mtime'] = $value;
252		//file or dir's size
253		//If not use pathfull, same-named file and '..' will be so bad
254		$pathfull = $dir . '/' . $key;
255		if (is_link($pathfull))
256		{
257		$files[$i]['size'] = FileSize1($pathfull);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `FileSize1()` has been deprecated with message: Use Fwlib\Util\FileSystem::getFileSize() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
258		}
259		elseif (is_dir($pathfull))
260		{
261		$files[$i]['size'] = DirSize($pathfull);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `DirSize()` has been deprecated with message: Use Fwlib\Util\FileSystem::getDirSize() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
262		}
263		else
264		{
265		$files[$i]['size'] = FileSize1($pathfull);
		0 ignored issues – show Deprecated Code introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this The function `FileSize1()` has been deprecated with message: Use Fwlib\Util\FileSystem::getFileSize() This function has been deprecated. The supplier of the file has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed from the class and what other function to use instead. Loading history...
266		}
267		}
268		// Some maintainence
269		unset($dirfiles, $filename, $filemtime, $ar_t);
270		return($files);
271		} // end of func ListDir
272
273		?>
		0 ignored issues – show Best Practice introduced 2016-06-01 06:17 UTC by Report Bug Copy Issue Report Show Similar Issues like this It is not recommended to use PHP's closing tag `?>` in files other than templates. Using a closing tag in PHP files that only contain PHP code is not recommended as you might accidentally add whitespace after the closing tag which would then be output by PHP. This can cause severe problems, for example headers cannot be sent anymore. A simple precaution is to leave off the closing tag as it is not required, and it also has no negative effects whatsoever. Loading history...
274

fwolf / fwlib

Issues (1752)

Security Analysis not enabled

func/filesystem.php (15 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like