Issues (2473)

Branch: master

Security Analysis    no vulnerabilities found

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

engine/classes/Elgg/Logger.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
namespace Elgg;
3
4
/**
5
 * WARNING: API IN FLUX. DO NOT USE DIRECTLY.
6
 *
7
 * Use the elgg_* versions instead.
8
 *
9
 * @access private
10
 *
11
 * @package    Elgg.Core
12
 * @subpackage Logging
13
 * @since      1.9.0
14
 */
15
class Logger {
16
17
	const OFF = 0;
18
	const ERROR = 400;
19
	const WARNING = 300;
20
	const NOTICE = 250;
21
	const INFO = 200;
22
23
	protected static $levels = array(
24
		0 => 'OFF',
25
		200 => 'INFO',
26
		250 => 'NOTICE',
27
		300 => 'WARNING',
28
		400 => 'ERROR',
29
	);
30
31
	/** @var int $level The logging level */
32
	protected $level = self::ERROR;
33
34
	/** @var bool $display Display to user? */
35
	protected $display = false;
36
37
	/** @var \Elgg\PluginHooksService $hooks */
38
	protected $hooks;
39
40
	/** @var \stdClass Global Elgg configuration */
41
	private $CONFIG;
42
43
	/**
44
	 * Constructor
45
	 *
46
	 * @param \Elgg\PluginHooksService $hooks Hooks service
47
	 */
48 10
	public function __construct(\Elgg\PluginHooksService $hooks) {
49 10
		global $CONFIG;
50
		
51 10
		$this->CONFIG = $CONFIG;
52 10
		$this->hooks = $hooks;
53 10
	}
54
55
	/**
56
	 * Set the logging level
57
	 *
58
	 * @param int $level The logging level
59
	 * @return void
60
	 */
61 2
	public function setLevel($level) {
62
		// @todo Elgg has used string constants for logging levels
63 2
		if (is_string($level)) {
64
			$levelStringsToInts = array_flip(self::$levels);
65
			$level = $levelStringsToInts[$level];
66
		}
67 2
		$this->level = $level;
68 2
	}
69
70
	/**
71
	 * Get the current logging level
72
	 * 
73
	 * @return int
74
	 */
75 1
	public function getLevel() {
76 1
		return $this->level;
77
	}
78
79
	/**
80
	 * Set whether the logging should be displayed to the user
81
	 *
82
	 * Whether data is actually displayed to the user depends on this setting
83
	 * and other factors such as whether we are generating a JavaScript or CSS
84
	 * file.
85
	 *
86
	 * @param bool $display Whether to display logging
87
	 * @return void
88
	 */
89
	public function setDisplay($display) {
90
		$this->display = $display;
91
	}
92
93
	/**
94
	 * Add a message to the log
95
	 *
96
	 * @param string $message The message to log
97
	 * @param int    $level   The logging level
98
	 * @return bool Whether the messages was logged
99
	 */
100 4
	public function log($message, $level = self::NOTICE) {
101 4
		if ($this->level == self::OFF || $level < $this->level) {
102 4
			return false;
103
		}
104
105 1
		if (!array_key_exists($level, self::$levels)) {
106
			return false;
107
		}
108
109 1
		$levelString = self::$levels[$level];
110
111
		// notices and below never displayed to user
112 1
		$display = $this->display && $level > self::NOTICE;
113
114 1
		$this->process("$levelString: $message", $display, $level);
115
116 1
		return true;
117
	}
118
119
	/**
120
	 * Log message at the ERROR level
121
	 *
122
	 * @param string $message The message to log
123
	 * @return bool
124
	 */
125
	public function error($message) {
126
		return $this->log($message, self::ERROR);
127
	}
128
129
	/**
130
	 * Log message at the WARNING level
131
	 *
132
	 * @param string $message The message to log
133
	 * @return bool
134
	 */
135
	public function warn($message) {
136
		return $this->log($message, self::WARNING);
137
	}
138
139
	/**
140
	 * Log message at the NOTICE level
141
	 *
142
	 * @param string $message The message to log
143
	 * @return bool
144
	 */
145
	public function notice($message) {
146
		return $this->log($message, self::NOTICE);
147
	}
148
149
	/**
150
	 * Log message at the INFO level
151
	 *
152
	 * @param string $message The message to log
153
	 * @return bool
154
	 */
155
	public function info($message) {
156
		return $this->log($message, self::INFO);
157
	}
158
159
	/**
160
	 * Dump data to log or screen
161
	 *
162
	 * @param mixed $data    The data to log
163
	 * @param bool  $display Whether to include this in the HTML page
164
	 * @return void
165
	 */
166
	public function dump($data, $display = true) {
167
		$this->process($data, $display, self::ERROR);
168
	}
169
170
	/**
171
	 * Process logging data
172
	 *
173
	 * @param mixed $data    The data to process
174
	 * @param bool  $display Whether to display the data to the user. Otherwise log it.
175
	 * @param int   $level   The logging level for this data
176
	 * @return void
177
	 */
178 1
	protected function process($data, $display, $level) {
179
		
180
181
		// plugin can return false to stop the default logging method
182
		$params = array(
183 1
			'level' => $level,
184 1
			'msg' => $data,
185 1
			'display' => $display,
186 1
			'to_screen' => $display,
187 1
		);
188
189 1
		if (!$this->hooks->trigger('debug', 'log', $params, true)) {
190
			return;
191
		}
192
193
		// Do not want to write to screen before page creation has started.
194
		// This is not fool-proof but probably fixes 95% of the cases when logging
195
		// results in data sent to the browser before the page is begun.
196 1
		if (!isset($this->CONFIG->pagesetupdone)) {
197 1
			$display = false;
198 1
		}
199
200
		// Do not want to write to JS or CSS pages
201 1
		if (elgg_in_context('js') || elgg_in_context('css')) {
202
			$display = false;
203
		}
204
205
		// don't display in simplecache requests
206 1
		$path = substr(current_page_url(), strlen(elgg_get_site_url()));
207 1
		if (preg_match('~^(cache|action)/~', $path)) {
208
			$display = false;
209
		}
210
211 1
		if ($display == true) {
0 ignored issues
show
Coding Style Best Practice introduced by
It seems like you are loosely comparing two booleans. Considering using the strict comparison === instead.

When comparing two booleans, it is generally considered safer to use the strict comparison operator.

Loading history...
212
			echo '<pre class="elgg-logger-data">';
213
			echo htmlspecialchars(print_r($data, true), ENT_QUOTES, 'UTF-8');
214
			echo '</pre>';
215
		} else {
216 1
			error_log(print_r($data, true));
217
		}
218 1
	}
219
}
220
221