Issues (2473)

Branch: master

Security Analysis    no vulnerabilities found

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

engine/classes/ElggObject.php (10 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Elgg Object
4
 *
5
 * Elgg objects are the most common means of storing information in the database.
6
 * They are a child class of \ElggEntity, so receive all the benefits of the Entities,
7
 * but also include a title and description field.
8
 *
9
 * An \ElggObject represents a row from the objects_entity table, as well
10
 * as the related row in the entities table as represented by the parent
11
 * \ElggEntity object.
12
 *
13
 * @note Internal: Title and description are stored in the objects_entity table.
14
 *
15
 * @package    Elgg.Core
16
 * @subpackage DataModel.Object
17
 * 
18
 * @property string $title       The title, name, or summary of this object
19
 * @property string $description The body, description, or content of the object
20
 * @property array  $tags        Tags that describe the object (metadata)
21
 */
22
class ElggObject extends \ElggEntity {
23
24
	/**
25
	 * Initialize the attributes array to include the type,
26
	 * title, and description.
27
	 *
28
	 * @return void
29
	 */
30 15 View Code Duplication
	protected function initializeAttributes() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
31 15
		parent::initializeAttributes();
32
33 15
		$this->attributes['type'] = "object";
34 15
		$this->attributes += self::getExternalAttributes();
35 15
		$this->tables_split = 2;
36 15
	}
37
38
	/**
39
	 * Get default values for attributes stored in a separate table
40
	 *
41
	 * @return array
42
	 * @access private
43
	 *
44
	 * @see \Elgg\Database\EntityTable::getEntities
45
	 */
46 15
	final public static function getExternalAttributes() {
47
		return [
48 15
			'title' => null,
49 15
			'description' => null,
50 15
		];
51
	}
52
53
	/**
54
	 * Create a new \ElggObject.
55
	 *
56
	 * Plugin developers should only use the constructor to create a new entity.
57
	 * To retrieve entities, use get_entity() and the elgg_get_entities* functions.
58
	 *
59
	 * If no arguments are passed, it creates a new entity.
60
	 * If a database result is passed as a \stdClass instance, it instantiates
61
	 * that entity.
62
	 *
63
	 * @param \stdClass $row Database row result. Default is null to create a new object.
64
	 *
65
	 * @throws IOException If cannot load remaining data from db
66
	 * @throws InvalidParameterException If not passed a db row result
67
	 */
68 15 View Code Duplication
	public function __construct($row = null) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
69 15
		$this->initializeAttributes();
70
71
		// compatibility for 1.7 api.
72 15
		$this->initialise_attributes(false);
0 ignored issues
show
Deprecated Code introduced by
The method ElggData::initialise_attributes() has been deprecated with message: 1.8 Use initializeAttributes()

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
73
74 15
		if (!empty($row)) {
75
			// Is $row is a DB row from the entity table
76
			if ($row instanceof \stdClass) {
77
				// Load the rest
78
				if (!$this->load($row)) {
79
					$msg = "Failed to load new " . get_class() . " for GUID: " . $row->guid;
80
					throw new \IOException($msg);
81
				}
82
			} else if ($row instanceof \ElggObject) {
83
				// $row is an \ElggObject so this is a copy constructor
84
				elgg_deprecated_notice('This type of usage of the \ElggObject constructor was deprecated. Please use the clone method.', 1.7);
85
				foreach ($row->attributes as $key => $value) {
86
					$this->attributes[$key] = $value;
87
				}
88
			} else if (is_numeric($row)) {
89
				// $row is a GUID so load
90
				elgg_deprecated_notice('Passing a GUID to constructor is deprecated. Use get_entity()', 1.9);
91
				if (!$this->load($row)) {
92
					throw new \IOException("Failed to load new " . get_class() . " from GUID:" . $row);
93
				}
94
			} else {
95
				throw new \InvalidParameterException("Unrecognized value passed to constuctor.");
96
			}
97
		}
98 15
	}
99
100
	/**
101
	 * Loads the full \ElggObject when given a guid.
102
	 *
103
	 * @param mixed $guid GUID of an \ElggObject or the \stdClass object from entities table
104
	 *
105
	 * @return bool
106
	 * @throws InvalidClassException
107
	 */
108 15 View Code Duplication
	protected function load($guid) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
109 15
		$attr_loader = new \Elgg\AttributeLoader(get_class(), 'object', $this->attributes);
110 15
		$attr_loader->requires_access_control = !($this instanceof \ElggPlugin);
111
		$attr_loader->secondary_loader = 'get_object_entity_as_row';
112
113
		$attrs = $attr_loader->getRequiredAttributes($guid);
114
		if (!$attrs) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $attrs of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.

This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.

Consider making the comparison explicit by using empty(..) or ! empty(...) instead.

Loading history...
115
			return false;
116
		}
117
118
		$this->attributes = $attrs;
119
		$this->tables_loaded = 2;
120
		$this->loadAdditionalSelectValues($attr_loader->getAdditionalSelectValues());
121
		_elgg_cache_entity($this);
122
123
		return true;
124
	}
125
126
	/**
127
	 * {@inheritdoc}
128
	 */
129 View Code Duplication
	protected function create() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
130
		global $CONFIG;
131
132
		$guid = parent::create();
133
		if (!$guid) {
134
			// @todo this probably means permission to create entity was denied
135
			// Is returning false the correct thing to do
136
			return false;
137
		}
138
		$title = sanitize_string($this->title);
139
		$description = sanitize_string($this->description);
140
		
141
		$query = "INSERT into {$CONFIG->dbprefix}objects_entity
142
			(guid, title, description) values ($guid, '$title', '$description')";
143
144
		$result = $this->getDatabase()->insertData($query);
145
		if ($result === false) {
146
			// TODO(evan): Throw an exception here?
147
			return false;
148
		}
149
150
		$this->enable();
151
		return $guid;
152
	}
153
154
	/**
155
	 * {@inheritdoc}
156
	 */
157 View Code Duplication
	protected function update() {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
158
		global $CONFIG;
159
160
		if (!parent::update()) {
161
			return false;
162
		}
163
		
164
		$guid = (int)$this->guid;
165
		$title = sanitize_string($this->title);
166
		$description = sanitize_string($this->description);
167
168
		$query = "UPDATE {$CONFIG->dbprefix}objects_entity
169
			set title='$title', description='$description' where guid=$guid";
170
171
		return $this->getDatabase()->updateData($query) !== false;
172
	}
173
174
	/**
175
	 * {@inheritdoc}
176
	 */
177
	public function getDisplayName() {
178
		return $this->title;
179
	}
180
181
	/**
182
	 * {@inheritdoc}
183
	 */
184
	public function setDisplayName($displayName) {
185
		$this->title = $displayName;
186
	}
187
188
	/**
189
	 * Return sites that this object is a member of
190
	 *
191
	 * Site membership is determined by relationships and not site_guid.
192
	 *
193
	 * @todo Moved to \ElggEntity so remove this in 2.0
194
	 *
195
	 * @param array $options Options array. Used to be $subtype
196
	 * @param int   $limit   The number of results to return (deprecated)
197
	 * @param int   $offset  Any indexing offset (deprecated)
198
	 *
199
	 * @return array
200
	 */
201 View Code Duplication
	public function getSites($options = "", $limit = 10, $offset = 0) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
202
		if (is_string($options)) {
203
			elgg_deprecated_notice('\ElggObject::getSites() takes an options array', 1.9);
204
			return get_site_objects($this->getGUID(), $options, $limit, $offset);
205
		}
206
207
		return parent::getSites();
208
	}
209
210
	/**
211
	 * Add this object to a site
212
	 *
213
	 * @param \ElggSite $site The site to add this object to. This used to be the
214
	 *                       the site guid (still supported by deprecated)
215
	 * @return bool
216
	 */
217 View Code Duplication
	public function addToSite($site) {
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
218
		if (is_numeric($site)) {
219
			elgg_deprecated_notice('\ElggObject::addToSite() takes a site entity', 1.9);
220
			return add_site_object($site, $this->getGUID());
221
		}
222
223
		return parent::addToSite($site);
224
	}
225
226
	/**
227
	 * {@inheritdoc}
228
	 */
229
	protected function prepareObject($object) {
230
		$object = parent::prepareObject($object);
231
		$object->title = $this->getDisplayName();
232
		$object->description = $this->description;
233
		$object->tags = $this->tags ? $this->tags : array();
234
		return $object;
235
	}
236
237
	/*
238
	 * EXPORTABLE INTERFACE
239
	 */
240
241
	/**
242
	 * Return an array of fields which can be exported.
243
	 *
244
	 * @return array
245
	 * @deprecated 1.9 Use toObject()
246
	 */
247
	public function getExportableValues() {
248
		return array_merge(parent::getExportableValues(), array(
0 ignored issues
show
Deprecated Code introduced by
The method ElggEntity::getExportableValues() has been deprecated with message: 1.9 Use toObject()

This method has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.

Loading history...
249
			'title',
250
			'description',
251
		));
252
	}
253
254
	/**
255
	 * Can a user comment on this object?
256
	 *
257
	 * @see \ElggEntity::canComment()
258
	 *
259
	 * @param int $user_guid User guid (default is logged in user)
260
	 * @return bool
261
	 * @since 1.8.0
262
	 */
263
	public function canComment($user_guid = 0) {
264
		$result = parent::canComment($user_guid);
265
		if ($result !== null) {
266
			return $result;
267
		}
268
269
		if ($user_guid == 0) {
270
			$user_guid = _elgg_services()->session->getLoggedInUserGuid();
271
		}
272
273
		// must be logged in to comment
274
		if (!$user_guid) {
275
			return false;
276
		}
277
278
		// must be member of group
279
		if (elgg_instanceof($this->getContainerEntity(), 'group')) {
280
			if (!$this->getContainerEntity()->canWriteToContainer($user_guid)) {
281
				return false;
282
			}
283
		}
284
285
		// no checks on read access since a user cannot see entities outside his access
286
		return true;
287
	}
288
}
289