This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Upgrade object for upgrades that need to be tracked |
||
4 | * and listed in the admin area. |
||
5 | * |
||
6 | * @todo Expand for all upgrades to be \ElggUpgrade subclasses. |
||
7 | */ |
||
8 | |||
9 | /** |
||
10 | * Represents an upgrade that runs outside of the upgrade.php script. |
||
11 | * These are listed in admin/upgrades and allow for ajax upgrades. |
||
12 | * |
||
13 | * @note The "upgrade_url" private setting originally stored the full URL, but |
||
14 | * was changed to hold the relative path from the site URL for #6838 |
||
15 | * |
||
16 | * @package Elgg.Admin |
||
17 | * @access private |
||
18 | */ |
||
19 | class ElggUpgrade extends \ElggObject { |
||
20 | private $requiredProperties = array( |
||
21 | 'title', |
||
22 | 'description', |
||
23 | 'upgrade_url', |
||
24 | ); |
||
25 | |||
26 | /** |
||
27 | * Do not use. |
||
28 | * |
||
29 | * @access private |
||
30 | * @var callable |
||
31 | */ |
||
32 | public $_callable_egefps = 'elgg_get_entities_from_private_settings'; |
||
33 | |||
34 | /** |
||
35 | * Set subtype to upgrade |
||
36 | * |
||
37 | * @return null |
||
38 | */ |
||
39 | 9 | public function initializeAttributes() { |
|
40 | 9 | parent::initializeAttributes(); |
|
41 | |||
42 | 9 | $this->attributes['subtype'] = 'elgg_upgrade'; |
|
43 | |||
44 | // unowned |
||
45 | 9 | $this->attributes['site_guid'] = 0; |
|
46 | 9 | $this->attributes['container_guid'] = 0; |
|
47 | 9 | $this->attributes['owner_guid'] = 0; |
|
48 | |||
49 | 9 | $this->is_completed = 0; |
|
50 | 9 | } |
|
51 | |||
52 | /** |
||
53 | * Mark this upgrade as completed |
||
54 | * |
||
55 | * @return bool |
||
56 | */ |
||
57 | public function setCompleted() { |
||
58 | $this->setCompletedTime(); |
||
59 | return $this->is_completed = true; |
||
60 | } |
||
61 | |||
62 | /** |
||
63 | * Has this upgrade completed? |
||
64 | * |
||
65 | * @return bool |
||
66 | */ |
||
67 | public function isCompleted() { |
||
68 | return (bool) $this->is_completed; |
||
69 | } |
||
70 | |||
71 | /** |
||
72 | * Sets an upgrade URL path |
||
73 | * |
||
74 | * @param string $path Set the URL path (without site URL) for the upgrade page |
||
75 | * @return void |
||
76 | * @throws InvalidArgumentException |
||
77 | */ |
||
78 | 5 | public function setPath($path) { |
|
79 | 5 | if (!$path) { |
|
80 | 1 | throw new InvalidArgumentException('Invalid value for URL path.'); |
|
81 | } |
||
82 | |||
83 | 4 | $path = ltrim($path, '/'); |
|
84 | |||
85 | 4 | if ($this->getUpgradeFromPath($path)) { |
|
86 | 1 | throw new InvalidArgumentException('Upgrade URL paths must be unique.'); |
|
87 | } |
||
88 | |||
89 | 3 | $this->upgrade_url = $path; |
|
90 | 3 | } |
|
91 | |||
92 | /** |
||
93 | * Returns a normalized URL for the upgrade page. |
||
94 | * |
||
95 | * @return string |
||
96 | */ |
||
97 | 1 | public function getURL() { |
|
98 | 1 | return elgg_normalize_url($this->upgrade_url); |
|
99 | } |
||
100 | |||
101 | /** |
||
102 | * Sets the timestamp for when the upgrade completed. |
||
103 | * |
||
104 | * @param int $time Timestamp when upgrade finished. Defaults to now. |
||
105 | * @return bool |
||
106 | */ |
||
107 | public function setCompletedTime($time = null) { |
||
108 | if (!$time) { |
||
0 ignored issues
–
show
|
|||
109 | $time = time(); |
||
110 | } |
||
111 | |||
112 | return $this->completed_time = $time; |
||
113 | } |
||
114 | |||
115 | /** |
||
116 | * Gets the time when the upgrade completed. |
||
117 | * |
||
118 | * @return string |
||
119 | */ |
||
120 | public function getCompletedTime() { |
||
121 | return $this->completed_time; |
||
122 | } |
||
123 | |||
124 | /** |
||
125 | * Require an upgrade page. |
||
126 | * |
||
127 | * @return mixed |
||
128 | * @throws UnexpectedValueException |
||
129 | */ |
||
130 | 3 | public function save() { |
|
131 | 3 | foreach ($this->requiredProperties as $prop) { |
|
132 | 3 | if (!$this->$prop) { |
|
133 | 3 | throw new UnexpectedValueException("ElggUpgrade objects must have a value for the $prop property."); |
|
134 | } |
||
135 | 2 | } |
|
136 | |||
137 | return parent::save(); |
||
0 ignored issues
–
show
|
|||
138 | } |
||
139 | |||
140 | /** |
||
141 | * Set a value as private setting or attribute. |
||
142 | * |
||
143 | * Attributes include title and description. |
||
144 | * |
||
145 | * @param string $name Name of the attribute or private_setting |
||
146 | * @param mixed $value Value to be set |
||
147 | * @return void |
||
148 | */ |
||
149 | 9 | public function __set($name, $value) { |
|
150 | 9 | if (array_key_exists($name, $this->attributes)) { |
|
151 | 3 | parent::__set($name, $value); |
|
152 | 3 | } else { |
|
153 | 9 | $this->setPrivateSetting($name, $value); |
|
154 | } |
||
155 | 9 | } |
|
156 | |||
157 | /** |
||
158 | * Get an attribute or private setting value |
||
159 | * |
||
160 | * @param string $name Name of the attribute or private setting |
||
161 | * @return mixed |
||
162 | */ |
||
163 | 9 | public function __get($name) { |
|
164 | // See if its in our base attribute |
||
165 | 9 | if (array_key_exists($name, $this->attributes)) { |
|
166 | 9 | return parent::__get($name); |
|
167 | } |
||
168 | |||
169 | 3 | return $this->getPrivateSetting($name); |
|
170 | } |
||
171 | |||
172 | /** |
||
173 | * Find an ElggUpgrade object by the unique URL path |
||
174 | * |
||
175 | * @param string $path The Upgrade URL path (after site URL) |
||
176 | * @return ElggUpgrade|false |
||
177 | */ |
||
178 | 6 | public function getUpgradeFromPath($path) { |
|
179 | 6 | $path = ltrim($path, '/'); |
|
180 | |||
181 | 6 | if (!$path) { |
|
182 | return false; |
||
183 | } |
||
184 | |||
185 | // test for full URL values (used at 1.9.0) |
||
186 | $options = array( |
||
187 | 6 | 'type' => 'object', |
|
188 | 6 | 'subtype' => 'elgg_upgrade', |
|
189 | 6 | 'private_setting_name' => 'upgrade_url', |
|
190 | 6 | 'private_setting_value' => elgg_normalize_url($path), |
|
191 | 6 | ); |
|
192 | 6 | $upgrades = call_user_func($this->_callable_egefps, $options); |
|
193 | /* @var ElggUpgrade[] $upgrades */ |
||
194 | |||
195 | 6 | if ($upgrades) { |
|
0 ignored issues
–
show
The expression
$upgrades of type ElggUpgrade[] is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using ![]() |
|||
196 | // replace URL with path (we can't use setPath due to recursion) |
||
197 | 2 | $upgrades[0]->upgrade_url = $path; |
|
198 | 5 | return $upgrades[0]; |
|
199 | } |
||
200 | |||
201 | 4 | $options['private_setting_value'] = $path; |
|
202 | 4 | $upgrades = call_user_func($this->_callable_egefps, $options); |
|
203 | |||
204 | 4 | if ($upgrades) { |
|
205 | 1 | return $upgrades[0]; |
|
206 | } |
||
207 | |||
208 | 3 | return false; |
|
209 | } |
||
210 | } |
In PHP, under loose comparison (like
==
, or!=
, orswitch
conditions), values of different types might be equal.For
integer
values, zero is a special case, in particular the following results might be unexpected: