This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Elgg profile plugin |
||
4 | * |
||
5 | * @package ElggProfile |
||
6 | */ |
||
7 | |||
8 | elgg_register_event_handler('init', 'system', 'profile_init', 1); |
||
9 | |||
10 | // Metadata on users needs to be independent |
||
11 | // outside of init so it happens earlier in boot. See #3316 |
||
12 | register_metadata_as_independent('user'); |
||
13 | |||
14 | /** |
||
15 | * Profile init function |
||
16 | */ |
||
17 | function profile_init() { |
||
18 | |||
19 | // Register a URL handler for users |
||
20 | elgg_register_plugin_hook_handler('entity:url', 'user', 'profile_set_url'); |
||
21 | |||
22 | elgg_register_plugin_hook_handler('entity:icon:url', 'user', 'profile_set_icon_url'); |
||
23 | elgg_unregister_plugin_hook_handler('entity:icon:url', 'user', 'user_avatar_hook'); |
||
24 | |||
25 | |||
26 | elgg_register_simplecache_view('icon/user/default/tiny'); |
||
27 | elgg_register_simplecache_view('icon/user/default/topbar'); |
||
28 | elgg_register_simplecache_view('icon/user/default/small'); |
||
29 | elgg_register_simplecache_view('icon/user/default/medium'); |
||
30 | elgg_register_simplecache_view('icon/user/default/large'); |
||
31 | elgg_register_simplecache_view('icon/user/default/master'); |
||
32 | |||
33 | elgg_register_page_handler('profile', 'profile_page_handler'); |
||
34 | |||
35 | elgg_extend_view('css/elgg', 'profile/css'); |
||
36 | elgg_extend_view('js/elgg', 'profile/js'); |
||
37 | |||
38 | // allow ECML in parts of the profile |
||
39 | elgg_register_plugin_hook_handler('get_views', 'ecml', 'profile_ecml_views_hook'); |
||
40 | |||
41 | // allow admins to set default widgets for users on profiles |
||
42 | elgg_register_plugin_hook_handler('get_list', 'default_widgets', 'profile_default_widgets_hook'); |
||
43 | |||
44 | elgg_register_event_handler('pagesetup', 'system', 'profile_pagesetup', 50); |
||
45 | } |
||
46 | |||
47 | /** |
||
48 | * Profile page handler |
||
49 | * |
||
50 | * @param array $page Array of URL segments passed by the page handling mechanism |
||
51 | * @return bool |
||
52 | */ |
||
53 | function profile_page_handler($page) { |
||
54 | |||
55 | View Code Duplication | if (isset($page[0])) { |
|
56 | $username = $page[0]; |
||
57 | $user = get_user_by_username($username); |
||
58 | elgg_set_page_owner_guid($user->guid); |
||
59 | } elseif (elgg_is_logged_in()) { |
||
60 | forward(elgg_get_logged_in_user_entity()->getURL()); |
||
61 | } |
||
62 | |||
63 | // short circuit if invalid or banned username |
||
64 | View Code Duplication | if (!$user || ($user->isBanned() && !elgg_is_admin_logged_in())) { |
|
0 ignored issues
–
show
|
|||
65 | register_error(elgg_echo('profile:notfound')); |
||
66 | forward(); |
||
67 | } |
||
68 | |||
69 | $action = NULL; |
||
70 | if (isset($page[1])) { |
||
71 | $action = $page[1]; |
||
72 | } |
||
73 | |||
74 | if ($action == 'edit') { |
||
75 | // use the core profile edit page |
||
76 | $base_dir = elgg_get_root_path(); |
||
77 | require "{$base_dir}pages/profile/edit.php"; |
||
78 | return true; |
||
79 | } |
||
80 | |||
81 | $content = elgg_view('profile/layout', array('entity' => $user)); |
||
82 | $body = elgg_view_layout('one_column', array( |
||
83 | 'content' => $content |
||
84 | )); |
||
85 | echo elgg_view_page($user->name, $body); |
||
86 | return true; |
||
87 | } |
||
88 | |||
89 | /** |
||
90 | * Profile URL generator for $user->getUrl(); |
||
91 | * |
||
92 | * @param string $hook |
||
93 | * @param string $type |
||
94 | * @param string $url |
||
95 | * @param array $params |
||
96 | * @return string |
||
97 | */ |
||
98 | function profile_set_url($hook, $type, $url, $params) { |
||
99 | $user = $params['entity']; |
||
100 | return "profile/" . $user->username; |
||
101 | } |
||
102 | |||
103 | /** |
||
104 | * Use a URL for avatars that avoids loading Elgg engine for better performance |
||
105 | * |
||
106 | * @param string $hook |
||
107 | * @param string $type |
||
108 | * @param string $url |
||
109 | * @param array $params |
||
110 | * @return string |
||
111 | */ |
||
112 | function profile_set_icon_url($hook, $type, $url, $params) { |
||
113 | |||
114 | // if someone already set this, quit |
||
115 | if ($url) { |
||
116 | return; |
||
117 | } |
||
118 | |||
119 | $user = $params['entity']; |
||
120 | $size = $params['size']; |
||
121 | |||
122 | $user_guid = $user->getGUID(); |
||
123 | $icon_time = $user->icontime; |
||
124 | |||
125 | if (!$icon_time) { |
||
126 | return "_graphics/icons/user/default{$size}.gif"; |
||
127 | } |
||
128 | |||
129 | $filehandler = new ElggFile(); |
||
130 | $filehandler->owner_guid = $user_guid; |
||
131 | $filehandler->setFilename("profile/{$user_guid}{$size}.jpg"); |
||
132 | |||
133 | try { |
||
134 | if ($filehandler->exists()) { |
||
135 | $join_date = $user->getTimeCreated(); |
||
136 | return "mod/profile/icondirect.php?lastcache=$icon_time&joindate=$join_date&guid=$user_guid&size=$size"; |
||
137 | } |
||
138 | } catch (InvalidParameterException $e) { |
||
139 | elgg_log("Unable to get profile icon for user with GUID $user_guid", 'ERROR'); |
||
140 | return "_graphics/icons/default/$size.png"; |
||
141 | } |
||
142 | } |
||
143 | |||
144 | /** |
||
145 | * Parse ECML on parts of the profile |
||
146 | * |
||
147 | * @param string $hook |
||
148 | * @param string $entity_type |
||
149 | * @param array $return_value |
||
150 | * @return array |
||
151 | */ |
||
152 | function profile_ecml_views_hook($hook, $entity_type, $return_value) { |
||
153 | $return_value['profile/profile_content'] = elgg_echo('profile'); |
||
154 | |||
155 | return $return_value; |
||
156 | } |
||
157 | |||
158 | /** |
||
159 | * Register profile widgets with default widgets |
||
160 | * |
||
161 | * @param string $hook |
||
162 | * @param string $type |
||
163 | * @param array $return |
||
164 | * @return array |
||
165 | */ |
||
166 | View Code Duplication | function profile_default_widgets_hook($hook, $type, $return) { |
|
167 | $return[] = array( |
||
168 | 'name' => elgg_echo('profile'), |
||
169 | 'widget_context' => 'profile', |
||
170 | 'widget_columns' => 3, |
||
171 | |||
172 | 'event' => 'create', |
||
173 | 'entity_type' => 'user', |
||
174 | 'entity_subtype' => ELGG_ENTITIES_ANY_VALUE, |
||
175 | ); |
||
176 | |||
177 | return $return; |
||
178 | } |
||
179 | |||
180 | /** |
||
181 | * Sets up user-related menu items |
||
182 | * |
||
183 | * @return void |
||
184 | * @access private |
||
185 | */ |
||
186 | function profile_pagesetup() { |
||
187 | $viewer = elgg_get_logged_in_user_entity(); |
||
188 | if (!$viewer) { |
||
189 | return; |
||
190 | } |
||
191 | |||
192 | elgg_register_menu_item('topbar', array( |
||
193 | 'name' => 'profile', |
||
194 | 'href' => $viewer->getURL(), |
||
195 | 'text' => elgg_view('output/img', array( |
||
196 | 'src' => $viewer->getIconURL('topbar'), |
||
197 | 'alt' => $viewer->name, |
||
198 | 'title' => elgg_echo('profile'), |
||
199 | 'class' => 'elgg-border-plain elgg-transition', |
||
200 | )), |
||
201 | 'priority' => 100, |
||
202 | 'link_class' => 'elgg-topbar-avatar', |
||
203 | 'item_class' => 'elgg-avatar elgg-avatar-topbar', |
||
204 | )); |
||
205 | } |
||
206 |
If you define a variable conditionally, it can happen that it is not defined for all execution paths.
Let’s take a look at an example:
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.
Available Fixes
Check for existence of the variable explicitly:
Define a default value for the variable:
Add a value for the missing path: