Issues (314)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Files/Classes/ClassHandlerFiles.php (2 issues)

1
<?php
2
3
namespace XoopsModules\Modulebuilder\Files\Classes;
4
5
use XoopsModules\Modulebuilder;
6
use XoopsModules\Modulebuilder\Files;
7
8
/*
9
 You may not change or alter any portion of this comment or credits
10
 of supporting developers from this source code or any supporting source code
11
 which is considered copyrighted (c) material of the original comment or credit authors.
12
13
 This program is distributed in the hope that it will be useful,
14
 but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
16
 */
17
/**
18
 * tc module.
19
 *
20
 * @copyright       XOOPS Project (https://xoops.org)
21
 * @license         GNU GPL 2 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
22
 *
23
 * @since           2.5.0
24
 *
25
 * @author          Txmod Xoops https://xoops.org 
26
 *                  Goffy https://myxoops.org
27
 *
28
 */
29
30
/**
31
 * Class ClassHandlerFiles.
32
 */
33
class ClassHandlerFiles extends Files\CreateFile
34
{
35
    /**
36
     * @var mixed
37
     */
38
    private $xc = null;
39
    /**
40
     * @var mixed
41
     */
42
    private $pc = null;
43
    /**
44
     * @var mixed
45
     */
46
    private $helper = null;
47
48
    /**
49
     * @public function constructor
50
     * @param null
51
     */
52
    public function __construct()
53
    {
54
        parent::__construct();
55
        $this->xc     = Modulebuilder\Files\CreateXoopsCode::getInstance();
56
        $this->pc     = Modulebuilder\Files\CreatePhpCode::getInstance();
57
        $this->helper = Modulebuilder\Helper::getInstance();
58
    }
59
60
    /**
61
     * @static function getInstance
62
     *
63
     * @return bool|ClassHandlerFiles
64
     */
65
    public static function getInstance()
66
    {
67
        static $instance = false;
68
        if (!$instance) {
69
            $instance = new self();
70
        }
71
72
        return $instance;
73
    }
74
75
    /**
76
     * @public function write
77
     *
78
     * @param string $module
79
     * @param string $table
80
     * @param mixed  $tables
81
     * @param        $filename
82
     */
83
    public function write($module, $table, $tables, $filename)
84
    {
85
        $this->setModule($module);
86
        $this->setTable($table);
87
        $this->setTables($tables);
88
        $this->setFileName($filename);
89
    }
90
91
    /**
92
     * @public function getClassHandler
93
     *
94
     * @param string $moduleDirname
95
     * @param string $table
96
     * @param string $fieldId
97
     * @param        $fieldName
98
     * @param string $fieldMain
99
     * @param        $fieldParentId
100
     * @param        $fieldElement
101
     * @return string
102
     */
103
    private function getClassObjectHandler($moduleDirname, $table, $fieldId, $fieldName, $fieldMain, $fieldParentId, $fieldElement)
0 ignored issues
show
The parameter $fieldName is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

103
    private function getClassObjectHandler($moduleDirname, $table, $fieldId, /** @scrutinizer ignore-unused */ $fieldName, $fieldMain, $fieldParentId, $fieldElement)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
104
    {
105
        $tableName      = $table->getVar('table_name');
106
        $tableFieldName = $table->getVar('table_fieldname');
0 ignored issues
show
The assignment to $tableFieldName is dead and can be removed.
Loading history...
107
        $ucfTableName   = \ucfirst($tableName);
108
        $multiLineCom   = ['Class Object Handler' => $ucfTableName];
109
        $ret            = $this->pc->getPhpCodeCommentMultiLine($multiLineCom);
110
111
        $cClh   = $this->pc->getPhpCodeCommentMultiLine(['Constructor' => '', '' => '', '@param' => '\XoopsDatabase $db'], "\t");
112
        $constr = "\t\tparent::__construct(\$db, '{$moduleDirname}_{$tableName}', {$ucfTableName}::class, '{$fieldId}', '{$fieldMain}');\n";
113
114
        $cClh .= $this->pc->getPhpCodeFunction('__construct', '\XoopsDatabase $db', $constr, 'public ', false, "\t");
115
        $cClh .= $this->getClassCreate();
116
        $cClh .= $this->getClassGet();
117
        $cClh .= $this->getClassGetInsertId();
118
        $cClh .= $this->getClassCounter($tableName, $fieldId, $fieldMain);
119
        $cClh .= $this->getClassAll($tableName, $fieldId, $fieldMain);
120
        $cClh .= $this->getClassCriteria($tableName);
121
        if ($fieldElement > 16 && \in_array(1, $fieldParentId)) {
122
            //$cClh .= $this->getClassByCategory($moduleDirname, $tableName, $tableFieldName, $fieldId, $fieldName, $fieldMain, $fieldElement);
123
            $cClh .= $this->getClassGetTableSolenameById($table, $fieldMain);
124
        }
125
126
        $ret .= $this->pc->getPhpCodeClass("{$ucfTableName}Handler", $cClh, '\XoopsPersistableObjectHandler');
127
128
        return $ret;
129
    }
130
131
    /**
132
     * @public function getClassCreate
133
     *
134
     * @return string
135
     */
136
    private function getClassCreate()
137
    {
138
        $ret   = $this->pc->getPhpCodeCommentMultiLine(['@param bool' => '$isNew', '' => '', '@return' => 'object'], "\t");
139
        $cClhc = $this->getSimpleString('return parent::create($isNew);', "\t\t");
140
141
        $ret .= $this->pc->getPhpCodeFunction('create', '$isNew = true', $cClhc, 'public ', false, "\t");
142
143
        return $ret;
144
    }
145
146
    /**
147
     * @public function getClassGet
148
     *
149
     * @return string
150
     */
151
    private function getClassGet()
152
    {
153
        $ret   = $this->pc->getPhpCodeCommentMultiLine(['retrieve a' => 'field', '' => '', '@param int' => '$i field id', '@param null' => 'fields', '@return \XoopsObject|null reference to the' => '{@link Get} object'], "\t");
154
        $cClhg = $this->getSimpleString('return parent::get($i, $fields);', "\t\t");
155
156
        $ret .= $this->pc->getPhpCodeFunction('get', '$i = null, $fields = null', $cClhg, 'public ', false, "\t");
157
158
        return $ret;
159
    }
160
161
    /**
162
     * @public function getClassGetInsertId
163
     *
164
     * @return string
165
     */
166
    private function getClassGetInsertId()
167
    {
168
        $ret     = $this->pc->getPhpCodeCommentMultiLine(['get inserted' => 'id', '' => '', '@param' => 'null', '@return int reference to the' => '{@link Get} object'], "\t");
169
        $cClhgid = $this->getSimpleString('return $this->db->getInsertId();', "\t\t");
170
171
        $ret .= $this->pc->getPhpCodeFunction('getInsertId', '', $cClhgid, 'public ', false, "\t");
172
173
        return $ret;
174
    }
175
176
    /**
177
     * @public function getClassCounter
178
     *
179
     * @param $tableName
180
     * @param $fieldId
181
     * @param $fieldMain
182
     *
183
     * @return string
184
     */
185
    private function getClassCounter($tableName, $fieldId, $fieldMain)
186
    {
187
        $ucfTableName = \ucfirst($tableName);
188
        $ret          = $this->pc->getPhpCodeCommentMultiLine(['Get Count ' . $ucfTableName => 'in the database', '@param int    $start' => '', '@param int    $limit' => '', '@param string $sort' => '', '@param string $order' => '', '@return' => 'int'], "\t");
189
190
        $critCount  = $this->xc->getXcCriteriaCompo('crCount' . $ucfTableName, "\t\t");
191
        $paramsCrit = "\$this->get{$ucfTableName}Criteria(\$crCount{$ucfTableName}, \$start, \$limit, \$sort, \$order)";
192
        $critCount  .= $this->xc->getXcEqualsOperator('$crCount' . $ucfTableName, $paramsCrit, null, "\t\t");
193
        $critCount  .= $this->getSimpleString("return \$this->getCount(\$crCount{$ucfTableName});", "\t\t");
194
        $params     = "\$start = 0, \$limit = 0, \$sort = '{$fieldId} ASC, {$fieldMain}', \$order = 'ASC'";
195
196
        $ret .= $this->pc->getPhpCodeFunction('getCount' . $ucfTableName, $params, $critCount, 'public ', false, "\t");
197
198
        return $ret;
199
    }
200
201
    /**
202
     * @public function getClassAll
203
     *
204
     * @param $tableName
205
     * @param $fieldId
206
     * @param $fieldMain
207
     *
208
     * @return string
209
     */
210
    private function getClassAll($tableName, $fieldId, $fieldMain)
211
    {
212
        $ucfTableName = \ucfirst($tableName);
213
        $ret          = $this->pc->getPhpCodeCommentMultiLine(['Get All ' . $ucfTableName => 'in the database', '@param int    $start' => '', '@param int    $limit' => '', '@param string $sort' => '', '@param string $order' => '', '@return' => 'array'], "\t");
214
215
        $critAll    = $this->xc->getXcCriteriaCompo('crAll' . $ucfTableName, "\t\t");
216
        $paramsCrit = "\$this->get{$ucfTableName}Criteria(\$crAll{$ucfTableName}, \$start, \$limit, \$sort, \$order)";
217
        $critAll    .= $this->xc->getXcEqualsOperator('$crAll' . $ucfTableName, $paramsCrit, null, "\t\t");
218
        $critAll    .= $this->getSimpleString("return \$this->getAll(\$crAll{$ucfTableName});", "\t\t");
219
        $params     = "\$start = 0, \$limit = 0, \$sort = '{$fieldId} ASC, {$fieldMain}', \$order = 'ASC'";
220
221
        $ret .= $this->pc->getPhpCodeFunction('getAll' . $ucfTableName, $params, $critAll, 'public ', false, "\t");
222
223
        return $ret;
224
    }
225
226
    /*remark from goffy: 'getClassByCategory' currently not in use*/
227
    /**
228
     * @public function getClassByCategory
229
     *
230
     * @param $moduleDirname
231
     * @param $tableName
232
     * @param $tableFieldName
233
     * @param $fieldId
234
     * @param $fieldName
235
     * @param $fieldMain
236
     * @param $fieldElement
237
     * @return string
238
     */
239
    /*
240
    private function getClassByCategory($moduleDirname, $tableName, $tableFieldName, $fieldId, $fieldName, $fieldMain, $fieldElement)
241
    {
242
        $ucfTableName      = \ucfirst($tableName);
243
        $fieldElements     = $this->helper->getHandler('Fieldelements')->get($fieldElement);
244
        $fieldElementName  = $fieldElements->getVar('fieldelement_name');
245
        $fieldNameDesc     = \ucfirst(mb_substr($fieldElementName, \mb_strrpos($fieldElementName, ':'), mb_strlen($fieldElementName)));
246
        $topicTableName    = \str_replace(': ', '', $fieldNameDesc);
247
        $lcfTopicTableName = lcfirst($topicTableName);
248
249
        $ret = $this->pc->getPhpCodeCommentMultiLine(["Get All {$ucfTableName} By" => "{$fieldNameDesc} Id", '@param int    $start' => '', '@param int    $limit' => '', '@param string $sort' => '', '@param string $order' => '', '@return' => 'array'], "\t");
250
251
        $critAll = $this->xc->getXcXoopsHandler('groupperm', "\t\t");
252
        $param1  = "'{$moduleDirname}_view'";
253
        $param2  = "\$GLOBALS['xoopsUser']->getGroups()";
254
        $param3  = "\$GLOBALS['xoopsModule']->getVar('mid')";
255
        $critAll .= $this->xc->getXcGetItemIds($lcfTopicTableName, 'grouppermHandler', $param1, $param2, $param3, "\t\t");
256
        $critAll .= $this->xc->getXcCriteriaCompo('crAll' . $ucfTableName, "\t\t");
257
258
        if (false !== mb_strpos($fieldName, 'status')) {
259
            $crit    = $this->xc->getXcCriteria('', "'{$fieldName}'", '0', "'!='", true);
260
            $critAll .= $this->xc->getXcCriteriaAdd('crAll' . $ucfTableName, $crit, "\t\t");
261
        }
262
        $paramsCritAll = "\$this->get{$ucfTableName}Criteria(\$crAll{$ucfTableName}, \$start, \$limit, \$sort, \$order)";
263
        $critAll       .= $this->xc->getXcEqualsOperator('$crAll' . $ucfTableName, $paramsCritAll, null, "\t\t");
264
265
        $critAll .= $this->getSimpleString("return \$this->getAll(\$crAll{$ucfTableName});", "\t\t");
266
        $params  = "\${$tableFieldName}Id, \$start = 0, \$limit = 0, \$sort = '{$fieldId} ASC, {$fieldMain}', \$order = 'ASC'";
267
268
        $ret .= $this->pc->getPhpCodeFunction("getAll{$ucfTableName}By{$fieldNameDesc}Id" . $ucfTableName, $params, $critAll, 'public ', false, "\t");
269
270
        return $ret;
271
272
    }
273
    */
274
275
    /**
276
     * @public function getClassCriteria
277
     *
278
     * @param $tableName
279
     * @return string
280
     */
281
    private function getClassCriteria($tableName)
282
    {
283
        $ucfTableName = \ucfirst($tableName);
284
        $ret          = $this->pc->getPhpCodeCommentMultiLine(['Get' => 'Criteria ' . $ucfTableName, '@param       ' => "\$cr{$ucfTableName}", '@param int    $start' => '', '@param int    $limit' => '', '@param string $sort' => '', '@param string $order' => '', '@return' => 'int'], "\t");
285
286
        $paramsAllCriteria = "\$cr{$ucfTableName}, \$start, \$limit, \$sort, \$order";
287
288
        $critSets = $this->xc->getXcCriteriaSetStart('cr' . $ucfTableName, '$start', "\t\t");
289
        $critSets .= $this->xc->getXcCriteriaSetLimit('cr' . $ucfTableName, '$limit', "\t\t");
290
        $critSets .= $this->xc->getXcCriteriaSetSort('cr' . $ucfTableName, '$sort', "\t\t");
291
        $critSets .= $this->xc->getXcCriteriaSetOrder('cr' . $ucfTableName, '$order', "\t\t");
292
        $critSets .= $this->getSimpleString("return \$cr{$ucfTableName};", "\t\t");
293
294
        $ret .= $this->pc->getPhpCodeFunction("get{$ucfTableName}Criteria", $paramsAllCriteria, $critSets, 'private ', false, "\t");
295
296
        return $ret;
297
    }
298
299
    /**
300
     * @public function getClassGetTableSolenameById
301
     *
302
     * @param $table
303
     * @param $fieldMain
304
     * @return string
305
     */
306
    private function getClassGetTableSolenameById($table, $fieldMain)
307
    {
308
        $tableName        = $table->getVar('table_name');
309
        $tableSoleName    = $table->getVar('table_solename');
310
        $ucfTableSoleName = \ucfirst($tableSoleName);
311
312
        $ret       = $this->pc->getPhpCodeCommentMultiLine(['Returns the' => $ucfTableSoleName . ' from id', '' => '', '@return' => 'string'], "\t");
313
        $soleName  = $this->xc->getXcEqualsOperator("\${$tableSoleName}Id", "(int)( \${$tableSoleName}Id )", null, "\t\t");
314
        $soleName  .= $this->xc->getXcEqualsOperator("\${$tableSoleName}", "''", null, "\t\t");
315
        $contentIf = $this->xc->getXcHandlerLine($tableName, "\t\t\t");
316
        $contentIf .= $this->xc->getXcHandlerGet($tableName, "{$tableSoleName}Id", 'Obj', $tableName . 'Handler', false, "\t\t\t");
317
        $getVar    = $this->xc->getXcGetVar($tableSoleName, "{$tableSoleName}Obj", $fieldMain, false, "\t\t\t\t");
318
        $contentIf .= $this->pc->getPhpCodeConditions("\is_object( \${$tableSoleName}Obj )", '', '', $getVar, false, "\t\t\t");
319
        $soleName  .= $this->pc->getPhpCodeConditions("\${$tableSoleName}Id", ' > ', '0', $contentIf, false, "\t\t");
320
        $soleName  .= $this->getSimpleString("return \${$tableSoleName};", "\t\t");
321
322
        $ret .= $this->pc->getPhpCodeFunction("get{$ucfTableSoleName}FromId", "\${$tableSoleName}Id", $soleName, 'public ', false, "\t");
323
324
        return $ret;
325
    }
326
327
    /**
328
     * @public function render
329
     * @param null
330
     *
331
     * @return bool|string
332
     */
333
    public function render()
334
    {
335
        $module         = $this->getModule();
336
        $table          = $this->getTable();
337
        $filename       = $this->getFileName();
338
        $moduleDirname  = $module->getVar('mod_dirname');
339
        $fields         = $this->getTableFields($table->getVar('table_mid'), $table->getVar('table_id'));
340
        $fieldInForm    = [];
341
        $fieldParentId  = [];
342
        $fieldElementId = [];
343
        $fieldId        = null;
344
        $fieldName      = null;
345
        $fieldMain      = null;
346
        $fieldElement   = null;
347
        foreach (\array_keys($fields) as $f) {
348
            $fieldName       = $fields[$f]->getVar('field_name');
349
            $fieldInForm[]   = $fields[$f]->getVar('field_inform');
350
            $fieldParentId[] = $fields[$f]->getVar('field_parent');
351
            if ((0 == $f) && (1 == $table->getVar('table_autoincrement'))) {
352
                $fieldId = $fieldName; // $fieldId = fields parameter index field
353
            }
354
            if (1 == $fields[$f]->getVar('field_main')) {
355
                $fieldMain = $fieldName; // $fieldMain = fields parameter main field
356
            }
357
            $fieldElement = $fields[$f]->getVar('field_element');
358
359
            $fieldElements    = $this->helper->getHandler('Fieldelements')->get($fieldElement);
360
            $fieldElementId[] = $fieldElements->getVar('fieldelement_id');
361
        }
362
        $namespace = $this->pc->getPhpCodeNamespace(['XoopsModules', $moduleDirname]);
363
        $content   = $this->getHeaderFilesComments($module, null, $namespace);
364
        $content   .= $this->pc->getPhpCodeUseNamespace(['XoopsModules', $moduleDirname]);
365
        $content   .= $this->getClassObjectHandler($moduleDirname, $table, $fieldId, $fieldName, $fieldMain, $fieldParentId, $fieldElement);
366
367
        $this->create($moduleDirname, 'class', $filename, $content, \_AM_MODULEBUILDER_FILE_CREATED, \_AM_MODULEBUILDER_FILE_NOTCREATED);
368
369
        return $this->renderFile();
370
    }
371
}
372