Issues (127)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/DirectoryHandler.php (5 issues)

1
<?php
2
3
declare(strict_types=1);
4
5
6
namespace XoopsModules\Wgfilemanager;
7
8
/*
9
 You may not change or alter any portion of this comment or credits
10
 of supporting developers from this source code or any supporting source code
11
 which is considered copyrighted (c) material of the original comment or credit authors.
12
13
 This program is distributed in the hope that it will be useful,
14
 but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
16
*/
17
18
/**
19
 * wgFileManager module for xoops
20
 *
21
 * @copyright    2021 XOOPS Project (https://xoops.org)
22
 * @license      GPL 2.0 or later
23
 * @package      wgfilemanager
24
 * @author       Goffy - Wedega - Email:[email protected] - Website:https://xoops.wedega.com
25
 */
26
27
use Xmf\Request;
28
use XoopsModules\Wgfilemanager;
29
use XoopsModules\Wgfilemanager\Common\{
30
    FilesManagement,
31
    SysUtility
32
};
33
34
35
/**
36
 * Class Object Handler Directory
37
 */
38
class DirectoryHandler extends \XoopsPersistableObjectHandler
39
{
40
    /**
41
     * Constructor
42
     *
43
     * @param \XoopsDatabase $db
44
     */
45
    public function __construct(\XoopsDatabase $db)
46
    {
47
        parent::__construct($db, 'wgfilemanager_directory', Directory::class, 'id', 'name');
48
    }
49
50
    /**
51
     * @param bool $isNew
52
     *
53
     * @return object
54
     */
55
    public function create($isNew = true)
56
    {
57
        return parent::create($isNew);
58
    }
59
60
    /**
61
     * retrieve a field
62
     *
63
     * @param int $id field id
64
     * @param null $fields fields
0 ignored issues
show
Documentation Bug introduced by
Are you sure the doc-type for parameter $fields is correct as it would always require null to be passed?
Loading history...
65
     * @return \XoopsObject|null reference to the {@link Get} object
66
     */
67
    public function get($id = null, $fields = null)
68
    {
69
        return parent::get($id, $fields);
70
    }
71
72
    /**
73
     * get inserted id
74
     *
75
     * @return int reference to the {@link Get} object
76
     */
77
    public function getInsertId()
78
    {
79
        return $this->db->getInsertId();
80
    }
81
82
    /**
83
     * Get Count Directory in the database
84
     * @param int    $start
85
     * @param int    $limit
86
     * @param string $sort
87
     * @param string $order
88
     * @return int
89
     */
90
    public function getCountDirectory($start = 0, $limit = 0, $sort = 'id', $order = 'DESC')
91
    {
92
        $crCountDirectory = new \CriteriaCompo();
93
        $crCountDirectory = $this->getDirectoryCriteria($crCountDirectory, $start, $limit, $sort, $order);
94
        return $this->getCount($crCountDirectory);
0 ignored issues
show
$crCountDirectory of type integer is incompatible with the type CriteriaElement|null expected by parameter $criteria of XoopsPersistableObjectHandler::getCount(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

94
        return $this->getCount(/** @scrutinizer ignore-type */ $crCountDirectory);
Loading history...
95
    }
96
97
    /**
98
     * Get All Directory in the database
99
     * @param int    $start
100
     * @param int    $limit
101
     * @param string $sort
102
     * @param string $order
103
     * @return array
104
     */
105
    public function getAllDirectory($start = 0, $limit = 0, $sort = 'id', $order = 'DESC')
106
    {
107
        $crAllDirectory = new \CriteriaCompo();
108
        $crAllDirectory = $this->getDirectoryCriteria($crAllDirectory, $start, $limit, $sort, $order);
109
        return $this->getAll($crAllDirectory);
0 ignored issues
show
$crAllDirectory of type integer is incompatible with the type CriteriaElement|null expected by parameter $criteria of XoopsPersistableObjectHandler::getAll(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

109
        return $this->getAll(/** @scrutinizer ignore-type */ $crAllDirectory);
Loading history...
110
    }
111
112
    /**
113
     * Get Criteria Directory
114
     * @param        $crDirectory
115
     * @param int    $start
116
     * @param int    $limit
117
     * @param string $sort
118
     * @param string $order
119
     * @return int
120
     */
121
    private function getDirectoryCriteria($crDirectory, $start, $limit, $sort, $order)
122
    {
123
        $crDirectory->setStart($start);
124
        $crDirectory->setLimit($limit);
125
        $crDirectory->setSort($sort);
126
        $crDirectory->setOrder($order);
127
        return $crDirectory;
128
    }
129
130
    /**
131
     * Get full path of given parent directory
132
     *
133
     * @param int $parent_id
134
     * @return string
135
     */
136
    public function getFullPath($parent_id) {
137
138
        $path = '';
139
        if ($parent_id > 0) {
140
            $path = $this->getFullPathRecursive($parent_id);
141
        }
142
        if ('' === $path) {
143
            return '';
144
        }
145
        $pathArray = \explode('/', $path);
146
        \krsort($pathArray);
147
148
        return \implode('/', \array_filter($pathArray));
149
    }
150
151
    /**
152
     * Get full path of given parent directory
153
     *
154
     * @param int $parent_id
155
     * @return string
156
     */
157
    public function getFullPathRecursive($parent_id) {
158
        $path = '';
159
        if ($parent_id > 1) {
160
            $directoryObj = $this->get($parent_id);
161
            $path .= mb_strtolower($directoryObj->getVar('name'));
162
            if ($directoryObj->getVar('parent_id') > 1) {
163
                $path .= '/' . $this->getFullPathRecursive($directoryObj->getVar('parent_id'));
164
            }
165
        }
166
        return $path;
167
    }
168
169
    /**
170
     * Check whether given path is a directory
171
     *
172
     * @param string $path
173
     * @return boolean
174
     */
175
    public function existDirectory ($path) {
176
177
        return \is_dir(\WGFILEMANAGER_REPO_PATH . $path);
178
179
    }
180
181
    /**
182
     * Create directory from given path
183
     *
184
     * @param string $path
185
     * @return boolean
186
     */
187
    public function createDirectory($path) {
188
189
        FilesManagement::createFolder(\WGFILEMANAGER_REPO_PATH . $path);
190
191
    }
192
193
    /**
194
     * Rename directory
195
     *
196
     * @param string $oldDirname
197
     * @param string $newDirname
198
     * @return boolean
199
     */
200
    public function renameDirectory($oldDirname, $newDirname)
201
    {
202
        $oldFilePath = \WGFILEMANAGER_REPO_PATH . $oldDirname;
203
        $newFilePath = \WGFILEMANAGER_REPO_PATH . $newDirname;
204
205
        if (\file_exists($oldFilePath)) {
206
            if (!\file_exists($newFilePath)) {
207
                return \rename($oldFilePath, $newFilePath);
208
            } else {
209
                throw new \Exception('New filename already exists.');
210
            }
211
        } else {
212
            throw new \Exception('Old file does not exist.');
213
        }
214
    }
215
216
    /**
217
     * Delete directory from given path
218
     *
219
     * @param string $path
220
     * @return boolean
221
     */
222
    public function deleteDirectory($path)
223
    {
224
        $fullPath = \WGFILEMANAGER_REPO_PATH . $path;
225
226
        if (!FilesManagement::deleteDirectory($fullPath)) {
227
            return false;
228
        }
229
230
        return !$this->existDirectory($fullPath);
231
232
    }
233
234
    /**
235
     * Check whether given directory is used as parent
236
     *
237
     * @param int $dirId
238
     * @return boolean
239
     */
240
    public function dirIsParent ($dirId) {
241
        $crCountDirectory = new \CriteriaCompo();
242
        $crCountDirectory->add(new \Criteria('parent_id', $dirId));
243
244
        return $this->getCount($crCountDirectory) > 0;
245
246
    }
247
248
    /**
249
     * Count subdirectories from given directory
250
     *
251
     * @param int $dirId
252
     * @return integer
253
     */
254
    public function countSubDirs($dirId) {
255
256
        $crSubDir = new \CriteriaCompo();
257
        $crSubDir->add(new \Criteria('parent_id', $dirId));
258
259
        return $this->getCount($crSubDir) ;
260
261
    }
262
263
    /**
264
     * Count files in given directory
265
     *
266
     * @param string $fullpath
267
     * @return integer
268
     */
269
    public function countFiles($fullpath) {
270
        $file_new = [];
271
        $path = \WGFILEMANAGER_REPO_PATH . $fullpath;
272
        if (!\file_exists($path)) {
273
            return -1;
274
        }
275
        $files = scandir($path);
276
        for($i = 0 ; $i < count($files) ; $i++){
0 ignored issues
show
Performance Best Practice introduced by
It seems like you are calling the size function count() as part of the test condition. You might want to compute the size beforehand, and not on each iteration.

If the size of the collection does not change during the iteration, it is generally a good practice to compute it beforehand, and not on each iteration:

for ($i=0; $i<count($array); $i++) { // calls count() on each iteration
}

// Better
for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once
}
Loading history...
277
            if(\is_file($path .  '/' . $files[$i]) && $files[$i] !='.' && $files[$i] !='..'  && $files[$i] !='index.php'  && $files[$i] !='index.html') {
278
                $file_new[] = $files[$i];
279
            }
280
        }
281
282
        return count($file_new);
283
    }
284
285
    /**
286
     * Delete data from all subdirectories from given directory
287
     *
288
     * @param int $dirId
289
     * @return boolean
290
     */
291
    public function deleteSubDirData($dirId) {
292
293
        $crSubDir = new \CriteriaCompo();
294
        $crSubDir->add(new \Criteria('parent_id', $dirId));
295
        if ($this->getCount($crSubDir) > 0) {
296
            $directoryAll = $this->getAll($crSubDir);
297
            foreach (\array_keys($directoryAll) as $i) {
298
                if (!$this->deleteSubDirData($i)) {
299
                    return false;
300
                }
301
            }
302
        }
303
        $directoryObj = $this->get($dirId);
304
        if (\is_object($directoryObj) && !$this->delete($directoryObj)) {
305
            return false;
306
        }
307
308
        return true;
309
310
    }
311
312
    /**
313
     * Move directory
314
     *
315
     * @param string $pathSource
316
     * @param string $pathDest
317
     * @return boolean
318
     */
319
    public function moveDirectory($pathSource, $pathDest) {
320
321
        if(!FilesManagement::rcopy(\WGFILEMANAGER_REPO_PATH . $pathSource, \WGFILEMANAGER_REPO_PATH . $pathDest)){
322
            return false;
323
        }
324
        if (!FilesManagement::deleteDirectory(\WGFILEMANAGER_REPO_PATH . $pathSource)) {
325
            return false;
326
        }
327
328
        return true;
329
    }
330
331
    /**
332
     * Returns an array directories
333
     *
334
     * @param int    $dirId
335
     * @param int    $dirCurrent
336
     * @param int    $levelCurrent
337
     * @param string $sortBy
338
     * @param string $orderBy
339
     * @param int    $lengthName
340
     * @return array
341
     */
342
    public function getDirList($dirId, $dirCurrent, $levelCurrent = 1, $sortBy = 'weight ASC, id', $orderBy = 'ASC', $lengthName = 0) {
343
344
        $result = [];
345
        //create list of parents
346
        $parents  = [];
347
        $parentId = 0;
348
        $dirCurrObj = $this->get($dirCurrent);
349
        if (\is_object($dirCurrObj)) {
350
            $parentId = $dirCurrObj->getVar('parent_id');
351
        }
352
        $parents[] = $parentId;
353
        while ($parentId > 0) {
354
            $parentId = $this->get($parentId)->getVar('parent_id');
355
            $parents[] = $parentId;
356
        }
357
358
        $levelCurrent++;
359
        $crSubDir = new \CriteriaCompo();
360
        $crSubDir->add(new \Criteria('parent_id', $dirId));
361
        $crSubDir->setSort($sortBy);
362
        $crSubDir->setOrder($orderBy);
363
        if ($this->getCount($crSubDir) > 0) {
364
            $directoryAll = $this->getAll($crSubDir);
365
            foreach (\array_keys($directoryAll) as $i) {
366
                $directory = $directoryAll[$i]->getValuesDir();
367
                $result[$i]['id'] = $directory['id'];
368
                $result[$i]['parent_id'] = $directory['parent_id'];
369
                if ($lengthName > 0) {
370
                    $result[$i]['name'] = SysUtility::truncateHtml($directory['name'], $lengthName, '...', true);
371
                } else {
372
                    $result[$i]['name'] = $directory['name'];
373
                }
374
                $result[$i]['state'] = $i === $dirCurrent ? 'open' : 'closed';
375
                $result[$i]['highlight'] = $i === $dirCurrent;
376
                $result[$i]['show'] = in_array($i, $parents);
377
                $result[$i]['count_subdirs'] = $directory['count_subdirs'];
378
                $result[$i]['count_files'] = $directory['count_files'];
379
                $result[$i]['level'] = $levelCurrent;
380
                $result[$i]['weight'] = $directory['weight'];
381
                $result[$i]['favorite_id'] = $directory['favorite_id'];
382
                if ($directory['count_subdirs'] > 0) {
383
                    $result[$i]['subdirs'] = $this->getDirList($i, $dirCurrent, $levelCurrent, $sortBy, $orderBy, $lengthName);
384
                }
385
            }
386
        }
387
388
        return $result;
389
390
    }
391
392
    /**
393
     * Returns an array directories for form select
394
     *
395
     * @param int $dirId
396
     * @return array
397
     */
398
    public function getDirListFormSelect($dirId) {
399
400
        $result = [];
401
        $crSubDir = new \CriteriaCompo();
402
        $crSubDir->add(new \Criteria('parent_id', $dirId));
403
        $crSubDir->setSort('weight ASC, id');
404
        $crSubDir->setOrder('ASC');
405
        if ($this->getCount($crSubDir) > 0) {
406
            $directoryAll = $this->getAll($crSubDir);
407
            foreach (\array_keys($directoryAll) as $i) {
408
                $directory = $directoryAll[$i]->getValuesDir();
409
                $name = $directory['name'];
410
                if ($dirId > 0) {
411
                    $level = \mb_substr_count($directory['fullpath'], '/');
412
                    $name = \str_repeat('- ', $level) . $name;
413
                }
414
                $result[$i] = [$directory['id'] => $name];
415
                if ($directory['count_subdirs'] > 0) {
416
                    $result[$i][]= $this->getDirListFormSelect($i);
417
                }
418
            }
419
        }
420
421
        return $result;
422
    }
423
424
    /**
425
     * Returns an array directories for breadcrumbs
426
     *
427
     * @param int $dirId
428
     * @return array
429
     */
430
    public function getDirListBreadcrumb($dirId) {
431
432
        $result = [];
433
        do {
434
            $dirObj = $this->get($dirId);
435
            if (\is_object($dirObj)) {
436
                if ($dirId > 1) {
437
                    $result[$dirId] = $dirObj->getVar('name');
438
                }
439
                $dirId = $dirObj->getVar('parent_id');
440
            } else {
441
                $dirId = 0;
442
            }
443
        } while ($dirId > 0);
444
445
        return $result;
446
    }
447
448
    /**
449
     * Returns an array of directories
450
     *
451
     * @param int    $dirId
452
     * @param string $sortBy
453
     * @param string $orderBy
454
     * @return array
455
     */
456
    public function getSubDirList($dirId, $sortBy = 'weight ASC, id', $orderBy = 'ASC') {
457
458
        $result = [];
459
        $crSubDir = new \CriteriaCompo();
460
        $crSubDir->add(new \Criteria('parent_id', $dirId));
461
        $crSubDir->setSort($sortBy);
462
        $crSubDir->setOrder($orderBy);
463
        if ($this->getCount($crSubDir) > 0) {
464
            $directoryAll = $this->getAll($crSubDir);
465
            foreach (\array_keys($directoryAll) as $i) {
466
                $result[$i] = $directoryAll[$i]->getValuesDir();
467
            }
468
        }
469
470
        return $result;
471
472
    }
473
474
    /**
475
     * Returns an array of favorite directories
476
     *
477
     * @param int $lengthName
478
     * @return array
479
     */
480
    public function getFavDirList($lengthName = 0) {
481
        $result = [];
482
        if (0 === $lengthName) {
483
            $lengthName = 1000;
484
        }
485
        //get current user
486
        $userUid = 0;
487
        if (isset($GLOBALS['xoopsUser']) && \is_object($GLOBALS['xoopsUser'])) {
488
            $userUid = $GLOBALS['xoopsUser']->uid();
489
        }
490
        if ($userUid > 0) {
491
            $crDirectory = new \CriteriaCompo();
492
            $directoryCount = $this->getCount($crDirectory);
493
            if ($directoryCount > 0) {
494
                $crDirectory->setSort('name');
495
                $crDirectory->setOrder('asc');
496
                $directoryAll = $this->getAll($crDirectory);
497
                foreach (\array_keys($directoryAll) as $i) {
498
                    $dirValues = $directoryAll[$i]->getValuesDir();
499
                    if ($lengthName > 0) {
500
                        $dirValues['name'] = SysUtility::truncateHtml($dirValues['name'], $lengthName, '...', true);
501
                    }
502
                    if ((int)$dirValues['favorite_id'] > 0) {
503
                        $result[] = $dirValues;
504
                    }
505
                }
506
            }
507
        }
508
        return $result;
509
    }
510
511
    /**
512
     * Returns an array directories
513
     *
514
     * @param int $parentId
515
     * @return boolean
516
     */
517
    public function setDirWeight($parentId) {
518
519
        if (0 == $parentId) {
520
            return true;
521
        }
522
        $crSubDir = new \CriteriaCompo();
523
        $crSubDir->add(new \Criteria('parent_id', $parentId));
524
        $crSubDir->setSort('weight ASC, id');
525
        $crSubDir->setOrder('ASC');
526
        if ($this->getCount($crSubDir) > 0) {
527
            $directoryAll = $this->getAll($crSubDir);
528
            $counter = 0;
529
            foreach (\array_keys($directoryAll) as $i) {
530
                $counter++;
531
                $directoryObj = $this->get($i);
532
                $directoryObj->setVar('weight', $counter);
533
                $this->insert($directoryObj);
0 ignored issues
show
It seems like $directoryObj can also be of type null; however, parameter $object of XoopsPersistableObjectHandler::insert() does only seem to accept XoopsObject, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

533
                $this->insert(/** @scrutinizer ignore-type */ $directoryObj);
Loading history...
534
                $this->setDirWeight($i);
535
            }
536
        }
537
538
        return true;
539
540
    }
541
542
}
543