This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
0 ignored issues
–
show
Coding Style
introduced
by
![]() |
|||||
2 | declare(strict_types=1); |
||||
3 | |||||
4 | /** |
||||
0 ignored issues
–
show
|
|||||
5 | * CakePHP(tm) : Rapid Development Framework (https://cakephp.org) |
||||
6 | * Copyright (c) Cake Software Foundation, Inc. (https://cakefoundation.org) |
||||
0 ignored issues
–
show
|
|||||
7 | * |
||||
8 | * Licensed under The MIT License |
||||
9 | * For full copyright and license information, please see the LICENSE.txt |
||||
10 | * Redistributions of files must retain the above copyright notice. |
||||
11 | * |
||||
12 | * @copyright Copyright (c) Cake Software Foundation, Inc. (https://cakefoundation.org) |
||||
0 ignored issues
–
show
|
|||||
13 | * @link https://cakephp.org CakePHP(tm) Project |
||||
0 ignored issues
–
show
|
|||||
14 | * @since 0.10.8 |
||||
0 ignored issues
–
show
|
|||||
15 | * @license https://opensource.org/licenses/mit-license.php MIT License |
||||
0 ignored issues
–
show
|
|||||
16 | */ |
||||
0 ignored issues
–
show
|
|||||
17 | |||||
18 | /* |
||||
19 | * Configure paths required to find CakePHP + general filepath constants |
||||
20 | */ |
||||
0 ignored issues
–
show
|
|||||
21 | require __DIR__ . '/paths.php'; |
||||
22 | |||||
23 | /* |
||||
24 | * Bootstrap CakePHP. |
||||
25 | * |
||||
26 | * Does the various bits of setup that CakePHP needs to do. |
||||
27 | * This includes: |
||||
28 | * |
||||
29 | * - Registering the CakePHP autoloader. |
||||
30 | * - Setting the default application paths. |
||||
31 | */ |
||||
0 ignored issues
–
show
|
|||||
32 | require CORE_PATH . 'config' . DS . 'bootstrap.php'; |
||||
33 | |||||
34 | use Cake\Cache\Cache; |
||||
35 | use Cake\Core\Configure; |
||||
36 | use Cake\Core\Configure\Engine\PhpConfig; |
||||
37 | use Cake\Datasource\ConnectionManager; |
||||
38 | use Cake\Error\ConsoleErrorHandler; |
||||
39 | use Cake\Error\ErrorHandler; |
||||
40 | use Cake\Http\ServerRequest; |
||||
41 | use Cake\Log\Log; |
||||
42 | use Cake\Mailer\Mailer; |
||||
43 | use Cake\Mailer\TransportFactory; |
||||
44 | use Cake\Routing\Router; |
||||
45 | use Cake\Utility\Security; |
||||
0 ignored issues
–
show
This use statement conflicts with another class in this namespace,
Security . Consider defining an alias.
Let?s assume that you have a directory layout like this: .
|-- OtherDir
| |-- Bar.php
| `-- Foo.php
`-- SomeDir
`-- Foo.php
and let?s assume the following content of // Bar.php
namespace OtherDir;
use SomeDir\Foo; // This now conflicts the class OtherDir\Foo
If both files PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php
However, as // Bar.php
namespace OtherDir;
use SomeDir\Foo as SomeDirFoo; // There is no conflict anymore.
![]() |
|||||
46 | |||||
47 | /* |
||||
48 | * See https://github.com/josegonzalez/php-dotenv for API details. |
||||
49 | * |
||||
50 | * Uncomment block of code below if you want to use `.env` file during development. |
||||
0 ignored issues
–
show
|
|||||
51 | * You should copy `config/.env.example` to `config/.env` and set/modify the |
||||
52 | * variables as required. |
||||
53 | * |
||||
54 | * The purpose of the .env file is to emulate the presence of the environment |
||||
55 | * variables like they would be present in production. |
||||
56 | * |
||||
57 | * If you use .env files, be careful to not commit them to source control to avoid |
||||
0 ignored issues
–
show
|
|||||
58 | * security risks. See https://github.com/josegonzalez/php-dotenv#general-security-information |
||||
0 ignored issues
–
show
|
|||||
59 | * for more information for recommended practices. |
||||
60 | */ |
||||
0 ignored issues
–
show
|
|||||
61 | // if (!env('APP_NAME') && file_exists(CONFIG . '.env')) { |
||||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
52% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||||
62 | // $dotenv = new \josegonzalez\Dotenv\Loader([CONFIG . '.env']); |
||||
0 ignored issues
–
show
|
|||||
63 | // $dotenv->parse() |
||||
0 ignored issues
–
show
|
|||||
64 | // ->putenv() |
||||
0 ignored issues
–
show
|
|||||
65 | // ->toEnv() |
||||
0 ignored issues
–
show
|
|||||
66 | // ->toServer(); |
||||
0 ignored issues
–
show
|
|||||
67 | // } |
||||
0 ignored issues
–
show
|
|||||
68 | |||||
69 | /* |
||||
70 | * Read configuration file and inject configuration into various |
||||
71 | * CakePHP classes. |
||||
72 | * |
||||
73 | * By default there is only one configuration file. It is often a good |
||||
74 | * idea to create multiple configuration files, and separate the configuration |
||||
75 | * that changes from configuration that does not. This makes deployment simpler. |
||||
76 | */ |
||||
0 ignored issues
–
show
|
|||||
77 | try { |
||||
78 | Configure::config('default', new PhpConfig()); |
||||
79 | Configure::load('app', 'default', false); |
||||
80 | } catch (\Exception $e) { |
||||
0 ignored issues
–
show
|
|||||
81 | exit($e->getMessage() . "\n"); |
||||
82 | } |
||||
83 | |||||
84 | /* |
||||
85 | * Load an environment local configuration file to provide overrides to your configuration. |
||||
0 ignored issues
–
show
|
|||||
86 | * Notice: For security reasons app_local.php **should not** be included in your git repo. |
||||
0 ignored issues
–
show
|
|||||
87 | */ |
||||
0 ignored issues
–
show
|
|||||
88 | if (file_exists(CONFIG . 'app_local.php')) { |
||||
89 | Configure::load('app_local', 'default'); |
||||
90 | } |
||||
91 | |||||
92 | /* |
||||
93 | * When debug = true the metadata cache should only last |
||||
94 | * for a short time. |
||||
95 | */ |
||||
0 ignored issues
–
show
|
|||||
96 | if (Configure::read('debug')) { |
||||
97 | Configure::write('Cache._cake_model_.duration', '+2 minutes'); |
||||
98 | Configure::write('Cache._cake_core_.duration', '+2 minutes'); |
||||
99 | // disable router cache during development |
||||
0 ignored issues
–
show
|
|||||
100 | Configure::write('Cache._cake_routes_.duration', '+2 seconds'); |
||||
101 | } |
||||
102 | |||||
103 | /* |
||||
104 | * Set the default server timezone. Using UTC makes time calculations / conversions easier. |
||||
0 ignored issues
–
show
|
|||||
105 | * Check http://php.net/manual/en/timezones.php for list of valid timezone strings. |
||||
0 ignored issues
–
show
|
|||||
106 | */ |
||||
0 ignored issues
–
show
|
|||||
107 | date_default_timezone_set(Configure::read('App.defaultTimezone')); |
||||
0 ignored issues
–
show
It seems like
Cake\Core\Configure::read('App.defaultTimezone') can also be of type null ; however, parameter $timezoneId of date_default_timezone_set() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
108 | |||||
109 | /* |
||||
110 | * Configure the mbstring extension to use the correct encoding. |
||||
111 | */ |
||||
0 ignored issues
–
show
|
|||||
112 | mb_internal_encoding(Configure::read('App.encoding')); |
||||
113 | |||||
114 | /* |
||||
115 | * Set the default locale. This controls how dates, number and currency is |
||||
116 | * formatted and sets the default language to use for translations. |
||||
117 | */ |
||||
0 ignored issues
–
show
|
|||||
118 | ini_set('intl.default_locale', Configure::read('App.defaultLocale')); |
||||
0 ignored issues
–
show
It seems like
Cake\Core\Configure::read('App.defaultLocale') can also be of type null ; however, parameter $value of ini_set() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
119 | |||||
120 | /* |
||||
121 | * Register application error and exception handlers. |
||||
122 | */ |
||||
0 ignored issues
–
show
|
|||||
123 | $isCli = PHP_SAPI === 'cli'; |
||||
0 ignored issues
–
show
|
|||||
124 | if ($isCli) { |
||||
125 | (new ConsoleErrorHandler(Configure::read('Error')))->register(); |
||||
0 ignored issues
–
show
It seems like
Cake\Core\Configure::read('Error') can also be of type null ; however, parameter $config of Cake\Error\ConsoleErrorHandler::__construct() does only seem to accept array , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
126 | } else { |
||||
0 ignored issues
–
show
|
|||||
127 | (new ErrorHandler(Configure::read('Error')))->register(); |
||||
0 ignored issues
–
show
It seems like
Cake\Core\Configure::read('Error') can also be of type null ; however, parameter $config of Cake\Error\ErrorHandler::__construct() does only seem to accept array , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
128 | } |
||||
129 | |||||
130 | /* |
||||
131 | * Include the CLI bootstrap overrides. |
||||
132 | */ |
||||
0 ignored issues
–
show
|
|||||
133 | if ($isCli) { |
||||
134 | require __DIR__ . '/bootstrap_cli.php'; |
||||
135 | } |
||||
136 | |||||
137 | /* |
||||
138 | * Set the full base URL. |
||||
139 | * This URL is used as the base of all absolute links. |
||||
140 | */ |
||||
0 ignored issues
–
show
|
|||||
141 | $fullBaseUrl = Configure::read('App.fullBaseUrl'); |
||||
142 | if (!$fullBaseUrl) { |
||||
0 ignored issues
–
show
|
|||||
143 | $s = null; |
||||
144 | if (env('HTTPS')) { |
||||
145 | $s = 's'; |
||||
146 | } |
||||
147 | |||||
148 | $httpHost = env('HTTP_HOST'); |
||||
149 | if (isset($httpHost)) { |
||||
150 | $fullBaseUrl = 'http' . $s . '://' . $httpHost; |
||||
151 | } |
||||
0 ignored issues
–
show
|
|||||
152 | unset($httpHost, $s); |
||||
153 | } |
||||
0 ignored issues
–
show
|
|||||
154 | if ($fullBaseUrl) { |
||||
155 | Router::fullBaseUrl($fullBaseUrl); |
||||
156 | } |
||||
0 ignored issues
–
show
|
|||||
157 | unset($fullBaseUrl); |
||||
158 | |||||
159 | Cache::setConfig(Configure::consume('Cache')); |
||||
160 | ConnectionManager::setConfig(Configure::consume('Datasources')); |
||||
161 | TransportFactory::setConfig(Configure::consume('EmailTransport')); |
||||
162 | Mailer::setConfig(Configure::consume('Email')); |
||||
163 | Log::setConfig(Configure::consume('Log')); |
||||
164 | Security::setSalt(Configure::consume('Security.salt')); |
||||
0 ignored issues
–
show
It seems like
Cake\Core\Configure::consume('Security.salt') can also be of type array and null ; however, parameter $salt of Cake\Utility\Security::setSalt() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
165 | |||||
166 | /* |
||||
167 | * Setup detectors for mobile and tablet. |
||||
168 | */ |
||||
0 ignored issues
–
show
|
|||||
169 | ServerRequest::addDetector('mobile', function ($request) { |
||||
0 ignored issues
–
show
The parameter
$request is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. ![]() |
|||||
170 | $detector = new \Detection\MobileDetect(); |
||||
0 ignored issues
–
show
|
|||||
171 | |||||
172 | return $detector->isMobile(); |
||||
173 | }); |
||||
174 | ServerRequest::addDetector('tablet', function ($request) { |
||||
0 ignored issues
–
show
The parameter
$request is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. ![]() |
|||||
175 | $detector = new \Detection\MobileDetect(); |
||||
0 ignored issues
–
show
|
|||||
176 | |||||
177 | return $detector->isTablet(); |
||||
178 | }); |
||||
179 | |||||
180 | /* |
||||
181 | * You can set whether the ORM uses immutable or mutable Time types. |
||||
182 | * The default changed in 4.0 to immutable types. You can uncomment |
||||
183 | * below to switch back to mutable types. |
||||
184 | * |
||||
185 | * You can enable default locale format parsing by adding calls |
||||
186 | * to `useLocaleParser()`. This enables the automatic conversion of |
||||
187 | * locale specific date formats. For details see |
||||
188 | * @link https://book.cakephp.org/4/en/core-libraries/internationalization-and-localization.html#parsing-localized-datetime-data |
||||
189 | */ |
||||
0 ignored issues
–
show
|
|||||
190 | // TypeFactory::build('time') |
||||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
55% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||||
191 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
192 | // TypeFactory::build('date') |
||||
193 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
194 | // TypeFactory::build('datetime') |
||||
195 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
196 | // TypeFactory::build('timestamp') |
||||
197 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
198 | // TypeFactory::build('datetimefractional') |
||||
199 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
200 | // TypeFactory::build('timestampfractional') |
||||
201 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
202 | // TypeFactory::build('datetimetimezone') |
||||
203 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
204 | // TypeFactory::build('timestamptimezone') |
||||
205 | // ->useMutable(); |
||||
0 ignored issues
–
show
|
|||||
206 | |||||
207 | /* |
||||
208 | * Custom Inflector rules, can be set to correctly pluralize or singularize |
||||
209 | * table, model, controller names or whatever other string is passed to the |
||||
210 | * inflection functions. |
||||
211 | */ |
||||
0 ignored issues
–
show
|
|||||
212 | //Inflector::rules('plural', ['/^(inflect)or$/i' => '\1ables']); |
||||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
67% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||||
213 | //Inflector::rules('irregular', ['red' => 'redlings']); |
||||
0 ignored issues
–
show
|
|||||
214 | //Inflector::rules('uninflected', ['dontinflectme']); |
||||
0 ignored issues
–
show
|
|||||
215 | //Inflector::rules('transliteration', ['/å/' => 'aa']); |
||||
0 ignored issues
–
show
|
|||||
216 |