Issues (125)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

code/MapUtil.php (14 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
class MapUtil
4
{
5
    /**
6
     * @var string The Google Maps API key
7
     */
8
    protected static $api_key;
9
10
    /**
11
     * @var int Number of active {@see GoogleMapsAPI} instances (for the HTML ID)
12
     */
13
    protected static $instances = 0;
14
15
    /**
16
     * @var int The default width of a Google Map
17
     */
18
    public static $map_width = '100%';
19
20
    /**
21
     * @var int The default height of a Google Map
22
     */
23
    public static $map_height = '400px';
24
25
    /**
26
     * @var int Prefix for the div ID of the map
27
     */
28
    public static $div_id = 'google_map';
29
30
    /**
31
     * @var bool Automatic center/zoom for the map
32
     */
33
    public static $automatic_center = true;
34
35
    /**
36
     * @var bool Show the marker fields on the map
37
     */
38
    public static $hide_marker = false;
39
40
    /**
41
     * @var bool Show the marker fields on the map
42
     */
43
    public static $map_type = 'google.maps.MapTypeId.ROADMAP';
44
45
    /**
46
     * @var string Center of map (adress)
47
     */
48
    public static $center = 'Paris, France';
49
50
    /* Signals whether at least one map has already been rendered */
51
    private static $map_already_rendered = false;
52
53
    /* Whether or not to allow full screen */
54
    private static $allow_full_screen = null;
55
56 49
    public static function reset()
57
    {
58 49
        self::$api_key = null;
59 49
        self::$instances = 0;
60 49
        self::$map_width = '100%';
0 ignored issues
show
Documentation Bug introduced by
The property $map_width was declared of type integer, but '100%' is of type string. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
61 49
        self::$map_height = '400px';
0 ignored issues
show
Documentation Bug introduced by
The property $map_height was declared of type integer, but '400px' is of type string. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
62 49
        self::$div_id = 'google_map';
0 ignored issues
show
Documentation Bug introduced by
The property $div_id was declared of type integer, but 'google_map' is of type string. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
63 49
        self::$automatic_center = true;
64 49
        self::$hide_marker = false;
65 49
        self::$map_type = 'google.maps.MapTypeId.ROADMAP';
0 ignored issues
show
Documentation Bug introduced by
The property $map_type was declared of type boolean, but 'google.maps.MapTypeId.ROADMAP' is of type string. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
66 49
        self::$center = 'Paris, France';
67 49
        self::$map_already_rendered = false;
68 49
        self::$allow_full_screen = null;
69 49
        Config::inst()->update('Mappable', 'language', 'en');
70 49
    }
71
72
    /**
73
     * Set the API key for Google Maps.
74
     *
75
     * @param string $key
76
     */
77 2
    public static function set_api_key($key)
0 ignored issues
show
Method name "MapUtil::set_api_key" is not in camel caps format
Loading history...
78
    {
79 2
        self::$api_key = $key;
80 2
    }
81
82
    /**
83
     * @param bool $new_map_already_rendered
84
     */
85 43
    public static function set_map_already_rendered($new_map_already_rendered)
0 ignored issues
show
Method name "MapUtil::set_map_already_rendered" is not in camel caps format
Loading history...
86
    {
87 43
        self::$map_already_rendered = $new_map_already_rendered;
88 43
    }
89
90 43
    public static function get_map_already_rendered()
0 ignored issues
show
Method name "MapUtil::get_map_already_rendered" is not in camel caps format
Loading history...
91
    {
92 43
        return self::$map_already_rendered;
93
    }
94
95
    /**
96
     * Set the default size of the map.
97
     *
98
     * @param int $width
99
     * @param int $height
100
     */
101 1
    public static function set_map_size($width, $height)
0 ignored issues
show
Method name "MapUtil::set_map_size" is not in camel caps format
Loading history...
102
    {
103 1
        self:: $map_width = $width;
104 1
        self::$map_height = $height;
105 1
    }
106
107
    /**
108
     * FIXME - NOT USED?
109
     * Set the type of the gmap.
110
     *
111
     * @param string $mapType (can be 'google.maps.MapTypeId.ROADMAP', 'G_SATELLITE_MAP',
112
     *                        'G_HYBRID_MAP', 'G_PHYSICAL_MAP')
113
     */
114 1
    public static function set_map_type($mapType)
0 ignored issues
show
Method name "MapUtil::set_map_type" is not in camel caps format
Loading history...
115
    {
116 1
        self::$map_type = $mapType;
0 ignored issues
show
Documentation Bug introduced by
The property $map_type was declared of type boolean, but $mapType is of type string. Maybe add a type cast?

This check looks for assignments to scalar types that may be of the wrong type.

To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.

$answer = 42;

$correct = false;

$correct = (bool) $answer;
Loading history...
117 1
    }
118
119
    /**
120
     * Set the center of the gmap (an address, using text geocoder query).
121
     *
122
     * @param string $center GoogleMap  center (an address)
123
     */
124 1
    public static function set_center($center)
0 ignored issues
show
Method name "MapUtil::set_center" is not in camel caps format
Loading history...
125
    {
126 1
        self::$center = $center;
127 1
    }
128
129
    /**
130
     * Get a new GoogleMapAPI object and load it with the default settings.
131
     *
132
     * @return MapAPI
133
     */
134 41
    public static function instance()
135
    {
136 41
        ++self::$instances;
137
138 41
        if (self::$allow_full_screen == null) {
139 39
            self::$allow_full_screen = Config::inst()->get('Mappable', 'allow_full_screen');
140 39
        }
141
142 41
        $url = Director::absoluteBaseURL();
143
144
        // remove http and https
145 41
        $url = str_replace('http://', '', $url);
146 41
        $url = str_replace('https://', '', $url);
147 41
        $parts = explode('/', $url);
148 41
        $host = $parts[0];
149
150 41
        $key = self::$api_key;
151
152
        // if an array, get the key by an array keyed by host
153 41
        if (is_array($key)) {
154 1
            $key = $key[$host];
155 1
        }
156
157 41
        $gmap = new MapAPI($key);
158 41
        $gmap->setDivId(self::$div_id.'_'.self::$instances);
159 41
        $gmap->setEnableAutomaticCenterZoom(self::$automatic_center);
160 41
        $gmap->setSize(self::$map_width, self::$map_height);
161 41
        $gmap->setDefaultHideMarker(self::$hide_marker);
162 41
        $gmap->setMapType(self::$map_type);
0 ignored issues
show
self::$map_type is of type boolean, but the function expects a string.

It seems like the type of the argument is not accepted by the function/method which you are calling.

In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.

We suggest to add an explicit type cast like in the following example:

function acceptsInteger($int) { }

$x = '123'; // string "123"

// Instead of
acceptsInteger($x);

// we recommend to use
acceptsInteger((integer) $x);
Loading history...
163 41
        $gmap->setCenter(self::$center);
164 41
        $gmap->setAllowFullScreen(self::$allow_full_screen);
165 41
        $language = Config::inst()->get('Mappable', 'language');
166 41
        $gmap->setLang($language);
167
168 41
        return $gmap;
169
    }
170
171
    /**
172
     * Sanitize a string of HTML content for safe inclusion in the JavaScript
173
     * for a Google Map.
174
     *
175
     * @return string
176
     */
177 14
    public static function sanitize($content)
178
    {
179 14
        return addslashes(str_replace(array("\n", "\r", "\t"), '', $content));
180
    }
181
182
    /**
183
     * Creates a new {@link GoogleMapsAPI} object loaded with the default settings
184
     * and places all of the items in a {@link SS_List}
185
     * e.g. {@link DataList} or {@link ArrayList} on the map.
186
     *
187
     * @param SS_List list of objects to display on a map
188
     * @param array $infowindowtemplateparams Optional array of extra parameters to pass to the map info window
189
     *
190
     * @return MapAPI
191
     */
192 41
    public static function get_map(SS_List $list, $infowindowtemplateparams)
0 ignored issues
show
Method name "MapUtil::get_map" is not in camel caps format
Loading history...
193
    {
194 41
        $gmap = self::instance();
195 41
        if ($list) {
196 41
            foreach ($list as $mappable) {
197 36
                if (self::ChooseToAddDataobject($mappable)) {
198 8
                    $gmap->addMarkerAsObject($mappable, $infowindowtemplateparams);
199 8
                }
200 41
            }
201 41
        }
202
203 41
        return $gmap;
204
    }
205
206
    /**
207
     * Determines if the current DataObject should be included to the map
208
     * Checks if it has Mappable interface implemented
209
     * If it has MapExtension included, the value of MapPinEdited is also checked.
210
     *
211
     * @param DataObject $do
212
     *
213
     * @return bool
214
     */
215 36
    private static function ChooseToAddDataobject(DataObject $do)
0 ignored issues
show
Method name "MapUtil::ChooseToAddDataobject" is not in camel caps format
Loading history...
216
    {
217 36
        $isMappable = $do->is_a('Mappable');
218
219 36
        foreach ($do->getExtensionInstances() as $extension) {
220 36
            $isMappable = $isMappable || $extension instanceof Mappable;
221 36
        }
222
223 36
        $filterMapPinEdited = $do->hasExtension('MapExtension')
224 36
            ? $do->MapPinEdited
225 36
            : true;
226
227 36
        return $isMappable && $filterMapPinEdited;
228
    }
229
}
230