Issues in index.php (v3.0) - Issues in v3.0 - iNextrix/ASTPP - Measure and Improve Code Quality continuously with Scrutinizer

Issues (4511)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

web_interface/astpp/index.php (4 issues)

Labels

Severity

Minor 4

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php
//echo "<pre>"; print_r($_SERVER);
/*
 *---------------------------------------------------------------
 * APPLICATION ENVIRONMENT
 *---------------------------------------------------------------
 *
 * You can load different configurations depending on your
 * current environment. Setting the environment also influences
 * things like logging and error reporting.
 *
 * This can be set to anything, but default usage is:
 *
 *     development
 *     testing
 *     production
 *  
 * NOTE: If you change these, also change the error_reporting() code below
 *
 */
		ini_set("date.timezone", "UTC");
	define('ENVIRONMENT', 'development');
/*
 *---------------------------------------------------------------
 * ERROR REPORTING
 *---------------------------------------------------------------
 *
 * Different environments will require different levels of error reporting.
 * By default development will show errors but testing and live will hide them.
 */

if (defined('ENVIRONMENT'))
{
	switch (ENVIRONMENT)
	{
		case 'development':
			error_reporting(E_ALL);
		break;
	
		case 'testing':
		case 'production':
			error_reporting(0);
		break;

		default:
			exit('The application environment is not set correctly.');
	}
}

/*
 *---------------------------------------------------------------
 * SYSTEM FOLDER NAME
 *---------------------------------------------------------------
 *
 * This variable must contain the name of your "system" folder.
 * Include the path if the folder is not in the same  directory
 * as this file.
 *
 */
	$system_path = 'system';
/*
 *---------------------------------------------------------------
 * ASSETS FOLDER NAME
 *---------------------------------------------------------------
 *
 * This variable must contain the name of your "assets" folder.
 * Include the path if the folder is not in the same  directory
 * as this file.
 *
 */
	   $assets_path='assets';
/*
 *---------------------------------------------------------------
 * APPLICATION FOLDER NAME
 *---------------------------------------------------------------
 *
 * If you want this front controller to use a different "application"
 * folder then the default one you can set its name here. The folder
 * can also be renamed or relocated anywhere on your server.  If
 * you do, use a full server path. For more info please see the user guide:
 * http://codeigniter.com/user_guide/general/managing_apps.html
 *
 * NO TRAILING SLASH!
 *
 */
	$application_folder = 'application';

/*
 * --------------------------------------------------------------------
 * DEFAULT CONTROLLER
 * --------------------------------------------------------------------
 *
 * Normally you will set your default controller in the routes.php file.
 * You can, however, force a custom routing by hard-coding a
 * specific controller class/function here.  For most applications, you
 * WILL NOT set your routing here, but it's an option for those
 * special instances where you might want to override the standard
 * routing in a specific front controller that shares a common CI installation.
 *
 * IMPORTANT:  If you set the routing here, NO OTHER controller will be
 * callable. In essence, this preference limits your application to ONE
 * specific controller.  Leave the function name blank if you need
 * to call functions dynamically via the URI.
 *
 * Un-comment the $routing array below to use this feature
 *
 */
	// The directory name, relative to the "controllers" folder.  Leave blank
	// if your controller is not in a sub-folder within the "controllers" folder
	// $routing['directory'] = '';


	// The controller class file name.  Example:  Mycontroller
	// $routing['controller'] = '';


	// The controller function you wish to be called.
	// $routing['function']	= '';



/*
 * -------------------------------------------------------------------
 *  CUSTOM CONFIG VALUES
 * -------------------------------------------------------------------
 *
 * The $assign_to_config array below will be passed dynamically to the
 * config class when initialized. This allows you to set custom config
 * items or override any default config values found in the config.php file.
 * This can be handy as it permits you to share one application between
 * multiple front controller files, with each file containing different
 * config values.
 *
 * Un-comment the $assign_to_config array below to use this feature
 *
 */
	// $assign_to_config['name_of_config_item'] = 'value of config item';




// --------------------------------------------------------------------
// END OF USER CONFIGURABLE SETTINGS.  DO NOT EDIT BELOW THIS LINE
// --------------------------------------------------------------------

/*
 * ---------------------------------------------------------------
 *  Resolve the system path for increased reliability
 * ---------------------------------------------------------------
 */

	// Set the current directory correctly for CLI requests
	if (defined('STDIN'))
	{
		chdir(dirname(__FILE__));
	}

	if (realpath($system_path) !== FALSE)
	{
		$system_path = realpath($system_path).'/';
	}

	// ensure there's a trailing slash
	$system_path = rtrim($system_path, '/').'/';

	// Is the system path correct?
	if ( ! is_dir($system_path))
	{
		exit("Your system folder path does not appear to be set correctly. Please open the following file and correct this: ".pathinfo(__FILE__, PATHINFO_BASENAME));
	}

/*
 * -------------------------------------------------------------------
 *  Now that we know the path, set the main path constants
 * -------------------------------------------------------------------
 */
	// The name of THIS file
	define('SELF', pathinfo(__FILE__, PATHINFO_BASENAME));

	// The PHP file extension
	// this global constant is deprecated.
	define('EXT', '.php');

	// Path to the system folder
	define('BASEPATH', str_replace("\\", "/", $system_path));

	// Path to the front controller (this file)
	define('FCPATH', str_replace(SELF, '', __FILE__));

	// Name of the "system folder"
	define('SYSDIR', trim(strrchr(trim(BASEPATH, '/'), '/'), '/'));
	
	//Name of the "assets folder'
	define('ASSETSDIR', realpath($assets_path).'/');
	
	// The path to the "application" folder
	if (is_dir($application_folder))
	{
		define('APPPATH', $application_folder.'/');
	} else
	{
		if ( ! is_dir(BASEPATH.$application_folder.'/'))
		{
			exit("Your application folder path does not appear to be set correctly. Please open the following file and correct this: ".SELF);
		}

		define('APPPATH', BASEPATH.$application_folder.'/');
	}

/*
 * --------------------------------------------------------------------
 * LOAD THE BOOTSTRAP FILE
 * --------------------------------------------------------------------
 *
 * And away we go...
 *
 */
require_once BASEPATH.'core/CodeIgniter.php';

/* End of file index.php */
/* Location: ./index.php */


1		<?php
2		//echo "<pre>"; print_r($_SERVER);
3		/*
4		*---------------------------------------------------------------
5		* APPLICATION ENVIRONMENT
6		*---------------------------------------------------------------
7		*
8		* You can load different configurations depending on your
9		* current environment. Setting the environment also influences
10		* things like logging and error reporting.
11		*
12		* This can be set to anything, but default usage is:
13		*
14		* development
15		* testing
16		* production
17		*
18		* NOTE: If you change these, also change the error_reporting() code below
19		*
20		*/
21		ini_set("date.timezone", "UTC");
22		define('ENVIRONMENT', 'development');
23		/*
24		*---------------------------------------------------------------
25		* ERROR REPORTING
26		*---------------------------------------------------------------
27		*
28		* Different environments will require different levels of error reporting.
29		* By default development will show errors but testing and live will hide them.
30		*/
31
32	View Code Duplication	if (defined('ENVIRONMENT'))
33		{
34		switch (ENVIRONMENT)
35		{
36		case 'development':
37		error_reporting(E_ALL);
38		break;
39
40		case 'testing':
41		case 'production':
42		error_reporting(0);
43		break;
44
45		default:
46		exit('The application environment is not set correctly.');
47		}
48		}
49
50		/*
51		*---------------------------------------------------------------
52		* SYSTEM FOLDER NAME
53		*---------------------------------------------------------------
54		*
55		* This variable must contain the name of your "system" folder.
56		* Include the path if the folder is not in the same directory
57		* as this file.
58		*
59		*/
60		$system_path = 'system';
61		/*
62		*---------------------------------------------------------------
63		* ASSETS FOLDER NAME
64		*---------------------------------------------------------------
65		*
66		* This variable must contain the name of your "assets" folder.
67		* Include the path if the folder is not in the same directory
68		* as this file.
69		*
70		*/
71		$assets_path='assets';
72		/*
73		*---------------------------------------------------------------
74		* APPLICATION FOLDER NAME
75		*---------------------------------------------------------------
76		*
77		* If you want this front controller to use a different "application"
78		* folder then the default one you can set its name here. The folder
79		* can also be renamed or relocated anywhere on your server. If
80		* you do, use a full server path. For more info please see the user guide:
81		* http://codeigniter.com/user_guide/general/managing_apps.html
82		*
83		* NO TRAILING SLASH!
84		*
85		*/
86		$application_folder = 'application';
87
88		/*
89		* --------------------------------------------------------------------
90		* DEFAULT CONTROLLER
91		* --------------------------------------------------------------------
92		*
93		* Normally you will set your default controller in the routes.php file.
94		* You can, however, force a custom routing by hard-coding a
95		* specific controller class/function here. For most applications, you
96		* WILL NOT set your routing here, but it's an option for those
97		* special instances where you might want to override the standard
98		* routing in a specific front controller that shares a common CI installation.
99		*
100		* IMPORTANT: If you set the routing here, NO OTHER controller will be
101		* callable. In essence, this preference limits your application to ONE
102		* specific controller. Leave the function name blank if you need
103		* to call functions dynamically via the URI.
104		*
105		* Un-comment the $routing array below to use this feature
106		*
107		*/
108		// The directory name, relative to the "controllers" folder. Leave blank
109		// if your controller is not in a sub-folder within the "controllers" folder
110		// $routing['directory'] = '';
		0 ignored issues – show Unused Code Comprehensibility introduced 2016-10-16 16:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this `60%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
111
112		// The controller class file name. Example: Mycontroller
113		// $routing['controller'] = '';
		0 ignored issues – show Unused Code Comprehensibility introduced 2016-10-16 16:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this `60%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
114
115		// The controller function you wish to be called.
116		// $routing['function'] = '';
		0 ignored issues – show Unused Code Comprehensibility introduced 2016-10-16 16:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this `60%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
117
118
119		/*
120		* -------------------------------------------------------------------
121		* CUSTOM CONFIG VALUES
122		* -------------------------------------------------------------------
123		*
124		* The $assign_to_config array below will be passed dynamically to the
125		* config class when initialized. This allows you to set custom config
126		* items or override any default config values found in the config.php file.
127		* This can be handy as it permits you to share one application between
128		* multiple front controller files, with each file containing different
129		* config values.
130		*
131		* Un-comment the $assign_to_config array below to use this feature
132		*
133		*/
134		// $assign_to_config['name_of_config_item'] = 'value of config item';
		0 ignored issues – show Unused Code Comprehensibility introduced 2016-10-16 16:00 UTC by Report Bug Copy Issue Report Show Similar Issues like this `60%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
135
136
137
138		// --------------------------------------------------------------------
139		// END OF USER CONFIGURABLE SETTINGS. DO NOT EDIT BELOW THIS LINE
140		// --------------------------------------------------------------------
141
142		/*
143		* ---------------------------------------------------------------
144		* Resolve the system path for increased reliability
145		* ---------------------------------------------------------------
146		*/
147
148		// Set the current directory correctly for CLI requests
149		if (defined('STDIN'))
150		{
151		chdir(dirname(__FILE__));
152		}
153
154		if (realpath($system_path) !== FALSE)
155		{
156		$system_path = realpath($system_path).'/';
157		}
158
159		// ensure there's a trailing slash
160		$system_path = rtrim($system_path, '/').'/';
161
162		// Is the system path correct?
163		if ( ! is_dir($system_path))
164		{
165		exit("Your system folder path does not appear to be set correctly. Please open the following file and correct this: ".pathinfo(__FILE__, PATHINFO_BASENAME));
166		}
167
168		/*
169		* -------------------------------------------------------------------
170		* Now that we know the path, set the main path constants
171		* -------------------------------------------------------------------
172		*/
173		// The name of THIS file
174		define('SELF', pathinfo(__FILE__, PATHINFO_BASENAME));
175
176		// The PHP file extension
177		// this global constant is deprecated.
178		define('EXT', '.php');
179
180		// Path to the system folder
181		define('BASEPATH', str_replace("\\", "/", $system_path));
182
183		// Path to the front controller (this file)
184		define('FCPATH', str_replace(SELF, '', __FILE__));
185
186		// Name of the "system folder"
187		define('SYSDIR', trim(strrchr(trim(BASEPATH, '/'), '/'), '/'));
188
189		//Name of the "assets folder'
190		define('ASSETSDIR', realpath($assets_path).'/');
191
192		// The path to the "application" folder
193		if (is_dir($application_folder))
194		{
195		define('APPPATH', $application_folder.'/');
196		} else
197		{
198		if ( ! is_dir(BASEPATH.$application_folder.'/'))
199		{
200		exit("Your application folder path does not appear to be set correctly. Please open the following file and correct this: ".SELF);
201		}
202
203		define('APPPATH', BASEPATH.$application_folder.'/');
204		}
205
206		/*
207		* --------------------------------------------------------------------
208		* LOAD THE BOOTSTRAP FILE
209		* --------------------------------------------------------------------
210		*
211		* And away we go...
212		*
213		*/
214		require_once BASEPATH.'core/CodeIgniter.php';
215
216		/* End of file index.php */
217		/* Location: ./index.php */
218

iNextrix / ASTPP

Issues (4511)

Security Analysis not enabled

web_interface/astpp/index.php (4 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like