imagecms /
ImageCMS
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | use libraries\Backup; |
||
|
0 ignored issues
–
show
|
|||
| 4 | |||
| 5 | /** |
||
| 6 | * ImageCMS System Update Class |
||
| 7 | * @copyright ImageCMS(c) 2013 |
||
| 8 | * @version 0.1 big start |
||
| 9 | */ |
||
| 10 | class Update |
||
| 11 | { |
||
| 12 | |||
| 13 | private $arr_files; |
||
| 14 | |||
| 15 | private $files_dates = []; |
||
| 16 | |||
| 17 | private $restore_files = []; |
||
| 18 | |||
| 19 | /** |
||
| 20 | * update server |
||
| 21 | * @var string |
||
| 22 | */ |
||
| 23 | private $US = 'http://upd.imagecms.net/'; |
||
| 24 | |||
| 25 | /** |
||
| 26 | * path to update server |
||
| 27 | * @var string |
||
| 28 | */ |
||
| 29 | private $pathUS; |
||
| 30 | |||
| 31 | /** |
||
| 32 | * папки, які не враховувати при обновлені |
||
| 33 | * @var array |
||
| 34 | */ |
||
| 35 | private $distinctDirs = [ |
||
| 36 | '.', |
||
| 37 | '..', |
||
| 38 | '.git', |
||
| 39 | 'uploads', |
||
| 40 | 'cache', |
||
| 41 | 'templates', |
||
| 42 | 'tests', |
||
| 43 | 'captcha', |
||
| 44 | 'nbproject', |
||
| 45 | 'uploads_site', |
||
| 46 | 'backups', |
||
| 47 | 'cmlTemp', |
||
| 48 | ]; |
||
| 49 | |||
| 50 | /** |
||
| 51 | * файли, які не враховувати при обновлені |
||
| 52 | * @var array |
||
| 53 | */ |
||
| 54 | private $distinctFiles = [ |
||
| 55 | 'md5.txt', |
||
| 56 | '.htaccess', |
||
| 57 | 'config.php', |
||
| 58 | ]; |
||
| 59 | |||
| 60 | /** |
||
| 61 | * instance of ci |
||
| 62 | * @var MY_Controller |
||
| 63 | */ |
||
| 64 | public $ci; |
||
| 65 | |||
| 66 | /** |
||
| 67 | * SoapClient |
||
| 68 | * @var SoapClient |
||
| 69 | */ |
||
| 70 | public $client; |
||
| 71 | |||
| 72 | /** |
||
| 73 | * |
||
| 74 | * @var array |
||
| 75 | */ |
||
| 76 | public $settings; |
||
| 77 | |||
| 78 | public function __construct() { |
||
| 79 | |||
| 80 | $this->ci = &get_instance(); |
||
| 81 | $this->pathUS = $this->US . 'application/modules/update/UpdateService.wsdl'; |
||
| 82 | $this->client = new SoapClient($this->pathUS); |
||
| 83 | $this->settings = $this->getSettings(); |
||
|
0 ignored issues
–
show
It seems like
$this->getSettings() of type string is incompatible with the declared type array of property $settings.
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
|
|||
| 84 | } |
||
| 85 | |||
| 86 | /** |
||
| 87 | * check new Version |
||
| 88 | * @return mixed |
||
| 89 | * @throws Exception |
||
| 90 | */ |
||
| 91 | public function getStatus() { |
||
| 92 | |||
| 93 | $domen = $this->ci->input->server('SERVER_NAME'); |
||
| 94 | |||
| 95 | $result = $this->client->getStatus($domen, BUILD_ID, IMAGECMS_NUMBER); |
||
| 96 | |||
| 97 | if (mb_strlen($result) < 5 and $result == !0) { |
||
| 98 | throw new Exception(lang('Cant get status', 'admin')); |
||
| 99 | } |
||
| 100 | $this->setSettings(['newVersion' => $result]); |
||
| 101 | $this->setSettings(['checkTime' => time()]); |
||
| 102 | |||
| 103 | return unserialize($result); |
||
| 104 | } |
||
| 105 | |||
| 106 | /** |
||
| 107 | * getting hash from setting |
||
| 108 | * @return array |
||
| 109 | * @throws Exception |
||
| 110 | */ |
||
| 111 | public function getHashSum() { |
||
| 112 | |||
| 113 | $domen = $this->ci->input->server('SERVER_NAME'); |
||
| 114 | $key = $this->getSettings('careKey'); |
||
| 115 | |||
| 116 | $result = $this->client->getHashSum($domen, IMAGECMS_NUMBER, BUILD_ID, $key); |
||
| 117 | |||
| 118 | $error = (array) json_decode($result); |
||
| 119 | if ($error['error']) { |
||
| 120 | throw new Exception($error['error']); |
||
| 121 | } |
||
| 122 | |||
| 123 | write_file(BACKUPFOLDER . 'md5.txt', $result); |
||
| 124 | $result = (array) json_decode($result); |
||
| 125 | |||
| 126 | $this->setSettings(['checkTime' => time()]); |
||
| 127 | |||
| 128 | return $result; |
||
| 129 | } |
||
| 130 | |||
| 131 | public function getUpdate() { |
||
| 132 | |||
| 133 | ini_set('soap.wsdl_cache_enabled', '0'); |
||
| 134 | $domain = $this->ci->input->server('SERVER_NAME'); |
||
| 135 | |||
| 136 | $href = $this->client->getUpdate($domain, IMAGECMS_NUMBER, $this->settings['careKey']); |
||
| 137 | if (!$href) { |
||
| 138 | throw new Exception(lang('Wrong generated hash code', 'admin')); |
||
| 139 | } |
||
| 140 | |||
| 141 | $all_href = $this->US . 'update/takeUpdate/' . $href . '/' . $domain . '/' . IMAGECMS_NUMBER . '/' . BUILD_ID; |
||
| 142 | file_put_contents(BACKUPFOLDER . 'updates.zip', file_get_contents($all_href)); |
||
| 143 | } |
||
| 144 | |||
| 145 | /** |
||
| 146 | * |
||
| 147 | * @param string $file |
||
| 148 | * @return string |
||
|
0 ignored issues
–
show
Should the return type not be
array? Also, consider making the array more specific, something like array<String>, or String[].
This check compares the return type specified in the If the return type contains the type array, this check recommends the use of
a more specific type like Loading history...
|
|||
| 149 | */ |
||
| 150 | public function getOldMD5File($file = 'md5.txt') { |
||
| 151 | |||
| 152 | return (array) json_decode(read_file($file)); |
||
| 153 | } |
||
| 154 | |||
| 155 | /** |
||
| 156 | * zipping files |
||
| 157 | * @param array $files |
||
| 158 | * @return bool |
||
|
0 ignored issues
–
show
|
|||
| 159 | * @throws Exception |
||
| 160 | */ |
||
| 161 | public function add_to_ZIP($files = []) { |
||
| 162 | |||
| 163 | if (empty($files)) { |
||
| 164 | throw new Exception(lang('Nothing to create', 'admin')); |
||
| 165 | } |
||
| 166 | |||
| 167 | $zip = new ZipArchive(); |
||
| 168 | $filename = BACKUPFOLDER . 'backup.zip'; |
||
| 169 | |||
| 170 | if (file_exists($filename)) { |
||
| 171 | |||
| 172 | $nameFolder = filemtime($filename); |
||
| 173 | rename($filename, BACKUPFOLDER . "$nameFolder.zip"); |
||
| 174 | touch($filename, $nameFolder); |
||
| 175 | |||
| 176 | } |
||
| 177 | |||
| 178 | if ($zip->open($filename, ZipArchive::CREATE) !== true) { |
||
| 179 | throw new Exception(lang('Dont have permissions folder backup', 'admin')); |
||
| 180 | } |
||
| 181 | |||
| 182 | foreach (array_keys($files) as $key) { |
||
| 183 | if (!is_readable('.' . $key)) { |
||
| 184 | continue; |
||
| 185 | } |
||
| 186 | $zip->addFile('.' . $key, $key); |
||
| 187 | } |
||
| 188 | $zip->close(); |
||
| 189 | } |
||
| 190 | |||
| 191 | /** |
||
| 192 | * @throws Exception |
||
| 193 | */ |
||
| 194 | public function createBackUp() { |
||
| 195 | |||
| 196 | $old = $this->getOldMD5File(BACKUPFOLDER . 'md5.txt'); |
||
| 197 | $array = $this->parse_md5(); |
||
| 198 | $diff = array_diff($array, $old); |
||
| 199 | chmod(BACKUPFOLDER, 0755); |
||
| 200 | |||
| 201 | if (!is_writable(BACKUPFOLDER)) { |
||
| 202 | throw new Exception(lang('Dont have permissions folder backup', 'admin')); |
||
| 203 | } |
||
| 204 | |||
| 205 | $this->add_to_ZIP($diff); |
||
| 206 | |||
| 207 | $filename = BACKUPFOLDER . 'backup.zip'; |
||
| 208 | $zip = new ZipArchive(); |
||
| 209 | $zip->open($filename); |
||
| 210 | |||
| 211 | $db = $this->db_backup(); |
||
| 212 | $zip->addFile(BACKUPFOLDER . $db, $db); |
||
| 213 | $zip->close(); |
||
| 214 | |||
| 215 | chmod(BACKUPFOLDER . $db, 0777); |
||
| 216 | unlink(BACKUPFOLDER . $db); |
||
| 217 | } |
||
| 218 | |||
| 219 | /** |
||
| 220 | * restore file to zip |
||
| 221 | * @param string $file |
||
| 222 | * @param mixed|string $destination |
||
| 223 | * @return bool |
||
| 224 | * @throws Exception |
||
| 225 | */ |
||
| 226 | public function restoreFromZIP($file, $destination = FCPATH) { |
||
| 227 | |||
| 228 | if (!$file) { |
||
| 229 | $file = BACKUPFOLDER . 'backup.zip'; |
||
| 230 | } |
||
| 231 | |||
| 232 | if (!file_exists($file) || substr(decoct(fileperms($destination)), 2) != '777') { |
||
| 233 | throw new Exception(lang('Dont have permissions folder backup', 'admin')); |
||
| 234 | } |
||
| 235 | |||
| 236 | $zip = new ZipArchive(); |
||
| 237 | $zip->open($file); |
||
| 238 | $rez = $zip->extractTo($destination); |
||
| 239 | $zip->close(); |
||
| 240 | |||
| 241 | if ($rez) { |
||
| 242 | $this->db_restore($destination . '/backup.sql'); |
||
| 243 | } |
||
| 244 | |||
| 245 | return $rez; |
||
| 246 | } |
||
| 247 | |||
| 248 | /** |
||
| 249 | * Бере контрольні суми файлів текущих файлів і файлів старої теперішньої версії |
||
| 250 | * Записує іх у відповідні файли з настройок, як серіалізований масив ключ - шлях до файлу, значення - контрольна сума |
||
| 251 | * запускати два рази переоприділивши $this->path_parse |
||
| 252 | * $this->path_parse = realpath('') текущі. |
||
| 253 | * $this->path_parse = rtrim($this->dir_old_upd, '\') |
||
| 254 | * @param null|string $directory |
||
| 255 | * @return array |
||
| 256 | */ |
||
| 257 | public function parse_md5($directory = null) { |
||
| 258 | |||
| 259 | $dir = null === $directory ? realpath('') : $directory; |
||
| 260 | |||
| 261 | $handle = opendir($dir); |
||
| 262 | if ($handle) { |
||
| 263 | while (FALSE !== ($file = readdir($handle))) { |
||
| 264 | if (!in_array($file, $this->distinctDirs)) { |
||
| 265 | if (is_file($dir . DIRECTORY_SEPARATOR . $file) && !in_array($file, $this->distinctFiles)) { |
||
| 266 | $this->arr_files[str_replace(realpath(''), '', $dir) . DIRECTORY_SEPARATOR . $file] = md5_file($dir . DIRECTORY_SEPARATOR . $file); |
||
| 267 | $this->files_dates[str_replace(realpath(''), '', $dir) . DIRECTORY_SEPARATOR . $file] = filemtime($dir . DIRECTORY_SEPARATOR . $file); |
||
| 268 | } |
||
| 269 | if (is_dir($dir . DIRECTORY_SEPARATOR . $file)) { |
||
| 270 | $this->parse_md5($dir . DIRECTORY_SEPARATOR . $file); |
||
| 271 | } |
||
| 272 | } |
||
| 273 | } |
||
| 274 | } |
||
| 275 | |||
| 276 | return $this->arr_files; |
||
| 277 | } |
||
| 278 | |||
| 279 | /** |
||
| 280 | * database backup |
||
| 281 | * @return string |
||
| 282 | */ |
||
| 283 | public function db_backup() { |
||
| 284 | |||
| 285 | View Code Duplication | if (is_really_writable(BACKUPFOLDER)) { |
|
| 286 | $this->ci->load->dbutil(); |
||
| 287 | $filePath = Backup::create()->createBackup('sql', 'backup', TRUE); |
||
| 288 | return pathinfo($filePath, PATHINFO_BASENAME); |
||
| 289 | } else { |
||
| 290 | showMessage(langf('Can not create a database snapshot, Check the folder {0} on the ability to record', 'admin', [BACKUPFOLDER])); |
||
| 291 | } |
||
| 292 | } |
||
| 293 | |||
| 294 | /** |
||
| 295 | * database restore |
||
| 296 | * @param string $file |
||
| 297 | * @return boolean |
||
| 298 | */ |
||
| 299 | public function db_restore($file) { |
||
| 300 | |||
| 301 | if (empty($file)) { |
||
| 302 | return FALSE; |
||
| 303 | } |
||
| 304 | |||
| 305 | if (is_readable($file)) { |
||
| 306 | $restore = file_get_contents($file); |
||
| 307 | return $this->query_from_file($restore); |
||
| 308 | } |
||
| 309 | return FALSE; |
||
| 310 | } |
||
| 311 | |||
| 312 | /** |
||
| 313 | * Create restore files list |
||
| 314 | * @return boolean|array |
||
|
0 ignored issues
–
show
|
|||
| 315 | */ |
||
| 316 | public function restore_files_list() { |
||
| 317 | |||
| 318 | if (is_readable(BACKUPFOLDER)) { |
||
| 319 | $dh = opendir(BACKUPFOLDER); |
||
| 320 | while ($filename = readdir($dh)) { |
||
| 321 | if (filetype($filename) != 'dir') { |
||
| 322 | $file_type = ''; |
||
| 323 | preg_match('/\.[a-z]{2,3}/', $filename, $file_type); |
||
| 324 | if ($file_type[0] == '.zip') { |
||
| 325 | $zip = new ZipArchive(); |
||
| 326 | $zip->open(BACKUPFOLDER . $filename); |
||
| 327 | if ($zip->statName('backup.sql')) { |
||
| 328 | $this->restore_files[] = [ |
||
| 329 | 'name' => $filename, |
||
| 330 | 'size' => round(filesize(BACKUPFOLDER . $filename) / 1024 / 1024, 2), |
||
| 331 | 'create_date' => filemtime(BACKUPFOLDER . $filename), |
||
| 332 | ]; |
||
| 333 | } |
||
| 334 | $zip->close(); |
||
| 335 | } |
||
| 336 | } |
||
| 337 | } |
||
| 338 | return $this->restore_files; |
||
| 339 | } else { |
||
| 340 | return FALSE; |
||
| 341 | } |
||
| 342 | } |
||
| 343 | |||
| 344 | /** |
||
| 345 | * remove dir recursive |
||
| 346 | * @param string $dir - path to directory |
||
| 347 | */ |
||
| 348 | public function removeDirRec($dir) { |
||
| 349 | |||
| 350 | if ($objs = glob($dir . '/*')) { |
||
| 351 | foreach ($objs as $obj) { |
||
| 352 | is_dir($obj) ? $this->removeDirRec($obj) : unlink($obj); |
||
| 353 | } |
||
| 354 | } |
||
| 355 | if (is_dir($dir)) { |
||
| 356 | rmdir($dir); |
||
| 357 | } |
||
| 358 | } |
||
| 359 | |||
| 360 | /** |
||
| 361 | * db update |
||
| 362 | * @param string $file_name |
||
| 363 | * @return boolean |
||
| 364 | */ |
||
| 365 | public function db_update($file_name = 'sql_19-08-2013_17.16.14.txt') { |
||
| 366 | |||
| 367 | if (is_readable(BACKUPFOLDER . $file_name)) { |
||
| 368 | $restore = file_get_contents(BACKUPFOLDER . $file_name); |
||
| 369 | return $this->query_from_file($restore); |
||
| 370 | } else { |
||
| 371 | return FALSE; |
||
| 372 | } |
||
| 373 | } |
||
| 374 | |||
| 375 | /** |
||
| 376 | * ganerate sql query from file |
||
| 377 | * @param string $file |
||
| 378 | * @return boolean |
||
| 379 | */ |
||
| 380 | public function query_from_file($file) { |
||
| 381 | |||
| 382 | $string_query = rtrim($file, "\n;"); |
||
| 383 | $array_query = explode(";\n", $string_query); |
||
| 384 | |||
| 385 | foreach ($array_query as $query) { |
||
| 386 | if ($query) { |
||
| 387 | if (!$this->ci->db->query($query)) { |
||
| 388 | echo 'Невозможно виполнить запрос: <br>'; |
||
| 389 | return FALSE; |
||
| 390 | } |
||
| 391 | } |
||
| 392 | } |
||
| 393 | return TRUE; |
||
| 394 | } |
||
| 395 | |||
| 396 | public function get_files_dates() { |
||
| 397 | |||
| 398 | if (!empty($this->files_dates)) { |
||
| 399 | return $this->files_dates; |
||
| 400 | } else { |
||
| 401 | return FALSE; |
||
| 402 | } |
||
| 403 | } |
||
| 404 | |||
| 405 | /** |
||
| 406 | * @param bool|string $param |
||
| 407 | * @return string |
||
| 408 | */ |
||
| 409 | public function getSettings($param = false) { |
||
| 410 | |||
| 411 | $settings = $this->ci->db |
||
| 412 | ->get('settings') |
||
| 413 | ->row_array(); |
||
| 414 | $settings = unserialize($settings['update']); |
||
| 415 | |||
| 416 | if (!$param) { |
||
| 417 | return $settings; |
||
| 418 | } else { |
||
| 419 | return $settings[$param]; |
||
| 420 | } |
||
| 421 | } |
||
| 422 | |||
| 423 | /** |
||
| 424 | * |
||
| 425 | * @param array $settings |
||
| 426 | * @return bool |
||
| 427 | */ |
||
| 428 | public function setSettings($settings) { |
||
| 429 | |||
| 430 | if (!is_array($settings)) { |
||
| 431 | return FALSE; |
||
| 432 | } |
||
| 433 | $s = (array) $this->getSettings(); |
||
| 434 | |||
| 435 | foreach ($settings as $key => $value) { |
||
| 436 | $s[$key] = $value; |
||
| 437 | } |
||
| 438 | |||
| 439 | return $this->ci->db |
||
| 440 | ->set('update', serialize($s)) |
||
| 441 | ->update('settings'); |
||
| 442 | } |
||
| 443 | |||
| 444 | } |
Let’s assume that you have a directory layout like this:
. |-- OtherDir | |-- Bar.php | `-- Foo.php `-- SomeDir `-- Foo.phpand let’s assume the following content of
Bar.php:If both files
OtherDir/Foo.phpandSomeDir/Foo.phpare loaded in the same runtime, you will see a PHP error such as the following:PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.phpHowever, as
OtherDir/Foo.phpdoes not necessarily have to be loaded and the error is only triggered if it is loaded beforeOtherDir/Bar.php, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: