This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
|||||||||||
2 | /** |
|||||||||||
3 | * Styrer hvilket intranet man arbejder i |
|||||||||||
4 | * |
|||||||||||
5 | * @author Sune Jensen <[email protected]> |
|||||||||||
6 | * @author Lars Olesen <[email protected]> |
|||||||||||
7 | * @version 002 |
|||||||||||
8 | */ |
|||||||||||
9 | class Intraface_Intranet extends Intraface_Standard |
|||||||||||
10 | { |
|||||||||||
11 | /** |
|||||||||||
12 | * @var object |
|||||||||||
13 | */ |
|||||||||||
14 | public $address; |
|||||||||||
15 | ||||||||||||
16 | /** |
|||||||||||
17 | * @var array |
|||||||||||
18 | */ |
|||||||||||
19 | public $value; |
|||||||||||
20 | ||||||||||||
21 | /** |
|||||||||||
22 | * @var integer |
|||||||||||
23 | */ |
|||||||||||
24 | protected $id; |
|||||||||||
25 | ||||||||||||
26 | /** |
|||||||||||
27 | * @var object |
|||||||||||
28 | */ |
|||||||||||
29 | private $db; |
|||||||||||
30 | ||||||||||||
31 | /** |
|||||||||||
32 | * @var array |
|||||||||||
33 | */ |
|||||||||||
34 | protected $permissions; |
|||||||||||
35 | ||||||||||||
36 | /** |
|||||||||||
37 | * Constructor |
|||||||||||
38 | * |
|||||||||||
39 | * @param integer $intranet_id The id of the intranet |
|||||||||||
0 ignored issues
–
show
|
||||||||||||
40 | * |
|||||||||||
41 | * @return void |
|||||||||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Adding a
@return annotation to constructors is generally not recommended as a constructor does not have a meaningful return value.
Adding a Please refer to the PHP core documentation on constructors. ![]() |
||||||||||||
42 | */ |
|||||||||||
43 | 5 | function __construct($id) |
||||||||||
44 | { |
|||||||||||
45 | 5 | $this->id = intval($id); |
||||||||||
46 | 5 | $this->db = MDB2::singleton(DB_DSN); |
||||||||||
47 | 5 | $this->error = new Intraface_Error(); |
||||||||||
0 ignored issues
–
show
The property
error does not exist. Did you maybe forget to declare it?
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { }
$x = new MyClass();
$x->foo = true;
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass {
public $foo;
}
$x = new MyClass();
$x->foo = true;
![]() |
||||||||||||
48 | ||||||||||||
49 | 5 | if (!$this->load()) { |
||||||||||
0 ignored issues
–
show
The expression
$this->load() of type integer|null is loosely compared to false ; this is ambiguous if the integer can be zero. You might want to explicitly use === null instead.
In PHP, under loose comparison (like For 0 == false // true
0 == null // true
123 == false // false
123 == null // false
// It is often better to use strict comparison
0 === false // false
0 === null // false
![]() |
||||||||||||
50 | throw new Exception('unknown intranet'); |
|||||||||||
51 | } |
|||||||||||
52 | 5 | } |
||||||||||
53 | ||||||||||||
54 | function getName() |
|||||||||||
55 | { |
|||||||||||
56 | return $this->get('name'); |
|||||||||||
57 | } |
|||||||||||
58 | ||||||||||||
59 | /** |
|||||||||||
60 | * loads |
|||||||||||
61 | * |
|||||||||||
62 | * @return void |
|||||||||||
63 | */ |
|||||||||||
64 | 23 | function load() |
||||||||||
65 | { |
|||||||||||
66 | 23 | $this->db = MDB2::singleton(DB_DSN); |
||||||||||
67 | 23 | $result = $this->db->query("SELECT |
||||||||||
68 | id, |
|||||||||||
69 | name, |
|||||||||||
70 | identifier, |
|||||||||||
71 | key_code, |
|||||||||||
72 | public_key, |
|||||||||||
73 | contact_id, |
|||||||||||
74 | private_key, |
|||||||||||
75 | pdf_header_file_id, |
|||||||||||
76 | maintained_by_user_id |
|||||||||||
77 | FROM intranet |
|||||||||||
78 | 23 | WHERE id = ".$this->db->quote($this->id, 'integer')); |
||||||||||
79 | ||||||||||||
80 | 23 | if (PEAR::isError($result)) { |
||||||||||
81 | throw new Exception($result->getUserInfo()); |
|||||||||||
82 | } |
|||||||||||
83 | ||||||||||||
84 | 23 | View Code Duplication | if ($row = $result->fetchRow(MDB2_FETCHMODE_ASSOC)) { |
|||||||||
85 | 23 | $this->value = $row; |
||||||||||
86 | 23 | $this->address = $this->getAddress(); |
||||||||||
87 | 23 | return $this->id; |
||||||||||
88 | } else { |
|||||||||||
89 | $this->id = 0; |
|||||||||||
90 | 1 | return 0; |
||||||||||
91 | } |
|||||||||||
92 | $result->free(); |
|||||||||||
0 ignored issues
–
show
$result->free(); does not seem to be reachable.
This check looks for unreachable code. It uses sophisticated control flow analysis techniques to find statements which will never be executed. Unreachable code is most often the result of function fx() {
try {
doSomething();
return true;
}
catch (\Exception $e) {
return false;
}
return false;
}
In the above example, the last ![]() |
||||||||||||
93 | } |
|||||||||||
94 | ||||||||||||
95 | 23 | public function getAddress() |
||||||||||
96 | { |
|||||||||||
97 | 23 | return ($this->address = Intraface_Address::factory('intranet', $this->id)); |
||||||||||
0 ignored issues
–
show
|
||||||||||||
98 | } |
|||||||||||
99 | ||||||||||||
100 | /** |
|||||||||||
101 | * Returns whether the intranet has access to the module |
|||||||||||
102 | * |
|||||||||||
103 | * @todo might be smarter to throw in an actual module object |
|||||||||||
104 | * that would make us sure that it is actually valid |
|||||||||||
105 | * |
|||||||||||
106 | * @param mixed $module The id or name of the module |
|||||||||||
107 | * |
|||||||||||
108 | * @return void |
|||||||||||
109 | */ |
|||||||||||
110 | 2 | function hasModuleAccess($module) |
||||||||||
111 | { |
|||||||||||
112 | 2 | $filename = PATH_INCLUDE_MODULE . $module . '/Main' . ucfirst($module) . '.php'; |
||||||||||
113 | 2 | View Code Duplication | if (file_exists($filename)) { |
|||||||||
114 | 2 | require_once $filename; |
||||||||||
115 | 2 | $module_class = 'Main'.ucfirst($module); |
||||||||||
116 | 2 | $module_object = new $module_class; |
||||||||||
117 | 2 | if ($module_object->isShared()) { |
||||||||||
118 | return true; |
|||||||||||
119 | } |
|||||||||||
120 | 2 | if ($module_object->isRequired()) { |
||||||||||
121 | return true; |
|||||||||||
122 | } |
|||||||||||
123 | 2 | } |
||||||||||
124 | ||||||||||||
125 | 2 | if (is_string($module)) { |
||||||||||
126 | 2 | View Code Duplication | if (empty($this->modules)) { |
|||||||||
127 | 2 | $result = $this->db->query("SELECT id, name FROM module WHERE active = 1"); |
||||||||||
128 | 2 | while ($row = $result->fetchRow(MDB2_FETCHMODE_ASSOC)) { |
||||||||||
129 | 2 | $this->modules[$row['name']] = $row['id']; |
||||||||||
0 ignored issues
–
show
The property
modules does not exist. Did you maybe forget to declare it?
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code: class MyClass { }
$x = new MyClass();
$x->foo = true;
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: class MyClass {
public $foo;
}
$x = new MyClass();
$x->foo = true;
![]() |
||||||||||||
130 | 2 | } |
||||||||||
131 | 2 | $result->free(); |
||||||||||
132 | 2 | } |
||||||||||
133 | ||||||||||||
134 | 2 | View Code Duplication | if (!empty($this->modules[$module])) { |
|||||||||
135 | 2 | $module_id = $this->modules[$module]; |
||||||||||
136 | 2 | } else { |
||||||||||
137 | throw new Exception('intranet says invalid module name '.$module); |
|||||||||||
138 | } |
|||||||||||
139 | 2 | } else { |
||||||||||
140 | $module_id = intval($module); |
|||||||||||
141 | } |
|||||||||||
142 | ||||||||||||
143 | 2 | if (!empty($this->permissions)) { |
||||||||||
144 | if (!empty($this->permissions['intranet']['module'][$module_id]) and $this->permissions['intranet']['module'][$module_id] == true) { |
|||||||||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Using logical operators such as
and instead of && is generally not recommended.
PHP has two types of connecting operators (logical operators, and boolean operators):
The difference between these is the order in which they are executed. In most cases,
you would want to use a boolean operator like Let’s take a look at a few examples: // Logical operators have lower precedence:
$f = false or true;
// is executed like this:
($f = false) or true;
// Boolean operators have higher precedence:
$f = false || true;
// is executed like this:
$f = (false || true);
Logical Operators are used for Control-FlowOne case where you explicitly want to use logical operators is for control-flow such as this: $x === 5
or die('$x must be 5.');
// Instead of
if ($x !== 5) {
die('$x must be 5.');
}
Since // The following is currently a parse error.
$x === 5
or throw new RuntimeException('$x must be 5.');
These limitations lead to logical operators rarely being of use in current PHP code. ![]() |
||||||||||||
145 | return true; |
|||||||||||
146 | } |
|||||||||||
147 | return false; |
|||||||||||
148 | } |
|||||||||||
149 | ||||||||||||
150 | 2 | $result = $this->db->query("SELECT module_id FROM permission WHERE intranet_id = ".$this->db->quote($this->id, 'integer')." AND user_id = 0"); |
||||||||||
151 | 2 | while ($row = $result->fetchRow(MDB2_FETCHMODE_ASSOC)) { |
||||||||||
152 | 2 | $this->permissions['intranet']['module'][$row['module_id']] = true; |
||||||||||
153 | 2 | } |
||||||||||
154 | 2 | $result->free(); |
||||||||||
155 | ||||||||||||
156 | 2 | if (!empty($this->permissions['intranet']['module'][$module_id]) and $this->permissions['intranet']['module'][$module_id] == true) { |
||||||||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Using logical operators such as
and instead of && is generally not recommended.
PHP has two types of connecting operators (logical operators, and boolean operators):
The difference between these is the order in which they are executed. In most cases,
you would want to use a boolean operator like Let’s take a look at a few examples: // Logical operators have lower precedence:
$f = false or true;
// is executed like this:
($f = false) or true;
// Boolean operators have higher precedence:
$f = false || true;
// is executed like this:
$f = (false || true);
Logical Operators are used for Control-FlowOne case where you explicitly want to use logical operators is for control-flow such as this: $x === 5
or die('$x must be 5.');
// Instead of
if ($x !== 5) {
die('$x must be 5.');
}
Since // The following is currently a parse error.
$x === 5
or throw new RuntimeException('$x must be 5.');
These limitations lead to logical operators rarely being of use in current PHP code. ![]() |
||||||||||||
157 | 1 | return true; |
||||||||||
158 | } |
|||||||||||
159 | 1 | return false; |
||||||||||
160 | } |
|||||||||||
161 | ||||||||||||
162 | /** |
|||||||||||
163 | * Returns the id of the intranet |
|||||||||||
164 | * |
|||||||||||
165 | * @return integer |
|||||||||||
166 | */ |
|||||||||||
167 | function getId() |
|||||||||||
168 | { |
|||||||||||
169 | return $this->id; |
|||||||||||
170 | } |
|||||||||||
171 | } |
|||||||||||
172 |
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.
Consider the following example. The parameter
$italy
is not defined by the methodfinale(...)
.The most likely cause is that the parameter was removed, but the annotation was not.