This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * // @todo could probably extend ModuleHandler, and therefore not need the |
||
4 | * constant pointing to the modules. |
||
5 | @package Intraface_IntranetMaintenance |
||
6 | */ |
||
7 | 1 | require_once 'Intraface/modules/intranetmaintenance/ModuleMaintenance.php'; |
|
8 | |||
9 | class Intraface_ModuleGateway |
||
10 | { |
||
11 | private $id; |
||
0 ignored issues
–
show
|
|||
12 | private $db; |
||
13 | private $value; |
||
0 ignored issues
–
show
|
|||
14 | public $error; |
||
15 | private $sub_access; |
||
0 ignored issues
–
show
|
|||
16 | |||
17 | 21 | public function __construct(MDB2_Driver_Common $db) |
|
18 | 1 | { |
|
19 | 21 | $this->db = $db; |
|
20 | 21 | $this->error = new Intraface_Error; |
|
21 | 21 | } |
|
22 | |||
23 | function findById($id) |
||
24 | { |
||
25 | return new ModuleMaintenance($id); |
||
26 | } |
||
27 | |||
28 | 20 | function findByName($name) |
|
29 | { |
||
30 | 1 | $result = $this->db->query("SELECT id FROM module WHERE name = ".$this->db->quote($name, 'text')); |
|
31 | 1 | if (PEAR::isError($result)) { |
|
32 | 20 | throw new Exception("Error in query: ".$result->getUserInfo()); |
|
33 | } |
||
34 | |||
35 | 1 | if ($row = $result->fetchRow(MDB2_FETCHMODE_ASSOC)) { |
|
36 | 1 | return new ModuleMaintenance($row['id']); |
|
37 | } else { |
||
38 | throw new Exception("invalid module name ".$name."!"); |
||
39 | } |
||
40 | } |
||
41 | |||
42 | 20 | public function registerByName($module_name) |
|
43 | { |
||
44 | 20 | $db = new DB_Sql; |
|
45 | 20 | $updated_sub_access_id = array(); |
|
46 | 20 | $module_msg = array(); |
|
47 | 20 | $updated_module_id = 0; |
|
48 | |||
49 | 20 | $main_class_name = "Main".ucfirst($module_name); |
|
50 | 20 | $main_class_path = PATH_INCLUDE_MODULE.$module_name."/".$main_class_name.".php"; |
|
51 | |||
52 | |||
53 | 20 | if (!file_exists($main_class_path)) { |
|
54 | 20 | $this->error->set("Filen ".$main_class_path." eksistere ikke!"); |
|
55 | } else { |
||
56 | 20 | include_once $main_class_path; |
|
57 | 20 | $module = new $main_class_name; |
|
58 | |||
59 | 20 | if (!is_object($module)) { |
|
60 | $this->error->set($main_class_name." kunne ikke initialiseres!"); |
||
61 | } else { |
||
62 | // her kan vi oprette tabellerne n�dvendige for det enkelte modul i stedet for at have dem i starten. |
||
63 | |||
64 | 20 | if (empty($module->menu_label) && empty($module->active) && empty($module->menu_index)) { |
|
65 | $this->error->set('Properties for module "'.$module_name.'" er ikke loadet. Kontrol er constructor er sat rigtigt op i modulet'); |
||
66 | } else { |
||
67 | 20 | $sql = "menu_label = \"".$module->getMenuLabel()."\", |
|
68 | 20 | show_menu = ".$module->getShowMenu().", |
|
69 | 20 | active = ".$module->isActive().", |
|
70 | 20 | menu_index = ".intval($module->getMenuIndex()).", |
|
71 | 20 | frontpage_index = ".intval($module->getFrontpageIndex()).", |
|
72 | 20 | required = " . intval($module->isRequired()); |
|
73 | |||
74 | 20 | $db->query("SELECT id FROM module WHERE name = \"".$module_name."\""); |
|
75 | 20 | if ($db->nextRecord()) { |
|
76 | 20 | $module_id = $db->f("id"); |
|
77 | 20 | $db->query("UPDATE module SET ".$sql." WHERE id = ".$module_id); |
|
78 | 20 | $module_msg[$module_name] = "Opdateret"; |
|
79 | 20 | } else { |
|
80 | 1 | $db->query("INSERT INTO module SET name = \"".$module_name."\", ".$sql); |
|
81 | 1 | $module_id = $db->insertedId(); |
|
82 | 1 | $module_msg[$module_name] = "Registreret"; |
|
83 | } |
||
84 | 20 | $db->free(); |
|
85 | |||
86 | 20 | $updated_module_id = $module_id; |
|
87 | 20 | $count_subaccess = count($module->sub_access); |
|
88 | |||
89 | 20 | for ($i = 0; $i < $count_subaccess; $i++) { |
|
90 | 20 | $db->query("SELECT id FROM module_sub_access WHERE module_id = ".$module_id." AND name = \"".$module->sub_access[$i]."\""); |
|
91 | 20 | if ($db->nextRecord()) { |
|
92 | 19 | $updated_sub_access_id[] = $db->f('id'); |
|
93 | 19 | $db->query("UPDATE module_sub_access SET description = \"".$module->sub_access_description[$i]."\", active = 1 WHERE id = ".$db->f("id")); |
|
94 | 19 | } else { |
|
95 | 1 | $db->query("INSERT INTO module_sub_access SET module_id = ".$module_id.", name = \"".$module->sub_access[$i]."\", description = \"".$module->sub_access_description[$i]."\", active = 1"); |
|
96 | 1 | $updated_sub_access_id[] = $db->insertedId(); |
|
97 | } |
||
98 | 20 | $db->free(); |
|
99 | 20 | } |
|
100 | } |
||
101 | } |
||
102 | } |
||
103 | |||
104 | 20 | return array('module_msg' => $module_msg, 'updated_module_id' => $updated_module_id, 'updated_sub_access_id' => $updated_sub_access_id); |
|
105 | } |
||
106 | |||
107 | 19 | public function registerAll() |
|
108 | { |
||
109 | 19 | $msg = array(); |
|
0 ignored issues
–
show
$msg is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
110 | 19 | $module_msg = array(); |
|
111 | 19 | $db = new DB_Sql; |
|
112 | 19 | $updated_sub_access_id = array(); |
|
0 ignored issues
–
show
$updated_sub_access_id is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
113 | |||
114 | 19 | if ($handle = opendir(PATH_INCLUDE_MODULE)) { |
|
115 | 19 | $updated_module_id = array(); |
|
116 | 19 | $updated_sub_access_id = array(); |
|
117 | |||
118 | 19 | while (false !== ($module_name = readdir($handle))) { |
|
119 | 19 | if (substr($module_name, 0, 1) == ".") { |
|
120 | 19 | continue; // starter forfra p� n�ste directory |
|
121 | } |
||
122 | |||
123 | 19 | if (substr($module_name, 0, 5) == "_old_") { |
|
124 | // Det er et slettet modul - det f�r lov at blive uden en besked |
||
125 | continue; |
||
126 | } |
||
127 | |||
128 | 19 | if (!preg_match("/^[a-z0-9]+$/", $module_name)) { |
|
129 | $this->error->set($module_name." er et ugyldigt navn"); |
||
130 | // $msg[] = $module_name." er et ugyldigt navn"; |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
55% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
131 | continue; // starter forfra p� n�ste directory |
||
132 | } |
||
133 | |||
134 | 19 | $updated = $this->registerByName($module_name); |
|
135 | |||
136 | 19 | $updated_module_id[] = (int)$updated['updated_module_id']; |
|
137 | 19 | $updated_sub_access_id = array_merge($updated_sub_access_id, $updated['updated_sub_access_id']); |
|
138 | 19 | $module_msg = array_merge($module_msg, $updated['module_msg']); |
|
139 | 19 | } |
|
140 | |||
141 | // S�tte alle moduler som ikke l�ngere eksistere til active = 0 |
||
142 | 19 | View Code Duplication | if (count($updated_module_id) > 0) { |
143 | 19 | $db->query("UPDATE module SET active = 0 WHERE id NOT IN (".implode(",", $updated_module_id).")"); |
|
144 | 19 | $module_msg['update'] = $db->affectedRows()." moduler er fjernet og blevet deaktiveret.<br />"; |
|
145 | 19 | } |
|
146 | |||
147 | 19 | View Code Duplication | if (count($updated_sub_access_id) > 0) { |
148 | 19 | $db->query("UPDATE module_sub_access SET active = 0 WHERE id NOT IN (".implode(",", $updated_sub_access_id).")"); |
|
149 | 19 | $module_msg['update'] .= $db->affectedRows()." sub access' er fjernet og blevet deaktiveret."; |
|
150 | 19 | } |
|
151 | 19 | } |
|
152 | |||
153 | 19 | return $module_msg; |
|
154 | } |
||
155 | |||
156 | public function getList() |
||
157 | { |
||
158 | $db = new DB_Sql; |
||
159 | |||
160 | $i = 0; |
||
161 | $result = $this->db->query("SELECT id, name, menu_label, show_menu, menu_index, frontpage_index FROM module WHERE active = 1 ORDER BY menu_index"); |
||
162 | if (PEAR::isError($result)) { |
||
163 | throw new Exception("Error in query: ".$result->getUserInfo()); |
||
164 | } |
||
165 | |||
166 | while ($row = $result->fetchRow()) { |
||
167 | $value[$i] = $row; |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$value was never initialized. Although not strictly required by PHP, it is generally a good practice to add $value = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
168 | |||
169 | $j = 0; |
||
170 | $db->query("SELECT id, name, description FROM module_sub_access WHERE active = 1 AND module_id = ".$row['id']." ORDER BY description"); |
||
171 | while ($db->nextRecord()) { |
||
172 | $value[$i]["sub_access"][$j]["id"] = $db->f("id"); |
||
0 ignored issues
–
show
The variable
$value does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() |
|||
173 | $value[$i]["sub_access"][$j]["name"] = $db->f("name"); |
||
174 | $value[$i]["sub_access"][$j]["description"] = $db->f("description"); |
||
175 | $j++; |
||
176 | } |
||
177 | $i++; |
||
178 | } |
||
179 | |||
180 | return $value; |
||
181 | } |
||
182 | } |
||
183 |
This check marks private properties in classes that are never used. Those properties can be removed.