This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Main XMLRPC server class to extend all other Serves from |
||
4 | * |
||
5 | * This version 1.0.0 supports utf8 backend. |
||
6 | * |
||
7 | * Gives ability to encode and decode data correct. |
||
8 | * @category XMLRPC_Server |
||
9 | * @package Intraface_XMLRPC |
||
10 | * @author Sune Jensen <[email protected]> |
||
11 | * @author Lars Olesen <[email protected]> |
||
12 | * @version @package-version@ |
||
13 | */ |
||
14 | |||
15 | /** |
||
16 | * Main XMLRPC server class to extend all other Serves from |
||
17 | * |
||
18 | * This version 1.0.0 supports utf8 backend. |
||
19 | * |
||
20 | * Gives ability to encode and decode data correct. |
||
21 | * @category XMLRPC_Server |
||
22 | * @package Intraface_XMLRPC |
||
23 | * @author Sune Jensen <[email protected]> |
||
24 | * @author Lars Olesen <[email protected]> |
||
25 | * @version @package-version@ |
||
26 | */ |
||
27 | class Intraface_XMLRPC_Server0200 |
||
28 | { |
||
29 | /** |
||
30 | * @var struct $credentials |
||
31 | */ |
||
32 | protected $credentials; |
||
33 | |||
34 | /** |
||
35 | * @var object $kernel intraface kernel |
||
36 | */ |
||
37 | protected $kernel; |
||
38 | |||
39 | /** |
||
40 | * @var array with valid encodings |
||
41 | */ |
||
42 | protected $valid_encodings = array('utf-8'); |
||
43 | |||
44 | /** |
||
45 | * @var string with encoding |
||
46 | */ |
||
47 | protected $encoding = 'utf-8'; |
||
48 | |||
49 | /** |
||
50 | * Constructor |
||
51 | * |
||
52 | * @param string $encoding The encoding wich the server recieves and returns data in |
||
0 ignored issues
–
show
|
|||
53 | * |
||
54 | * @return void |
||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Adding a
@return annotation to constructors is generally not recommended as a constructor does not have a meaningful return value.
Adding a Please refer to the PHP core documentation on constructors. ![]() |
|||
55 | */ |
||
56 | public function __construct() |
||
57 | { |
||
58 | } |
||
59 | |||
60 | /** |
||
61 | * Checks credentials |
||
62 | * |
||
63 | * @param struct $credentials Credentials to use the server |
||
64 | * |
||
65 | * @return array |
||
66 | */ |
||
67 | protected function checkCredentials($credentials) |
||
68 | { |
||
69 | $this->credentials = $credentials; |
||
70 | |||
71 | if (count($credentials) != 2) { // -4 |
||
72 | require_once 'XML/RPC2/Exception.php'; |
||
73 | throw new XML_RPC2_FaultException('wrong argument count in $credentials - got ' . count($credentials) . ' arguments - need 2', -4); |
||
74 | } |
||
75 | if (empty($credentials['private_key'])) { // -5 |
||
76 | require_once 'XML/RPC2/Exception.php'; |
||
77 | throw new XML_RPC2_FaultException('supply a private_key', -5); |
||
78 | } |
||
79 | if (empty($credentials['session_id'])) { // -5 |
||
80 | require_once 'XML/RPC2/Exception.php'; |
||
81 | throw new XML_RPC2_FaultException('supply a session_id', -5); |
||
82 | } |
||
83 | |||
84 | $auth_adapter = new Intraface_Auth_PrivateKeyLogin(MDB2::singleton(DB_DSN), $credentials['session_id'], $credentials['private_key']); |
||
85 | $weblogin = $auth_adapter->auth(); |
||
86 | |||
87 | if (!$weblogin) { |
||
88 | require_once 'XML/RPC2/Exception.php'; |
||
89 | throw new XML_RPC2_FaultException('access to intranet denied', -2); |
||
90 | } |
||
91 | |||
92 | $this->kernel = new Intraface_Kernel($credentials['session_id']); |
||
93 | $this->kernel->weblogin = $weblogin; |
||
0 ignored issues
–
show
The property
weblogin does not seem to exist in Intraface_Kernel .
An attempt at access to an undefined property has been detected. This may either be a typographical error or the property has been renamed but there are still references to its old name. If you really want to allow access to undefined properties, you can define magic methods to allow access. See the php core documentation on Overloading. ![]() |
|||
94 | $this->kernel->intranet = new Intraface_Intranet($weblogin->getActiveIntranetId()); |
||
95 | $this->kernel->setting = new Intraface_Setting($this->kernel->intranet->get('id')); |
||
96 | |||
97 | // makes intranet_id accessable in Doctrine |
||
98 | Intraface_Doctrine_Intranet::singleton($this->kernel->intranet->getId()); |
||
99 | |||
100 | return true; |
||
101 | } |
||
102 | |||
103 | /** |
||
104 | * Prepares response to be sent |
||
105 | * |
||
106 | * @param mixed $values Array or string to decode |
||
107 | * |
||
108 | * @return mixed UTF8 decoded request |
||
109 | */ |
||
110 | protected function prepareResponseData($values) |
||
111 | { |
||
112 | $values = $this->recursiveMap(array($this, 'handleNull'), $values); |
||
113 | return $values; |
||
114 | } |
||
115 | |||
116 | /** |
||
117 | * Process data from client, so that data is returned with the correct encoding. |
||
118 | * |
||
119 | * @param mixed $values Array or string to decode |
||
120 | * |
||
121 | * @return mixed correct encoded response |
||
122 | */ |
||
123 | protected function processRequestData($values) |
||
124 | { |
||
125 | return $values; |
||
126 | } |
||
127 | |||
128 | function handleNull($value) |
||
129 | { |
||
130 | if (is_null($value)) { |
||
131 | return ''; |
||
132 | } |
||
133 | return $value; |
||
134 | } |
||
135 | |||
136 | protected function recursiveMap($function, $values) |
||
137 | { |
||
138 | if (is_string($values)) { |
||
139 | return call_user_func($function, $values); |
||
140 | } elseif (is_null($values)) { |
||
141 | return call_user_func($function, $values); |
||
142 | } elseif (is_array($values)) { |
||
143 | foreach ($values as $key => $value) { |
||
144 | $values[$key] = $this->recursiveMap($function, $value); |
||
145 | } |
||
146 | return $values; |
||
147 | } else { |
||
148 | return $values; |
||
149 | } |
||
150 | } |
||
151 | } |
||
152 |
This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.
Consider the following example. The parameter
$italy
is not defined by the methodfinale(...)
.The most likely cause is that the parameter was removed, but the annotation was not.