Issues (188)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

readFlights.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * \file    mypage.php
4
 * \ingroup mymodule
5
 * \brief   Example PHP page.
6
 *
7
 * read flights
8
 */
9
10
// Load Dolibarr environment
11
if (false === (@include '../main.inc.php')) {  // From htdocs directory
12
    require '../../documents/custom/main.inc.php'; // From "custom" directory
13
}
14
15
global $db, $langs, $user, $conf;
16
17
dol_include_once('/core/class/dolgraph.class.php');
18
dol_include_once("/flightlog/flightlog.inc.php");
19
20
use flightlog\query\GetPilotsWithMissionsQuery;
21
use flightlog\query\GetPilotsWithMissionsQueryHandler;
22
23
$langs->load("mymodule@flightlog");
24
25
// Get parametersI
26
//TODO get all parameters from here
27
$id = GETPOST('id', 'int');
28
$action = GETPOST('action', 'alpha');
29
$myparam = GETPOST('myparam', 'alpha');
30
31
$unitPriceMission = $conf->global->BBC_FLIGHT_LOG_UNIT_PRICE_MISSION;
32
33
//variables
34
$WIDTH = DolGraph::getDefaultGraphSizeForStats('width', 768);
35
$HEIGHT = DolGraph::getDefaultGraphSizeForStats('height');
36
37
$year = strftime("%Y", dol_now());
38
$dir = $conf->expensereport->dir_temp;
39
40
$filenamenb = $dir . "/test2-" . $year . ".png";
41
$fileurlnb = DOL_URL_ROOT . '/viewimage.php?modulepart=flightlog&amp;file=' . $fileurlnb;
42
43
$graphByTypeAndYear = new DolGraph();
44
$mesg = $graphByTypeAndYear->isGraphKo();
45
if (!$mesg) {
46
    $data = getGraphByTypeAndYearData();
47
    $graphByTypeAndYear->SetData($data->export());
48
    $graphByTypeAndYear->SetPrecisionY(0);
49
50
    $legend = [];
51
    $graphByTypeAndYear->type = [];
52
    foreach (fetchBbcFlightTypes() as $flightType) {
53
54
        if (!in_array($flightType->numero, [1, 2, 3, 6])) {
55
            continue;
56
        }
57
58
        $legend[] = $flightType->nom;
59
        $graphByTypeAndYear->type[] = "lines";
60
    }
61
    $graphByTypeAndYear->SetLegend($legend);
62
    $graphByTypeAndYear->SetMaxValue($graphByTypeAndYear->GetCeilMaxValue());
63
    $graphByTypeAndYear->SetWidth($WIDTH + 100);
64
    $graphByTypeAndYear->SetHeight($HEIGHT);
65
    $graphByTypeAndYear->SetYLabel($langs->trans("YEAR"));
66
    $graphByTypeAndYear->SetShading(3);
67
    $graphByTypeAndYear->SetHorizTickIncrement(1);
68
    $graphByTypeAndYear->SetPrecisionY(0);
69
70
    $graphByTypeAndYear->SetTitle($langs->trans("Par type et par année"));
71
72
    $graphByTypeAndYear->draw($filenamenb, $fileurlnb);
73
}
74
75
// Default action
76
if (empty($action) && empty($id) && empty($ref)) {
77
    $action = 'create';
78
}
79
80
// Load object if id or ref is provided as parameter
81
$object = new Bbcvols($db);
82 View Code Duplication
if (($id > 0 || !empty($ref)) && $action != 'add') {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
83
    $result = $object->fetch($id, $ref);
84
    if ($result < 0) {
85
        dol_print_error($db);
86
    }
87
}
88
89
/*
90
 * ACTIONS
91
 *
92
 * Put here all code to do according to value of "action" parameter
93
 */
94
95
/*
96
 * VIEW
97
 *
98
 * Put here all code to build page
99
 */
100
101
llxHeader('', $langs->trans('Read flights'), '');
102
103
$form = new Form($db);
104
105
// Put here content of your page
106
$data = array();
107
$tmp = array();
108
$legend = array();
109
110
//tableau par pilote
111
$sqlYear = "SELECT DISTINCT(YEAR(llx_bbc_vols.date)) as annee FROM llx_bbc_vols ";
112
$resql_years = $db->query($sqlYear);
113
114
$num = $db->num_rows($resql_years);
115
$i = 0;
116
if ($num) {
117
    print '<div class="tabs">';
118
    print '<a class="tabTitle"><img src="../theme/eldy/img/object_user.png" border="0" alt="" title=""> Recap / utilisateur </a>'; //title
119
120
    while ($i < $num) {
121
        $obj = $db->fetch_object($resql_years); //vol
122
        if ($obj->annee) {
123
            print '<a class="tab" id="' . (GETPOST("year") == $obj->annee || (!GETPOST("year") && $obj->annee == date("Y")) ? 'active' : '') . '" " href="readFlights.php?year=' . $obj->annee . '">' . $obj->annee . '</a>';
124
        }
125
        $i++;
126
    }
127
    print '</div>';
128
}
129
130
131
print '<div class="tabBar">';
132
print '<table class="" width="100%">';
133
134
print '<tbody>';
135
print '<tr class="liste_titre">';
136
print '<td colspan="2">Nom</td>';
137
print '<td class="liste_titre" colspan="2">' . $langs->trans("Type 1 : Sponsor") . '</td>';
138
print '<td class="liste_titre" colspan="2">' . $langs->trans("Type 2 : Baptême") . '</td>';
139
print '<td class="liste_titre" colspan="2">' . $langs->trans("Organisateur_(T1/T2)") . '</td>';
140
print '<td class="liste_titre" colspan="2">' . $langs->trans("Instructeur (orga T6)") . '</td>';
141
print '<td class="liste_titre" >' . $langs->trans("Total bonus") . '</td>';
142
print '<td class="liste_titre" colspan="2">' . $langs->trans("Type 3 : Privé") . '</td>';
143
print '<td class="liste_titre" colspan="2">' . $langs->trans("Type 4: Meeting") . '</td>';
144
print '<td class="liste_titre" colspan="1">' . $langs->trans("Type 5: Chambley") . '</td>';
145
print '<td class="liste_titre" colspan="2">' . $langs->trans("Type 6: instruction") . '</td>';
146
print '<td class="liste_titre" colspan="2">' . $langs->trans("Type 7: vols < 50 ") . '</td>';
147
print '<td class="liste_titre" colspan="1">' . $langs->trans("Facture") . '</td>';
148
print '<td class="liste_titre" colspan="1">' . $langs->trans("A payer") . '</td>';
149
print '<tr>';
150
151
print '<tr class="liste_titre">';
152
print '<td colspan="2" class="liste_titre"></td>';
153
154
print '<td class="liste_titre"> # </td>';
155
print '<td class="liste_titre"> Pts </td>';
156
157
print '<td class="liste_titre"> # </td>';
158
print '<td class="liste_titre"> Pts </td>';
159
160
print '<td class="liste_titre"> # </td>';
161
print '<td class="liste_titre"> Pts </td>';
162
163
print '<td class="liste_titre"> # </td>';
164
print '<td class="liste_titre"> Pts </td>';
165
166
print '<td class="liste_titre"> Bonus gagnés </td>';
167
168
print '<td class="liste_titre"> # </td>';
169
print '<td class="liste_titre"> € </td>';
170
171
print '<td class="liste_titre"> # </td>';
172
print '<td class="liste_titre"> € </td>';
173
174
print '<td class="liste_titre"> # </td>';
175
176
print '<td class="liste_titre"> # </td>';
177
print '<td class="liste_titre"> € </td>';
178
179
print '<td class="liste_titre"> #</td>';
180
print '<td class="liste_titre"> €</td>';
181
182
print '<td class="liste_titre"> € </td>';
183
print '<td class="liste_titre"> Balance (A payer) €</td>';
184
185
print'</tr>';
186
$tableQuery = new BillableFlightQuery(true, (GETPOST("year") ?: date("Y")));
187
$tableQueryHandler = new BillableFlightQueryHandler($db, $conf->global);
188
189
$total = 0;
190
$totalT1 = 0;
191
$totalT2 = 0;
192
$totalT3 = 0;
193
$totalT4 = 0;
194
$totalT5 = 0;
195
$totalT6 = 0;
196
$totalT7 = 0;
197
/**
198
 * @var int   $key
199
 * @var Pilot $pilot
200
 */
201
foreach ($tableQueryHandler->__invoke($tableQuery) as $key => $pilot) {
202
    $total += $pilot->getTotalBill()->getValue();
203
    $totalT1 += $pilot->getCountForType('1')->getCount();
204
    $totalT2 += $pilot->getCountForType('2')->getCount();
205
    $totalT3 += $pilot->getCountForType('3')->getCount();
206
    $totalT4 += $pilot->getCountForType('4')->getCount();
207
    $totalT5 += $pilot->getCountForType('5')->getCount();
208
    $totalT6 += $pilot->getCountForType('6')->getCount();
209
    $totalT7 += $pilot->getCountForType('7')->getCount();
210
211
    print '<tr class="oddeven">';
212
    print '<td>' . $pilot->getId() . '</td>';
213
    print '<td>' . $pilot->getName() . '</td>';
214
215
    print '<td>' . $pilot->getCountForType('1')->getCount() . '</td>';
216
    print '<td>' . $pilot->getCountForType('1')->getCost()->getValue() . '</td>';
217
218
    print '<td>' . $pilot->getCountForType('2')->getCount() . '</td>';
219
    print '<td>' . $pilot->getCountForType('2')->getCost()->getValue() . '</td>';
220
221
    print '<td>' . $pilot->getCountForType('orga')->getCount() . '</td>';
222
    print '<td>' . $pilot->getCountForType('orga')->getCost()->getValue() . '</td>';
223
224
    print '<td>' . $pilot->getCountForType('orga_T6')->getCount() . '</td>';
225
    print '<td>' . $pilot->getCountForType('orga_T6')->getCost()->getValue() . '</td>';
226
227
    print '<td><b>' . $pilot->getFlightBonus()->getValue() . '</b></td>';
228
229
    print '<td>' . $pilot->getCountForType('3')->getCount() . '</td>';
230
    print '<td>' . price($pilot->getCountForType('3')->getCost()->getValue()) . '€</td>';
231
232
    print '<td>' . $pilot->getCountForType('4')->getCount() . '</td>';
233
    print '<td>' . price($pilot->getCountForType('4')->getCost()->getValue()) . '€</td>';
234
235
    print '<td>' . $pilot->getCountForType('5')->getCount() . '</td>';
236
237
    print '<td>' . $pilot->getCountForType('6')->getCount() . '</td>';
238
    print '<td>' . price($pilot->getCountForType('6')->getCost()->getValue()) . '€</td>';
239
240
    print '<td>' . $pilot->getCountForType('7')->getCount() . '</td>';
241
    print '<td>' . price($pilot->getCountForType('7')->getCost()->getValue()) . '€</td>';
242
243
    print '<td>' . price($pilot->getFlightsCost()->getValue()) . '€ </td>';
244
    print '<td><b>' . price($pilot->getTotalBill()->getValue()) . '€</b></td>';
245
    print '</tr>';
246
}
247
248
print '<tr class="oddeven">';
249
print '<td></td>';
250
print '<td></td>';
251
252
print '<td>' . $totalT1 . '</td>';
253
print '<td></td>';
254
255
print '<td>' . $totalT2 . '</td>';
256
print '<td>' . '</td>';
257
258
print '<td>' . '</td>';
259
print '<td>' . '</td>';
260
261
print '<td>' . '</td>';
262
print '<td>' . '</td>';
263
264
print '<td><b>' . '</b></td>';
265
266
print '<td>' . $totalT3 . '</td>';
267
print '<td></td>';
268
269
print '<td>' . $totalT4. '</td>';
270
print '<td></td>';
271
272
print '<td>' . $totalT5 . '</td>';
273
274
print '<td>' . $totalT6 . '</td>';
275
print '<td></td>';
276
277
print '<td>' . $totalT7 . '</td>';
278
print '<td></td>';
279
280
print '<td>Total à reçevoir </td>';
281
print "<td>" . price($total) . "€</td>";
282
print '</tr>';
283
284
285
print '</tbody>';
286
print'</table>';
287
288
289
print '<br/>';
290
print '<h3>' . $langs->trans("Remboursement aux pilotes") . '</h3>';
291
292
//table km
293
$tauxRemb = isset($conf->global->BBC_FLIGHT_LOG_TAUX_REMB_KM) ? $conf->global->BBC_FLIGHT_LOG_TAUX_REMB_KM : 0;
294
$year = GETPOST("year", 'int');
295
if(empty($year)){
296
    $year = date('Y');
297
}
298
299
$queryHandler = new GetPilotsWithMissionsQueryHandler($db);
300
$query = new GetPilotsWithMissionsQuery($year);
301
302
printBbcKilometersByQuartil($queryHandler->__invoke($query), $tauxRemb, $unitPriceMission);
303
304
print '</div>';
305
306
print '<br/>';
307
308
print '<div class="tabsAction">';
309
310
311
if ($conf->facture->enabled && $user->rights->flightlog->vol->status && $user->rights->flightlog->vol->financialGenerateDocuments) {
312
    print '<a class="butAction" href="generateBilling.php?year=' . (GETPOST("year",
313
            'int') ?: date("Y")) . '">Générer Factures</a>';
314
}
315
316
if ($conf->expensereport->enabled && $user->rights->flightlog->vol->financialGenerateDocuments) {
317
    print '<a class="butAction" href="generateExpenseNote.php?year=' . (GETPOST("year",
318
            'int') ?: date("Y")) . '">Générer notes de frais</a>';
319
}
320
321
print '</div>';
322
323
324
?>
325
326
327
    <div class="fichecenter">
328
        <?php print $graphByTypeAndYear->show(); ?>
329
    </div>
330
331
<?php
332
llxFooter();
333