Issues (733)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/pcltrace.lib.php (1 issue)

1
<?php
2
// --------------------------------------------------------------------------------
3
// PhpConcept Library (PCL) Trace 1.0
4
// --------------------------------------------------------------------------------
5
// License GNU/GPL - Vincent Blavet - Janvier 2001
6
// http://www.phpconcept.net & http://phpconcept.free.fr
7
// --------------------------------------------------------------------------------
8
// Français :
9
//   La description de l'usage de la librairie PCL Trace 1.0 n'est pas encore
10
//   disponible. Celle-ci n'est pour le moment distribuée qu'avec l'application
11
//   et la librairie PhpZip.
12
//   Une version indépendante sera bientot disponible sur http://www.phpconcept.net
13
//
14
// English :
15
//   The PCL Trace 1.0 library description is not available yet. This library is
16
//   released only with PhpZip application and library.
17
//   An independant release will be soon available on http://www.phpconcept.net
18
//
19
// --------------------------------------------------------------------------------
20
//
21
//   * Avertissement :
22
//
23
//   Cette librairie a été créée de façon non professionnelle.
24
//   Son usage est au risque et péril de celui qui l'utilise, en aucun cas l'auteur
25
//   de ce code ne pourra être tenu pour responsable des éventuels dégats qu'il pourrait
26
//   engendrer.
27
//   Il est entendu cependant que l'auteur a réalisé ce code par plaisir et n'y a
28
//   caché aucun virus, ni malveillance.
29
//   Cette libairie est distribuée sous la license GNU/GPL (https://www.gnu.org)
30
//
31
//   * Auteur :
32
//
33
//   Ce code a été écrit par Vincent Blavet ([email protected]) sur son temps
34
//   de loisir.
35
//
36
// --------------------------------------------------------------------------------
37
38
// ----- Look for double include
39
if (!defined('PCLTRACE_LIB')) {
40
    define('PCLTRACE_LIB', 1);
41
42
    // ----- Version
43
    $g_pcl_trace_version = '1.0';
44
45
    // ----- Internal variables
46
    // These values must be change by PclTrace library functions
47
    $g_pcl_trace_mode     = 'memory';
48
    $g_pcl_trace_filename = 'trace.txt';
49
    $g_pcl_trace_name     = [];
50
    $g_pcl_trace_index    = 0;
51
    $g_pcl_trace_level    = 0;
52
    //$g_pcl_trace_entries = [];
53
54
    // --------------------------------------------------------------------------------
55
    // Function : TrOn($p_level, $p_mode, $p_filename)
56
    // Description :
57
    // Parameters :
58
    //   $p_level : Trace level
59
    //   $p_mode : Mode of trace displaying :
60
    //             'normal' : messages are displayed at function call
61
    //             'memory' : messages are memorized in a table and can be display by
62
    //                        TrDisplay() function. (default)
63
    //             'log'    : messages are writed in the file $p_filename
64
    // --------------------------------------------------------------------------------
65
    /**
66
     * @param int    $p_level
67
     * @param string $p_mode
68
     * @param string $p_filename
69
     */
70
    function TrOn($p_level = 1, $p_mode = 'memory', $p_filename = 'trace.txt')
71
    {
72
        global $g_pcl_trace_level;
73
        global $g_pcl_trace_mode;
74
        global $g_pcl_trace_filename;
75
        global $g_pcl_trace_name;
76
        global $g_pcl_trace_index;
77
        global $g_pcl_trace_entries;
78
79
        // ----- Enable trace mode
80
        $g_pcl_trace_level = $p_level;
81
82
        // ----- Memorize mode and filename
83
        switch ($p_mode) {
84
            case 'normal':
85
            case 'memory':
86
            case 'log':
87
                $g_pcl_trace_mode = $p_mode;
88
                break;
89
            default:
90
                $g_pcl_trace_mode = 'logged';
91
        }
92
93
        // ----- Memorize filename
94
        $g_pcl_trace_filename = $p_filename;
95
    }
96
97
    // --------------------------------------------------------------------------------
98
99
    // --------------------------------------------------------------------------------
100
    // Function : IsTrOn()
101
    // Description :
102
    // Return value :
103
    //   The trace level (0 for disable).
104
    // --------------------------------------------------------------------------------
105
    /**
106
     * @return int
107
     */
108
    function IsTrOn()
109
    {
110
        global $g_pcl_trace_level;
111
112
        return $g_pcl_trace_level;
113
    }
114
115
    // --------------------------------------------------------------------------------
116
117
    // --------------------------------------------------------------------------------
118
    // Function : TrOff()
119
    // Description :
120
    // Parameters :
121
    // --------------------------------------------------------------------------------
122
    function TrOff()
123
    {
124
        global $g_pcl_trace_level;
125
        global $g_pcl_trace_mode;
126
        global $g_pcl_trace_filename;
127
        global $g_pcl_trace_name;
128
        global $g_pcl_trace_index;
129
130
        // ----- Clean
131
        $g_pcl_trace_mode = 'memory';
132
        unset($g_pcl_trace_entries, $g_pcl_trace_name, $g_pcl_trace_index);
133
134
        // ----- Switch off trace
135
        $g_pcl_trace_level = 0;
136
    }
137
138
    // --------------------------------------------------------------------------------
139
140
    // --------------------------------------------------------------------------------
141
    // Function : TrFctStart()
142
    // Description :
143
    //   Just a trace function for debbugging purpose before I use a better tool !!!!
144
    //   Start and stop of this function is by $g_pcl_trace_level global variable.
145
    // Parameters :
146
    //   $p_level : Level of trace required.
147
    // --------------------------------------------------------------------------------
148
    /**
149
     * @param        $p_file
150
     * @param        $p_line
151
     * @param        $p_name
152
     * @param string $p_param
153
     * @param string $p_message
154
     */
155
    function TrFctStart($p_file, $p_line, $p_name, $p_param = '', $p_message = '')
156
    {
157
        global $g_pcl_trace_level;
158
        global $g_pcl_trace_mode;
159
        global $g_pcl_trace_filename;
160
        global $g_pcl_trace_name;
161
        global $g_pcl_trace_index;
162
        global $g_pcl_trace_entries;
163
164
        // ----- Look for disabled trace
165
        if ($g_pcl_trace_level < 1) {
166
            return;
167
        }
168
169
        // ----- Add the function name in the list
170
        if (!isset($g_pcl_trace_name)) {
171
            $g_pcl_trace_name = $p_name;
172
        } else {
173
            $g_pcl_trace_name .= ',' . $p_name;
174
        }
175
176
        // ----- Update the function entry
177
        $i                                  = count($g_pcl_trace_entries);
178
        $g_pcl_trace_entries[$i]['name']    = $p_name;
179
        $g_pcl_trace_entries[$i]['param']   = $p_param;
180
        $g_pcl_trace_entries[$i]['message'] = '';
181
        $g_pcl_trace_entries[$i]['file']    = $p_file;
182
        $g_pcl_trace_entries[$i]['line']    = $p_line;
183
        $g_pcl_trace_entries[$i]['index']   = $g_pcl_trace_index;
184
        $g_pcl_trace_entries[$i]['type']    = '1'; // means start of function
185
186
        // ----- Update the message entry
187
        if ('' != $p_message) {
188
            $i                                  = count($g_pcl_trace_entries);
189
            $g_pcl_trace_entries[$i]['name']    = '';
190
            $g_pcl_trace_entries[$i]['param']   = '';
191
            $g_pcl_trace_entries[$i]['message'] = $p_message;
192
            $g_pcl_trace_entries[$i]['file']    = $p_file;
193
            $g_pcl_trace_entries[$i]['line']    = $p_line;
194
            $g_pcl_trace_entries[$i]['index']   = $g_pcl_trace_index;
195
            $g_pcl_trace_entries[$i]['type']    = '3'; // means message
196
        }
197
198
        // ----- Action depending on mode
199
        PclTraceAction($g_pcl_trace_entries[$i]);
200
201
        // ----- Increment the index
202
        ++$g_pcl_trace_index;
203
    }
204
205
    // --------------------------------------------------------------------------------
206
207
    // --------------------------------------------------------------------------------
208
    // Function : TrFctEnd()
209
    // Description :
210
    //   Just a trace function for debbugging purpose before I use a better tool !!!!
211
    //   Start and stop of this function is by $g_pcl_trace_level global variable.
212
    // Parameters :
213
    //   $p_level : Level of trace required.
214
    // --------------------------------------------------------------------------------
215
    /**
216
     * @param        $p_file
217
     * @param        $p_line
218
     * @param int    $p_return
219
     * @param string $p_message
220
     */
221
    function TrFctEnd($p_file, $p_line, $p_return = 1, $p_message = '')
222
    {
223
        global $g_pcl_trace_level;
224
        global $g_pcl_trace_mode;
225
        global $g_pcl_trace_filename;
226
        global $g_pcl_trace_name;
227
        global $g_pcl_trace_index;
228
        global $g_pcl_trace_entries;
229
230
        // ----- Look for disabled trace
231
        if ($g_pcl_trace_level < 1) {
232
            return;
233
        }
234
235
        // ----- Extract the function name in the list
236
        // ----- Remove the function name in the list
237
        if (!($v_name = mb_strrchr($g_pcl_trace_name, ','))) {
238
            $v_name           = $g_pcl_trace_name;
239
            $g_pcl_trace_name = '';
240
        } else {
241
            $g_pcl_trace_name = mb_substr($g_pcl_trace_name, 0, -mb_strlen($v_name));
242
            $v_name           = mb_substr($v_name, -mb_strlen($v_name) + 1);
243
        }
244
245
        // ----- Decrement the index
246
        --$g_pcl_trace_index;
247
248
        // ----- Update the message entry
249
        if ('' != $p_message) {
250
            $i                                  = count($g_pcl_trace_entries);
251
            $g_pcl_trace_entries[$i]['name']    = '';
252
            $g_pcl_trace_entries[$i]['param']   = '';
253
            $g_pcl_trace_entries[$i]['message'] = $p_message;
254
            $g_pcl_trace_entries[$i]['file']    = $p_file;
255
            $g_pcl_trace_entries[$i]['line']    = $p_line;
256
            $g_pcl_trace_entries[$i]['index']   = $g_pcl_trace_index;
257
            $g_pcl_trace_entries[$i]['type']    = '3'; // means message
258
        }
259
260
        // ----- Update the function entry
261
        $i                                  = count($g_pcl_trace_entries);
262
        $g_pcl_trace_entries[$i]['name']    = $v_name;
263
        $g_pcl_trace_entries[$i]['param']   = $p_return;
264
        $g_pcl_trace_entries[$i]['message'] = '';
265
        $g_pcl_trace_entries[$i]['file']    = $p_file;
266
        $g_pcl_trace_entries[$i]['line']    = $p_line;
267
        $g_pcl_trace_entries[$i]['index']   = $g_pcl_trace_index;
268
        $g_pcl_trace_entries[$i]['type']    = '2'; // means end of function
269
270
        // ----- Action depending on mode
271
        PclTraceAction($g_pcl_trace_entries[$i]);
272
    }
273
274
    // --------------------------------------------------------------------------------
275
276
    // --------------------------------------------------------------------------------
277
    // Function : TrFctMessage()
278
    // Description :
279
    // Parameters :
280
    // --------------------------------------------------------------------------------
281
    /**
282
     * @param        $p_file
283
     * @param        $p_line
284
     * @param        $p_level
285
     * @param string $p_message
286
     */
287
    function TrFctMessage($p_file, $p_line, $p_level, $p_message = '')
288
    {
289
        global $g_pcl_trace_level;
290
        global $g_pcl_trace_mode;
291
        global $g_pcl_trace_filename;
292
        global $g_pcl_trace_name;
293
        global $g_pcl_trace_index;
294
        global $g_pcl_trace_entries;
295
296
        // ----- Look for disabled trace
297
        if ($g_pcl_trace_level < $p_level) {
298
            return;
299
        }
300
301
        // ----- Update the entry
302
        $i                                  = count($g_pcl_trace_entries);
303
        $g_pcl_trace_entries[$i]['name']    = '';
304
        $g_pcl_trace_entries[$i]['param']   = '';
305
        $g_pcl_trace_entries[$i]['message'] = $p_message;
306
        $g_pcl_trace_entries[$i]['file']    = $p_file;
307
        $g_pcl_trace_entries[$i]['line']    = $p_line;
308
        $g_pcl_trace_entries[$i]['index']   = $g_pcl_trace_index;
309
        $g_pcl_trace_entries[$i]['type']    = '3'; // means message of function
310
311
        // ----- Action depending on mode
312
        PclTraceAction($g_pcl_trace_entries[$i]);
313
    }
314
315
    // --------------------------------------------------------------------------------
316
317
    // --------------------------------------------------------------------------------
318
    // Function : TrMessage()
319
    // Description :
320
    // Parameters :
321
    // --------------------------------------------------------------------------------
322
    /**
323
     * @param        $p_file
324
     * @param        $p_line
325
     * @param        $p_level
326
     * @param string $p_message
327
     */
328
    function TrMessage($p_file, $p_line, $p_level, $p_message = '')
329
    {
330
        global $g_pcl_trace_level;
331
        global $g_pcl_trace_mode;
332
        global $g_pcl_trace_filename;
333
        global $g_pcl_trace_name;
334
        global $g_pcl_trace_index;
335
        global $g_pcl_trace_entries;
336
337
        // ----- Look for disabled trace
338
        if ($g_pcl_trace_level < $p_level) {
339
            return;
340
        }
341
342
        // ----- Update the entry
343
        $i                                  = count($g_pcl_trace_entries);
344
        $g_pcl_trace_entries[$i]['name']    = '';
345
        $g_pcl_trace_entries[$i]['param']   = '';
346
        $g_pcl_trace_entries[$i]['message'] = $p_message;
347
        $g_pcl_trace_entries[$i]['file']    = $p_file;
348
        $g_pcl_trace_entries[$i]['line']    = $p_line;
349
        $g_pcl_trace_entries[$i]['index']   = $g_pcl_trace_index;
350
        $g_pcl_trace_entries[$i]['type']    = '4'; // means simple message
351
352
        // ----- Action depending on mode
353
        PclTraceAction($g_pcl_trace_entries[$i]);
354
    }
355
356
    // --------------------------------------------------------------------------------
357
358
    // --------------------------------------------------------------------------------
359
    // Function : TrDisplay()
360
    // Description :
361
    // Parameters :
362
    // --------------------------------------------------------------------------------
363
    function TrDisplay()
364
    {
365
        global $g_pcl_trace_level;
366
        global $g_pcl_trace_mode;
367
        global $g_pcl_trace_filename;
368
        global $g_pcl_trace_name;
369
        global $g_pcl_trace_index;
370
        global $g_pcl_trace_entries;
371
372
        // ----- Look for disabled trace
373
        if (($g_pcl_trace_level <= 0) || ('memory' !== $g_pcl_trace_mode)) {
374
            return;
375
        }
376
377
        $v_font = '"Verdana, Arial, Helvetica, sans-serif"';
378
379
        // ----- Trace Header
380
        echo '<table width=100% border=0 cellspacing=0 cellpadding=0>';
381
        echo '<tr bgcolor=#0000CC>';
382
        echo '<td bgcolor=#0000CC width=1>';
383
        echo '</td>';
384
        echo "<td><div align=center><span style='font-size: small; color: #FFFFFF; font-family: $v_font;'>Trace</span></div></td>";
385
        echo '</tr>';
386
        echo '<tr>';
387
        echo '<td bgcolor=#0000CC width=1>';
388
        echo '</td>';
389
        echo '<td>';
390
391
        // ----- Content header
392
        echo '<table width=100% border=0 cellspacing=0 cellpadding=0>';
393
394
        // ----- Display
395
        $v_again = 0;
0 ignored issues
show
The assignment to $v_again is dead and can be removed.
Loading history...
396
        for ($i = 0, $iMax = count($g_pcl_trace_entries); $i < $iMax; ++$i) {
397
            // ---- Row header
398
            echo '<tr>';
399
            echo '<td><table width=100% border=0 cellspacing=0 cellpadding=0><tr>';
400
            $n = ($g_pcl_trace_entries[$i]['index'] + 1) * 10;
401
            echo '<td width=' . $n . '><table width=100% border=0 cellspacing=0 cellpadding=0><tr>';
402
403
            for ($j = 0; $j <= $g_pcl_trace_entries[$i]['index']; ++$j) {
404
                if ($j == $g_pcl_trace_entries[$i]['index']) {
405
                    if ((1 == $g_pcl_trace_entries[$i]['type']) || (2 == $g_pcl_trace_entries[$i]['type'])) {
406
                        echo "<td width=10><div align=center><span style='font-size: x-small; font-family: $v_font; '>+</span></div></td>";
407
                    }
408
                } else {
409
                    echo "<td width=10><span style='font-size: x-small; font-family: $v_font; '>|</span></td>";
410
                }
411
            }
412
            //echo "<td>&nbsp</td>";
413
            echo '</tr></table></td>';
414
415
            echo '<td width=2></td>';
416
            switch ($g_pcl_trace_entries[$i]['type']) {
417
                case 1:
418
                    echo "<td><span style='font-size: x-small; font-family: $v_font; '>" . $g_pcl_trace_entries[$i]['name'] . '(' . $g_pcl_trace_entries[$i]['param'] . ')</span></td>';
419
                    break;
420
                case 2:
421
                    echo "<td><span style='font-size: x-small; font-family: $v_font; '>" . $g_pcl_trace_entries[$i]['name'] . '()=' . $g_pcl_trace_entries[$i]['param'] . '</span></td>';
422
                    break;
423
                case 3:
424
                case 4:
425
                    echo '<td><table width=100% border=0 cellspacing=0 cellpadding=0><td width=20></td><td>';
426
                    echo "<span style='font-size: x-small; font-family: $v_font; '>" . $g_pcl_trace_entries[$i]['message'] . '</span>';
427
                    echo '</td></table></td>';
428
                    break;
429
                default:
430
                    echo "<td><span style='font-size: x-small; font-family: $v_font; '>" . $g_pcl_trace_entries[$i]['name'] . '(' . $g_pcl_trace_entries[$i]['param'] . ')</span></td>';
431
            }
432
            echo '</tr></table></td>';
433
            echo '<td width=5></td>';
434
            echo '<td><span style="font-size: xx-small; font-family: $v_font; ">' . basename($g_pcl_trace_entries[$i]['file']) . '</span></td>';
435
            echo '<td width=5></td>';
436
            echo '<td><span style="font-size: xx-small; font-family: $v_font; ">' . $g_pcl_trace_entries[$i]['line'] . '</span></td>';
437
            echo '</tr>';
438
        }
439
440
        // ----- Content footer
441
        echo '</table>';
442
443
        // ----- Trace footer
444
        echo '</td>';
445
        echo '<td bgcolor=#0000CC width=1>';
446
        echo '</td>';
447
        echo '</tr>';
448
        echo '<tr bgcolor=#0000CC>';
449
        echo '<td bgcolor=#0000CC width=1>';
450
        echo '</td>';
451
        echo "<td><div align=center><span style='color: #FFFFFF; font-family: $v_font;'>&nbsp</span></div></td>";
452
        echo '</tr>';
453
        echo '</table>';
454
    }
455
456
    // --------------------------------------------------------------------------------
457
458
    // --------------------------------------------------------------------------------
459
    // Function : PclTraceAction()
460
    // Description :
461
    // Parameters :
462
    // --------------------------------------------------------------------------------
463
    /**
464
     * @param $p_entry
465
     */
466
    function PclTraceAction($p_entry)
467
    {
468
        global $g_pcl_trace_level;
469
        global $g_pcl_trace_mode;
470
        global $g_pcl_trace_filename;
471
        global $g_pcl_trace_name;
472
        global $g_pcl_trace_index;
473
        global $g_pcl_trace_entries;
474
475
        if ('normal' === $g_pcl_trace_mode) {
476
            for ($i = 0; $i < $p_entry['index']; ++$i) {
477
                echo '---';
478
            }
479
            if (1 == $p_entry['type']) {
480
                echo '<b>' . $p_entry['name'] . '</b>(' . $p_entry['param'] . ') : ' . $p_entry['message'] . ' [' . $p_entry['file'] . ', ' . $p_entry['line'] . ']<br>';
481
            } else {
482
                if (2 == $p_entry['type']) {
483
                    echo '<b>' . $p_entry['name'] . '</b>()=' . $p_entry['param'] . ' : ' . $p_entry['message'] . ' [' . $p_entry['file'] . ', ' . $p_entry['line'] . ']<br>';
484
                } else {
485
                    echo $p_entry['message'] . ' [' . $p_entry['file'] . ', ' . $p_entry['line'] . ']<br>';
486
                }
487
            }
488
        }
489
    }
490
491
    // --------------------------------------------------------------------------------
492
493
    // ----- End of double include look
494
}
495