Issues (992)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/pear/Image/Transform/Driver/GD1.php (13 issues)

1
<?php
2
// +----------------------------------------------------------------------+
3
// | PHP Version 4                                                        |
4
// +----------------------------------------------------------------------+
5
// | Copyright (c) 1997-2003 The PHP Group                                |
6
// +----------------------------------------------------------------------+
7
// | This source file is subject to version 2.02 of the PHP license,      |
8
// | that is bundled with this package in the file LICENSE, and is        |
9
// | available at through the world-wide-web at                           |
10
// | http://www.php.net/license/2_02.txt.                                 |
11
// | If you did not receive a copy of the PHP license and are unable to   |
12
// | obtain it through the world-wide-web, please send a note to          |
13
// | [email protected] so we can mail you a copy immediately.               |
14
// +----------------------------------------------------------------------+
15
// | Authors: Peter Bowyer <[email protected]>                      |
16
// |          Alan Knowles <[email protected]>                            |
17
// +----------------------------------------------------------------------+
18
19
//require_once __DIR__ . '/Image/Transform/Driver/GD.php';
20
require_once XOOPS_ROOT_PATH . '/modules/extgallery/class/pear/Image/Transform/Driver/GD.php';
21
22
/**
23
 * This driver is for GD1 or the non-bundled version of GD2
24
 *
25
 * @package
26
 * @author    NAWAL ASWAN
27
 * @copyright Copyright (c) 2003
28
 * @version   $Id: GD1.php 234123 2007-04-19 16:36:09Z dufuz $
29
 * @access    public
30
 **/
31
class Image_Transform_Driver_GD1 extends Image_Transform_Driver_GD
32
{
33
    /**
34
     * Check settings
35
     *
36
     * @return mixed true or  or a PEAR error object on error
37
     *
38
     * @see PEAR::isError()
39
     */
40
    public function Image_Transform_Driver_GD1()
41
    {
42
        $this->__construct();
43
    }
44
45
    // End function Image
46
47
    /**
48
     * Check settings
49
     *
50
     * @return mixed true or  or a PEAR error object on error
51
     *
52
     * @see PEAR::isError()
53
     */
54
    public function __construct()
55
    {
56
        parent::__construct();
57
    }
58
59
    // End function Image
60
61
    /**
62
     * Resize Action
63
     *
64
     * For GD 2.01+ the new copyresampled function is used
65
     * It uses a bicubic interpolation algorithm to get far
66
     * better result.
67
     *
68
     * @param int   $new_x   new width
69
     * @param int   $new_y   new height
70
     * @param mixed $options Optional parameters
71
     *
72
     * @return true on success or PEAR Error object on error
73
     * @see PEAR::isError()
74
     */
75
    public function _resize($new_x, $new_y, $options = null)
76
    {
77
        if (true === $this->resized) {
78
            return PEAR::raiseError('You have already resized the image without saving it.  Your previous resizing will be overwritten', null, PEAR_ERROR_TRIGGER, E_USER_NOTICE);
0 ignored issues
show
The method raiseError() does not exist on PEAR. Since you implemented __callStatic, consider adding a @method annotation. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

78
            return PEAR::/** @scrutinizer ignore-call */ raiseError('You have already resized the image without saving it.  Your previous resizing will be overwritten', null, PEAR_ERROR_TRIGGER, E_USER_NOTICE);
Loading history...
79
        }
80
        $new_img = imagecreate($new_x, $new_y);
81
        imagecopyresized($new_img, $this->imageHandle, 0, 0, 0, 0, $new_x, $new_y, $this->img_x, $this->img_y);
82
        $this->old_image   = $this->imageHandle;
0 ignored issues
show
Bug Best Practice introduced by
The property old_image does not exist. Although not strictly required by PHP, it is generally a best practice to declare properties explicitly.
Loading history...
83
        $this->imageHandle = $new_img;
0 ignored issues
show
Documentation Bug introduced by
It seems like $new_img can also be of type GdImage. However, the property $imageHandle is declared as type resource. Maybe add an additional type check?

Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.

For example, imagine you have a variable $accountId that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the id property of an instance of the Account class. This class holds a proper account, so the id value must no longer be false.

Either this assignment is in error or a type check should be added for that assignment.

class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
Loading history...
84
        $this->resized     = true;
85
86
        $this->new_x = $new_x;
87
        $this->new_y = $new_y;
88
89
        return true;
90
    }
91
92
    /**
93
     * @param int  $angle
94
     * @param null $options
0 ignored issues
show
Documentation Bug introduced by
Are you sure the doc-type for parameter $options is correct as it would always require null to be passed?
Loading history...
95
     * @return bool|object|\PEAR_Error
96
     */
97
    public function rotate($angle, $options = null)
98
    {
99
        if (null === $options) {
0 ignored issues
show
The condition null === $options is always true.
Loading history...
100
            $autoresize = true;
101
            $color_mask = [255, 255, 0];
102
        } else {
103
            extract($options);
104
        }
105
106
        while ($angle <= -45) {
107
            $angle += 360;
108
        }
109
        while ($angle > 270) {
110
            $angle -= 360;
111
        }
112
113
        $t = deg2rad($angle);
114
115
        if (!is_array($color_mask)) {
0 ignored issues
show
The condition is_array($color_mask) is always true.
Loading history...
116
            // Not already in numberical format, so we convert it.
117
            if ('#' == $color_mask[0]) {
118
                $color_mask = $this->colorhex2colorarray($color_mask);
119
            } else {
120
                require_once __DIR__ . '/Image/Transform/Driver/ColorsDefs.php';
121
                $color_mask = $colornames[$color_mask] ?? false;
122
            }
123
        }
124
125
        // Do not round it, too much lost of quality
126
        $cosT = cos($t);
127
        $sinT = sin($t);
128
129
        $img = &$this->imageHandle;
130
131
        $width  = $max_x = $this->img_x;
132
        $height = $max_y = $this->img_y;
133
        $min_y  = 0;
134
        $min_x  = 0;
135
136
        $x1 = round($max_x / 2, 0);
137
        $y1 = round($max_y / 2, 0);
138
139
        if ($autoresize) {
0 ignored issues
show
The condition $autoresize is always true.
Loading history...
140
            $t = abs($t);
141
            $a = round($angle, 0);
0 ignored issues
show
The assignment to $a is dead and can be removed.
Loading history...
142
            switch ((int)$angle) {
143
                case 0:
144
                    $width2  = $width;
145
                    $height2 = $height;
146
                    break;
147
                case 90:
148
                    $width2  = $height;
149
                    $height2 = $width;
150
                    break;
151
                case 180:
152
                    $width2  = $width;
153
                    $height2 = $height;
154
                    break;
155
                case 270:
156
                    $width2  = $height;
157
                    $height2 = $width;
158
                    break;
159
                default:
160
                    $width2  = (int)abs(sin($t) * $height + cos($t) * $width);
161
                    $height2 = (int)abs(cos($t) * $height + sin($t) * $width);
162
            }
163
164
            $width2  -= $width2 % 2;
165
            $height2 -= $height2 % 2;
166
167
            $d_width  = abs($width - $width2);
168
            $d_height = abs($height - $height2);
169
            $x_offset = $d_width / 2;
170
            $y_offset = $d_height / 2;
171
            $min_x2   = -abs($x_offset);
172
            $min_y2   = -abs($y_offset);
173
            $max_x2   = $width2;
174
            $max_y2   = $height2;
175
        }
176
177
        $img2 = @imagecreatetruecolor($width2, $height2);
178
179
        if (!is_resource($img2)) {
180
            return PEAR::raiseError('Cannot create buffer for the rotataion.', null, PEAR_ERROR_TRIGGER, E_USER_NOTICE);
181
        }
182
183
        $this->img_x = $width2;
184
        $this->img_y = $height2;
185
186
        imagepalettecopy($img2, $img);
187
188
        $mask = imagecolorresolve($img2, $color_mask[0], $color_mask[1], $color_mask[2]);
189
190
        // use simple lines copy for axes angles
191
        switch ((int)$angle) {
192
            case 0:
193
                imagefill($img2, 0, 0, $mask);
194
                for ($y = 0; $y < $max_y; $y++) {
195
                    for ($x = $min_x; $x < $max_x; $x++) {
196
                        $c = @imagecolorat($img, $x, $y);
197
                        imagesetpixel($img2, $x + $x_offset, $y + $y_offset, $c);
0 ignored issues
show
$x + $x_offset of type double is incompatible with the type integer expected by parameter $x of imagesetpixel(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

197
                        imagesetpixel($img2, /** @scrutinizer ignore-type */ $x + $x_offset, $y + $y_offset, $c);
Loading history...
$y + $y_offset of type double is incompatible with the type integer expected by parameter $y of imagesetpixel(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

197
                        imagesetpixel($img2, $x + $x_offset, /** @scrutinizer ignore-type */ $y + $y_offset, $c);
Loading history...
198
                    }
199
                }
200
                break;
201
            case 90:
202
                imagefill($img2, 0, 0, $mask);
203
                for ($x = $min_x; $x < $max_x; $x++) {
204
                    for ($y = $min_y; $y < $max_y; $y++) {
205
                        $c = imagecolorat($img, $x, $y);
206
                        imagesetpixel($img2, $max_y - $y - 1, $x, $c);
207
                    }
208
                }
209
                break;
210
            case 180:
211
                imagefill($img2, 0, 0, $mask);
212
                for ($y = 0; $y < $max_y; $y++) {
213
                    for ($x = $min_x; $x < $max_x; $x++) {
214
                        $c = @imagecolorat($img, $x, $y);
215
                        imagesetpixel($img2, $max_x2 - $x - 1, $max_y2 - $y - 1, $c);
216
                    }
217
                }
218
                break;
219
            case 270:
220
                imagefill($img2, 0, 0, $mask);
221
                for ($y = 0; $y < $max_y; $y++) {
222
                    for ($x = $max_x; $x >= $min_x; $x--) {
223
                        $c = @imagecolorat($img, $x, $y);
224
                        imagesetpixel($img2, $y, $max_x - $x - 1, $c);
225
                    }
226
                }
227
                break;
228
            // simple reverse rotation algo
229
            default:
230
                $i = 0;
0 ignored issues
show
The assignment to $i is dead and can be removed.
Loading history...
231
                for ($y = $min_y2; $y < $max_y2; $y++) {
232
                    // Algebra :)
233
                    $x2 = round((($min_x2 - $x1) * $cosT) + (($y - $y1) * $sinT + $x1), 0);
234
                    $y2 = round(($y - $y1) * $cosT - ($min_x2 - $x1) * $sinT + $y1, 0);
235
236
                    for ($x = $min_x2; $x < $max_x2; $x++) {
237
                        // Check if we are out of original bounces, if we are
238
                        // use the default color mask
239
                        if ($x2 >= 0 && $x2 < $max_x && $y2 >= 0 && $y2 < $max_y) {
240
                            $c = imagecolorat($img, $x2, $y2);
0 ignored issues
show
$y2 of type double is incompatible with the type integer expected by parameter $y of imagecolorat(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

240
                            $c = imagecolorat($img, $x2, /** @scrutinizer ignore-type */ $y2);
Loading history...
$x2 of type double is incompatible with the type integer expected by parameter $x of imagecolorat(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

240
                            $c = imagecolorat($img, /** @scrutinizer ignore-type */ $x2, $y2);
Loading history...
241
                        } else {
242
                            $c = $mask;
243
                        }
244
                        imagesetpixel($img2, $x + $x_offset, $y + $y_offset, $c);
245
246
                        // round verboten!
247
                        $x2 += $cosT;
248
                        $y2 -= $sinT;
249
                    }
250
                }
251
                break;
252
        }
253
254
        $this->imageHandle = $img2;
255
256
        return true;
257
    }
258
} // End class ImageGD
259