Issues (889)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

tests/bootstrap.php (18 issues)

1
<?php
2
3
declare(strict_types=1);
4
5
namespace {
6
7
// Define XOOPS constants expected by the module configuration files
8
if (!\defined('XOOPS_ROOT_PATH')) {
9
    \define('XOOPS_ROOT_PATH', \dirname(__DIR__));
10
}
11
if (!\defined('XOOPS_URL')) {
12
    \define('XOOPS_URL', 'https://xoops.invalid');
13
}
14
if (!\defined('XOOPS_UPLOAD_PATH')) {
15
    \define('XOOPS_UPLOAD_PATH', XOOPS_ROOT_PATH . '/uploads');
16
}
17
if (!\defined('XOOPS_UPLOAD_URL')) {
18
    \define('XOOPS_UPLOAD_URL', XOOPS_URL . '/uploads');
19
}
20
if (!\defined('_EDIT')) {
21
    \define('_EDIT', 'Edit');
22
}
23
if (!\defined('_DELETE')) {
24
    \define('_DELETE', 'Delete');
25
}
26
if (!\defined('_CLONE')) {
27
    \define('_CLONE', 'Clone');
28
}
29
if (!\defined('_PREVIEW')) {
30
    \define('_PREVIEW', 'Preview');
31
}
32
if (!\defined('_PRINT')) {
33
    \define('_PRINT', 'Print');
34
}
35
if (!\defined('_PDF')) {
36
    \define('_PDF', 'Pdf');
37
}
38
if (!\defined('_ADD')) {
39
    \define('_ADD', 'Add');
40
}
41
if (!\defined('_OFF')) {
42
    \define('_OFF', 'Off');
43
}
44
if (!\defined('_ON')) {
45
    \define('_ON', 'On');
46
}
47
if (!\defined('XOBJ_DTYPE_INT')) {
48
    \define('XOBJ_DTYPE_INT', 1);
49
}
50
if (!\defined('XOBJ_DTYPE_TXTAREA')) {
51
    \define('XOBJ_DTYPE_TXTAREA', 2);
52
}
53
if (!\defined('XOBJ_DTYPE_TXTBOX')) {
54
    \define('XOBJ_DTYPE_TXTBOX', 3);
55
}
56
if (!\defined('XOBJ_DTYPE_ENUM')) {
57
    \define('XOBJ_DTYPE_ENUM', 4);
58
}
59
60
// Provide a minimal $xoops helper with the path() method expected by the module
61
if (!isset($GLOBALS['xoops'])) {
62
    $GLOBALS['xoops'] = new class {
63
        public function path(string $path): string
64
        {
65
            return XOOPS_ROOT_PATH . '/' . \ltrim($path, '/');
66
        }
67
    };
68
}
69
70
// Lightweight stubs that mimic the pieces of XOOPS used by the tests
71
if (!\class_exists('XoopsObject')) {
72
    abstract class XoopsObject
73
    {
74
        /** @var array<string,mixed> */
75
        protected $vars = [];
76
        /** @var bool */
77
        protected $isNew = true;
78
79
        public function __construct()
80
        {
81
        }
82
83
        public function initVar($key, $type, $default = null, $required = false, $maxlength = null): void
0 ignored issues
show
The parameter $required is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

83
        public function initVar($key, $type, $default = null, /** @scrutinizer ignore-unused */ $required = false, $maxlength = null): void

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $type is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

83
        public function initVar($key, /** @scrutinizer ignore-unused */ $type, $default = null, $required = false, $maxlength = null): void

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $maxlength is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

83
        public function initVar($key, $type, $default = null, $required = false, /** @scrutinizer ignore-unused */ $maxlength = null): void

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
84
        {
85
            $this->vars[$key] = $default;
86
        }
87
88
        public function setVar(string $key, $value): void
89
        {
90
            $this->vars[$key] = $value;
91
        }
92
93
        public function assignVars(array $values): void
94
        {
95
            foreach ($values as $key => $value) {
96
                $this->setVar($key, $value);
97
            }
98
            $this->unsetNew();
99
        }
100
101
        public function getVar(string $key)
102
        {
103
            return $this->vars[$key] ?? null;
104
        }
105
106
        public function setNew(): void
107
        {
108
            $this->isNew = true;
109
        }
110
111
        public function unsetNew(): void
112
        {
113
            $this->isNew = false;
114
        }
115
116
        public function isNew(): bool
117
        {
118
            return $this->isNew;
119
        }
120
    }
121
}
122
123
if (!\class_exists('XoopsPersistableObjectHandler')) {
124
    abstract class XoopsPersistableObjectHandler
125
    {
126
        /** @var array<int|string,XoopsObject> */
127
        protected $objects = [];
128
        /** @var string */
129
        protected $className;
130
        /** @var string */
131
        protected $keyName;
132
133
        public function __construct($db = null, string $table = '', string $className = '', string $keyName = '', string $identifierName = '')
0 ignored issues
show
The parameter $table is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

133
        public function __construct($db = null, /** @scrutinizer ignore-unused */ string $table = '', string $className = '', string $keyName = '', string $identifierName = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $db is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

133
        public function __construct(/** @scrutinizer ignore-unused */ $db = null, string $table = '', string $className = '', string $keyName = '', string $identifierName = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $identifierName is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

133
        public function __construct($db = null, string $table = '', string $className = '', string $keyName = '', /** @scrutinizer ignore-unused */ string $identifierName = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
134
        {
135
            $this->className = $className;
136
            $this->keyName   = $keyName;
137
        }
138
139
        public function create(bool $isNew = true): XoopsObject
140
        {
141
            $class = $this->className;
142
            /** @var XoopsObject $object */
143
            $object = new $class();
144
            if ($isNew) {
145
                $object->setNew();
146
            } else {
147
                $object->unsetNew();
148
            }
149
150
            return $object;
151
        }
152
153
        public function insert(XoopsObject $object)
154
        {
155
            $key = $object->getVar($this->keyName);
156
            $this->objects[$key] = $object;
157
158
            return $key;
159
        }
160
161
        public function get($id)
162
        {
163
            return $this->objects[$id] ?? null;
164
        }
165
    }
166
}
167
168
if (!\class_exists('XoopsDatabaseFactory')) {
169
    class XoopsDatabaseFactory
170
    {
171
        public static function getDatabaseConnection()
172
        {
173
            return new XoopsMySQLDatabase();
174
        }
175
    }
176
}
177
178
if (!\class_exists('XoopsDatabase')) {
179
    class XoopsDatabase
180
    {
181
    }
182
}
183
184
if (!\class_exists('XoopsMySQLDatabase')) {
185
    class XoopsMySQLDatabase extends XoopsDatabase
186
    {
187
    }
188
}
189
190
if (!\class_exists('Criteria')) {
191
    class Criteria
192
    {
193
        public function __construct($column = null, $value = null, $operator = '=', $prefix = '', $function = '')
0 ignored issues
show
The parameter $operator is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

193
        public function __construct($column = null, $value = null, /** @scrutinizer ignore-unused */ $operator = '=', $prefix = '', $function = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $column is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

193
        public function __construct(/** @scrutinizer ignore-unused */ $column = null, $value = null, $operator = '=', $prefix = '', $function = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $prefix is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

193
        public function __construct($column = null, $value = null, $operator = '=', /** @scrutinizer ignore-unused */ $prefix = '', $function = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $value is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

193
        public function __construct($column = null, /** @scrutinizer ignore-unused */ $value = null, $operator = '=', $prefix = '', $function = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $function is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

193
        public function __construct($column = null, $value = null, $operator = '=', $prefix = '', /** @scrutinizer ignore-unused */ $function = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
194
        {
195
        }
196
    }
197
}
198
199
if (!\class_exists('CriteriaCompo')) {
200
    class CriteriaCompo extends Criteria
201
    {
202
        public function add($criteria, $condition = 'AND')
0 ignored issues
show
The parameter $condition is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

202
        public function add($criteria, /** @scrutinizer ignore-unused */ $condition = 'AND')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $criteria is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

202
        public function add(/** @scrutinizer ignore-unused */ $criteria, $condition = 'AND')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
203
        {
204
            return $this;
205
        }
206
207
        public function setSort($sort)
0 ignored issues
show
The parameter $sort is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

207
        public function setSort(/** @scrutinizer ignore-unused */ $sort)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
208
        {
209
            return $this;
210
        }
211
212
        public function setOrder($order)
0 ignored issues
show
The parameter $order is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

212
        public function setOrder(/** @scrutinizer ignore-unused */ $order)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
213
        {
214
            return $this;
215
        }
216
217
        public function setLimit($limit)
0 ignored issues
show
The parameter $limit is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

217
        public function setLimit(/** @scrutinizer ignore-unused */ $limit)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
218
        {
219
            return $this;
220
        }
221
    }
222
}
223
224
if (!\class_exists('Xmf\\Module\\Helper')) {
225
    \class_alias('PedigreeTest\\XmfModuleHelperStub', 'Xmf\\Module\\Helper');
226
}
227
228
}
229
230
namespace PedigreeTest {
231
    class XmfModuleHelperStub
232
    {
233
        protected $dirname;
234
235
        public function __construct(string $dirname)
236
        {
237
            $this->dirname = $dirname;
238
        }
239
240
        public function addLog(string $message): void
0 ignored issues
show
The parameter $message is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

240
        public function addLog(/** @scrutinizer ignore-unused */ string $message): void

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
241
        {
242
        }
243
    }
244
}
245
246
namespace {
247
    if (!\class_exists('Xmf\\Module\\Admin')) {
248
        class_alias('PedigreeTest\\XmfModuleAdminStub', 'Xmf\\Module\\Admin');
249
    }
250
}
251
252
namespace PedigreeTest {
253
    class XmfModuleAdminStub
254
    {
255
        public static function iconUrl(string $path = '', int $size = 16): string
0 ignored issues
show
The parameter $size is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

255
        public static function iconUrl(string $path = '', /** @scrutinizer ignore-unused */ int $size = 16): string

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
256
        {
257
            $path = \trim($path, '/');
258
            if ('' === $path) {
259
                return 'icons';
260
            }
261
262
            return 'icons/' . $path;
263
        }
264
    }
265
}
266
267
namespace {
268
    if (!\class_exists('PHPUnit\\Framework\\TestCase')) {
269
        require __DIR__ . '/support/TestCase.php';
270
    }
271
272
    spl_autoload_register(static function (string $class): void {
273
        $prefix = 'XoopsModules\\Pedigree\\';
274
        if (0 === strpos($class, $prefix)) {
275
            $relative = substr($class, \strlen($prefix));
276
            $relativePath = str_replace('\\', '/', $relative);
277
            $paths = [
278
                __DIR__ . '/../class/' . $relativePath . '.php',
279
                __DIR__ . '/../preloads/' . $relativePath . '.php',
280
            ];
281
            foreach ($paths as $file) {
282
                if (is_file($file)) {
283
                    require_once $file;
284
                    return;
285
                }
286
            }
287
        }
288
    });
289
}
290