Issues (519)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Files/CreatePhpCode.php (3 issues)

1
<?php namespace XoopsModules\Tdmcreate\Files;
2
3
use XoopsModules\Tdmcreate;
4
5
/*
6
 You may not change or alter any portion of this comment or credits
7
 of supporting developers from this source code or any supporting source code
8
 which is considered copyrighted (c) material of the original comment or credit authors.
9
10
 This program is distributed in the hope that it will be useful,
11
 but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
 */
14
/**
15
 * tdmcreate module.
16
 *
17
 * @copyright       XOOPS Project (https://xoops.org)
18
 * @license         GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
19
 *
20
 * @since           2.5.0
21
 *
22
 * @author          Txmod Xoops http://www.txmodxoops.org
23
 *
24
 * @version         $Id: reatePhpCode.php 12258 2014-01-02 09:33:29Z timgno $
25
 */
26
27
/**
28
 * Class CreatePhpCode.
29
 */
30
class CreatePhpCode
31
{
32
    /**
33
     *  @static function getInstance
34
     *  @param null
35
     * @return CreatePhpCode
36
     */
37
    public static function getInstance()
38
    {
39
        static $instance = false;
40
        if (!$instance) {
41
            $instance = new self();
42
        }
43
44
        return $instance;
45
    }
46
47
    /**
48
     * @public function getPhpCodeCommentLine
49
     * @param        $comment
50
     * @param        $var
51
     * @param string $t
52
     * @return string
53
     */
54
    public function getPhpCodeCommentLine($comment = null, $var = null, $t = '')
55
    {
56
        $value = !empty($var) ? ' ' . $var : '';
57
        $ret = "{$t}// {$comment}{$value}\n";
58
59
        return $ret;
60
    }
61
62
    /**
63
     * @public function getPhpCodeCommentMultiLine
64
     * @param array  $multiLine
65
     *
66
     * @param string $t
67
     * @return string
68
     */
69
    public function getPhpCodeCommentMultiLine($multiLine = [], $t = '')
70
    {
71
        $values = !empty($multiLine) ? $multiLine : [];
72
        $ret = "\n{$t}/**\n";
73
        foreach ($values as $string => $value) {
74
            if ('' === $string && '' === $value) {
75
                $ret .= "{$t} *\n";
76
            } else {
77
                $ret .= "{$t} * {$string} {$value}\n";
78
            }
79
        }
80
        $ret .= "{$t} */\n";
81
82
        return $ret;
83
    }
84
85
    /**
86
     *  @public function getPhpCodeDefine
87
     *  @param $left
88
     *  @param $right
89
     *
90
     *  @return string
91
     */
92
    public function getPhpCodeDefine($left, $right)
93
    {
94
        return "define('{$left}', {$right});\n";
95
    }
96
97
    /**
98
     *  @public function getPhpCodeDefine
99
     *  @param $left
100
     *  @param $right
101
     *
102
     *  @return string
103
     */
104
    public function getPhpCodeDefined($left = 'XOOPS_ROOT_PATH', $right = 'Restricted access')
105
    {
106
        return "defined('{$left}') || die('{$right}');\n";
107
    }
108
109
    /**
110
     *  @public function getPhpCodeGlobals
111
     *  @param $var
112
     *  @param $value
113
     *
114
     *  @return string
115
     */
116
    public function getPhpCodeGlobals($var, $value = '')
117
    {
118
        if ('' != $value) {
119
            $ret = "\$GLOBALS['{$var}'] = \${$value};\n";
120
        } else {
121
            $ret = "\$GLOBALS['{$var}']";
122
        }
123
124
        return $ret;
125
    }
126
127
    /**
128
     *  @public function getPhpCodeGlobalsVariables
129
     *  @param $var
130
     *  @param $type
131
     *
132
     *  @return string
133
     */
134
    public function getPhpCodeGlobalsVariables($var = null, $type = 'REQUEST')
135
    {
136
        $type = mb_strtoupper($type);
137
        switch ($type) {
138
            case 'GET':
139
                $ret = "\$_GET['{$var}']";
140
                break;
141
            case 'POST':
142
                $ret = "\$_POST['{$var}']";
143
                break;
144
            case 'FILES':
145
                $ret = "\$_FILES['{$var}']";
146
                break;
147
            case 'COOKIE':
148
                $ret = "\$_COOKIE['{$var}']";
149
                break;
150
            case 'ENV':
151
                $ret = "\$_ENV['{$var}']";
152
                break;
153
            case 'SERVER':
154
                $ret = "\$_SERVER['{$var}']";
155
                break;
156
            default:
157
                $ret = "\$_REQUEST['{$var}']";
158
                break;
159
        }
160
161
        return $ret;
162
    }
163
164
    /**
165
     * @public function getPhpCodeRemoveCarriageReturn
166
     * @param        $string
167
     *
168
     * @param string $n
169
     * @param string $t
170
     * @return string
171
     */
172
    public function getPhpCodeRemoveCarriageReturn($string, $n = "\n", $t = "\r")
173
    {
174
        return str_replace([(string)$n, (string)$t], '', $string);
175
    }
176
177
    /**
178
     *  @public function getPhpCodeFileExists
179
     *  @param $filename
180
     *
181
     *  @return string
182
     */
183
    public function getPhpCodeFileExists($filename)
184
    {
185
        return "file_exists({$filename})";
186
    }
187
188
    /**
189
     * @public function getPhpCodeIncludeDir
190
     * @param        $directory
191
     * @param        $filename
192
     * @param bool   $once
193
     * @param bool   $isPath
194
     *
195
     * @param string $type
196
     * @param string $t
197
     * @return string
198
     */
199
    public function getPhpCodeIncludeDir($directory = null, $filename = null, $once = false, $isPath = false, $type = 'include', $t = '')
200
    {
201
        if ('' === $type) {
202
            $type = 'include';
203
        }
204
        if (false === $once) {
205
            if (!$isPath) {
206
                $ret = "{$t}{$type} {$directory} .'/{$filename}.php';\n";
207
            } else {
208
                $ret = "{$t}{$type} {$directory};\n";
209
            }
210
        } else {
211
            if (!$isPath) {
212
                $ret = "{$t}{$type}_once {$directory} .'/{$filename}.php';\n";
213
            } else {
214
                $ret = "{$t}{$type}_once {$directory};\n";
215
            }
216
        }
217
218
        return $ret;
219
    }
220
221
    /**
222
     *  @public function getPhpCodeTernaryOperator
223
     *  @param $return
224
     *  @param $condition
225
     *  @param $one
226
     *  @param $two
227
     *  @param $t - Indentation
0 ignored issues
show
Documentation Bug introduced by
The doc comment - at position 0 could not be parsed: Unknown type name '-' at position 0 in -.
Loading history...
228
     *
229
     *  @return string
230
     */
231
    public function getPhpCodeTernaryOperator($return, $condition, $one, $two, $t = '')
232
    {
233
        return "{$t}\${$return} = {$condition} ? {$one} : {$two};\n";
234
    }
235
236
    /**
237
     *  @public function getPhpCodeClass
238
     *  @param $name
239
     *  @param $content
240
     *  @param $extends
241
     *  @param $type
242
     *
243
     *  @return string
244
     */
245
    public function getPhpCodeClass($name = null, $content = null, $extends = null, $type = null)
246
    {
247
        $typ = (null != $type) ? "{$type} " : '';
248
        $ext = (null != $extends) ? " extends {$extends}" : '';
249
        $ret = "{$typ}class {$name}{$ext}\n";
250
        $ret .= '{';
251
        $ret .= $content;
252
        $ret .= "}\n";
253
254
        return $ret;
255
    }
256
257
    /**
258
     *  @public function getPhpCodeClass
259
     *  @param $type
260
     *  @param $name
261
     *  @param $assign
262
     *  @param $t - Indentation
0 ignored issues
show
Documentation Bug introduced by
The doc comment - at position 0 could not be parsed: Unknown type name '-' at position 0 in -.
Loading history...
263
     *
264
     *  @return string
265
     */
266
    public function getPhpCodeVariableClass($type = 'private', $name = null, $assign = 'null', $t = '')
267
    {
268
        return "{$t}{$type} \${$name} = {$assign};\n";
269
    }
270
271
    /**
272
     * @public function getPhpCodeFunction
273
     * @param        $name
274
     * @param        $params
275
     * @param        $content
276
     * @param        $method
277
     * @param bool   $isRef
278
     * @param string $t - Indentation
279
     * @return string
280
     */
281
    public function getPhpCodeFunction($name = null, $params = null, $content = null, $method = null, $isRef = false, $t = '')
282
    {
283
        $inClass = (null != $method) ? $method : '';
284
        $ref = (false !== $isRef) ? '&' : '';
285
        $ret = "{$t}{$inClass}function {$ref}{$name}({$params})\n";
286
        $ret .= "{$t}{\n";
287
        $ret .= $content;
288
        $ret .= "{$t}}\n";
289
290
        return $ret;
291
    }
292
293
    /**
294
     * @public function getPhpCodeConditions
295
     * @param string $condition
296
     * @param string $operator
297
     * @param string $type
298
     * @param string $contentIf
299
     * @param mixed  $contentElse
300
     * @param $t - Indentation
0 ignored issues
show
Documentation Bug introduced by
The doc comment - at position 0 could not be parsed: Unknown type name '-' at position 0 in -.
Loading history...
301
     *
302
     * @return string
303
     */
304
    public function getPhpCodeConditions($condition = null, $operator = null, $type = null, $contentIf = null, $contentElse = false, $t = '')
305
    {
306
        if (false === $contentElse) {
307
            $ret = "{$t}if({$condition}{$operator}{$type}) {\n";
308
            $ret .= $contentIf;
309
            $ret .= "{$t}}\n";
310
        } else {
311
            $ret = "{$t}if({$condition}{$operator}{$type}) {\n";
312
            $ret .= $contentIf;
313
            $ret .= "{$t}} else {\n";
314
            $ret .= $contentElse;
315
            $ret .= "{$t}}\n";
316
        }
317
318
        return $ret;
319
    }
320
321
    /**
322
     * @public function getPhpCodeForeach
323
     * @param string      $array
324
     * @param bool|string $arrayKey
325
     * @param bool|string $key
326
     * @param bool|string $value
327
     * @param string      $content
328
     *
329
     * @param string      $t
330
     * @return string
331
     */
332
    public function getPhpCodeForeach($array, $arrayKey = false, $key = false, $value = false, $content = null, $t = '')
333
    {
334
        $vars = '';
335
        $value = '' !== $value ? $value : 'i';
336
        if ((false === $arrayKey) && (false === $key)) {
337
            $vars = "\${$array} as \${$value}";
338
        } elseif ((false === $arrayKey) && (false !== $key)) {
339
            $vars = "\${$array} as \${$key} => \${$value}";
340
        } elseif ((false !== $arrayKey) && (false === $key)) {
341
            $vars = "array_keys(\${$array}) as \${$value}";
342
        }
343
344
        $ret = "{$t}foreach({$vars}) {\n";
345
        $ret .= "{$t}{$content}";
346
        $ret .= "{$t}}\n";
347
348
        return $ret;
349
    }
350
351
    /**
352
     * @public function getPhpCodeFor
353
     * @param        $var
354
     * @param        $content
355
     * @param        $value
356
     * @param        $initVal
357
     * @param        $operator
358
     *
359
     * @param string $t
360
     * @return string
361
     */
362
    public function getPhpCodeFor($var = null, $content = null, $value = null, $initVal = null, $operator = null, $t = '')
363
    {
364
        $ret = "{$t}for(\${$var} = {$initVal}; {$var} {$operator} \${$value}; \${$var}++) {\n";
365
        $ret .= "{$t}{$content}";
366
        $ret .= "{$t}}\n";
367
368
        return $ret;
369
    }
370
371
    /**
372
     * @public function getPhpCodeWhile
373
     * @param $var
374
     * @param $content
375
     * @param $value
376
     * @param $operator
377
     *  @param $t
378
     *
379
     * @return string
380
     */
381
    public function getPhpCodeWhile($var = null, $content = null, $value = null, $operator = null, $t = '')
382
    {
383
        $ret = "{$t}while(\${$var} {$operator} {$value}) {\n";
384
        $ret .= "{$t}{$content}";
385
        $ret .= "{$t}}\n";
386
387
        return $ret;
388
    }
389
390
    /**
391
     *  @public function getPhpCodeSwitch
392
     *
393
     *  @param $op
394
     *  @param $content
395
     *  @param $t
396
     *
397
     *  @return string
398
     */
399
    public function getPhpCodeSwitch($op = null, $content = null, $t = '')
400
    {
401
        //$ret = "{$t}switch(\${$op}) {\n"; test goffy
402
        $ret = "switch(\${$op}) {\n";
403
        $ret .= $content;
404
        $ret .= "}\n";
405
406
        return $ret;
407
    }
408
409
    /**
410
     *  @public function getPhpCodeCaseSwitch
411
     *
412
     *  @param $cases
413
     *  @param $defaultAfterCase
414
     *  @param $default
415
     *  @param $t
416
     *
417
     *  @return string
418
     */
419
    public function getPhpCodeCaseSwitch($cases = [], $defaultAfterCase = false, $default = false, $t = '')
420
    {
421
        $ret = '';
422
        $def = "{$t}default:\n";
423
        foreach ($cases as $case => $value) {
424
            $case = is_string($case) ? "'{$case}'" : $case;
425
            if (!empty($case)) {
426
                $ret .= "{$t}case {$case}:\n";
427
                if (false !== $defaultAfterCase) {
428
                    $ret .= $def;
429
                }
430
                if (is_array($value)) {
431
                    foreach ($value as $content) {
432
                        $ret .= "{$t}{$t}{$content}\n";
433
                    }
434
                }
435
                $ret .= "{$t}break;\n";
436
            }
437
            $defaultAfterCase = false;
438
        }
439
        if (false !== $default) {
440
            $ret .= $def;
441
            $ret .= "{$t}{$default}\n";
442
            $ret .= "{$t}break;\n";
443
        }
444
445
        return $ret;
446
    }
447
448
    /**
449
     *  @public function getPhpCodeIsset
450
     *  @param $var
451
     *  @return string
452
     */
453
    public function getPhpCodeIsset($var)
454
    {
455
        return "isset(\${$var})";
456
    }
457
458
    /**
459
     * @public function getPhpCodeUnset
460
     * @param string $var
461
     * @param string $t
462
     * @return string
463
     */
464
    public function getPhpCodeUnset($var = '', $t = '')
465
    {
466
        return "{$t}unset(\${$var});\n";
467
    }
468
469
    /**
470
     *  @public function getPhpCodeIsDir
471
     *  @param $var
472
     *  @return string
473
     */
474
    public function getPhpCodeIsDir($var)
475
    {
476
        return "is_dir({$var})";
477
    }
478
479
    /**
480
     *  @public function getPhpCodeImplode
481
     *  @param $left
482
     *  @param $right
483
     *  @return string
484
     */
485
    public function getPhpCodeImplode($left, $right)
486
    {
487
        return "implode('{$left}', {$right})";
488
    }
489
490
    /**
491
     *  @public function getPhpCodeExplode
492
     *  @param $left
493
     *  @param $right
494
     *  @return string
495
     */
496
    public function getPhpCodeExplode($left, $right)
497
    {
498
        return "explode('{$left}', {$right})";
499
    }
500
501
    /**
502
     * @public function getPhpCodeChmod
503
     * @param        $var
504
     * @param string $perm
505
     * @param string $t
506
     * @return string
507
     */
508
    public function getPhpCodeChmod($var, $perm = '0777', $t = '')
509
    {
510
        return "{$t}chmod(\${$var}, {$perm});\n";
511
    }
512
513
    /**
514
     * @public function getPhpCodeMkdir
515
     * @param        $var
516
     * @param string $perm
517
     * @param string $t
518
     * @return string
519
     */
520
    public function getPhpCodeMkdir($var, $perm = '0777', $t = '')
521
    {
522
        return "{$t}mkdir(\${$var}, {$perm});\n";
523
    }
524
525
    /**
526
     * @public function getPhpCodeCopy
527
     * @param        $file
528
     * @param string $newfile
529
     * @param string $t
530
     * @return string
531
     */
532
    public function getPhpCodeCopy($file, $newfile = '', $t = '')
533
    {
534
        return "{$t}copy({$file}, {$newfile});\n";
535
    }
536
537
    /**
538
     * @public function getPhpCodeArray
539
     * @param        $var
540
     * @param        $array
541
     * @param bool   $isParam
542
     *
543
     * @param string $t
544
     * @return string
545
     */
546
    public function getPhpCodeArray($var, $array = null, $isParam = false, $t = "\t\t")
547
    {
548
        $retArray = [];
549
        if (is_array($array) && !empty($array)) {
550
            foreach ($array as $k => $v) {
551
                if (is_numeric($k)) {
552
                    $retArray[] = $v;
553
                } else {
554
                    $retArray[] = "{$k} => {$v}";
555
                }
556
            }
557
            $arrayContent = implode(', ', $retArray);
558
        } else {
559
            $arrayContent = '';
560
        }
561
        unset($retArray);
562
563
        if (!$isParam) {
564
            $ret = "{$t}\${$var} = array({$arrayContent});\n";
565
        } else {
566
            $ret = "array({$array})";
567
        }
568
569
        return $ret;
570
    }
571
572
    /**
573
     * @public function getPhpCodeArrayType
574
     * @param        $var
575
     * @param        $type
576
     * @param        $left
577
     * @param        $right
578
     * @param bool   $isParam
579
     *
580
     * @param string $t
581
     * @return string
582
     */
583
    public function getPhpCodeArrayType($var, $type, $left, $right = null, $isParam = false, $t = "\t\t")
584
    {
585
        $vars = (null != $right) ? "\${$left}, {$right}" : "\${$left}";
586
        if (!$isParam) {
587
            $ret = "{$t}\${$var}[] = array_{$type}({$vars});\n";
588
        } else {
589
            $ret = "array_{$type}({$vars})";
590
        }
591
592
        return $ret;
593
    }
594
595
    /**
596
     *  @public function getPhpCodeSprintf
597
     *  @param $left
598
     *  @param $right
599
     *  @return string
600
     */
601
    public function getPhpCodeSprintf($left, $right)
602
    {
603
        return "sprintf({$left}, {$right})";
604
    }
605
606
    /**
607
     *  @public function getPhpCodeEmpty
608
     *  @param $var
609
     *  @return string
610
     */
611
    public function getPhpCodeEmpty($var)
612
    {
613
        return "empty({$var})";
614
    }
615
616
    /**
617
     *  @public function getPhpCodeHeader
618
     *  @param $var
619
     *  @return string
620
     */
621
    public function getPhpCodeHeader($var)
622
    {
623
        return "header({$var})";
624
    }
625
626
    /**
627
     *  @public function getPhpCodeRawurlencode
628
     *  @param $var
629
     *  @return string
630
     */
631
    public function getPhpCodeRawurlencode($var)
632
    {
633
        return "rawurlencode({$var})";
634
    }
635
636
    /**
637
     * @public function getPhpCodePregFunzions
638
     * @param        $var
639
     * @param        $exp
640
     * @param        $str
641
     * @param        $val
642
     * @param string $type
643
     * @param bool   $isParam
644
     *
645
     * @param string $t
646
     * @return string
647
     */
648
    public function getPhpCodePregFunzions($var, $exp, $str, $val, $type = 'match', $isParam = false, $t = "\t")
649
    {
650
        $pregFunz = "preg_{$type}('";
651
        if (!$isParam) {
652
            $ret = "{$t}\${$var} = {$pregFunz}{$exp}', '{$str}', {$val});\n";
653
        } else {
654
            $ret = "{$pregFunz}{$exp}', '{$str}', {$val})";
655
        }
656
657
        return $ret;
658
    }
659
660
    /**
661
     * @public function getPhpCodeStrType
662
     * @param        $left
663
     * @param        $var
664
     * @param        $str
665
     * @param        $value
666
     * @param string $type
667
     * @param bool   $isParam
668
     *
669
     * @param string $t
670
     * @return string
671
     */
672
    public function getPhpCodeStrType($left, $var, $str, $value, $type = 'replace', $isParam = false, $t = "\t")
673
    {
674
        $strType = "str_{$type}('";
675
        if (!$isParam) {
676
            $ret = "{$t}\${$left} = {$strType}{$var}', '{$str}', {$value});\n";
677
        } else {
678
            $ret = "{$strType}{$var}', '{$str}', {$value})";
679
        }
680
681
        return $ret;
682
    }
683
684
    /**
685
     * @public function getPhpCodeStripTags
686
     * @param        $left
687
     * @param        $value
688
     * @param bool   $isParam
689
     *
690
     * @param string $t
691
     * @return string
692
     */
693
    public function getPhpCodeStripTags($left, $value, $isParam = false, $t = '')
694
    {
695
        if (!$isParam) {
696
            $ret = "{$t}\${$left} = strip_tags({$value});\n";
697
        } else {
698
            $ret = "strip_tags({$value})";
699
        }
700
701
        return $ret;
702
    }
703
704
    /**
705
     *  @public function getPhpCodeHtmlentities
706
     *  @param $entitiesVar
707
     *  @param $entitiesQuote
708
     *  @return string
709
     */
710
    public function getPhpCodeHtmlentities($entitiesVar, $entitiesQuote = false)
711
    {
712
        $entitiesVar = (false !== $entitiesQuote) ? $entitiesVar . ', ' . $entitiesQuote : $entitiesVar;
713
        $entities = "htmlentities({$entitiesVar})";
714
715
        return $entities;
716
    }
717
718
    /**
719
     *  @public function getPhpCodeHtmlspecialchars
720
     *  @param $specialVar
721
     *  @param $specialQuote
722
     *  @return string
723
     */
724
    public function getPhpCodeHtmlspecialchars($specialVar, $specialQuote = false)
725
    {
726
        $specialVar = (false !== $specialQuote) ? $specialVar . ', ' . $specialQuote : $specialVar;
727
        $specialchars = "htmlspecialchars({$specialVar})";
728
729
        return $specialchars;
730
    }
731
}
732