Issues (519)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Files/CreateStructure.php (5 issues)

1
<?php namespace XoopsModules\Tdmcreate\Files;
2
3
use XoopsModules\Tdmcreate;
4
5
/*
6
 You may not change or alter any portion of this comment or credits
7
 of supporting developers from this source code or any supporting source code
8
 which is considered copyrighted (c) material of the original comment or credit authors.
9
10
 This program is distributed in the hope that it will be useful,
11
 but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
 */
14
/**
15
 * tdmcreate module.
16
 *
17
 * @copyright       XOOPS Project (https://xoops.org)
18
 * @license         GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
19
 *
20
 * @since           2.5.0
21
 *
22
 * @author          Txmod Xoops http://www.txmodxoops.org
23
 *
24
 * @version         $Id: TDMCreateStructure.php 12258 2014-01-02 09:33:29Z timgno $
25
 */
26
27
/**
28
 * Class TDMCreateStructure.
29
 */
30
class CreateStructure
31
{
32
    /**
33
     * @var string
34
     */
35
    private $moduleName;
36
    /**
37
     * @var string
38
     */
39
    private $folderName;
40
    /**
41
     * @var string
42
     */
43
    private $fileName;
44
    /**
45
     * @var string
46
     */
47
    private $path;
0 ignored issues
show
The private property $path is not used, and could be removed.
Loading history...
48
    /**
49
     * @var mixed
50
     */
51
    private $uploadPath;
52
53
    /**
54
     *  @public function constructor class
55
     *
56
     *  @param null
57
     */
58
    public function __construct()
59
    {
60
    }
61
62
    /**
63
     *  @static function getInstance
64
     *
65
     *  @param null
66
     *
67
     * @return Tdmcreate\Files\CreateStructure
68
     */
69
    public static function getInstance()
70
    {
71
        static $instance = false;
72
        if (!$instance) {
73
            $instance = new self();
74
        }
75
76
        return $instance;
77
    }
78
79
    /**
80
     * @protected function setUploadPath
81
     *
82
     * @param $path
83
     */
84
    protected function setUploadPath($path)
85
    {
86
        $this->uploadPath = $path;
87
    }
88
89
    /**
90
     * @protected function getUploadPath
91
     *
92
     * @return string $path
93
     */
94
    protected function getUploadPath()
95
    {
96
        return $this->uploadPath;
97
    }
98
99
    /**
100
     * @protected function setModuleName
101
     * @param $moduleName
102
     */
103
    protected function setModuleName($moduleName)
104
    {
105
        $this->moduleName = $moduleName;
106
    }
107
108
    /**
109
     *  @protected function getModuleName
110
     *
111
     *  @return string $moduleName
112
     */
113
    protected function getModuleName()
114
    {
115
        return $this->moduleName;
116
    }
117
118
    /**
119
     * @private function setFolderName
120
     *
121
     * @param $folderName
122
     */
123
    private function setFolderName($folderName)
124
    {
125
        $this->folderName = $folderName;
126
    }
127
128
    /**
129
     *  @private function getFolderName
130
     *  @return string $folderName
131
     */
132
    private function getFolderName()
133
    {
134
        return $this->folderName;
135
    }
136
137
    /**
138
     * @private function setFileName
139
     *
140
     * @param $fileName
141
     */
142
    private function setFileName($fileName)
143
    {
144
        $this->fileName = $fileName;
145
    }
146
147
    /**
148
     *  @private function getFileName
149
     *
150
     *  @return string $fileName
151
     */
152
    private function getFileName()
153
    {
154
        return $this->fileName;
155
    }
156
157
    /**
158
     * @private function isDir
159
     *
160
     * @param $dname
161
     */
162
    private function isDir($dname)
163
    {
164
        if (!is_dir($dname)) {
165
            if (!mkdir($dname, 0755) && !is_dir($dname)) {
166
                throw new \RuntimeException(sprintf('Directory "%s" was not created', $dname));
167
            }
168
            chmod($dname, 0755);
169
        } else {
170
            chmod($dname, 0755);
171
        }
172
    }
173
174
    /**
175
     *  @protected function makeDir
176
     *
177
     *  @param string $dir
178
     */
179
    protected function makeDir($dir)
180
    {
181
        $this->isDir(mb_strtolower(trim($dir)));
182
    }
183
184
    /**
185
     *  @protected function isDirEmpty
186
     *
187
     *  @param string $dir
188
     *
189
     * @return string
190
     */
191
    public function isDirEmpty($dir)
192
    {
193
        $content = [];
194
        $handle = opendir($dir);
195
        while (false !== ($entry = readdir($handle))) {
0 ignored issues
show
It seems like $handle can also be of type false; however, parameter $dir_handle of readdir() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

195
        while (false !== ($entry = readdir(/** @scrutinizer ignore-type */ $handle))) {
Loading history...
196
            if ('.' !== $entry && '..' !== $entry) {
197
                $content[] = $entry;
198
            }
199
        }
200
        closedir($handle);
0 ignored issues
show
It seems like $handle can also be of type false; however, parameter $dir_handle of closedir() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

200
        closedir(/** @scrutinizer ignore-type */ $handle);
Loading history...
201
        if (count($content) > 0) {
202
            return true;
0 ignored issues
show
Bug Best Practice introduced by
The expression return true returns the type true which is incompatible with the documented return type string.
Loading history...
203
        }
204
205
        return false;
0 ignored issues
show
Bug Best Practice introduced by
The expression return false returns the type false which is incompatible with the documented return type string.
Loading history...
206
    }
207
208
    /**
209
     * @public function addFolderPath
210
     *
211
     * @param string      $folderName
212
     * @param bool|string $fileName
213
     * @return string
214
     */
215
    private function addFolderPath($folderName, $fileName = false)
216
    {
217
        $this->setFolderName($folderName);
218
        if ($fileName) {
219
            $this->setFileName($fileName);
220
            $ret = $this->getUploadPath() . DS . $this->getModuleName() . DS . $this->getFolderName() . DS . $this->getFileName();
221
        } else {
222
            $ret = $this->getUploadPath() . DS . $this->getModuleName() . DS . $this->getFolderName();
223
        }
224
225
        return $ret;
226
    }
227
228
    /**
229
     *  @public function makeDirInModule
230
     *
231
     *  @param string $dirName
232
     */
233
    public function makeDirInModule($dirName)
234
    {
235
        $fname = $this->addFolderPath($dirName);
236
        $this->makeDir($fname);
237
    }
238
239
    /**
240
     *  @public function makeDir & copy file
241
     *
242
     *  @param string $folderName
243
     *  @param string $fromFile
244
     *  @param string $toFile
245
     */
246
    public function makeDirAndCopyFile($folderName, $fromFile, $toFile)
247
    {
248
        $dname = $this->addFolderPath($folderName);
249
        $this->makeDir($dname);
250
        $this->copyFile($folderName, $fromFile, $toFile);
251
    }
252
253
    /**
254
     *  @public function copy file
255
     *
256
     *  @param string $folderName
257
     *  @param string $fromFile
258
     *  @param string $toFile
259
     */
260
    public function copyFile($folderName, $fromFile, $toFile)
261
    {
262
        $dname = $this->addFolderPath($folderName);
263
        $fname = $this->addFolderPath($folderName, $toFile);
264
        $this->setCopy($dname, $fromFile, $fname);
265
    }
266
267
    /**
268
     *  @public function setCopy
269
     *
270
     *  @param string $dname
271
     *  @param string $fromFile
272
     *  @param string $fname
273
     */
274
    public function setCopy($dname, $fromFile, $fname)
275
    {
276
        if (is_dir($dname)) {
277
            chmod($dname, 0777);
278
            copy($fromFile, $fname);
279
        } else {
280
            $this->makeDir($dname);
281
            copy($fromFile, $fname);
282
        }
283
    }
284
}
285