mbirth /
cops
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * COPS (Calibre OPDS PHP Server) class file |
||
| 4 | * |
||
| 5 | * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) |
||
| 6 | * @author Sébastien Lucas <[email protected]> |
||
| 7 | */ |
||
| 8 | |||
| 9 | abstract class Base |
||
| 10 | { |
||
| 11 | const PAGE_INDEX = 'index'; |
||
| 12 | const PAGE_ALL_AUTHORS = '1'; |
||
| 13 | const PAGE_AUTHORS_FIRST_LETTER = '2'; |
||
| 14 | const PAGE_AUTHOR_DETAIL = '3'; |
||
| 15 | const PAGE_ALL_BOOKS = '4'; |
||
| 16 | const PAGE_ALL_BOOKS_LETTER = '5'; |
||
| 17 | const PAGE_ALL_SERIES = '6'; |
||
| 18 | const PAGE_SERIE_DETAIL = '7'; |
||
| 19 | const PAGE_OPENSEARCH = '8'; |
||
| 20 | const PAGE_OPENSEARCH_QUERY = '9'; |
||
| 21 | const PAGE_ALL_RECENT_BOOKS = '10'; |
||
| 22 | const PAGE_ALL_TAGS = '11'; |
||
| 23 | const PAGE_TAG_DETAIL = '12'; |
||
| 24 | const PAGE_BOOK_DETAIL = '13'; |
||
| 25 | const PAGE_ALL_CUSTOMS = '14'; |
||
| 26 | const PAGE_CUSTOM_DETAIL = '15'; |
||
| 27 | const PAGE_ABOUT = '16'; |
||
| 28 | const PAGE_ALL_LANGUAGES = '17'; |
||
| 29 | const PAGE_LANGUAGE_DETAIL = '18'; |
||
| 30 | const PAGE_CUSTOMIZE = '19'; |
||
| 31 | const PAGE_ALL_PUBLISHERS = '20'; |
||
| 32 | const PAGE_PUBLISHER_DETAIL = '21'; |
||
| 33 | const PAGE_ALL_RATINGS = '22'; |
||
| 34 | const PAGE_RATING_DETAIL = '23'; |
||
| 35 | |||
| 36 | const COMPATIBILITY_XML_ALDIKO = 'aldiko'; |
||
| 37 | |||
| 38 | private static $db = NULL; |
||
| 39 | |||
| 40 | 144 | public static function isMultipleDatabaseEnabled() |
|
| 41 | { |
||
| 42 | 144 | global $config; |
|
| 43 | 144 | return is_array ($config['calibre_directory']); |
|
| 44 | } |
||
| 45 | |||
| 46 | 49 | public static function useAbsolutePath() |
|
| 47 | { |
||
| 48 | 49 | global $config; |
|
| 49 | 49 | $path = self::getDbDirectory(); |
|
| 50 | 49 | return preg_match ('/^\//', $path) || // Linux / |
|
| 51 | 49 | preg_match ('/^\w\:/', $path); // Windows X: |
|
| 52 | } |
||
| 53 | |||
| 54 | 56 | public static function noDatabaseSelected() |
|
| 55 | { |
||
| 56 | 56 | return self::isMultipleDatabaseEnabled() && is_null(GetUrlParam(DB)); |
|
| 57 | } |
||
| 58 | |||
| 59 | 4 | View Code Duplication | public static function getDbList() |
| 60 | { |
||
| 61 | 4 | global $config; |
|
| 62 | 4 | if (self::isMultipleDatabaseEnabled()) { |
|
| 63 | 4 | return $config['calibre_directory']; |
|
| 64 | } else { |
||
| 65 | 1 | return array('' => $config['calibre_directory']); |
|
| 66 | } |
||
| 67 | } |
||
| 68 | |||
| 69 | 5 | View Code Duplication | public static function getDbNameList() |
| 70 | { |
||
| 71 | 5 | global $config; |
|
| 72 | 5 | if (self::isMultipleDatabaseEnabled()) { |
|
| 73 | 5 | return array_keys ($config['calibre_directory']); |
|
| 74 | } else { |
||
| 75 | return array (''); |
||
| 76 | } |
||
| 77 | } |
||
| 78 | |||
| 79 | 1 | View Code Duplication | public static function getDbName($database = NULL) |
| 80 | { |
||
| 81 | 1 | global $config; |
|
| 82 | 1 | if (self::isMultipleDatabaseEnabled()) { |
|
| 83 | 1 | if (is_null($database)) $database = GetUrlParam(DB, 0); |
|
| 84 | 1 | if (!is_null($database) && !preg_match('/^\d+$/', $database)) { |
|
| 85 | self::error($database); |
||
| 86 | } |
||
| 87 | 1 | $array = array_keys($config['calibre_directory']); |
|
| 88 | 1 | return $array[$database]; |
|
| 89 | } |
||
| 90 | return ''; |
||
| 91 | } |
||
| 92 | |||
| 93 | 126 | View Code Duplication | public static function getDbDirectory($database = NULL) |
| 94 | { |
||
| 95 | 126 | global $config; |
|
| 96 | 126 | if (self::isMultipleDatabaseEnabled()) { |
|
| 97 | 9 | if (is_null($database)) $database = GetUrlParam(DB, 0); |
|
| 98 | 9 | if (!is_null($database) && !preg_match('/^\d+$/', $database)) { |
|
| 99 | self::error($database); |
||
| 100 | } |
||
| 101 | 9 | $array = array_values($config['calibre_directory']); |
|
| 102 | 9 | return $array[$database]; |
|
| 103 | } |
||
| 104 | 117 | return $config['calibre_directory']; |
|
| 105 | } |
||
| 106 | |||
| 107 | 98 | public static function getDbFileName($database = NULL) |
|
| 108 | { |
||
| 109 | 98 | return self::getDbDirectory($database) .'metadata.db'; |
|
| 110 | } |
||
| 111 | |||
| 112 | 2 | private static function error($database) |
|
| 113 | { |
||
| 114 | 2 | if (php_sapi_name() != 'cli') { |
|
| 115 | header('location: checkconfig.php?err=1'); |
||
| 116 | } |
||
| 117 | 2 | throw new Exception('Database <' . $database . '> not found.'); |
|
| 118 | } |
||
| 119 | |||
| 120 | 159 | public static function getDb ($database = NULL) |
|
| 121 | { |
||
| 122 | 159 | if (is_null (self::$db)) { |
|
| 123 | try { |
||
| 124 | 98 | if (is_readable(self::getDbFileName ($database))) { |
|
| 125 | 97 | self::$db = new PDO('sqlite:'. self::getDbFileName($database)); |
|
| 126 | 97 | if (useNormAndUp()) { |
|
| 127 | 7 | self::$db->sqliteCreateFunction('normAndUp', 'normAndUp', 1); |
|
| 128 | 7 | } |
|
| 129 | 97 | } else { |
|
| 130 | 2 | self::error($database); |
|
| 131 | } |
||
| 132 | 98 | } catch (Exception $e) { |
|
| 133 | 2 | self::error($database); |
|
| 134 | } |
||
| 135 | 97 | } |
|
| 136 | 158 | return self::$db; |
|
| 137 | } |
||
| 138 | |||
| 139 | 4 | public static function checkDatabaseAvailability() |
|
| 140 | { |
||
| 141 | 4 | if (self::noDatabaseSelected()) { |
|
| 142 | 3 | for ($i = 0; $i < count(self::getDbList()); $i++) { |
|
| 143 | 3 | self::getDb($i); |
|
| 144 | 2 | self::clearDb(); |
|
| 145 | 2 | } |
|
| 146 | 1 | } else { |
|
| 147 | 1 | self::getDb(); |
|
| 148 | } |
||
| 149 | 2 | return true; |
|
| 150 | } |
||
| 151 | |||
| 152 | 103 | public static function clearDb() |
|
| 153 | { |
||
| 154 | 103 | self::$db = NULL; |
|
| 155 | 103 | } |
|
| 156 | |||
| 157 | 24 | public static function executeQuerySingle($query, $database = NULL) |
|
| 158 | { |
||
| 159 | 24 | return self::getDb($database)->query($query)->fetchColumn(); |
|
| 160 | } |
||
| 161 | |||
| 162 | 19 | public static function getCountGeneric($table, $id, $pageId, $numberOfString = NULL) |
|
| 163 | { |
||
| 164 | 19 | if (!$numberOfString) { |
|
| 165 | 18 | $numberOfString = $table . '.alphabetical'; |
|
| 166 | 18 | } |
|
| 167 | 19 | $count = self::executeQuerySingle('select count(*) from ' . $table); |
|
| 168 | 19 | if ($count == 0) { |
|
| 169 | 11 | return NULL; |
|
| 170 | } |
||
| 171 | 19 | $entry = new Entry(localize($table . '.title'), $id, |
|
| 172 | 19 | str_format(localize($numberOfString, $count), $count), 'text', |
|
| 173 | 19 | array(new LinkNavigation('?page='.$pageId)), '', $count); |
|
| 174 | 19 | return $entry; |
|
| 175 | } |
||
| 176 | |||
| 177 | 35 | public static function getEntryArrayWithBookNumber($query, $columns, $params, $category) |
|
| 178 | { |
||
| 179 | /* @var $result PDOStatement */ |
||
| 180 | |||
| 181 | 35 | list (, $result) = self::executeQuery($query, $columns, '', $params, -1); |
|
| 182 | 35 | $entryArray = array(); |
|
| 183 | 35 | while ($post = $result->fetchObject()) |
|
| 184 | { |
||
| 185 | /* @var $instance Author|Tag|Serie|Publisher */ |
||
|
0 ignored issues
–
show
|
|||
| 186 | |||
| 187 | 25 | $instance = new $category($post); |
|
| 188 | 25 | if (property_exists($post, 'sort')) { |
|
| 189 | 17 | $title = $post->sort; |
|
| 190 | 17 | } else { |
|
| 191 | 8 | $title = $post->name; |
|
| 192 | } |
||
| 193 | 25 | array_push($entryArray, new Entry($title, $instance->getEntryId(), |
|
| 194 | 25 | str_format(localize('bookword', $post->count), $post->count), 'text', |
|
| 195 | 25 | array(new LinkNavigation($instance->getUri())), '', $post->count)); |
|
| 196 | 25 | } |
|
| 197 | 35 | return $entryArray; |
|
| 198 | } |
||
| 199 | |||
| 200 | 75 | public static function executeQuery($query, $columns, $filter, $params, $n, $database = NULL, $numberPerPage = NULL) |
|
| 201 | { |
||
| 202 | 75 | $totalResult = -1; |
|
| 203 | |||
| 204 | 75 | if (useNormAndUp()) { |
|
| 205 | 7 | $query = preg_replace('/upper/', 'normAndUp', $query); |
|
| 206 | 7 | $columns = preg_replace('/upper/', 'normAndUp', $columns); |
|
| 207 | 7 | } |
|
| 208 | |||
| 209 | 75 | if (is_null($numberPerPage)) { |
|
| 210 | 73 | $numberPerPage = getCurrentOption('max_item_per_page'); |
|
| 211 | 73 | } |
|
| 212 | |||
| 213 | 75 | if ($numberPerPage != -1 && $n != -1) { |
|
| 214 | // First check total number of results |
||
| 215 | 28 | $result = self::getDb($database)->prepare(str_format($query, 'count(*)', $filter)); |
|
| 216 | 28 | $result->execute($params); |
|
| 217 | 28 | $totalResult = $result->fetchColumn(); |
|
| 218 | |||
| 219 | // Next modify the query and params |
||
| 220 | 28 | $query .= ' limit ?, ?'; |
|
| 221 | 28 | array_push($params, ($n - 1) * $numberPerPage, $numberPerPage); |
|
| 222 | 28 | } |
|
| 223 | |||
| 224 | 75 | $result = self::getDb($database)->prepare(str_format($query, $columns, $filter)); |
|
| 225 | 75 | $result->execute($params); |
|
| 226 | 75 | return array($totalResult, $result); |
|
| 227 | } |
||
| 228 | } |
||
| 229 |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.