Issues (6)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/DirectAdmin/Context/ResellerContext.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
/*
4
 * DirectAdmin API Client
5
 * (c) Omines Internetbureau B.V. - https://omines.nl/
6
 *
7
 * For the full copyright and license information, please view the LICENSE
8
 * file that was distributed with this source code.
9
 */
10
11
namespace Omines\DirectAdmin\Context;
12
13
use Omines\DirectAdmin\Objects\BaseObject;
14
use Omines\DirectAdmin\Objects\Users\User;
15
16
/**
17
 * Context for reseller functions.
18
 *
19
 * @author Niels Keurentjes <[email protected]>
20
 */
21
class ResellerContext extends UserContext
22
{
23
    /**
24
     * Creates a new user on the server.
25
     *
26
     * @param string $username Login for the new user
27
     * @param string $password Password for the new user
28
     * @param string $email Email for the new user
29
     * @param string $domain Default domain for the new user
30
     * @param string $ip IP for the user
31
     * @param string|array $package Either a package name or an array of options for custom
32
     * @return User Newly created user
33
     * @url http://www.directadmin.com/api.html#create for options to use.
34
     */
35
    public function createUser($username, $password, $email, $domain, $ip, $package = [])
36
    {
37
        $options = array_merge(
38
            ['ip' => $ip, 'domain' => $domain],
39
            is_array($package) ? $package : ['package' => $package]
40
        );
41
        return $this->createAccount($username, $password, $email, $options, 'ACCOUNT_USER', User::class);
42
    }
43
44
    /**
45
     * Internal helper function for creating new accounts.
46
     *
47
     * @param string $username Login for the new user
48
     * @param string $password Password for the new user
49
     * @param string $email Email for the new user
50
     * @param array $options List of DA account options to apply
51
     * @param string $endpoint API endpoint to invoke
52
     * @param string $returnType Class name that should wrap the resulting account
53
     * @return object An instance of the type specified in $returnType
54
     */
55
    protected function createAccount($username, $password, $email, $options, $endpoint, $returnType)
56
    {
57
        $this->invokeApiPost($endpoint, array_merge($options, [
58
            'action' => 'create',
59
            'add' => 'Submit',
60
            'email' => $email,
61
            'passwd' => $password,
62
            'passwd2' => $password,
63
            'username' => $username,
64
        ]));
65
        return new $returnType($username, $this);
66
    }
67
68
    /**
69
     * Deletes a single account.
70
     *
71
     * @param string $username Account to delete
72
     */
73
    public function deleteAccount($username)
74
    {
75
        $this->deleteAccounts([$username]);
76
    }
77
78
    /**
79
     * Deletes multiple accounts.
80
     *
81
     * @param string[] $usernames Accounts to delete
82
     */
83 View Code Duplication
    public function deleteAccounts(array $usernames)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
84
    {
85
        $options = ['confirmed' => 'Confirm', 'delete' => 'yes'];
86
        foreach (array_values($usernames) as $idx => $username) {
87
            $options["select{$idx}"] = $username;
88
        }
89
        $this->invokeApiPost('SELECT_USERS', $options);
90
    }
91
92
    /**
93
     * Suspends a single account.
94
     *
95
     * @param string $username Account to delete
96
     */
97
    public function suspendAccount($username)
98
    {
99
        $this->suspendAccounts([$username]);
100
    }
101
102
    /**
103
     * Unsuspends a single account.
104
     *
105
     * @param string $username Account to delete
106
     */
107
    public function unsuspendAccount($username)
108
    {
109
        $this->suspendAccounts([$username], false);
110
    }
111
112
    /**
113
     * Suspends (or unsuspends) multiple accounts.
114
     *
115
     * @param string[] $usernames Accounts to delete
116
     * @param bool $suspend (true - suspend, false - unsuspend)
117
     */
118 View Code Duplication
    public function suspendAccounts(array $usernames, $suspend = true)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
119
    {
120
        $options = ['suspend' => $suspend ? 'Suspend' : 'Unsuspend'];
121
        foreach (array_values($usernames) as $idx => $username) {
122
            $options['select' . $idx] = $username;
123
        }
124
        $this->invokeApiPost('SELECT_USERS', $options);
125
    }
126
127
    /**
128
     * Unsuspends multiple accounts.
129
     *
130
     * @param string[] $usernames Accounts to delete
131
     */
132
    public function unsuspendAccounts(array $usernames)
133
    {
134
        $this->suspendAccounts($usernames, false);
135
    }
136
137
    /**
138
     * Returns all IPs available to this reseller.
139
     *
140
     * @return array List of IPs as strings
141
     */
142
    public function getIPs()
143
    {
144
        return $this->invokeApiGet('SHOW_RESELLER_IPS');
145
    }
146
147
    /**
148
     * Returns a single user by name.
149
     *
150
     * @param string $username
151
     * @return User|null
152
     */
153
    public function getUser($username)
154
    {
155
        $resellers = $this->getUsers();
156
        return isset($resellers[$username]) ? $resellers[$username] : null;
157
    }
158
159
    /**
160
     * Returns all users for this reseller.
161
     *
162
     * @return User[] Associative array of users
163
     */
164
    public function getUsers()
165
    {
166
        return BaseObject::toObjectArray($this->invokeApiGet('SHOW_USERS'), User::class, $this);
167
    }
168
169
    /**
170
     * Impersonates a user, allowing the reseller/admin to act on their behalf.
171
     *
172
     * @param string $username Login of the account to impersonate
173
     * @param bool $validate Whether to check the user exists and is a user
174
     * @return UserContext
175
     */
176
    public function impersonateUser($username, $validate = false)
177
    {
178
        return new UserContext($this->getConnection()->loginAs($username), $validate);
179
    }
180
}
181