Issues (493)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

js/otherbackendconfig.js (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
OC.Contacts = OC.Contacts || {};
2
3
(function(window, $, OC) {
4
	'use strict';
5
6
	var OtherBackendConfig = function(storage, addressbooks, $template) {
7
		this.storage = storage;
8
		this.addressbooks = addressbooks;
9
		this.$template = $template;
10
		this.getConnectors();
11
	};
12
	
13
	OC.Contacts.OtherBackendConfig = OtherBackendConfig;
14
15
	OtherBackendConfig.prototype.openAddressbookUi = function() {
16
		this.addressbookUiInit();
17
	};
18
19
	OtherBackendConfig.prototype.editAddressbookUI = function(addressbook) {
20
		var self = this;
21
		$('#addressbooks-ui-addressbookid').val(addressbook.id);
22
		$('#addressbooks-ui-name').val(addressbook.displayname);
23
		$('#addressbooks-ui-uri').val(addressbook.uri);
24
		$('#addressbooks-ui-description').val(addressbook.description);
25
		$('#addressbooks-ui-ldapurl').val(addressbook.ldapurl);
26
		$('#addressbooks-ui-ldapanonymous').attr('checked', (addressbook.ldapanonymous===true));
27
		$('#addressbooks-ui-ldapreadonly').attr('checked', (addressbook.ldapreadonly===true));
28
		$('#addressbooks-ui-ldapuser').val(addressbook.ldapuser);
29
		$('#addressbooks-ui-ldappass').val('nochange');
30
		$('#addressbooks-ui-ldappass-modified').val('false');
31
		$('#addressbooks-ui-ldappagesize').val(addressbook.ldappagesize);
32
		$('#addressbooks-ui-ldapbasednsearch').val(addressbook.ldapbasednsearch);
33
		$('#addressbooks-ui-ldapfilter').val(addressbook.ldapfilter);
34
		$('#addressbooks-ui-ldapbasednmodify').val(addressbook.ldapbasednmodify);
35
		$('#addressbooks-ui-uri').prop('disabled', true);
36
		if ($('#addressbooks-ui-ldapanonymous').prop('checked')) {
37
			$('#addressbooks-ui-ldapuser').prop('disabled', true);
38
			$('#addressbooks-ui-ldappass').prop('disabled', true);
39
		} else {
40
			$('#addressbooks-ui-ldapuser').removeProp('disabled');
41
			$('#addressbooks-ui-ldappass').removeProp('disabled');
42
		}
43
		if ($('#addressbooks-ui-ldapreadonly').prop('checked')) {
44
			$('#addressbooks-ui-ldapbasednmodify').prop('disabled', true);
45
		} else {
46
			$('#addressbooks-ui-ldapbasednmodify').removeProp('disabled');
47
		}
48
		
49
		$('#addressbooks-ui-ldappass').change(function() {
50
			$('#addressbooks-ui-ldappass-modified').val('true');
51
		});
52
		
53
		this.addressbookUiInit();
54
55
		var connectors = self.getConnectors();
56
		$('#addressbooks-ui-ldapvcardconnector').empty();
57
		var custom = true;
58
		var $option = null;
59
		for (var id = 0; id < connectors.length; id++) {
60
			if (connectors[id].id === addressbook.ldapconnectorid) {
61
				$option = $('<option value="' + connectors[id].id + '">' + connectors[id].name + '</option>').attr('selected','selected');
62
				custom = false;
63
			} else {
64
				$option = $('<option value="' + connectors[id].id + '">' + connectors[id].name + '</option>');
65
			}
66
			$('#addressbooks-ui-ldapvcardconnector').append($option);
67
		}
68
		if (custom) {
69
			$option = $('<option value="">' + 'Custom connector' + '</option>').attr('selected','selected');
70
			$('#addressbooks-ui-ldapvcardconnector').append($option);
71
			$('#addressbooks-ui-ldapvcardconnector-value-p').show();
72
			$('#addressbooks-ui-ldapvcardconnector-copyfrom-p').show();
73
			$('#addressbooks-ui-ldapvcardconnector-copyfrom').empty();
74
			$option = $('<option value="">' + 'Select connector' + '</option>').attr('selected','selected');
75
			$('#addressbooks-ui-ldapvcardconnector-copyfrom').append($option);
76
			for (var id = 0; id < connectors.length; id++) {
0 ignored issues
show
It seems like id was already defined.
Loading history...
77
				$option = $('<option value="' + connectors[id].id + '">' + connectors[id].name + '</option>');
78
				$('#addressbooks-ui-ldapvcardconnector-copyfrom').append($option);
79
			}
80
81
			$('#addressbooks-ui-ldapvcardconnector-value').text(addressbook.ldap_vcard_connector);
82
		} else {
83
			$option = $('<option value="">' + 'Custom connector' + '</option>');
84
			$('#addressbooks-ui-ldapvcardconnector').append($option);
85
		}
86
	};
87
88
	OtherBackendConfig.prototype.addressbookUiOk = function($divDlg) {
89
		var defer = $.Deferred();
90
		var addressbook = OC.Contacts.addressBooks;
91
92
		var error=false;
93
		var errorFields = [];
94
		$('[required]').each(function() {
95
			if ($(this).val() === '' && !$(this).attr('disabled')){
96
				error = true;
97
				errorFields.push($(this).attr('placeholder'));
98
			}
99
		});
100
		if (!error) {
101
			$('#addressbooks-ui-errortitle-p').empty();
102
			$('#addressbooks-ui-errormessage-p').empty();
103
			$.when(this.storage.addAddressBook($('#addressbooks-ui-backend').val(),
104
			{
105
				displayname: $('#addressbooks-ui-name').val(),
106
				description: $('#addressbooks-ui-description').val(),
107
				uri: ($('#addressbooks-ui-uri').val()==='')?$('#addressbooks-ui-name').val():$('#addressbooks-ui-uri').val(),
108
				ldapurl: $('#addressbooks-ui-ldapurl').val(),
109
				ldapanonymous: $('#addressbooks-ui-ldapanonymous').prop('checked')===true?'true':'false',
110
				ldapreadonly: $('#addressbooks-ui-ldapreadonly').prop('checked')===true?'true':'false',
111
				ldapuser: $('#addressbooks-ui-ldapuser').val(),
112
				ldappass: $('#addressbooks-ui-ldappass').val(),
113
				ldappagesize: $('#addressbooks-ui-ldappagesize').val(),
114
				ldapbasednsearch: $('#addressbooks-ui-ldapbasednsearch').val(),
115
				ldapfilter: $('#addressbooks-ui-ldapfilter').val(),
116
				ldapbasednmodify: $('#addressbooks-ui-ldapbasednmodify').val(),
117
				ldapvcardconnector: $('#addressbooks-ui-ldapvcardconnector').val(),
118
				ldapvcardconnectorvalue: $('#addressbooks-ui-ldapvcardconnector-value').val(),
119
			}
120
			)).then(function(response) {
121
				if(response.error) {
122
					var error = response.message;
123
					if(typeof cb === 'function') {
124
						cb({error:true, message:error});
125
					}
126
					defer.reject(response);
127
				} else {
128
					var book = addressbook.insertAddressBook(response.data);
129
					$(document).trigger('status.addressbook.added');
130
					if(typeof cb === 'function') {
131
						cb({error:false, addressbook: book});
132
					}
133
					defer.resolve({error:false, addressbook: book});
134
				}
135
				OC.Contacts.otherBackendConfig.addressbookUiClose($divDlg);
136
			})
137
			.fail(function(jqxhr, textStatus, error) {
138
				$(this).removeClass('loading');
139
				var err = textStatus + ', ' + error;
140
				console.log('Request Failed', + err);
141
				error = t('contacts', 'Failed adding address book: {error}', {error:err});
142
				if(typeof cb === 'function') {
143
					cb({error:true, message:error});
144
				}
145
				defer.reject({error:true, message:error});
146
				OC.Contacts.otherBackendConfig.addressbookUiClose($divDlg);
147
			});
148
		} else {
149
			$('#addressbooks-ui-errortitle-p').css('color', 'red').text(t('contacts', 'Error, missing parameters: '));
150
			$('#addressbooks-ui-errormessage-p').css('color', 'red').text(errorFields.join(', '));
151
		}
152
	};
153
154
	OtherBackendConfig.prototype.addressbookUiEditOk = function($divDlg) {
155
		var defer = $.Deferred();
156
157
		var error=false;
158
		var errorFields = [];
159
		$('[required]').each(function() {
160
			if ($(this).val() === '' && !$(this).attr('disabled')){
161
				error = true;
162
				errorFields.push($(this).attr('placeholder'));
163
			}
164
		});
165
		if (!error) {
166
			$.when(this.storage.updateAddressBook($('#addressbooks-ui-backend').val(), $('#addressbooks-ui-addressbookid').val(),
167
			{properties:
168
				{
169
					displayname: $('#addressbooks-ui-name').val(),
170
					description: $('#addressbooks-ui-description').val(),
171
					uri: $('#addressbooks-ui-uri').val(),
172
					ldapurl: $('#addressbooks-ui-ldapurl').val(),
173
					ldapanonymous: $('#addressbooks-ui-ldapanonymous').prop('checked')===true?'true':'false',
174
					ldapreadonly: $('#addressbooks-ui-ldapreadonly').prop('checked')===true?'true':'false',
175
					ldapuser: $('#addressbooks-ui-ldapuser').val(),
176
					ldappassmodified: $('#addressbooks-ui-ldappass-modified').val(),
177
					ldappass: $('#addressbooks-ui-ldappass').val(),
178
					ldappagesize: $('#addressbooks-ui-ldappagesize').val(),
179
					ldapbasednsearch: $('#addressbooks-ui-ldapbasednsearch').val(),
180
					ldapfilter: $('#addressbooks-ui-ldapfilter').val(),
181
					ldapbasednmodify: $('#addressbooks-ui-ldapbasednmodify').val(),
182
					ldapvcardconnector: $('#addressbooks-ui-ldapvcardconnector').val(),
183
					ldapvcardconnectorvalue: $('#addressbooks-ui-ldapvcardconnector-value').val(),
184
				}
185
			}
186
			)).then(function(response) {
187
				if(response.error) {
188
					error = response.message;
189
					if(typeof cb === 'function') {
190
						cb({error:true, message:error});
191
					}
192
					defer.reject(response);
193
				}
194
				OC.Contacts.otherBackendConfig.addressbookUiClose($divDlg);
195
			})
196
			.fail(function(jqxhr, textStatus, error) {
197
				$(this).removeClass('loading');
198
				var err = textStatus + ', ' + error;
199
				console.log('Request Failed', + err);
200
				error = t('contacts', 'Failed adding address book: {error}', {error:err});
201
				if(typeof cb === 'function') {
202
					cb({error:true, message:error});
203
				}
204
				defer.reject({error:true, message:error});
205
			});
206
		} else {
207
			$('#addressbooks-ui-errortitle-p').css('color', 'red').text(t('contacts', 'Error, missing parameters: '));
208
			$('#addressbooks-ui-errormessage-p').css('color', 'red').text(errorFields.join(', '));
209
		}
210
	};
211
212
	OtherBackendConfig.prototype.addressbookUiClose = function($divDlg) {
213
		$divDlg.ocdialog().ocdialog('close');
214
		$divDlg.ocdialog().ocdialog('destroy').remove();
215
	};
216
217
	OtherBackendConfig.prototype.addressbookUiInit = function() {
218
		var self = this;
219
		
220
		$('#addressbooks-ui-ldapvcardconnector-value-p').hide();
221
		$('#addressbooks-ui-ldapvcardconnector-copyfrom-p').hide();
222
		$('#addressbooks-ui-name').change(function() {
223
			if ($('#addressbooks-ui-uri').val() === '') {
224
				$('#addressbooks-ui-uri').val($('#addressbooks-ui-name').val().toLowerCase().replace(' ', '-'));
225
			}
226
		});
227
		$('#addressbooks-ui-ldapanonymous').change(function() {
228
			if ($('#addressbooks-ui-ldapanonymous').prop('checked')) {
229
				$('#addressbooks-ui-ldapuser').prop('disabled', true);
230
				$('#addressbooks-ui-ldappass').prop('disabled', true);
231
			} else {
232
				$('#addressbooks-ui-ldapuser').removeProp('disabled');
233
				$('#addressbooks-ui-ldappass').removeProp('disabled');
234
			}
235
		});
236
		$('#addressbooks-ui-ldapreadonly').change(function() {
237
			if ($('#addressbooks-ui-ldapreadonly').prop('checked')) {
238
				$('#addressbooks-ui-ldapbasednmodify').prop('disabled', true);
239
			} else {
240
				$('#addressbooks-ui-ldapbasednmodify').removeProp('disabled');
241
			}
242
		});
243
		$('#addressbooks-ui-ldapbasednsearch').change(function() {
244
			if ($('#addressbooks-ui-ldapbasednmodify').val() === '') {
245
				$('#addressbooks-ui-ldapbasednmodify').val($('#addressbooks-ui-ldapbasednsearch').val());
246
			}
247
		});
248
		$('#addressbooks-ui-ldapbasednmodify').change(function() {
249
			if ($('#addressbooks-ui-ldapbasednsearch').val() === '') {
250
				$('#addressbooks-ui-ldapbasednsearch').val($('#addressbooks-ui-ldapbasednmodify').val());
251
			}
252
		});
253
		
254
		$('#addressbooks-ui-ldapvcardconnector').empty();
255
		var $option = null;
256
		var connectors = self.getConnectors();
257
		for (var id = 0; id < connectors.length; id++) {
258
			if (connectors[id] !== null) {
259
				$option = $('<option value="' + connectors[id].id + '">' + connectors[id].name + '</option>');
260
				$('#addressbooks-ui-ldapvcardconnector').append($option);
261
			}
262
		}
263
		$option = $('<option value="">' + 'Custom connector' + '</option>');
264
		$('#addressbooks-ui-ldapvcardconnector').append($option);
265
266
		$('#addressbooks-ui-ldapvcardconnector').change(function() {
267
			// Custom connector
268
			if ($('#addressbooks-ui-ldapvcardconnector').val() === '') {
269
				$('#addressbooks-ui-ldapvcardconnector-value-p').show();
270
				$('#addressbooks-ui-ldapvcardconnector-copyfrom-p').show();
271
				var connectors = self.getConnectors();
272
				$('#addressbooks-ui-ldapvcardconnector-copyfrom').empty();
273
				var $option = $('<option value="">' + 'Select connector' + '</option>').attr('selected','selected');
274
				$('#addressbooks-ui-ldapvcardconnector-copyfrom').append($option);
275
				for (var id = 0; id < connectors.length; id++) {
276
					$option = $('<option value="' + connectors[id].id + '">' + connectors[id].name + '</option>');
277
					$('#addressbooks-ui-ldapvcardconnector-copyfrom').append($option);
278
				}
279
			} else {
280
				$('#addressbooks-ui-ldapvcardconnector-value-p').hide();
281
				$('#addressbooks-ui-ldapvcardconnector-copyfrom-p').hide();
282
			}
283
		});
284
		$('#addressbooks-ui-ldapvcardconnector-copyfrom').change(function() {
285
			if ($('#addressbooks-ui-ldapvcardconnector-copyfrom').val() !== '') {
286
				var connectors = self.getConnectors();
287
				for (var id = 0; id < connectors.length; id++) {
288
					if ($('#addressbooks-ui-ldapvcardconnector-copyfrom').val() === connectors[id].id) {
289
						$('#addressbooks-ui-ldapvcardconnector-value').text(connectors[id].xml);
290
					}
291
				}
292
			}
293
		});
294
		
295
		$('#addressbooks-ui-ldappagesize').forceNumericOnly();
296
	};
297
	
298
	OtherBackendConfig.prototype.getConnectors = function() {
299
		var self = this;
300
		
301
		if (self.connectors === null || self.connectors === undefined) {
302
			$.when(self.storage.getConnectors($('#addressbooks-ui-backend').val()))
303
			.then(function(response) {
304
				self.connectors = response.data;
305
				return self.connectors;
306
			})
307
			.fail(function(jqxhr, textStatus, error) {
308
				var err = textStatus + ', ' + error;
309
				console.log('Request Failed', + err);
310
				defer.reject({error:true, message:error});
311
			});
312
		} else {
313
			return self.connectors;
314
		}
315
	};
316
	
317
	jQuery.fn.forceNumericOnly = function()
318
	{
319
		return this.each(function()
320
		{
321
			$(this).keydown(function(e)
322
			{
323
				var key = e.charCode || e.keyCode || 0;
324
				// allow backspace, tab, delete, enter, arrows, numbers and keypad numbers ONLY
325
				// home, end, period, and numpad decimal
326
				return (
327
					key === 8 || 
328
					key === 9 ||
329
					key === 13 ||
330
					key === 46 ||
331
					key === 110 ||
332
					key === 190 ||
333
					(key >= 35 && key <= 40) ||
334
					(key >= 48 && key <= 57) ||
335
					(key >= 96 && key <= 105));
336
			});
337
		});
338
	};
339
	
340
})(window, jQuery, OC);
341