Issues (108)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

js/galleryimage.js (4 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
/* global Handlebars, oc_requesttoken, Gallery, Thumbnails */
2
(function ($, Gallery, oc_requesttoken) {
0 ignored issues
show
Identifier 'oc_requesttoken' is not in camel case.
Loading history...
3
	"use strict";
4
5
	var TEMPLATE =
6
		'<a class="row-element" style="width: {{targetWidth}}px; height: {{targetHeight}}px;" ' +
7
		'href="" data-path="{{path}}">' +
8
		'	<div class="image-loader loading"></div>' +
9
		'	<span class="image-label">' +
10
		'		<span class="title">{{label}}</span>' +
11
		'	</span>' +
12
		'	<div class="image container"></div>' +
13
		'</a>';
14
15
	/**
16
	 * Creates a new image object to store information about a media file
17
	 *
18
	 * @param {string} src
19
	 * @param {string} path
20
	 * @param {number} fileId
21
	 * @param {string} mimeType
22
	 * @param {number} mTime modification time
23
	 * @param {string} etag
24
	 * @param {number} size
25
	 * @param {boolean} sharedWithUser
26
	 * @param {string} owner
27
	 * @param {number} permissions
28
 * @constructor
29
	 */
30
	var GalleryImage = function (src, path, fileId, mimeType, mTime, etag, size, sharedWithUser,
0 ignored issues
show
This function has too many parameters. (10)
Loading history...
31
								 owner, permissions) {
32
		this.src = src;
33
		this.path = path;
34
		this.fileId = fileId;
35
		this.mimeType = mimeType;
36
		this.mTime = mTime;
37
		this.etag = etag;
38
		this.size = size;
39
		this.sharedWithUser = sharedWithUser;
40
		this.owner = owner;
41
		this.permissions = permissions;
42
		this.thumbnail = null;
43
		this.domDef = null;
44
		this.spinner = null;
45
	};
46
47
	GalleryImage.prototype = {
48
		/**
49
		 * Returns the Thumbnail ID
50
		 *
51
		 * @returns {[number]}
52
		 */
53
		getThumbnailIds: function () {
54
			return [this.fileId];
55
		},
56
57
		/**
58
		 * Returns a reference to a loading Thumbnail.image
59
		 *
60
		 * @param {boolean} square
61
		 *
62
		 * @returns {jQuery.Deferred<Thumbnail.image>}
63
		 */
64
		getThumbnail: function (square) {
65
			if (this.thumbnail === null) {
66
				this.thumbnail = Thumbnails.get(this.fileId, square);
67
			}
68
			return this.thumbnail.loadingDeferred;
69
		},
70
71
		/**
72
		 * Returns the width of a thumbnail
73
		 *
74
		 * Used to calculate the width of the row as we add more images to it
75
		 *
76
		 * @returns {number}
77
		 */
78
		getThumbnailWidth: function (targetHeight) {
79
			var image = this;
80
			// img is a Thumbnail.image
81
			return this.getThumbnail(false).then(function (img) {
82
				var width = 0;
83
				if (img) {
84
					// In Firefox, you don't get the size of a SVG before it's added to the DOM
85
					image.domDef.children('.image').append(img);
86
					if (image.mimeType === 'image/svg+xml') {
87
						image.thumbnail.ratio = img.width / img.height;
88
					}
89
					width = Math.round(targetHeight * image.thumbnail.ratio);
90
				}
91
92
				return width;
93
			});
94
		},
95
96
		/**
97
		 * Creates the container, the a and img elements in the DOM
98
		 *
99
		 * Each image is also a link to start the full screen slideshow
100
		 *
101
		 * @param {number} targetHeight
102
		 *
103
		 * @return {a}
104
		 */
105
		getDom: function (targetHeight) {
106
			if (this.domDef === null) {
107
				var template = Handlebars.compile(TEMPLATE);
108
				var imageElement = template({
109
					targetHeight: targetHeight,
110
					targetWidth: targetHeight,
111
					label: OC.basename(this.path),
112
					path: this.path
113
				});
114
				this.domDef = $(imageElement);
115
				this._addLabel();
116
				this.spinner = this.domDef.children('.image-loader');
117
			}
118
			return this.domDef;
119
		},
120
121
		/**
122
		 * Resizes the image once it has been loaded
123
		 *
124
		 * @param {Number} targetHeight
125
		 * @param {Number} newWidth
126
		 */
127
		resize: function (targetHeight, newWidth) {
128
			if (this.spinner !== null) {
129
				var img = this.thumbnail.image;
130
				this.spinner.remove();
131
				this.spinner = null;
132
				this.domDef.attr('data-width', newWidth)
133
					.attr('data-height', targetHeight);
134
135
				var url = this._getLink();
136
				this.domDef.attr('href', url);
137
138
				// This will stretch wide images to make them reach targetHeight
139
				$(img).css({
140
					'width': newWidth,
141
					'height': targetHeight
142
				});
143
				img.alt = encodeURI(this.path);
144
145
				this.domDef.click(this._openImage.bind(this));
146
			}
147
		},
148
149
		/**
150
		 * Adds a label to the album
151
		 *
152
		 * @private
153
		 */
154
		_addLabel: function () {
155
			var imageLabel = this.domDef.children('.image-label');
156
			this.domDef.hover(function () {
157
				imageLabel.slideToggle(OC.menuSpeed);
158
			}, function () {
159
				imageLabel.slideToggle(OC.menuSpeed);
160
			});
161
		},
162
163
		/**
164
		 * Generates the link for the click action of the image
165
		 *
166
		 * @returns {string}
167
		 * @private
168
		 */
169
		_getLink: function () {
170
			var url = '#' + encodeURIComponent(this.path);
171
			if (!this.thumbnail.valid) {
172
				var params = {
173
					c: this.etag,
174
					requesttoken: oc_requesttoken
0 ignored issues
show
Identifier 'oc_requesttoken' is not in camel case.
Loading history...
175
				};
176
				url = Gallery.utility.buildGalleryUrl(
177
					'files',
178
					'/download/' + this.fileId,
179
					params
180
				);
181
			}
182
183
			return url;
184
		},
185
186
		/**
187
		 * Call when the image is clicked on.
188
		 *
189
		 * @param event
190
		 * @private
191
		 */
192
		_openImage: function (event) {
193
			event.stopPropagation();
194
			// click function for future use.
195
		}
196
	};
197
198
	window.GalleryImage = GalleryImage;
199
})(jQuery, Gallery, oc_requesttoken);
0 ignored issues
show
Identifier 'oc_requesttoken' is not in camel case.
Loading history...
200