This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * @author Victor Dubiniuk <[email protected]> |
||
4 | * |
||
5 | * @copyright Copyright (c) 2015, ownCloud, Inc. |
||
6 | * @license AGPL-3.0 |
||
7 | * |
||
8 | * This code is free software: you can redistribute it and/or modify |
||
9 | * it under the terms of the GNU Affero General Public License, version 3, |
||
10 | * as published by the Free Software Foundation. |
||
11 | * |
||
12 | * This program is distributed in the hope that it will be useful, |
||
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
15 | * GNU Affero General Public License for more details. |
||
16 | * |
||
17 | * You should have received a copy of the GNU Affero General Public License, version 3, |
||
18 | * along with this program. If not, see <http://www.gnu.org/licenses/> |
||
19 | * |
||
20 | */ |
||
21 | |||
22 | namespace Owncloud\Updater\Utils; |
||
23 | |||
24 | use \Owncloud\Updater\Console\Application; |
||
25 | |||
26 | /** |
||
27 | * Class Locator |
||
28 | * |
||
29 | * @package Owncloud\Updater\Utils |
||
30 | */ |
||
31 | class Locator { |
||
32 | |||
33 | /** |
||
34 | * absolute path to ownCloud root |
||
35 | * @var string |
||
36 | */ |
||
37 | protected $ownCloudRootPath; |
||
38 | |||
39 | /** |
||
40 | * absolute path to updater root |
||
41 | * @var string |
||
42 | */ |
||
43 | protected $updaterRootPath; |
||
44 | |||
45 | /** |
||
46 | * |
||
47 | * @param string $baseDir |
||
48 | */ |
||
49 | public function __construct($baseDir){ |
||
50 | $this->updaterRootPath = $baseDir; |
||
51 | $this->ownCloudRootPath = dirname($baseDir); |
||
52 | } |
||
53 | |||
54 | /** |
||
55 | * @return string |
||
56 | */ |
||
57 | public function getOwnCloudRootPath(){ |
||
58 | return $this->ownCloudRootPath; |
||
59 | } |
||
60 | |||
61 | /** |
||
62 | * expected items in the core |
||
63 | * @return string[] |
||
64 | */ |
||
65 | public function getRootDirContent(){ |
||
66 | return [ |
||
67 | "3rdparty", |
||
68 | "config", |
||
69 | "core", |
||
70 | "l10n", |
||
71 | "lib", |
||
72 | "ocm-provider", |
||
73 | "ocs", |
||
74 | "ocs-provider", |
||
75 | "resources", |
||
76 | "settings", |
||
77 | ".htaccess", |
||
78 | ".mailmap", |
||
79 | ".tag", |
||
80 | ".user.ini", |
||
81 | "AUTHORS", |
||
82 | "CHANGELOG.md", |
||
83 | "console.php", |
||
84 | "COPYING", |
||
85 | "cron.php", |
||
86 | "db_structure.xml", |
||
87 | "index.html", |
||
88 | "index.php", |
||
89 | "indie.json", |
||
90 | "occ", |
||
91 | "public.php", |
||
92 | "remote.php", |
||
93 | "robots.txt", |
||
94 | "status.php", |
||
95 | "version.php", |
||
96 | ]; |
||
97 | } |
||
98 | |||
99 | /** |
||
100 | * @return array |
||
101 | */ |
||
102 | public function getUpdaterContent(){ |
||
103 | return [ |
||
104 | 'app', |
||
105 | 'application.php', |
||
106 | 'box.json', |
||
107 | 'composer.json', |
||
108 | 'composer.lock', |
||
109 | 'CHANGELOG.md', |
||
110 | 'CONTRIBUTING.md', |
||
111 | 'COPYING-AGPL', |
||
112 | 'index.php', |
||
113 | 'pub', |
||
114 | 'src', |
||
115 | 'vendor', |
||
116 | 'README.md', |
||
117 | '.travis.yml', |
||
118 | '.scrutinizer.yml', |
||
119 | 'nbproject', |
||
120 | ]; |
||
121 | } |
||
122 | |||
123 | /** |
||
124 | * Get all files and directories in the OC root dir using signature.json as a source |
||
125 | * |
||
126 | * @param string $basePath |
||
127 | * |
||
128 | * @return array |
||
129 | */ |
||
130 | public function getRootDirItemsFromSignature($basePath) { |
||
131 | $signature = $this->getSignature($basePath); |
||
132 | $items = []; |
||
133 | if (isset($signature['hashes'])) { |
||
134 | $allItems = array_keys($signature['hashes']); |
||
135 | foreach ($allItems as $k => $v) { |
||
136 | // Get the part of the string before the first slash or entire string if there is no slash |
||
137 | $allItems[$k] = strtok($v, '/'); |
||
138 | } |
||
139 | $items = array_unique($allItems); |
||
140 | } |
||
141 | return $items; |
||
142 | } |
||
143 | |||
144 | /** |
||
145 | * Absolute path to core root dir content |
||
146 | * @return array |
||
147 | */ |
||
148 | public function getRootDirItems(){ |
||
149 | $items = $this->getRootDirContent(); |
||
150 | $items = array_map( |
||
151 | function($item){ return $this->ownCloudRootPath . "/" . $item; }, |
||
152 | $items |
||
153 | ); |
||
154 | return $items; |
||
155 | } |
||
156 | |||
157 | /** |
||
158 | * Absolute path |
||
159 | * @return string |
||
160 | * @throws \Exception |
||
161 | */ |
||
162 | public function getDataDir(){ |
||
163 | $container = Application::$container; |
||
164 | if (isset($container['utils.configReader']) && $container['utils.configReader']->getIsLoaded()){ |
||
165 | return $container['utils.configReader']->getByPath('system.datadirectory'); |
||
166 | } |
||
167 | |||
168 | // Fallback case |
||
169 | include $this->getPathToConfigFile(); |
||
170 | if (isset($CONFIG['datadirectory'])){ |
||
0 ignored issues
–
show
|
|||
171 | return $CONFIG['datadirectory']; |
||
172 | } |
||
173 | |||
174 | // Something went wrong |
||
175 | throw new \Exception('Unable to detect datadirectory'); |
||
176 | } |
||
177 | |||
178 | /** |
||
179 | * Absolute path to updater root dir |
||
180 | * @return string |
||
181 | */ |
||
182 | public function getUpdaterBaseDir(){ |
||
183 | return $this->getDataDir() . '/updater-data'; |
||
184 | } |
||
185 | |||
186 | /** |
||
187 | * Absolute path to create a core and apps backups |
||
188 | * @return string |
||
189 | */ |
||
190 | public function getCheckpointDir(){ |
||
191 | return $this->getUpdaterBaseDir() . '/checkpoint'; |
||
192 | } |
||
193 | |||
194 | /** |
||
195 | * Absolute path to store downloaded packages |
||
196 | * @return string |
||
197 | */ |
||
198 | public function getDownloadBaseDir(){ |
||
199 | return $this->getUpdaterBaseDir() . '/download'; |
||
200 | } |
||
201 | |||
202 | /** |
||
203 | * Absolute path to a temporary directory |
||
204 | * to extract downloaded packages into |
||
205 | * @return string |
||
206 | */ |
||
207 | public function getExtractionBaseDir(){ |
||
208 | return $this->getUpdaterBaseDir() . "/_oc_upgrade"; |
||
209 | } |
||
210 | |||
211 | /** |
||
212 | * |
||
213 | * @return string |
||
214 | */ |
||
215 | public function getPathToOccFile(){ |
||
216 | return $this->ownCloudRootPath . '/occ'; |
||
217 | } |
||
218 | |||
219 | /** |
||
220 | * |
||
221 | * @return string |
||
222 | */ |
||
223 | public function getInstalledVersion(){ |
||
224 | include $this->getPathToVersionFile(); |
||
225 | |||
226 | /** @var $OC_Version string */ |
||
227 | return $OC_Version; |
||
0 ignored issues
–
show
|
|||
228 | } |
||
229 | |||
230 | /** |
||
231 | * |
||
232 | * @return string |
||
233 | */ |
||
234 | public function getChannelFromVersionsFile(){ |
||
235 | include $this->getPathToVersionFile(); |
||
236 | |||
237 | /** @var $OC_Channel string */ |
||
238 | return $OC_Channel; |
||
0 ignored issues
–
show
|
|||
239 | } |
||
240 | |||
241 | /** |
||
242 | * |
||
243 | * @return string |
||
244 | */ |
||
245 | public function getBuild(){ |
||
246 | include $this->getPathToVersionFile(); |
||
247 | |||
248 | /** @var $OC_Build string */ |
||
249 | return $OC_Build; |
||
0 ignored issues
–
show
|
|||
250 | } |
||
251 | |||
252 | /** |
||
253 | * @return string |
||
254 | */ |
||
255 | public function getSecretFromConfig(){ |
||
256 | include $this->getPathToConfigFile(); |
||
257 | if (isset($CONFIG['updater.secret'])){ |
||
0 ignored issues
–
show
The variable
$CONFIG seems to never exist, and therefore isset should always return false . Did you maybe rename this variable?
This check looks for calls to This is most likely caused by the renaming of a variable or the removal of a function/method parameter. ![]() |
|||
258 | return $CONFIG['updater.secret']; |
||
259 | } |
||
260 | return ''; |
||
261 | } |
||
262 | |||
263 | /** |
||
264 | * @param string $filePostfix |
||
265 | * @return array |
||
266 | */ |
||
267 | public function getPathtoConfigFiles($filePostfix = 'config.php'){ |
||
268 | // Only config.php for now |
||
269 | return [ |
||
270 | $this->ownCloudRootPath . '/config/' . $filePostfix |
||
271 | ]; |
||
272 | } |
||
273 | |||
274 | /** |
||
275 | * @return string |
||
276 | */ |
||
277 | public function getPathToConfigFile(){ |
||
278 | return $this->ownCloudRootPath . '/config/config.php'; |
||
279 | } |
||
280 | |||
281 | /** |
||
282 | * |
||
283 | * @return string |
||
284 | */ |
||
285 | public function getPathToVersionFile(){ |
||
286 | return $this->ownCloudRootPath . '/version.php'; |
||
287 | } |
||
288 | |||
289 | /** |
||
290 | * @param string $rootPath |
||
291 | * |
||
292 | * @return array|mixed |
||
293 | */ |
||
294 | private function getSignature($rootPath) { |
||
295 | $signature = []; |
||
296 | $signaturePath = $rootPath . '/core/signature.json'; |
||
297 | if (is_file($signaturePath)) { |
||
298 | $signature = \json_decode(file_get_contents($signaturePath), true); |
||
299 | if (!is_array($signature)) { |
||
300 | $signature = []; |
||
301 | } |
||
302 | } |
||
303 | return $signature; |
||
304 | } |
||
305 | } |
||
306 |
This check looks for calls to
isset(...)
orempty()
on variables that are yet undefined. These calls will always produce the same result and can be removed.This is most likely caused by the renaming of a variable or the removal of a function/method parameter.