Issues (18)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/AppBundle/Controller/ExtensionsController.php (1 issue)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 *
4
 * @copyright (c) 2014 phpBB Group
5
 * @license http://opensource.org/licenses/gpl-3.0.php GNU General Public License v3
6
 * @author MichaelC, Paul, VSE & battye
7
 *
8
 */
9
10
namespace AppBundle\Controller;
11
12
use Phpbb\Epv\Output\HtmlOutput;
13
use Phpbb\Epv\Output\Output;
14
use Phpbb\Epv\Tests\TestStartup;
15
use AppBundle\Entity\EpvResults;
16
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
17
use AppBundle\Helper\Extensions\OfficialExtension;
18
use Symfony\Component\HttpFoundation\Request;
19
20
// Controller for Extensions pages
21
class ExtensionsController extends Controller
22
{
23
	public function officialExtensionsAction()
24
	{
25
		// TODO: In the future we may load this dynamically from a database table
26
		$officialExtensions = array();
27
28
		$officialExtensions[] = new OfficialExtension(
29
			'Advertisement Management',
30
			'The Advertisement Management extension allows phpBB board administrators to add and manage advertisements on their forums. Create unlimited advertisements using code snippets (such as Google AdSense) or create your own HTML/JS and banner ads. Display ads in a variety of locations with priority weighting to show important ads more often than others. Ad views and clicks can be counted and set to expire at a certain date or number of clicks and/or views. This extension is a complete management tool for all of a board’s advertising needs.',
31
			'This extension was developed during our participation in the 2017 Google Summer of Code (GSoC) program. It was a collaboration between phpBB Customisations team members mentoring a student (Senky) who has since become a member of the phpBB Customisations team. See how the process was tracked on our <a href="https://trello.com/b/N3ZDYzdA/gsoc-2017-ad-management">Trello board</a>.',
32
			'https://www.phpbb.com/customise/db/extension/ads/',
33
			'https://github.com/phpbb-extensions/ad-management',
34
			'/assets/images/images/extensions/admanagement.png'
35
		);
36
37
		$officialExtensions[] = new OfficialExtension(
38
			'Auto Groups',
39
			'The Auto Groups extension can automate the process of adding and removing users from groups upon reaching specified quantitative milestones related to their post count, age, membership, and warnings count. This allows board administrators to set up special groups that users will automatically be added to (or removed from) based on their activity.',
40
			'The Auto Groups extension comes with a handful of user data conditions that can be used to qualify users for automatic group placement. However, this extension was written with extensibility in mind to allow other extension developers to easily add new user data conditions or integrate Auto Groups into their own extensions. For example, an extension that adds new user data, such as "reputation points," could integrate with Auto Groups to allow a user\'s reputation points to be used as a condition for auto group placement. For more information, see the Wiki page at the Auto Groups GitHub repository to find detailed documentation about extending Auto Groups.',
41
			'https://www.phpbb.com/customise/db/extension/auto_groups/',
42
			'https://github.com/phpbb-extensions/autogroups',
43
			'/assets/images/images/extensions/autogroups.png'
44
		);
45
46
		$officialExtensions[] = new OfficialExtension(
47
			'Board Rules',
48
			'The Board Rules Extension adds a dedicated Rules page to a board. It offers an ACP module from which an unlimited number of rules and rule categories can be created in each language installed on a board. It also supports sending out notifications to all board members notifying them that the rules have been changed, and can require newly registering users read the board rules as part of the terms of agreement for registering on a board.',
49
			'The Board Rules Extension is a fairly advanced design compared to previous phpBB modifications. Abstract classes implemented through interfaces are used to specify the methods that handle most of the code logic. There is an Entity class for manipulating a single rule and an Operator class for manipulating sets of rules. Controller classes are used to process the front-end of the ACP module and the Rules page itself. It also makes use of phpBB\'s new notification system, nestedsets/trees, and AJAX functionality in the ACP user-interface. There is also extensive PHP unit test coverage of the code to ensure its stability and reliability and prevent regressions. We think testing code is so important, we\'ve made it possible for any extension (on Github) to use phpBB\'s PHPUnit testing framework with Travis Continuous Integration hosted servers; just look through our tests and travis files/folders to see how we did it.',
50
			'https://www.phpbb.com/customise/db/extension/boardrules/',
51
			'https://github.com/phpbb-extensions/boardrules',
52
			'/assets/images/images/extensions/boardrules.png'
53
		);
54
55
		$officialExtensions[] = new OfficialExtension(
56
			'Board Announcements',
57
			'The Board Announcements Extension allows board admins to create a special board-wide announcement. Unlike phpBB\'s native global announcements which only appear inside forums, Board Announcements appear near the top of any page being viewed. Users have the option to dismiss the announcement after they have read it.',
58
			'Board Announcements is an entry-level extension by design. We built this extension using techniques that will be more familiar to MOD developers. Code changes are injected directly from the event listener, and all ACP module logic is contained in its ACP module class. Overall, this extension is a good example that shows how to inject new code, add an ACP module, utilize a controller file to run some functional code in combination with AJAX, and how to use new config_text table added in phpBB 3.1.x to store textual data.',
59
			'https://www.phpbb.com/customise/db/extension/boardannouncements/',
60
			'https://github.com/phpbb-extensions/boardannouncements',
61
			'/assets/images/images/extensions/boardannouncements.png'
62
		);
63
64
		$officialExtensions[] = new OfficialExtension(
65
			'Collapsible Forum Categories',
66
			'Collapsible Forum Categories is a nice addition to any forum that will allow users to collapse, or hide, any forum or forum category with a simple click. This provides a convenient way for users to minimise the forums they do not particpate in and focus their attention on the forums they do care about. Collapsed forums will remain hidden for logged-in users across different browsers and devices (guests settings are handled via cookies).',
67
			'Collpasible Forum Categories can be used in third party extensions. Some extensions that add forum category-like sections to a phpBB board (such as a chatbox, portal or additional topic lists) may want to include collapsibility. The GitHub repository for Collapsible Forum Categories has a Wiki article for adding Collapsible Forum Category support to another extension.',
68
			'https://www.phpbb.com/customise/db/extension/collapsible_forum_categories/',
69
			'https://github.com/phpbb-extensions/collapsible-categories',
70
			'/assets/images/images/extensions/collapsiblecategories.png'
71
		);
72
73
		$officialExtensions[] = new OfficialExtension(
74
			'Google Analytics',
75
			'The Google Analytics Extension simply adds a Google Analytics tracking code with your Property ID to your phpBB forum.',
76
			'This extension is the simplest of extensions in form and function. It adds a single new field to the ACP for a Google Analytics Property ID, validates it, and inserts the Universal Analytics a-synchronous javascript code into the head of your board\'s HTML pages, just before the closing &lt;/head&gt; tag, as recommended by Google. In addition to allowing boards to easily add Google\'s powerful analytics, this extension is an ideal starting example for new extension authors, demonstrating how to effectively add an ACP config option implement that config setting using template events.',
77
			'https://www.phpbb.com/customise/db/extension/googleanalytics/',
78
			'https://github.com/phpbb-extensions/googleanalytics',
79
			'/assets/images/images/extensions/googleanalytics.png'
80
		);
81
82
		$officialExtensions[] = new OfficialExtension(
83
			'Media Embed Plug In',
84
			'The Media Embed Plug In brings a modern feature to your board, allowing users to post links to media sites that appear directly in their posts as embedded videos and/or content. It supports over 50 popular sites including videos, music streams, tweets, products, articles and other embeddable content. Users can utilise the new [MEDIA] BBCode or simply post the URL in plain text. Older posts made before installation of this extension containing supported links will automatically display as embedded content too.',
85
			'The Media Embed Plug In extension is a great example of how developers can harness some of the powerful features in the TextFormatter library that powers phpBB\'s BBCode engine. Media Embed is a plug in from this library that phpBB does not make use of by default. This extension enables this component of the TextFormatter library and takes it a step further giving Administrators some control over which of the supported sites will be allowed to embed content on their boards.',
86
			'https://www.phpbb.com/customise/db/extension/mediaembed/',
87
			'https://github.com/phpbb-extensions/mediaembed',
88
			'/assets/images/images/extensions/mediaembed.png'
89
		);
90
91
		$officialExtensions[] = new OfficialExtension(
92
			'Pages',
93
			'The Pages Extension allows administrators to create custom static pages for their phpBB forum. With Pages you can add an unlimited number of new static pages to your board, such as an About Us page, News page, or even a simple forum Blog. The ACP\'s page editor allows you to create page content using BBCodes or HTML, making it possible to embed media from other sites and create truly unique pages.',
94
			'This extension provides another opportunity for developers to analyse an object-oriented and abstracted approach to developing an extension for phpBB. Because the Pages extension can create an unlimited number of pages, it is set up to account for dynamic page routes and links. It allows users to choose a number of possible link locations for each page using mutliple template events, and leverages the power of phpBB\'s finder object to allow users to upload their own custom link icons and page template files. As with all our extensions, there is complete test coverage of all code to ensure maximum stability and reliability.',
95
			'https://www.phpbb.com/customise/db/extension/pages/',
96
			'https://github.com/phpbb-extensions/pages',
97
			'/assets/images/images/extensions/pages.png'
98
		);
99
100
		$templateVariables = array(
101
			'extensions' => $officialExtensions,
102
		);
103
104
		return $this->render('AppBundle:Extensions:official-extensions.html.twig', $templateVariables);
105
	}
106
107
	public function policiesAction()
108
	{
109
		// Extensions Rules and Policies
110
		$templateVariables = array(
111
			'policies'		 => array(
112
				array('i' => 0, 'name' => 'Validation Policy', 'description' => 'Some general policies on how we handle validation.', 'link' => '/extensions/rules-and-policies/validation-policy'),
113
				array('i' => 1, 'name' => 'Insta-Deny Policy', 'description' => 'How we handle Insta-Denies of Extensions.', 'link' => '/extensions/rules-and-policies/insta-deny'),
114
				array('i' => 2, 'name' => 'Repack Policy', 'description' => 'How we handle repacking of Extensions.', 'link' => '/extensions/rules-and-policies/repack'),
115
			)
116
		);
117
118
		return $this->render('AppBundle:Extensions:rules-policies.html.twig', $templateVariables);
119
	}
120
121
	public function epvAction(Request $request)
122
	{
123
		$templateVariables = array();
124
125
		$github = $request->request->get('github');
126
		$debug = $request->request->get('debug');
127
128
		if ($github)
129
		{
130
			$results = $this->getDoctrine()
131
				->getRepository('AppBundle:EpvResults')
132
				->findByGithub($github);
133
			$em = $this->getDoctrine()->getManager();
134
135
			$fail = false;
136
			if ($results && sizeof($results))
137
			{
138
				/** @var  $item EpvResults */
139
				foreach ($results as $item)
140
				{
141
					if ($item->getRuntime() > time() - 30)
142
					{
143
						$fail = true;
144
					}
145
					else
146
					{
147
						$em->remove($item);
148
					}
149
				}
150
			}
151
152
			if (!$fail)
153
			{
154
				$int_output = new HtmlOutput();
155
				$output	 = new Output($int_output, $debug);
156
157
				$test						 = new TestStartup($output, TestStartup::TYPE_GITHUB, $github, $debug);
0 ignored issues
show
$test is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
158
				$templateVariables['results'] = $int_output->getBuffer();
159
160
				$result = new EpvResults();
161
				$result->setGithub($github);
162
				$result->setRuntime(time());
163
164
				$em->persist($result);
165
				$em->flush();
166
			}
167
			else
168
			{
169
				$templateVariables['errors'] = 'Please wait a while before running EPV again.';
170
			}
171
172
		}
173
174
		return $this->render('AppBundle:Extensions:epv.html.twig', $templateVariables);
175
	}
176
}
177