Issues (632)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Apps/Console/MainInstallCommand.php (4 issues)

Labels
1
<?php
2
3
namespace Apps\Console;
4
5
6
use Apps\ActiveRecord\System;
7
use Extend\Version;
8
use Ffcms\Console\Command;
9
use Ffcms\Console\Console;
10
use Ffcms\Core\Helper\Crypt;
11
use Ffcms\Core\Helper\FileSystem\File;
12
use Ffcms\Core\Helper\Type\Arr;
13
use Ffcms\Core\Managers\MigrationsManager;
14
use Symfony\Component\Console\Input\ArrayInput;
15
use Symfony\Component\Console\Input\InputInterface;
16
use Symfony\Component\Console\Input\InputOption;
17
use Symfony\Component\Console\Output\OutputInterface;
18
19
/**
20
 * Class MainInstallCommand. Install cms
21
 * @package Apps\Console
22
 */
23
class MainInstallCommand extends Command
24
{
25
    /**
26
     * Register installation command and used options
27
     */
28
    public function configure()
29
    {
30
        $this->setName('main:install')
31
            ->setDescription('Install ffcms via command line. Shoud be used for experienced users only!!!')
32
            ->addOption('driver', 'driver', InputOption::VALUE_OPTIONAL, 'Set type of used database driver. Allowed: mysql, pgsql, sqlite')
33
            ->addOption('host', 'host', InputOption::VALUE_OPTIONAL, 'Set connection host of .sqlite file location folder')
34
            ->addOption('user', 'user', InputOption::VALUE_OPTIONAL, 'Set database connection user name')
35
            ->addOption('password', 'password', InputOption::VALUE_OPTIONAL, 'Set password for database user connection')
36
            ->addOption('dbname', 'dbname', InputOption::VALUE_OPTIONAL, 'Set database name')
37
            ->addOption('prefix', 'prefix', InputOption::VALUE_OPTIONAL, 'Set database tables constant prefix')
38
            ->addOption('email', 'email', InputOption::VALUE_OPTIONAL, 'Set website email')
39
            ->addOption('domain', 'domain', InputOption::VALUE_OPTIONAL, 'Set website main domain')
40
            ->addOption('mit', 'mit', InputOption::VALUE_OPTIONAL, 'Set yes if you agree with MIT license requirements in /LICENSE file')
41
            ->setHelp("This tools help to install ffcms in console. Also this can help to install many copy of ffcms automaticaly. 
42
You can use installation in 1 short command:
43
\t~\$:php console.php main:install --drv='mysql' --host='127.0.0.1' --user='root' --password='rootpass' --dbname='ffcms' --prefix='ffcms_'
44
Also you can manually pass all params after running install command:
45
\t~\$:php console.php main:install
46
Good luck ;)");
47
    }
48
49
    /**
50
     * Install cms - database, configs, etc
51
     * @param InputInterface $input
52
     * @param OutputInterface $output
53
     * @return void
54
     */
55
    public function execute(InputInterface $input, OutputInterface $output)
56
    {
57
        // check if installation is locked
58
        if (File::exist('/Private/Install/install.lock')) {
59
            $output->writeln('Installation is locked! Please delete /Private/Install/install.lock');
60
            return;
61
        }
62
        // show license agreement
63
        $license = File::read('/LICENSE');
64
        $output->write($license, PHP_EOL);
0 ignored issues
show
Apps\Console\PHP_EOL of type string is incompatible with the type boolean expected by parameter $newline of Symfony\Component\Consol...utputInterface::write(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

64
        $output->write($license, /** @scrutinizer ignore-type */ PHP_EOL);
Loading history...
It seems like $license can also be of type false; however, parameter $messages of Symfony\Component\Consol...utputInterface::write() does only seem to accept array|string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

64
        $output->write(/** @scrutinizer ignore-type */ $license, PHP_EOL);
Loading history...
65
66
        // check if user agree with license terms
67
        if ($input->getOption('mit') !== 'yes') {
68
            if (!$this->confirm('Are you accept this license terms?', false)) {
69
                $output->writeln('You are deny license agreement, installation is rejected');
70
                return;
71
            }
72
        }
73
74
        // read old & try to get newest configs
75
        $configs = Console::$Properties->get('database');
76
        $newConfigs = [];
77
        $newConfigs['driver'] = $this->optionOrAsk('driver', 'Database driver(mysql|pgsql)', 'mysql');
78
        $newConfigs['host'] = $this->optionOrAsk('host', 'Database host', '127.0.0.1');
79
        $newConfigs['username'] = $this->optionOrAsk('user', 'Database user', 'root');
80
        $newConfigs['password'] = $this->optionOrAsk('password', 'Database password', 'rootpwd');
81
        $newConfigs['database'] = $this->optionOrAsk('dbname', 'Database name', 'ffcms');
82
        $newConfigs['prefix'] = $this->optionOrAsk('prefix', 'Database table prefix', 'ffcms_');
83
84
        // merge configs and add new connection
85
        $dbConf = Arr::merge($configs, $newConfigs);
86
        Console::$Database->addConnection($dbConf, 'install');
87
88
        // check if connection is established
89
        try {
90
            Console::$Database->getConnection('install')->getPdo();
91
        } catch (\Exception $e) {
92
            $output->writeln('Test database connection with new data is FAILED! Please, try to make it with right connection data');
93
            return;
94
        }
95
96
        $output->writeln('=== Merge migrations and prepare installation');
97
98
        // implement migrations
99
        $migrationInstall = $this->getApplication()->find('migration:install');
100
        $migrationInstall->setDbConnection('install');
0 ignored issues
show
The method setDbConnection() does not exist on Symfony\Component\Console\Command\Command. It seems like you code against a sub-type of Symfony\Component\Console\Command\Command such as Ffcms\Console\Command. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

100
        $migrationInstall->/** @scrutinizer ignore-call */ 
101
                           setDbConnection('install');
Loading history...
101
        $migrationInstall->run(new ArrayInput([]), $output);
102
103
        $migrationManager = new MigrationsManager(null, 'install');
104
        $search = $migrationManager->search(null, false);
105
        $migrationManager->makeUp($search);
0 ignored issues
show
$search of type false is incompatible with the type array|string expected by parameter $file of Ffcms\Core\Managers\MigrationsManager::makeUp(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

105
        $migrationManager->makeUp(/** @scrutinizer ignore-type */ $search);
Loading history...
106
107
        // add system info about current install version
108
        $system = new System();
109
        $system->setConnection('install');
110
        $system->var = 'version';
111
        $system->data = Version::VERSION;
112
        $system->save();
113
114
        $email = $this->optionOrAsk('email', 'Website email', '[email protected]');
115
        $domain = $this->optionOrAsk('domain', 'Website domain', 'localhost.ltd');
116
117
        // save configurations to /Private/Default.php
118
        $output->writeln('=== Writing configurations');
119
        $chmod = $this->getApplication()->find('main:chmod');
120
        $chmod->run(new ArrayInput([]), $output);
121
        /** @var array $allCfg */
122
        $allCfg = Console::$Properties->getAll('default');
123
        $allCfg['database'] = $dbConf;
124
        $allCfg['adminEmail'] = $email;
125
        $allCfg['baseDomain'] = $domain;
126
        $output->writeln('Generate security cookies for debug panel');
127
        $allCfg['debug']['cookie']['key'] = 'fdebug_' . Crypt::randomString(mt_rand(8, 32));
128
        $allCfg['debug']['cookie']['value'] = Crypt::randomString(mt_rand(32, 128));
129
        // write config data
130
        $writeCfg = Console::$Properties->writeConfig('default', $allCfg);
131
        if ($writeCfg !== true) {
132
            $output->writeln('File /Private/Config/Default.php is unavailable to write data!');
133
            return;
134
        }
135
        File::write('/Private/Install/install.lock', 'Install is locked');
136
        $output->writeln('Congratulations! FFCMS are successful installed. Used version: ' . Version::VERSION . ' since ' . Version::DATE);
137
        $output->writeln('');
138
        $output->writeln('> Please, use "php console.php main:adduser" to add admin account(set role=4) or you are unavailable to manage cms.');
139
    }
140
141
}