GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (9)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/FileManager.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace rdx\filemanager;
4
5
use Illuminate\Http\UploadedFile;
6
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
7
use rdx\filemanager\FileUsageContract;
8
use rdx\filemanager\FileManagerStorage;
9
use rdx\filemanager\ManagedFile;
10
11
class FileManager {
12
13
	protected $storage;
14
	protected $options = [];
15
16
	protected $storage_path = '';
17
	protected $public_path = '';
18
19
	protected $publishers = [];
20
21
	/**
22
	 *
23
	 */
24
	public function __construct(FileManagerStorage $storage, array $options = []) {
25
		$this->storage = $storage;
26
		$this->options = $options;
27
28
		$this->storage_path = storage_path($options['storage']) . '/';
29
		$this->public_path = public_path($options['public']) . '/';
30
	}
31
32
	/**
33
	 *
34
	 */
35
	public function addPublisher($name, callable $callback) {
36
		$this->publishers[$name] = $callback;
37
	}
38
39
	/**
40
	 *
41
	 */
42
	public function publish($publisher, ManagedFile ...$files) {
43
		if (!isset($this->publishers[$publisher])) {
44
			throw new \Exception("Invalid publisher '$publisher'.");
45
		}
46
47
		$callback = $this->publishers[$publisher];
48
49
		foreach ($files as $file) {
50
			$target = $this->resolvePublicPath($publisher, $file->filepath);
51
			$this->prepPublicDir(dirname($target));
52
53
			$callback($this, $file);
54
55
			$this->chmodFile($target);
56
		}
57
	}
58
59
	/**
60
	 *
61
	 */
62
	public function resolveWebPath($publisher, $path) {
63
		$root = $this->public_path;
64
		$full = $this->resolvePublicPath($publisher, $path);
65
		return '/' . $this->options['public'] . '/' . substr($full, strlen($root));
66
	}
67
68
	/**
69
	 *
70
	 */
71
	public function resolvePublicPath($publisher, $path) {
72
		return rtrim($this->public_path . $publisher . '/' . trim($path, '/'), '/');
73
	}
74
75
	/**
76
	 *
77
	 */
78
	public function resolveStoragePath($path) {
79
		return rtrim($this->storage_path . trim($path, '/'), '/');
80
	}
81
82
	/**
83
	 *
84
	 */
85
	public function getFilePath($filename, $destination = null) {
86
		return $this->resolveStoragePath($destination) . '/' . $this->cleanFileName($filename);
87
	}
88
89
	/**
90
	 *
91
	 */
92
	public function makeNewFilePath($filename, $destination = null) {
93
		$original = $this->getFilePath($filename, $destination);
94
95
		$i = 0;
96
		$filepath = $original;
97
		while (file_exists($filepath)) {
98
			$filepath = $this->appendFilePathUniqueness($original, $i++);
99
		}
100
101
		return substr($filepath, strlen($this->storage_path));
102
	}
103
104
	/**
105
	 *
106
	 */
107
	public function appendFilePathUniqueness($filepath, $index) {
108
		$ext = $this->takeExtension($filepath);
109
		return $filepath . '_' . $index . $ext;
110
	}
111
112
	/**
113
	 *
114
	 */
115
	public function cleanFileName($filename) {
116
		$ext = $this->takeExtension($filename);
117
118
		$filename = preg_replace('#[^a-z0-9\-_]#i', '_', $filename);
119
		$filename = preg_replace('#[_\-]+#', '_', $filename);
120
		$filename = trim($filename, '_');
121
		$filename = strtolower($filename);
122
123
		return $filename . $ext;
124
	}
125
126
	/**
127
	 *
128
	 */
129
	public function takeExtension(&$filename) {
130
		$ext = strtolower($this->getExtension($filename));
131
		$filename = preg_replace('#' . preg_quote($ext, '#') . '$#i', '', $filename);
132
		if ($ext && trim($ext, '.')) {
133
			return $ext;
134
		}
135
	}
136
137
	/**
138
	 *
139
	 */
140
	public function getExtension($filename) {
141
		if (strpos($filename, '/') !== false) {
142
			$filename = basename($filename);
143
		}
144
145
		$pos = strrpos($filename, '.');
146
		if ($pos !== false) {
147
			return substr($filename, $pos);
148
		}
149
	}
150
151
	/**
152
	 *
153
	 */
154
	public function saveFile(UploadedFile $uploaded, $destination = null) {
155
		$managed = $this->createManagedFileFromUpload($uploaded, $destination);
156
		$this->persistFile($managed, $uploaded);
157
158
		// @todo Customizable filename by App
159
160
		$this->storage->addFile($managed);
161
		return $managed;
162
	}
163
164
	/**
165
	 *
166
	 */
167
	protected function persistFile(ManagedFile $managed, UploadedFile $uploaded) {
168
		$moved = $uploaded->move(
169
			dirname($managed->fullpath),
170
			basename($managed->fullpath)
171
		);
172
173
		$this->prepDir($this->storage_path, dirname($managed->fullpath));
174
		$this->chmodFile($managed->fullpath);
175
176
		return $moved;
177
	}
178
179
	/**
180
	 *
181
	 */
182
	public function chmodFile($path) {
183
		return chmod($path, $this->options['chmod_files']);
184
	}
185
186
	/**
187
	 *
188
	 */
189
	public function chmodDir($path) {
190
		return @chmod($path, $this->options['chmod_dirs']);
191
	}
192
193
	/**
194
	 *
195
	 */
196
	public function prepPublicDir($path) {
197
		return $this->prepDir($this->public_path, $path);
198
	}
199
200
	/**
201
	 *
202
	 */
203
	public function prepDir($root, $path) {
204
		$root = rtrim($root, '/');
205
		$path = rtrim($path, '/');
206
207
		@mkdir($path, $this->options['chmod_dirs'], true);
208
209
		while ($path != $root) {
210
			$this->chmodDir($path);
211
			$path = dirname($path);
212
		}
213
	}
214
215
	/**
216
	 *
217
	 */
218
	protected function createManagedFileFromUpload(UploadedFile $file, $destination) {
219
		return new ManagedFile($this, [
220
			'filename' => $file->getClientOriginalName(),
221
			'filepath' => $this->makeNewFilePath($file->getClientOriginalName(), $destination),
222
		]);
223
	}
224
225
	/**
226
	 *
227
	 */
228
	protected function createManagedFileFromStorage(array $params) {
229
		return new ManagedFile($this, $params);
230
	}
231
232
	/**
233
	 *
234
	 */
235
	public function getUsageCount(ManagedFile $file) {
236
		return $this->storage->getUsageCount($file);
237
	}
238
239
	/**
240
	 *
241
	 */
242
	public function getUsages(ManagedFile $file) {
243
		$usages = $this->storage->getUsages($file);
244
		return collect($usages)->map(function($usage) {
245
			return get_object_vars($usage);
246
		});
247
	}
248
249
	/**
250
	 *
251
	 */
252
	public function findByPath($path) {
253
		$file = $this->storage->getFileByPath($path);
254
		if ($file) {
255
			return $this->createManagedFileFromStorage(get_object_vars($file));
256
		}
257
	}
258
259
	/**
260
	 *
261
	 */
262
	public function findByPathOrFail($path) {
263
		$file = $this->findByPath($path);
264
		if (!$file) {
265
			throw new NotFoundHttpException("File '$path' doesn't exist.");
266
		}
267
		return $file;
268
	}
269
270
	/**
271
	 *
272
	 */
273
	public function find($id) {
274
		$file = $this->storage->getFile($id);
275
		if ($file) {
276
			return $this->createManagedFileFromStorage(get_object_vars($file));
277
		}
278
	}
279
280
	/**
281
	 *
282
	 */
283
	public function findOrFail($id) {
284
		$file = $this->find($id);
285
		if (!$file) {
286
			throw new NotFoundHttpException("File '$id' doesn't exist.");
287
		}
288
		return $file;
289
	}
290
291
	/**
292
	 *
293
	 */
294
	public function findAll(array $conditions = []) {
295
		$files = $this->storage->getFiles($conditions);
296
		return collect($files)->map(function($file) {
297
			return $this->createManagedFileFromStorage(get_object_vars($file));
298
		});
299
	}
300
301
	/**
302
	 *
303
	 */
304
	public function addUsage(FileUsageContract $usage, ManagedFile $file) {
305
		$this->storage->addUsage($file, $usage->getUsageParams());
306
		return $file;
307
	}
308
309
	/**
310
	 *
311
	 */
312
	public function removeUsage(FileUsageContract $usage, ManagedFile $file) {
313
		$this->storage->removeUsage($file, $usage->getUsageParams());
314
		return $file;
315
	}
316
317
	/**
318
	 *
319
	 */
320
	public function replaceUsage(FileUsageContract $usage, ManagedFile $file) {
321
		$params = $usage->getUsageParams();
322
		$this->storage->removeUsage(null, $params);
323
		$this->storage->addUsage($file, $params);
324
		return $file;
325
	}
326
327
	/**
328
	 *
329
	 */
330
	public function cleanUsage() {
331
		// @todo Find and remove all files without usage
332
	}
333
334
	/**
335
	 *
336
	 */
337
	public function addUsages(FileUsageContract $usage, ManagedFile ...$files) {
0 ignored issues
show
The parameter $usage is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
338
		return $files;
339
	}
340
341
	/**
342
	 *
343
	 */
344
	public function removeUsages(FileUsageContract $usage, ManagedFile ...$files) {
0 ignored issues
show
The parameter $usage is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
345
		return $files;
346
	}
347
348
	/**
349
	 *
350
	 */
351
	public function replaceUsages(FileUsageContract $usage, ManagedFile ...$files) {
0 ignored issues
show
The parameter $usage is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
352
		return $files;
353
	}
354
355
}
356