GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.

Issues (1410)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

protected/extensions/eauth/EAuth.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * EAuth class file.
4
 *
5
 * @author Maxim Zemskov <[email protected]>
6
 * @link http://github.com/Nodge/yii-eauth/
7
 * @license http://www.opensource.org/licenses/bsd-license.php
8
 */
9
10
/**
11
 * The EAuth class provides simple authentication via OpenID and OAuth providers.
12
 *
13
 * @package application.extensions.eauth
14
 */
15
class EAuth extends CApplicationComponent {
16
17
	/**
18
	 * @var array Authorization services and their settings.
19
	 */
20
	public $services = array();
21
22
	/**
23
	 * @var boolean Whether to use popup window for the authorization dialog.
24
	 */
25
	public $popup = true;
26
27
	/**
28
	 * @var mixed Cache component name to use. False to disable cache.
29
	 */
30
	public $cache = 'cache';
31
32
	/**
33
	 * @var integer the number of seconds in which the cached value will expire. 0 means never expire.
34
	 */
35
	public $cacheExpire = 0;
36
37
	/**
38
	 * @var string popup redirect view with custom js code
39
	 */
40
	protected $redirectView = 'redirect';
41
42
	/**
43
	 * Creates alias eauth and adds some import paths to simplify 
44
	 * class files lookup.
45
	 */
46
	public function init() {
47
		if (!Yii::getPathOfAlias('eauth')) {
48
			Yii::setPathOfAlias('eauth', dirname(__FILE__));
49
		}
50
51
		Yii::import('eauth.*');
52
		Yii::import('eauth.services.*');
53
		Yii::import('eauth.custom_services.*');
54
	}
55
56
	/**
57
	 * Returns services settings declared in the authorization classes.
58
	 * For perfomance reasons it uses cache to store settings array.
59
	 *
60
	 * @return array services settings.
61
	 */
62
	public function getServices() {
63
		$services = false;
64
		if (!empty($this->cache) && Yii::app()->hasComponent($this->cache)) {
65
			$cache = Yii::app()->getComponent($this->cache);
66
			$services = $cache->get('EAuth.services');
67
		}
68
69
		if (false === $services || !is_array($services)) {
70
			$services = array();
71
			foreach ($this->services as $service => $options) {
72
				$class = $this->getIdentity($service);
73
				$services[$service] = (object)array(
74
					'id' => $class->getServiceName(),
75
					'title' => $class->getServiceTitle(),
76
					'type' => $class->getServiceType(),
77
					'jsArguments' => $class->getJsArguments(),
78
				);
79
			}
80
			if (isset($cache)) {
81
				$cache->set('EAuth.services', $services, $this->cacheExpire);
82
			}
83
		}
84
		return $services;
85
	}
86
87
	/**
88
	 * Returns the settings of the service.
89
	 *
90
	 * @param string $service the service name.
91
	 * @return array the service settings.
92
	 */
93
	protected function getService($service) {
94
		$service = strtolower($service);
95
		$services = $this->getServices();
96 View Code Duplication
		if (!isset($services[$service])) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
97
			throw new EAuthException(Yii::t('eauth', 'Undefined service name: {service}.', array('{service}' => $service)), 500);
98
		}
99
		return $services[$service];
100
	}
101
102
	/**
103
	 * Returns the type of the service.
104
	 *
105
	 * @param string $service the service name.
106
	 * @return string the service type.
107
	 */
108
	public function getServiceType($service) {
109
		$service = $this->getService($service);
110
		return $service->type;
111
	}
112
113
	/**
114
	 * Returns the service identity class.
115
	 *
116
	 * @param string $service the service name.
117
	 * @param array[optional] $options 
118
	 * @return IAuthService the identity class.
119
	 */
120
	public function getIdentity($service, $options = array()) {
121
		$service = strtolower($service);
122 View Code Duplication
		if (!isset($this->services[$service])) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
123
			throw new EAuthException(Yii::t('eauth', 'Undefined service name: {service}.', array('{service}' => $service)), 500);
124
		}
125
		$service = $this->services[$service];
126
127
		$class = $service['class'];
128
		$point = strrpos($class, '.');
129
		// if it is yii path alias
130
		if ($point > 0) {
131
			Yii::import($class);
132
			$class = substr($class, $point + 1);
133
		}
134
		unset($service['class']);
135
		$identity = new $class();
136
		$identity->init($this, array_merge($service, $options));
137
		return $identity;
138
	}
139
140
	/**
141
	 * Change default redirect view to custom. Allow Yii alias.
142
	 *
143
	 * @param string $view new name of view with js code
144
	 */
145
	public function setRedirectView($view) {
146
		$this->redirectView = $view;
147
	}
148
149
	/**
150
	 * Redirects to url. If the authorization dialog opened in the popup window,
151
	 * it will be closed instead of redirect. Set $jsRedirect=true if you want
152
	 * to redirect anyway.
153
	 *
154
	 * @param mixed $url url to redirect. Can be route or normal url. See {@link CHtml::normalizeUrl}.
155
	 * @param boolean $jsRedirect whether to use redirect while popup window is used. Defaults to true.
156
	 * @param array $params
157
	 */
158
	public function redirect($url, $jsRedirect = true, $params = array()) {
159
		require_once dirname(__FILE__) . DIRECTORY_SEPARATOR . 'EAuthRedirectWidget.php';
160
		$widget = Yii::app()->getWidgetFactory()->createWidget($this, 'EAuthRedirectWidget',
161
			array(
162
				'url' => CHtml::normalizeUrl($url),
163
				'redirect' => $jsRedirect,
164
				'view' => $this->redirectView,
165
				'params' => $params
166
			)
167
		);
168
		$widget->init();
169
		$widget->run();
170
	}
171
172
	/**
173
	 * Simple wrapper for {@link CController::widget} function for render the {@link EAuthWidget} widget.
174
	 *
175
	 * @param array $properties the widget properties.
176
	 * @deprecated use CComponent->widget('ext.eauth.EAuthWidget', $properties) instead.
177
	 */
178
	public function renderWidget($properties = array()) {
179
		require_once dirname(__FILE__) . DIRECTORY_SEPARATOR . 'EAuthWidget.php';
180
		$widget = Yii::app()->getWidgetFactory()->createWidget($this, 'EAuthWidget', $properties);
181
		$widget->init();
182
		$widget->run();
183
	}
184
185
	/**
186
	 * Serialize the identity class.
187
	 *
188
	 * @param EAuthServiceBase $identity the class instance.
189
	 * @return string serialized value.
190
	 */
191
	public function toString($identity) {
192
		return serialize($identity);
193
	}
194
195
	/**
196
	 * Serialize the identity class.
197
	 *
198
	 * @param string $identity serialized value.
199
	 * @return EAuthServiceBase the class instance.
200
	 */
201
	public function fromString($identity) {
202
		return unserialize($identity);
203
	}
204
}
205
206
/**
207
 * The EAuthException exception class.
208
 *
209
 * @author Maxim Zemskov <[email protected]>
210
 * @package application.extensions.auth
211
 * @version 1.0
212
 */
213
class EAuthException extends CException {
214
}
215