This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* |
||
3 | * This product includes software developed at |
||
4 | * Google Inc. (http://www.google.es/about.html) |
||
5 | * under Apache 2.0 License (http://www.apache.org/licenses/LICENSE-2.0.html). |
||
6 | * |
||
7 | * See http://google-api-dfp-php.googlecode.com. |
||
8 | * |
||
9 | */ |
||
10 | class EOAuthUserIdentity extends EOAuthComponent implements IUserIdentity { |
||
11 | |||
12 | /** |
||
13 | * @var string (required) |
||
14 | * For example 'https://sandbox.google.com/apis/ads/publisher/' |
||
15 | */ |
||
16 | public $scope; |
||
17 | |||
18 | /** |
||
19 | * @var string OAuth consumer key. Defaults to 'anonymous' |
||
20 | */ |
||
21 | public $key='anonymous'; |
||
22 | /** |
||
23 | * @var string OAuth consumer secret. Defaults to 'anonymous' |
||
24 | */ |
||
25 | public $secret='anonymous'; |
||
26 | |||
27 | /** |
||
28 | * @var array|class OAuthProvider configuration|class. |
||
29 | * If using array: |
||
30 | * 'provider'=>array( |
||
31 | * 'request'=>'https://www...', |
||
32 | * 'authorize'=>'https://www...', |
||
33 | * 'access'=>'https://www...', |
||
34 | * ) |
||
35 | * |
||
36 | * @see EOAuthProvider |
||
37 | */ |
||
38 | private $provider; |
||
39 | |||
40 | |||
41 | private $_providerClass='EOAuthProvider'; |
||
42 | private $_authenticated=false; |
||
43 | private $_error; |
||
44 | |||
45 | public function __construct($attributes) { |
||
46 | |||
47 | if(is_array($attributes)) { |
||
48 | if(isset($attributes['provider'])) { |
||
49 | $this->setProvider($attributes['provider']); |
||
50 | unset($attributes['provider']); |
||
51 | } |
||
52 | else |
||
53 | $this->setProvider(); |
||
54 | |||
55 | foreach($attributes as $attr=>$value) |
||
56 | $this->$attr=$value; |
||
57 | } |
||
58 | else return null; |
||
59 | } |
||
60 | |||
61 | public function getError(){ |
||
62 | return $this->_error; |
||
63 | } |
||
64 | |||
65 | public function setError($msg) { |
||
66 | $this->_error=$msg; |
||
67 | } |
||
68 | |||
69 | public function getIsAuthenticated() { |
||
70 | return $this->_authenticated; |
||
71 | } |
||
72 | |||
73 | public function getId() { |
||
74 | return $this->provider->token->key; |
||
75 | } |
||
76 | |||
77 | public function getName() { |
||
78 | return $this->provider->token->key; |
||
79 | } |
||
80 | |||
81 | public function getPersistentStates() { |
||
82 | } |
||
83 | |||
84 | public function authenticate() { |
||
85 | |||
86 | $session=Yii::app()->session; |
||
87 | |||
88 | if (isset($_REQUEST['oauth_token'])) { |
||
89 | $oauthToken = $_REQUEST['oauth_token']; |
||
90 | } |
||
91 | if (isset($_REQUEST['oauth_verifier'])) { |
||
92 | $oauthVerifier = $_REQUEST['oauth_verifier']; |
||
93 | } |
||
94 | |||
95 | try { |
||
96 | |||
97 | if (!isset($oauthToken)) { |
||
98 | // Create consumer. |
||
99 | $consumer = new OAuthConsumer($this->key, $this->secret); |
||
100 | |||
101 | // Set the scope (must match service endpoint). |
||
102 | $scope = $this->scope; |
||
103 | |||
104 | // Set the application name as it is displayed on the authorization page. |
||
105 | $applicationName = Yii::app()->name; |
||
106 | |||
107 | // Use the URL of the current page as the callback URL. |
||
108 | $protocol = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on") |
||
109 | ? 'https://' : 'http://'; |
||
110 | $server = $_SERVER['HTTP_HOST']; |
||
111 | $path = $_SERVER["REQUEST_URI"]; |
||
112 | $callbackUrl = $protocol . $server . $path; |
||
113 | |||
114 | // Get request token. |
||
115 | $token = EOAuthUtils::GetRequestToken($consumer, $scope, |
||
116 | $this->provider->request_token_endpoint, $applicationName, $callbackUrl); |
||
117 | |||
118 | // Store consumer and token in session. |
||
119 | $session['OAUTH_CONSUMER'] = $consumer; |
||
120 | $session['OAUTH_TOKEN'] = $token; |
||
121 | |||
122 | // Get authorization URL. |
||
123 | $url = EOAuthUtils::GetAuthorizationUrl($token, |
||
124 | $this->provider->authorize_token_endpoint); |
||
125 | |||
126 | // Redirect to authorization URL. |
||
127 | Yii::app()->request->redirect($url); |
||
128 | } else { |
||
129 | // Retrieve consumer and token from session. |
||
130 | $consumer = $session['OAUTH_CONSUMER']; |
||
131 | $token = $session['OAUTH_TOKEN']; |
||
132 | |||
133 | // Set authorized token. |
||
134 | $token->key = $oauthToken; |
||
135 | |||
136 | // Upgrade to access token. |
||
137 | $token = EOAuthUtils::GetAccessToken($consumer, $token, $oauthVerifier, |
||
0 ignored issues
–
show
|
|||
138 | $this->provider->access_token_endpoint); |
||
139 | |||
140 | // Set OAuth provider. |
||
141 | $this->provider->consumer=$consumer; |
||
142 | $this->provider->token=$token; |
||
143 | |||
144 | $this->_authenticated=true; |
||
145 | } |
||
146 | |||
147 | } catch (OAuthException $e) { |
||
148 | $this->_error=$e->getMessage(); |
||
149 | } |
||
150 | |||
151 | return $this->isAuthenticated; |
||
152 | } |
||
153 | |||
154 | public function setProvider($provider='EOAuthProvider') { |
||
155 | if(is_string($provider)) |
||
156 | $this->_providerClass=$provider; |
||
157 | $this->provider= new $this->_providerClass; |
||
158 | if(is_array($provider)) |
||
159 | foreach($provider as $attr=>$val) { |
||
160 | $attribute=$attr.'_token_endpoint'; |
||
161 | $this->provider->$attribute=$val; |
||
162 | } |
||
163 | |||
164 | |||
165 | } |
||
166 | public function getProvider(){ |
||
167 | return $this->provider; |
||
168 | } |
||
169 | |||
170 | } |
||
171 | ?> |
||
0 ignored issues
–
show
It is not recommended to use PHP's closing tag
?> in files other than templates.
Using a closing tag in PHP files that only contain PHP code is not recommended as you might accidentally add whitespace after the closing tag which would then be output by PHP. This can cause severe problems, for example headers cannot be sent anymore. A simple precaution is to leave off the closing tag as it is not required, and it also has no negative effects whatsoever. ![]() |
|||
172 |
If you define a variable conditionally, it can happen that it is not defined for all execution paths.
Let’s take a look at an example:
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined.
Available Fixes
Check for existence of the variable explicitly:
Define a default value for the variable:
Add a value for the missing path: