silverstripe /
silverstripe-mssql
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace SilverStripe\MSSQL; |
||
| 4 | |||
| 5 | use SilverStripe\Dev\Install\DatabaseAdapterRegistry; |
||
| 6 | use SilverStripe\Dev\Install\DatabaseConfigurationHelper; |
||
| 7 | use PDO; |
||
| 8 | use Exception; |
||
| 9 | |||
| 10 | /** |
||
| 11 | * This is a helper class for the SS installer. |
||
| 12 | * |
||
| 13 | * It does all the specific checking for MSSQLDatabase |
||
| 14 | * to ensure that the configuration is setup correctly. |
||
| 15 | */ |
||
| 16 | class MSSQLDatabaseConfigurationHelper implements DatabaseConfigurationHelper |
||
| 17 | { |
||
| 18 | |||
| 19 | protected function isAzure($databaseConfig) |
||
| 20 | { |
||
| 21 | /** @skipUpgrade */ |
||
| 22 | return $databaseConfig['type'] === 'MSSQLAzureDatabase'; |
||
| 23 | } |
||
| 24 | |||
| 25 | /** |
||
| 26 | * Create a connection of the appropriate type |
||
| 27 | * |
||
| 28 | * @skipUpgrade |
||
| 29 | * @param array $databaseConfig |
||
| 30 | * @param string $error Error message passed by value |
||
| 31 | * @return mixed|null Either the connection object, or null if error |
||
| 32 | */ |
||
| 33 | protected function createConnection($databaseConfig, &$error) |
||
| 34 | { |
||
| 35 | $error = null; |
||
| 36 | try { |
||
| 37 | switch ($databaseConfig['type']) { |
||
| 38 | case 'MSSQLDatabase': |
||
| 39 | case 'MSSQLAzureDatabase': |
||
| 40 | $parameters = array( |
||
| 41 | 'UID' => $databaseConfig['username'], |
||
| 42 | 'PWD' => $databaseConfig['password'] |
||
| 43 | ); |
||
| 44 | |||
| 45 | // Azure has additional parameter requirements |
||
| 46 | if ($this->isAzure($databaseConfig)) { |
||
| 47 | $parameters['database'] = $databaseConfig['database']; |
||
| 48 | $parameters['multipleactiveresultsets'] = 1; |
||
| 49 | $parameters['returndatesasstrings'] = 1; |
||
| 50 | } |
||
| 51 | |||
| 52 | $conn = @sqlsrv_connect($databaseConfig['server'], $parameters); |
||
| 53 | |||
| 54 | if ($conn) { |
||
| 55 | return $conn; |
||
| 56 | } |
||
| 57 | |||
| 58 | // Get error |
||
| 59 | if ($errors = sqlsrv_errors()) { |
||
| 60 | $error = ''; |
||
| 61 | foreach ($errors as $detail) { |
||
| 62 | $error .= "{$detail['message']}\n"; |
||
| 63 | } |
||
| 64 | } else { |
||
| 65 | $error = 'Unknown connection error'; |
||
| 66 | } |
||
| 67 | return null; |
||
| 68 | case 'MSSQLPDODatabase': |
||
| 69 | $driver = $this->getPDODriver(); |
||
|
0 ignored issues
–
show
|
|||
| 70 | if (!$driver) { |
||
| 71 | $error = 'No supported PDO driver'; |
||
| 72 | return null; |
||
| 73 | } |
||
| 74 | |||
| 75 | // May throw a PDOException if fails |
||
| 76 | $conn = @new PDO($driver.':Server='.$databaseConfig['server'], $databaseConfig['username'], $databaseConfig['password']); |
||
| 77 | if ($conn) { |
||
| 78 | return $conn; |
||
| 79 | } else { |
||
| 80 | $error = 'Unknown connection error'; |
||
| 81 | return null; |
||
| 82 | } |
||
| 83 | default: |
||
| 84 | $error = 'Invalid connection type: ' . $databaseConfig['type']; |
||
| 85 | return null; |
||
| 86 | } |
||
| 87 | } catch (Exception $ex) { |
||
| 88 | $error = $ex->getMessage(); |
||
| 89 | return null; |
||
| 90 | } |
||
| 91 | } |
||
| 92 | |||
| 93 | /** |
||
| 94 | * Get supported PDO driver |
||
| 95 | * |
||
| 96 | * @return null |
||
| 97 | */ |
||
| 98 | public static function getPDODriver() { |
||
| 99 | if (!class_exists('PDO')) { |
||
| 100 | return null; |
||
| 101 | } |
||
| 102 | |||
| 103 | foreach(PDO::getAvailableDrivers() as $driver) { |
||
| 104 | if (in_array($driver, array('sqlsrv', 'dblib'))) { |
||
| 105 | return $driver; |
||
| 106 | } |
||
| 107 | } |
||
| 108 | |||
| 109 | return null; |
||
| 110 | } |
||
| 111 | |||
| 112 | /** |
||
| 113 | * Helper function to quote a string value |
||
| 114 | * |
||
| 115 | * @param mixed $conn Connection object/resource |
||
| 116 | * @param string $value Value to quote |
||
| 117 | * @return string Quoted string |
||
| 118 | */ |
||
| 119 | protected function quote($conn, $value) |
||
| 120 | { |
||
| 121 | if ($conn instanceof PDO) { |
||
| 122 | return $conn->quote($value); |
||
| 123 | } elseif (is_resource($conn)) { |
||
| 124 | $value = str_replace("'", "''", $value); |
||
| 125 | $value = str_replace("\0", "[NULL]", $value); |
||
| 126 | return "N'$value'"; |
||
| 127 | } else { |
||
| 128 | user_error('Invalid database connection', E_USER_ERROR); |
||
| 129 | } |
||
| 130 | |||
| 131 | return null; |
||
| 132 | } |
||
| 133 | |||
| 134 | /** |
||
| 135 | * Helper function to execute a query |
||
| 136 | * |
||
| 137 | * @param mixed $conn Connection object/resource |
||
| 138 | * @param string $sql SQL string to execute |
||
| 139 | * @return array List of first value from each resulting row |
||
| 140 | */ |
||
| 141 | protected function query($conn, $sql) |
||
| 142 | { |
||
| 143 | $items = array(); |
||
| 144 | if ($conn instanceof PDO) { |
||
| 145 | $result = $conn->query($sql); |
||
| 146 | if ($result) { |
||
| 147 | foreach ($result as $row) { |
||
| 148 | $items[] = $row[0]; |
||
| 149 | } |
||
| 150 | } |
||
| 151 | } elseif (is_resource($conn)) { |
||
| 152 | $result = sqlsrv_query($conn, $sql); |
||
| 153 | if ($result) { |
||
| 154 | while ($row = sqlsrv_fetch_array($result, SQLSRV_FETCH_NUMERIC)) { |
||
| 155 | $items[] = $row[0]; |
||
| 156 | } |
||
| 157 | } |
||
| 158 | } |
||
| 159 | |||
| 160 | return $items; |
||
| 161 | } |
||
| 162 | |||
| 163 | public function requireDatabaseFunctions($databaseConfig) |
||
| 164 | { |
||
| 165 | $data = DatabaseAdapterRegistry::get_adapter($databaseConfig['type']); |
||
| 166 | return !empty($data['supported']); |
||
| 167 | } |
||
| 168 | |||
| 169 | View Code Duplication | public function requireDatabaseServer($databaseConfig) |
|
| 170 | { |
||
| 171 | $conn = $this->createConnection($databaseConfig, $error); |
||
| 172 | $success = !empty($conn); |
||
| 173 | |||
| 174 | return array( |
||
| 175 | 'success' => $success, |
||
| 176 | 'error' => $error |
||
| 177 | ); |
||
| 178 | } |
||
| 179 | |||
| 180 | View Code Duplication | public function requireDatabaseConnection($databaseConfig) |
|
| 181 | { |
||
| 182 | $conn = $this->createConnection($databaseConfig, $error); |
||
| 183 | $success = !empty($conn); |
||
| 184 | |||
| 185 | return array( |
||
| 186 | 'success' => $success, |
||
| 187 | 'connection' => $conn, |
||
| 188 | 'error' => $error |
||
| 189 | ); |
||
| 190 | } |
||
| 191 | |||
| 192 | public function getDatabaseVersion($databaseConfig) |
||
| 193 | { |
||
| 194 | $conn = $this->createConnection($databaseConfig, $error); |
||
| 195 | $result = $this->query($conn, "SELECT CONVERT(char(15), SERVERPROPERTY('ProductVersion'))"); |
||
| 196 | return empty($result) ? 0 : reset($result); |
||
| 197 | } |
||
| 198 | |||
| 199 | /** |
||
| 200 | * Ensure that the SQL Server version is at least 10.00.2531 (SQL Server 2008 SP1). |
||
| 201 | * |
||
| 202 | * @see http://www.sqlteam.com/article/sql-server-versions |
||
| 203 | * @param array $databaseConfig Associative array of db configuration, e.g. "server", "username" etc |
||
| 204 | * @return array Result - e.g. array('success' => true, 'error' => 'details of error') |
||
| 205 | */ |
||
| 206 | public function requireDatabaseVersion($databaseConfig) |
||
| 207 | { |
||
| 208 | $success = false; |
||
| 209 | $error = ''; |
||
| 210 | $version = $this->getDatabaseVersion($databaseConfig); |
||
| 211 | |||
| 212 | if ($version) { |
||
| 213 | $success = version_compare($version, '10.00.2531', '>='); |
||
| 214 | if (!$success) { |
||
| 215 | $error = "Your SQL Server version is $version. It's recommended you use at least 10.00.2531 (SQL Server 2008 SP1)."; |
||
| 216 | } |
||
| 217 | } else { |
||
| 218 | $error = "Your SQL Server version could not be determined."; |
||
| 219 | } |
||
| 220 | |||
| 221 | return array( |
||
| 222 | 'success' => $success, |
||
| 223 | 'error' => $error |
||
| 224 | ); |
||
| 225 | } |
||
| 226 | |||
| 227 | public function requireDatabaseOrCreatePermissions($databaseConfig) |
||
| 228 | { |
||
| 229 | $conn = $this->createConnection($databaseConfig, $error); |
||
| 230 | /** @skipUpgrade */ |
||
| 231 | if (empty($conn)) { |
||
| 232 | $success = false; |
||
| 233 | $alreadyExists = false; |
||
| 234 | } elseif ($databaseConfig['type'] == 'MSSQLAzureDatabase') { |
||
| 235 | // Don't bother with DB selection for azure, as it's not supported |
||
| 236 | $success = true; |
||
| 237 | $alreadyExists = true; |
||
| 238 | } else { |
||
| 239 | // does this database exist already? |
||
| 240 | $list = $this->query($conn, 'SELECT NAME FROM sys.sysdatabases'); |
||
| 241 | if (in_array($databaseConfig['database'], $list)) { |
||
| 242 | $success = true; |
||
| 243 | $alreadyExists = true; |
||
| 244 | } else { |
||
| 245 | $permissions = $this->query($conn, "select COUNT(*) from sys.fn_my_permissions('','') where permission_name like 'CREATE ANY DATABASE' or permission_name like 'CREATE DATABASE';"); |
||
| 246 | $success = $permissions[0] > 0; |
||
| 247 | $alreadyExists = false; |
||
| 248 | } |
||
| 249 | } |
||
| 250 | |||
| 251 | return array( |
||
| 252 | 'success' => $success, |
||
| 253 | 'alreadyExists' => $alreadyExists |
||
| 254 | ); |
||
| 255 | } |
||
| 256 | |||
| 257 | public function requireDatabaseAlterPermissions($databaseConfig) |
||
| 258 | { |
||
| 259 | $success = false; |
||
| 260 | $conn = $this->createConnection($databaseConfig, $error); |
||
| 261 | if (!empty($conn)) { |
||
| 262 | if (!$this->isAzure($databaseConfig)) { |
||
| 263 | // Make sure to select the current database when checking permission against this database |
||
| 264 | $this->query($conn, "USE \"{$databaseConfig['database']}\""); |
||
| 265 | } |
||
| 266 | |||
| 267 | $permissions = $this->query($conn, "select COUNT(*) from sys.fn_my_permissions(NULL,'DATABASE') WHERE permission_name like 'create table';"); |
||
| 268 | $success = $permissions[0] > 0; |
||
| 269 | } |
||
| 270 | |||
| 271 | return array( |
||
| 272 | 'success' => $success, |
||
| 273 | 'applies' => true |
||
| 274 | ); |
||
| 275 | } |
||
| 276 | } |
||
| 277 |
This check looks for function or method calls that always return null and whose return value is assigned to a variable.
The method
getObject()can return nothing but null, so it makes no sense to assign that value to a variable.The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.