Issues in index.php - All Issues - Inspection of "Selectable notification preferences" - smtech/canvas-management - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( 8f93db...434590 )

by Seth

created 2016-10-07 20:43 UTC

index.php (6 issues)

Labels

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

require_once 'common.inc.php';

use smtech\CanvasManagement\Toolbox;
use smtech\ReflexiveCanvasLTI\LTI\ToolProvider;
use smtech\ReflexiveCanvasLTI\Exception\ConfigurationException;

/* store any requested actions for future handling */
$action = (empty($_REQUEST['action']) ?
    ACTION_UNSPECIFIED :
    strtolower($_REQUEST['action'])
);

/* action requests only come from outside the LTI! */
if ($action) {
    unset($_SESSION[ToolProvider::class]);
}

/* authenticate LTI launch request, if present */
if ($toolbox->lti_isLaunching()) {
    /* http://stackoverflow.com/a/14329752 */
    // session_start(); // already called in common.inc.php

    @session_destroy(); // TODO I don't feel good about suppressing errors
// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
    @session_unset();
// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
    @session_start();
// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
    @session_regenerate_id(true);
// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
    $_SESSION[Toolbox::class] =& $toolbox;
    session_write_close();
    $toolbox->lti_authenticate();
    exit;
}

/* if authenticated LTI launch, redirect to appropriate placement view */
if (!empty($_SESSION[ToolProvider::class]['canvas']['account_id'])) {
    $toolbox->smarty_display('home.tpl');
    exit;

/* if not authenticated, default to showing credentials */
} else {
    $action = (empty($action) ?
        ACTION_CONFIG :
        $action
    );
}

/* process any actions */
switch ($action) {
    /* reset cached install data from config file */
    case ACTION_INSTALL:
        $_SESSION['toolbox'] = Toolbox::fromConfiguration(CONFIG_FILE, true);
        $toolbox =& $_SESSION['toolbox'];

        /* test to see if we can connect to the API */
        try {
            $toolbox->getAPI();
        } catch (ConfigurationException $e) {
            /* if there isn't an API token in config.xml, are there OAuth credentials? */
            if ($e->getCode() === ConfigurationException::CANVAS_API_INCORRECT) {
                $toolbox->interactiveGetAccessToken('This tool requires access to the Canvas APIs by an administrative user. This API access is used to make (sometimes dramatic) updates to your course and user data via administrative scripts. Please enter the URL of your Canvas instance below (e.g. <code>https://canvas.instructure.com</code> -- the URL that you would enter to log in to Canvas). If you are not already logged in, you will be asked to log in. After logging in, you will be asked to authorize this tool.</p><p>If you are already logged, but <em>not</em> logged in as an administrative user, please log out now, so that you may log in as administrative user to authorize this tool.');
abstract class User
{
    /** @return string */
    abstract public function getPassword();
}

class MyUser extends User
{
    public function getPassword()
    {
        // return something
    }

    public function getDisplayName()
    {
        // return some name.
    }
}

class AuthSystem
{
    public function authenticate(User $user)
    {
        $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName()));
        // do something.
    }
}
                exit;
            } else { /* no (understandable) API credentials available -- doh! */
                throw $e;
            }
        }

        /* finish by opening consumers control panel */
        header('Location: consumers.php');
        exit;

    /* show LTI configuration XML file */
    case ACTION_CONFIG:
        header('Content-type: application/xml');
        echo $toolbox->saveConfigurationXML();
        exit;
}


Push — master ( 8f93db...434590 )

index.php (6 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

1			<?php
2
3			require_once 'common.inc.php';
4
5			use smtech\CanvasManagement\Toolbox;
6			use smtech\ReflexiveCanvasLTI\LTI\ToolProvider;
7			use smtech\ReflexiveCanvasLTI\Exception\ConfigurationException;
8
9			/* store any requested actions for future handling */
10			$action = (empty($_REQUEST['action']) ?
11			ACTION_UNSPECIFIED :
12			strtolower($_REQUEST['action'])
13			);
14
15			/* action requests only come from outside the LTI! */
16			if ($action) {
17			unset($_SESSION[ToolProvider::class]);
18			}
19
20			/* authenticate LTI launch request, if present */
21			if ($toolbox->lti_isLaunching()) {
22			/* http://stackoverflow.com/a/14329752 */
23			// session_start(); // already called in common.inc.php
			0 ignored issues – show Unused Code Comprehensibility introduced 2016-08-22 18:53 UTC by Report Bug Copy Issue Report Show Similar Issues like this `50%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
24			@session_destroy(); // TODO I don't feel good about suppressing errors
			0 ignored issues – show Security Best Practice introduced 2016-08-22 18:53 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended. If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of @mkdir($dir); // Better use if (@mkdir($dir) === false) { throw new \RuntimeException('The directory '.$dir.' could not be created.'); } Loading history...
25			@session_unset();
			0 ignored issues – show Security Best Practice introduced 2016-08-22 18:53 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended. If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of @mkdir($dir); // Better use if (@mkdir($dir) === false) { throw new \RuntimeException('The directory '.$dir.' could not be created.'); } Loading history...
26			@session_start();
			0 ignored issues – show Security Best Practice introduced 2016-08-22 18:53 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended. If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of @mkdir($dir); // Better use if (@mkdir($dir) === false) { throw new \RuntimeException('The directory '.$dir.' could not be created.'); } Loading history...
27			@session_regenerate_id(true);
			0 ignored issues – show Security Best Practice introduced 2016-08-22 18:53 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended. If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of @mkdir($dir); // Better use if (@mkdir($dir) === false) { throw new \RuntimeException('The directory '.$dir.' could not be created.'); } Loading history...
28			$_SESSION[Toolbox::class] =& $toolbox;
29			session_write_close();
30			$toolbox->lti_authenticate();
31			exit;
32			}
33
34			/* if authenticated LTI launch, redirect to appropriate placement view */
35			if (!empty($_SESSION[ToolProvider::class]['canvas']['account_id'])) {
36			$toolbox->smarty_display('home.tpl');
37			exit;
38
39			/* if not authenticated, default to showing credentials */
40			} else {
41			$action = (empty($action) ?
42			ACTION_CONFIG :
43			$action
44			);
45			}
46
47			/* process any actions */
48			switch ($action) {
49			/* reset cached install data from config file */
50			case ACTION_INSTALL:
51			$_SESSION['toolbox'] = Toolbox::fromConfiguration(CONFIG_FILE, true);
52			$toolbox =& $_SESSION['toolbox'];
53
54			/* test to see if we can connect to the API */
55			try {
56			$toolbox->getAPI();
57			} catch (ConfigurationException $e) {
58			/* if there isn't an API token in config.xml, are there OAuth credentials? */
59			if ($e->getCode() === ConfigurationException::CANVAS_API_INCORRECT) {
60			$toolbox->interactiveGetAccessToken('This tool requires access to the Canvas APIs by an administrative user. This API access is used to make (sometimes dramatic) updates to your course and user data via administrative scripts. Please enter the URL of your Canvas instance below (e.g. <code>https://canvas.instructure.com</code> -- the URL that you would enter to log in to Canvas). If you are not already logged in, you will be asked to log in. After logging in, you will be asked to authorize this tool.</p><p>If you are already logged, but <em>not</em> logged in as an administrative user, please log out now, so that you may log in as administrative user to authorize this tool.');
			0 ignored issues – show Bug introduced 2016-08-22 18:53 UTC by Report Bug Copy Issue Report Show Similar Issues like this It seems like you code against a specific sub-type and not the parent class `smtech\ReflexiveCanvasLTI\Toolbox` as the method `interactiveGetAccessToken()` does only exist in the following sub-classes of `smtech\ReflexiveCanvasLTI\Toolbox`: `smtech\CanvasManagement\Toolbox`, `smtech\StMarksReflexiveCanvasLTI\Toolbox`. Maybe you want to `instanceof` check for one of these explicitly? Let’s take a look at an example: abstract class User { /** @return string / abstract public function getPassword(); } class MyUser extends User { public function getPassword() { // return something } public function getDisplayName() { // return some name. } } class AuthSystem { public function authenticate(User $user) { $this->logger->info(sprintf('Authenticating %s.', $user->getDisplayName())); // do something. } } In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break. Available Fixes Change the type-hint for the parameter: class AuthSystem { public function authenticate(MyUser $user) { / ... / } } Add an additional type-check: class AuthSystem { public function authenticate(User $user) { if ($user instanceof MyUser) { $this->logger->info(/* ... /); } // or alternatively if ( ! $user instanceof MyUser) { throw new \LogicException( '$user must be an instance of MyUser, ' .'other instances are not supported.' ); } } } Note:* PHP Analyzer uses reverse abstract interpretation to narrow down the types inside the if block in such a case. Add the method to the parent class: abstract class User { /** @return string / abstract public function getPassword(); /* @return string */ abstract public function getDisplayName(); } Loading history...
61			exit;
62			} else { /* no (understandable) API credentials available -- doh! */
63			throw $e;
64			}
65			}
66
67			/* finish by opening consumers control panel */
68			header('Location: consumers.php');
69			exit;
70
71			/* show LTI configuration XML file */
72			case ACTION_CONFIG:
73			header('Content-type: application/xml');
74			echo $toolbox->saveConfigurationXML();
75			exit;
76			}
77

smtech / canvas-management

Push — master ( 8f93db...434590 )

index.php (6 issues)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Available Fixes

Duplication Side-by-Side

Filter issues like