splitbrain /
dokuwiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | namespace dokuwiki\Ui; |
||
| 3 | |||
| 4 | use dokuwiki\Utf8\Sort; |
||
| 5 | |||
| 6 | /** |
||
| 7 | * Class Admin |
||
| 8 | * |
||
| 9 | * Displays the Admin screen |
||
| 10 | * |
||
| 11 | * @package dokuwiki\Ui |
||
| 12 | * @author Andreas Gohr <[email protected]> |
||
| 13 | * @author HÃ¥kan Sandell <[email protected]> |
||
| 14 | */ |
||
| 15 | class Admin extends Ui { |
||
| 16 | |||
| 17 | protected $forAdmins = array('usermanager', 'acl', 'extension', 'config', 'logviewer', 'styling'); |
||
| 18 | protected $forManagers = array('revert', 'popularity'); |
||
| 19 | /** @var array[] */ |
||
| 20 | protected $menu; |
||
| 21 | |||
| 22 | /** |
||
| 23 | * Display the UI element |
||
| 24 | * |
||
| 25 | * @return void |
||
| 26 | */ |
||
| 27 | public function show() { |
||
| 28 | $this->menu = $this->getPluginList(); |
||
|
0 ignored issues
–
show
|
|||
| 29 | echo '<div class="ui-admin">'; |
||
| 30 | echo p_locale_xhtml('admin'); |
||
| 31 | |||
| 32 | $this->showMenu('admin'); |
||
| 33 | $this->showMenu('manager'); |
||
| 34 | $this->showSecurityCheck(); |
||
| 35 | $this->showVersion(); |
||
| 36 | $this->showMenu('other'); |
||
| 37 | echo '</div>'; |
||
| 38 | } |
||
| 39 | |||
| 40 | /** |
||
| 41 | * Show the given menu of available plugins |
||
| 42 | * |
||
| 43 | * @param string $type admin|manager|other |
||
| 44 | */ |
||
| 45 | protected function showMenu($type) { |
||
| 46 | if (!$this->menu[$type]) return; |
||
| 47 | |||
| 48 | if ($type === 'other') { |
||
| 49 | echo p_locale_xhtml('adminplugins'); |
||
| 50 | $class = 'admin_plugins'; |
||
| 51 | } else { |
||
| 52 | $class = 'admin_tasks'; |
||
| 53 | } |
||
| 54 | |||
| 55 | echo "<ul class=\"$class\">"; |
||
| 56 | foreach ($this->menu[$type] as $item) { |
||
| 57 | $this->showMenuItem($item); |
||
| 58 | } |
||
| 59 | echo '</ul>'; |
||
| 60 | } |
||
| 61 | |||
| 62 | /** |
||
| 63 | * Display the DokuWiki version |
||
| 64 | */ |
||
| 65 | protected function showVersion() { |
||
| 66 | echo '<div id="admin__version">'; |
||
| 67 | echo getVersion(); |
||
| 68 | echo '</div>'; |
||
| 69 | } |
||
| 70 | |||
| 71 | /** |
||
| 72 | * data security check |
||
| 73 | * |
||
| 74 | * simple check if the 'savedir' is relative and accessible when appended to DOKU_URL |
||
| 75 | * |
||
| 76 | * it verifies either: |
||
| 77 | * 'savedir' has been moved elsewhere, or |
||
| 78 | * has protection to prevent the webserver serving files from it |
||
| 79 | * |
||
| 80 | * The actual check is carried out via JavaScript. See behaviour.js |
||
| 81 | */ |
||
| 82 | protected function showSecurityCheck() { |
||
| 83 | global $conf; |
||
| 84 | if(substr($conf['savedir'], 0, 2) !== './') return; |
||
| 85 | $img = DOKU_URL . $conf['savedir'] . |
||
| 86 | '/dont-panic-if-you-see-this-in-your-logs-it-means-your-directory-permissions-are-correct.png'; |
||
| 87 | echo '<div id="security__check" data-src="' . $img . '"></div>'; |
||
| 88 | } |
||
| 89 | |||
| 90 | /** |
||
| 91 | * Display a single Admin menu item |
||
| 92 | * |
||
| 93 | * @param array $item |
||
| 94 | */ |
||
| 95 | protected function showMenuItem($item) { |
||
| 96 | global $ID; |
||
| 97 | if(blank($item['prompt'])) return; |
||
| 98 | echo '<li><div class="li">'; |
||
| 99 | echo '<a href="' . wl($ID, 'do=admin&page=' . $item['plugin']) . '">'; |
||
| 100 | echo '<span class="icon">'; |
||
| 101 | echo inlineSVG($item['icon']); |
||
| 102 | echo '</span>'; |
||
| 103 | echo '<span class="prompt">'; |
||
| 104 | echo $item['prompt']; |
||
| 105 | echo '</span>'; |
||
| 106 | echo '</a>'; |
||
| 107 | echo '</div></li>'; |
||
| 108 | } |
||
| 109 | |||
| 110 | /** |
||
| 111 | * Build list of admin functions from the plugins that handle them |
||
| 112 | * |
||
| 113 | * Checks the current permissions to decide on manager or admin plugins |
||
| 114 | * |
||
| 115 | * @return array list of plugins with their properties |
||
| 116 | */ |
||
| 117 | protected function getPluginList() { |
||
| 118 | global $conf; |
||
| 119 | |||
| 120 | $pluginlist = plugin_list('admin'); |
||
| 121 | $menu = ['admin' => [], 'manager' => [], 'other' => []]; |
||
| 122 | |||
| 123 | foreach($pluginlist as $p) { |
||
| 124 | /** @var \dokuwiki\Extension\AdminPlugin $obj */ |
||
| 125 | if(($obj = plugin_load('admin', $p)) === null) continue; |
||
| 126 | |||
| 127 | // check permissions |
||
| 128 | if (!$obj->isAccessibleByCurrentUser()) continue; |
||
| 129 | |||
| 130 | if (in_array($p, $this->forAdmins, true)) { |
||
| 131 | $type = 'admin'; |
||
| 132 | } elseif (in_array($p, $this->forManagers, true)){ |
||
| 133 | $type = 'manager'; |
||
| 134 | } else { |
||
| 135 | $type = 'other'; |
||
| 136 | } |
||
| 137 | |||
| 138 | $menu[$type][$p] = array( |
||
| 139 | 'plugin' => $p, |
||
| 140 | 'prompt' => $obj->getMenuText($conf['lang']), |
||
| 141 | 'icon' => $obj->getMenuIcon(), |
||
| 142 | 'sort' => $obj->getMenuSort(), |
||
| 143 | ); |
||
| 144 | } |
||
| 145 | |||
| 146 | // sort by name, then sort |
||
| 147 | uasort($menu['admin'], [$this, 'menuSort']); |
||
| 148 | uasort($menu['manager'], [$this, 'menuSort']); |
||
| 149 | uasort($menu['other'], [$this, 'menuSort']); |
||
| 150 | |||
| 151 | return $menu; |
||
| 152 | } |
||
| 153 | |||
| 154 | /** |
||
| 155 | * Custom sorting for admin menu |
||
| 156 | * |
||
| 157 | * We sort alphabetically first, then by sort value |
||
| 158 | * |
||
| 159 | * @param array $a |
||
| 160 | * @param array $b |
||
| 161 | * @return int |
||
| 162 | */ |
||
| 163 | protected function menuSort($a, $b) { |
||
| 164 | $strcmp = Sort::strcmp($a['prompt'], $b['prompt']); |
||
| 165 | if($strcmp != 0) return $strcmp; |
||
| 166 | if($a['sort'] === $b['sort']) return 0; |
||
| 167 | return ($a['sort'] < $b['sort']) ? -1 : 1; |
||
| 168 | } |
||
| 169 | } |
||
| 170 |
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property.
Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property..