This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | namespace dokuwiki\Ui; |
||
3 | |||
4 | use dokuwiki\Utf8\Sort; |
||
5 | |||
6 | /** |
||
7 | * Class Admin |
||
8 | * |
||
9 | * Displays the Admin screen |
||
10 | * |
||
11 | * @package dokuwiki\Ui |
||
12 | * @author Andreas Gohr <[email protected]> |
||
13 | * @author HÃ¥kan Sandell <[email protected]> |
||
14 | */ |
||
15 | class Admin extends Ui { |
||
16 | |||
17 | protected $forAdmins = array('usermanager', 'acl', 'extension', 'config', 'logviewer', 'styling'); |
||
18 | protected $forManagers = array('revert', 'popularity'); |
||
19 | /** @var array[] */ |
||
20 | protected $menu; |
||
21 | |||
22 | /** |
||
23 | * Display the UI element |
||
24 | * |
||
25 | * @return void |
||
26 | */ |
||
27 | public function show() { |
||
28 | $this->menu = $this->getPluginList(); |
||
0 ignored issues
–
show
|
|||
29 | echo '<div class="ui-admin">'; |
||
30 | echo p_locale_xhtml('admin'); |
||
31 | |||
32 | $this->showMenu('admin'); |
||
33 | $this->showMenu('manager'); |
||
34 | $this->showSecurityCheck(); |
||
35 | $this->showVersion(); |
||
36 | $this->showMenu('other'); |
||
37 | echo '</div>'; |
||
38 | } |
||
39 | |||
40 | /** |
||
41 | * Show the given menu of available plugins |
||
42 | * |
||
43 | * @param string $type admin|manager|other |
||
44 | */ |
||
45 | protected function showMenu($type) { |
||
46 | if (!$this->menu[$type]) return; |
||
47 | |||
48 | if ($type === 'other') { |
||
49 | echo p_locale_xhtml('adminplugins'); |
||
50 | $class = 'admin_plugins'; |
||
51 | } else { |
||
52 | $class = 'admin_tasks'; |
||
53 | } |
||
54 | |||
55 | echo "<ul class=\"$class\">"; |
||
56 | foreach ($this->menu[$type] as $item) { |
||
57 | $this->showMenuItem($item); |
||
58 | } |
||
59 | echo '</ul>'; |
||
60 | } |
||
61 | |||
62 | /** |
||
63 | * Display the DokuWiki version |
||
64 | */ |
||
65 | protected function showVersion() { |
||
66 | echo '<div id="admin__version">'; |
||
67 | echo getVersion(); |
||
68 | echo '</div>'; |
||
69 | } |
||
70 | |||
71 | /** |
||
72 | * data security check |
||
73 | * |
||
74 | * simple check if the 'savedir' is relative and accessible when appended to DOKU_URL |
||
75 | * |
||
76 | * it verifies either: |
||
77 | * 'savedir' has been moved elsewhere, or |
||
78 | * has protection to prevent the webserver serving files from it |
||
79 | * |
||
80 | * The actual check is carried out via JavaScript. See behaviour.js |
||
81 | */ |
||
82 | protected function showSecurityCheck() { |
||
83 | global $conf; |
||
84 | if(substr($conf['savedir'], 0, 2) !== './') return; |
||
85 | $img = DOKU_URL . $conf['savedir'] . |
||
86 | '/dont-panic-if-you-see-this-in-your-logs-it-means-your-directory-permissions-are-correct.png'; |
||
87 | echo '<div id="security__check" data-src="' . $img . '"></div>'; |
||
88 | } |
||
89 | |||
90 | /** |
||
91 | * Display a single Admin menu item |
||
92 | * |
||
93 | * @param array $item |
||
94 | */ |
||
95 | protected function showMenuItem($item) { |
||
96 | global $ID; |
||
97 | if(blank($item['prompt'])) return; |
||
98 | echo '<li><div class="li">'; |
||
99 | echo '<a href="' . wl($ID, 'do=admin&page=' . $item['plugin']) . '">'; |
||
100 | echo '<span class="icon">'; |
||
101 | echo inlineSVG($item['icon']); |
||
102 | echo '</span>'; |
||
103 | echo '<span class="prompt">'; |
||
104 | echo $item['prompt']; |
||
105 | echo '</span>'; |
||
106 | echo '</a>'; |
||
107 | echo '</div></li>'; |
||
108 | } |
||
109 | |||
110 | /** |
||
111 | * Build list of admin functions from the plugins that handle them |
||
112 | * |
||
113 | * Checks the current permissions to decide on manager or admin plugins |
||
114 | * |
||
115 | * @return array list of plugins with their properties |
||
116 | */ |
||
117 | protected function getPluginList() { |
||
118 | global $conf; |
||
119 | |||
120 | $pluginlist = plugin_list('admin'); |
||
121 | $menu = ['admin' => [], 'manager' => [], 'other' => []]; |
||
122 | |||
123 | foreach($pluginlist as $p) { |
||
124 | /** @var \dokuwiki\Extension\AdminPlugin $obj */ |
||
125 | if(($obj = plugin_load('admin', $p)) === null) continue; |
||
126 | |||
127 | // check permissions |
||
128 | if (!$obj->isAccessibleByCurrentUser()) continue; |
||
129 | |||
130 | if (in_array($p, $this->forAdmins, true)) { |
||
131 | $type = 'admin'; |
||
132 | } elseif (in_array($p, $this->forManagers, true)){ |
||
133 | $type = 'manager'; |
||
134 | } else { |
||
135 | $type = 'other'; |
||
136 | } |
||
137 | |||
138 | $menu[$type][$p] = array( |
||
139 | 'plugin' => $p, |
||
140 | 'prompt' => $obj->getMenuText($conf['lang']), |
||
141 | 'icon' => $obj->getMenuIcon(), |
||
142 | 'sort' => $obj->getMenuSort(), |
||
143 | ); |
||
144 | } |
||
145 | |||
146 | // sort by name, then sort |
||
147 | uasort($menu['admin'], [$this, 'menuSort']); |
||
148 | uasort($menu['manager'], [$this, 'menuSort']); |
||
149 | uasort($menu['other'], [$this, 'menuSort']); |
||
150 | |||
151 | return $menu; |
||
152 | } |
||
153 | |||
154 | /** |
||
155 | * Custom sorting for admin menu |
||
156 | * |
||
157 | * We sort alphabetically first, then by sort value |
||
158 | * |
||
159 | * @param array $a |
||
160 | * @param array $b |
||
161 | * @return int |
||
162 | */ |
||
163 | protected function menuSort($a, $b) { |
||
164 | $strcmp = Sort::strcmp($a['prompt'], $b['prompt']); |
||
165 | if($strcmp != 0) return $strcmp; |
||
166 | if($a['sort'] === $b['sort']) return 0; |
||
167 | return ($a['sort'] < $b['sort']) ? -1 : 1; |
||
168 | } |
||
169 | } |
||
170 |
Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property.
Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property..