This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Configuration Manager admin plugin |
||
4 | * |
||
5 | * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) |
||
6 | * @author Christopher Smith <[email protected]> |
||
7 | * @author Ben Coburn <[email protected]> |
||
8 | */ |
||
9 | |||
10 | use dokuwiki\plugin\config\core\Configuration; |
||
11 | use dokuwiki\plugin\config\core\Setting\Setting; |
||
0 ignored issues
–
show
|
|||
12 | use dokuwiki\plugin\config\core\Setting\SettingFieldset; |
||
13 | use dokuwiki\plugin\config\core\Setting\SettingHidden; |
||
14 | |||
15 | /** |
||
16 | * All DokuWiki plugins to extend the admin function |
||
17 | * need to inherit from this class |
||
18 | */ |
||
19 | class admin_plugin_config extends DokuWiki_Admin_Plugin { |
||
20 | |||
21 | const IMGDIR = DOKU_BASE . 'lib/plugins/config/images/'; |
||
22 | |||
23 | /** @var Configuration */ |
||
24 | protected $configuration; |
||
25 | |||
26 | /** @var bool were there any errors in the submitted data? */ |
||
27 | protected $hasErrors = false; |
||
28 | |||
29 | /** @var bool have the settings translations been loaded? */ |
||
30 | protected $promptsLocalized = false; |
||
31 | |||
32 | |||
33 | /** |
||
34 | * handle user request |
||
35 | */ |
||
36 | public function handle() { |
||
37 | global $ID, $INPUT; |
||
38 | |||
39 | // always initialize the configuration |
||
40 | $this->configuration = new Configuration(); |
||
41 | |||
42 | if(!$INPUT->bool('save') || !checkSecurityToken()) { |
||
43 | return; |
||
44 | } |
||
45 | |||
46 | // don't go any further if the configuration is locked |
||
47 | if($this->configuration->isLocked()) return; |
||
48 | |||
49 | // update settings and redirect of successful |
||
50 | $ok = $this->configuration->updateSettings($INPUT->arr('config')); |
||
51 | if($ok) { // no errors |
||
52 | try { |
||
53 | if($this->configuration->hasChanged()) { |
||
54 | $this->configuration->save(); |
||
55 | } else { |
||
56 | $this->configuration->touch(); |
||
57 | } |
||
58 | msg($this->getLang('updated'), 1); |
||
59 | } catch(Exception $e) { |
||
60 | msg($this->getLang('error'), -1); |
||
61 | } |
||
62 | send_redirect(wl($ID, array('do' => 'admin', 'page' => 'config'), true, '&')); |
||
63 | } else { |
||
64 | $this->hasErrors = true; |
||
65 | } |
||
66 | } |
||
67 | |||
68 | /** |
||
69 | * output appropriate html |
||
70 | */ |
||
71 | public function html() { |
||
72 | $allow_debug = $GLOBALS['conf']['allowdebug']; // avoid global $conf; here. |
||
73 | global $lang; |
||
74 | global $ID; |
||
75 | |||
76 | $this->setupLocale(true); |
||
77 | |||
78 | echo $this->locale_xhtml('intro'); |
||
79 | |||
80 | echo '<div id="config__manager">'; |
||
81 | |||
82 | if($this->configuration->isLocked()) { |
||
83 | echo '<div class="info">' . $this->getLang('locked') . '</div>'; |
||
84 | } |
||
85 | |||
86 | // POST to script() instead of wl($ID) so config manager still works if |
||
87 | // rewrite config is broken. Add $ID as hidden field to remember |
||
88 | // current ID in most cases. |
||
89 | echo '<form id="dw__configform" action="' . script() . '" method="post">'; |
||
90 | echo '<div class="no"><input type="hidden" name="id" value="' . $ID . '" /></div>'; |
||
91 | formSecurityToken(); |
||
92 | $this->printH1('dokuwiki_settings', $this->getLang('_header_dokuwiki')); |
||
93 | |||
94 | $in_fieldset = false; |
||
95 | $first_plugin_fieldset = true; |
||
96 | $first_template_fieldset = true; |
||
97 | foreach($this->configuration->getSettings() as $setting) { |
||
98 | if(is_a($setting, SettingHidden::class)) { |
||
99 | continue; |
||
100 | } else if(is_a($setting, settingFieldset::class)) { |
||
101 | // config setting group |
||
102 | if($in_fieldset) { |
||
103 | echo '</table>'; |
||
104 | echo '</div>'; |
||
105 | echo '</fieldset>'; |
||
106 | } else { |
||
107 | $in_fieldset = true; |
||
108 | } |
||
109 | if($first_plugin_fieldset && $setting->getType() == 'plugin') { |
||
110 | $this->printH1('plugin_settings', $this->getLang('_header_plugin')); |
||
111 | $first_plugin_fieldset = false; |
||
112 | } else if($first_template_fieldset && $setting->getType() == 'template') { |
||
113 | $this->printH1('template_settings', $this->getLang('_header_template')); |
||
114 | $first_template_fieldset = false; |
||
115 | } |
||
116 | echo '<fieldset id="' . $setting->getKey() . '">'; |
||
117 | echo '<legend>' . $setting->prompt($this) . '</legend>'; |
||
118 | echo '<div class="table">'; |
||
119 | echo '<table class="inline">'; |
||
120 | } else { |
||
121 | // config settings |
||
122 | list($label, $input) = $setting->html($this, $this->hasErrors); |
||
123 | |||
124 | $class = $setting->isDefault() |
||
125 | ? ' class="default"' |
||
126 | : ($setting->isProtected() ? ' class="protected"' : ''); |
||
127 | $error = $setting->hasError() |
||
128 | ? ' class="value error"' |
||
129 | : ' class="value"'; |
||
130 | $icon = $setting->caution() |
||
131 | ? '<img src="' . self::IMGDIR . $setting->caution() . '.png" ' . |
||
132 | 'alt="' . $setting->caution() . '" title="' . $this->getLang($setting->caution()) . '" />' |
||
133 | : ''; |
||
134 | |||
135 | echo '<tr' . $class . '>'; |
||
136 | echo '<td class="label">'; |
||
137 | echo '<span class="outkey">' . $setting->getPrettyKey() . '</span>'; |
||
138 | echo $icon . $label; |
||
139 | echo '</td>'; |
||
140 | echo '<td' . $error . '>' . $input . '</td>'; |
||
141 | echo '</tr>'; |
||
142 | } |
||
143 | } |
||
144 | |||
145 | echo '</table>'; |
||
146 | echo '</div>'; |
||
147 | if($in_fieldset) { |
||
148 | echo '</fieldset>'; |
||
149 | } |
||
150 | |||
151 | // show undefined settings list |
||
152 | $undefined_settings = $this->configuration->getUndefined(); |
||
153 | if($allow_debug && !empty($undefined_settings)) { |
||
154 | /** |
||
155 | * Callback for sorting settings |
||
156 | * |
||
157 | * @param Setting $a |
||
158 | * @param Setting $b |
||
159 | * @return int if $a is lower/equal/higher than $b |
||
160 | */ |
||
161 | function settingNaturalComparison($a, $b) { |
||
162 | return strnatcmp($a->getKey(), $b->getKey()); |
||
163 | } |
||
164 | |||
165 | usort($undefined_settings, 'settingNaturalComparison'); |
||
166 | $this->printH1('undefined_settings', $this->getLang('_header_undefined')); |
||
167 | echo '<fieldset>'; |
||
168 | echo '<div class="table">'; |
||
169 | echo '<table class="inline">'; |
||
170 | foreach($undefined_settings as $setting) { |
||
171 | list($label, $input) = $setting->html($this); |
||
172 | echo '<tr>'; |
||
173 | echo '<td class="label">' . $label . '</td>'; |
||
174 | echo '<td>' . $input . '</td>'; |
||
175 | echo '</tr>'; |
||
176 | } |
||
177 | echo '</table>'; |
||
178 | echo '</div>'; |
||
179 | echo '</fieldset>'; |
||
180 | } |
||
181 | |||
182 | // finish up form |
||
183 | echo '<p>'; |
||
184 | echo '<input type="hidden" name="do" value="admin" />'; |
||
185 | echo '<input type="hidden" name="page" value="config" />'; |
||
186 | |||
187 | if(!$this->configuration->isLocked()) { |
||
188 | echo '<input type="hidden" name="save" value="1" />'; |
||
189 | echo '<button type="submit" name="submit" accesskey="s">' . $lang['btn_save'] . '</button>'; |
||
190 | echo '<button type="reset">' . $lang['btn_reset'] . '</button>'; |
||
191 | } |
||
192 | |||
193 | echo '</p>'; |
||
194 | |||
195 | echo '</form>'; |
||
196 | echo '</div>'; |
||
197 | } |
||
198 | |||
199 | /** |
||
200 | * @param bool $prompts |
||
201 | */ |
||
202 | public function setupLocale($prompts = false) { |
||
203 | parent::setupLocale(); |
||
204 | if(!$prompts || $this->promptsLocalized) return; |
||
205 | $this->lang = array_merge($this->lang, $this->configuration->getLangs()); |
||
206 | $this->promptsLocalized = true; |
||
207 | } |
||
208 | |||
209 | /** |
||
210 | * Generates a two-level table of contents for the config plugin. |
||
211 | * |
||
212 | * @author Ben Coburn <[email protected]> |
||
213 | * |
||
214 | * @return array |
||
215 | */ |
||
216 | public function getTOC() { |
||
217 | $this->setupLocale(true); |
||
218 | |||
219 | $allow_debug = $GLOBALS['conf']['allowdebug']; // avoid global $conf; here. |
||
220 | $toc = array(); |
||
221 | $check = false; |
||
222 | |||
223 | // gather settings data into three sub arrays |
||
224 | $labels = ['dokuwiki' => [], 'plugin' => [], 'template' => []]; |
||
225 | foreach($this->configuration->getSettings() as $setting) { |
||
226 | if(is_a($setting, SettingFieldset::class)) { |
||
227 | $labels[$setting->getType()][] = $setting; |
||
228 | } |
||
229 | } |
||
230 | |||
231 | // top header |
||
232 | $title = $this->getLang('_configuration_manager'); |
||
233 | $toc[] = html_mktocitem(sectionID($title, $check), $title, 1); |
||
234 | |||
235 | // main entries |
||
236 | foreach(['dokuwiki', 'plugin', 'template'] as $section) { |
||
237 | if(empty($labels[$section])) continue; // no entries, skip |
||
238 | |||
239 | // create main header |
||
240 | $toc[] = html_mktocitem( |
||
241 | $section . '_settings', |
||
242 | $this->getLang('_header_' . $section), |
||
243 | 1 |
||
244 | ); |
||
245 | |||
246 | // create sub headers |
||
247 | foreach($labels[$section] as $setting) { |
||
248 | /** @var SettingFieldset $setting */ |
||
249 | $name = $setting->prompt($this); |
||
250 | $toc[] = html_mktocitem($setting->getKey(), $name, 2); |
||
251 | } |
||
252 | } |
||
253 | |||
254 | // undefined settings if allowed |
||
255 | if(count($this->configuration->getUndefined()) && $allow_debug) { |
||
256 | $toc[] = html_mktocitem('undefined_settings', $this->getLang('_header_undefined'), 1); |
||
257 | } |
||
258 | |||
259 | return $toc; |
||
260 | } |
||
261 | |||
262 | /** |
||
263 | * @param string $id |
||
264 | * @param string $text |
||
265 | */ |
||
266 | protected function printH1($id, $text) { |
||
267 | echo '<h1 id="' . $id . '">' . $text . '</h1>'; |
||
268 | } |
||
269 | |||
270 | /** |
||
271 | * Adds a translation to this plugin's language array |
||
272 | * |
||
273 | * Used by some settings to set up dynamic translations |
||
274 | * |
||
275 | * @param string $key |
||
276 | * @param string $value |
||
277 | */ |
||
278 | public function addLang($key, $value) { |
||
279 | if(!$this->localised) $this->setupLocale(); |
||
280 | $this->lang[$key] = $value; |
||
281 | } |
||
282 | } |
||
283 |
Let’s assume that you have a directory layout like this:
and let’s assume the following content of
Bar.php
:If both files
OtherDir/Foo.php
andSomeDir/Foo.php
are loaded in the same runtime, you will see a PHP error such as the following:PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php
However, as
OtherDir/Foo.php
does not necessarily have to be loaded and the error is only triggered if it is loaded beforeOtherDir/Bar.php
, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: