This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | |||
4 | class HideMailto extends SiteTreeExtension |
||
5 | { |
||
6 | private static $email_field = "Email"; |
||
7 | |||
8 | private static $default_subject = "enquiry"; |
||
9 | |||
10 | private static $replace_characters = array( |
||
0 ignored issues
–
show
|
|||
11 | "." => ".", |
||
12 | "@" => "@", |
||
13 | "a" => "a", |
||
14 | "b" => "b", |
||
15 | "c" => "c", |
||
16 | "d" => "d", |
||
17 | "e" => "e", |
||
18 | "f" => "f", |
||
19 | "g" => "g", |
||
20 | "h" => "h", |
||
21 | "i" => "i" |
||
22 | ); |
||
23 | |||
24 | /** |
||
25 | * |
||
26 | * @param String $email |
||
27 | * @param String $subject |
||
28 | * @return Obj (MailTo, Text, Original, Subject) |
||
29 | */ |
||
30 | public static function convert_email($email, $subject = '') |
||
31 | { |
||
32 | $obj = new ViewableData(); |
||
33 | if (!$subject) { |
||
34 | $subject = self::$default_subject; |
||
35 | } |
||
36 | //mailto part |
||
37 | $mailTo = "mailto:".$email."?subject=".Convert::raw2mailto($subject); |
||
38 | $mailToConverted = self::string_encoder($mailTo); |
||
39 | $convertedEmail = self::string_encoder($email); |
||
40 | $obj->MailTo = $mailToConverted; |
||
41 | $obj->Text = $convertedEmail; |
||
42 | $obj->Original = $email; |
||
43 | $obj->Subject = $subject; |
||
44 | //$obj->OnClick = "jQuery(this).attr('href', HideMailto2Email('".self::get_dot_replacer()."', '".$array[0]."', '".$array[1]."', '".Convert::raw2mailto($subject)."')); return true;"; |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
62% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
45 | //TO DO: add a JS function that puts the |
||
46 | Requirements::javascript(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
47 | //Requirements::javascript("hidemailto/javascript/HideMailto2Email.js"); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
72% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
48 | return $obj; |
||
49 | } |
||
50 | |||
51 | |||
52 | /** |
||
53 | * encodes a string - randomly |
||
54 | * @param String $string |
||
55 | * @return String |
||
56 | */ |
||
57 | private static function string_encoder($string) |
||
58 | { |
||
59 | $encodedString = ''; |
||
60 | $nowCodeString = ''; |
||
0 ignored issues
–
show
$nowCodeString is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
61 | $originalLength = strlen($string); |
||
62 | for ($i = 0; $i < $originalLength; $i++) { |
||
63 | $encodeMode = rand(1, 2); |
||
64 | switch ($encodeMode) { |
||
65 | case 1: // Decimal code |
||
66 | $nowCodeString = '&#' . ord($string[$i]) . ';'; |
||
67 | break; |
||
68 | case 2: // Hexadecimal code |
||
69 | $nowCodeString = '&#x' . dechex(ord($string[$i])) . ';'; |
||
70 | break; |
||
71 | default: |
||
72 | return 'ERROR: wrong encoding mode.'; |
||
73 | } |
||
74 | $encodedString .= $nowCodeString; |
||
75 | } |
||
76 | return $encodedString; |
||
77 | } |
||
78 | |||
79 | public function HideMailToObject() |
||
80 | { |
||
81 | if ($email = $this->getHiddenEmailData()) { |
||
82 | $obj = self::convert_email($email); |
||
83 | return $obj; |
||
84 | } |
||
85 | } |
||
86 | |||
87 | private function getHiddenEmailData() |
||
88 | { |
||
89 | if ($field = self::$email_field) { |
||
90 | if ($email = $this->owner->$field) { |
||
91 | return $this->isEmail($email); |
||
92 | } |
||
93 | } |
||
94 | } |
||
95 | |||
96 | private function isEmail($email) |
||
97 | { |
||
98 | if (!preg_match("/^([A-Za-z0-9._-])+\@(([A-Za-z0-9-])+\.)+([A-Za-z0-9])+$/", trim($email))) { |
||
99 | return ""; |
||
100 | } else { |
||
101 | return $email; |
||
102 | } |
||
103 | } |
||
104 | } |
||
105 | |||
106 | class HideMailto_Role extends DataExtension |
||
107 | { |
||
108 | |||
109 | //member link |
||
110 | |||
111 | public function HideMailtoLink() |
||
112 | { |
||
113 | return "mailto/" . $this->owner->ID; |
||
114 | } |
||
115 | } |
||
116 | |||
117 | /** |
||
118 | * Generates obfusticated links, and also holds the method called when /mailto/ |
||
119 | * is called via the URL. As noted above, take a look at the _config.php file to |
||
120 | * see how mailto/ maps to this class. |
||
121 | */ |
||
122 | class HideMailto_Controller extends ContentController |
||
123 | { |
||
124 | /** |
||
125 | * The list of allowed domains to create a mailto: link to. By default, allow |
||
126 | * all domains. |
||
127 | * |
||
128 | * TODO Maybe the default should be to allow the current domain only? |
||
129 | */ |
||
130 | private static $allowed_domains = '*'; |
||
131 | |||
132 | public function __construct($dataRecord = null) |
||
133 | { |
||
134 | parent::__construct($dataRecord); |
||
135 | return $this->index(); |
||
136 | } |
||
137 | |||
138 | public function defaultAction($action) |
||
139 | { |
||
140 | return $this->index(); |
||
141 | } |
||
142 | |||
143 | public $url = ''; |
||
144 | |||
145 | /** |
||
146 | * This is called by default when this controller is executed. |
||
147 | */ |
||
148 | public function index() |
||
149 | { |
||
150 | $member = null; |
||
0 ignored issues
–
show
$member is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
151 | $user = ''; |
||
152 | $domain = ''; |
||
153 | $subject = ''; |
||
0 ignored issues
–
show
$subject is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
154 | // We have two situations to deal with, where urlParams['Action'] is an int (assume Member ID), or a string (assume username) |
||
155 | if (is_numeric($this->getRequest()->param('Name'))) { |
||
156 | // Action is numeric, assume it's a member ID and optional ID is the email subject |
||
157 | $member = Member::get()->byID($this->getRequest()->param('Name')); |
||
158 | if (!$member) { |
||
159 | user_error("No member found with ID #" . $this->getRequest()->param('Name'), E_USER_ERROR); // No member found with this ID, perhaps we could redirect a user back instead of giving them a 500 error? |
||
160 | } |
||
161 | list($user, $domain) = explode('@', $member->Email); |
||
162 | $subject = $this->getRequest()->param('ID'); |
||
163 | } else { |
||
164 | // Action is not numeric, assume that Action is the username, ID is the domain and optional OtherID is the email subject |
||
165 | $user = urldecode($this->getRequest()->param('Name')); |
||
166 | $domain = urldecode($this->getRequest()->param('URL')); |
||
167 | $subject = $this->getRequest()->param('Subject'); |
||
168 | } |
||
169 | $emailString = "mailto: $user@$domain?subject=".$subject; |
||
170 | // Make sure the domain is in the allowed domains |
||
171 | if ((is_string(self::$allowed_domains) && self::$allowed_domains == '*') || in_array($domain, self::$allowed_domains)) { |
||
172 | // Create the redirect |
||
173 | header("Location: " . $emailString); |
||
174 | header("Refresh: 0; url=". $emailString); |
||
175 | echo $this->customise(array("RedirectBackURL" => $this->RedirectBackURL(), "Email" => $this->makeMailtoString($user, $domain, $subject)))->renderWith("HideMailto"); |
||
176 | $emailString = $this->makeMailtoString($user, $domain, $subject); |
||
0 ignored issues
–
show
$emailString is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
177 | } else { |
||
178 | user_error("We're not allowed to redirect to the domain '$domain', because it's not listed in the _config.php file", E_USER_ERROR); |
||
179 | } |
||
180 | } |
||
181 | |||
182 | public function RedirectBackURL() |
||
183 | { |
||
184 | if (isset($_SERVER['HTTP_REFERER'])) { |
||
185 | $this->redirectBackURL = $_SERVER['HTTP_REFERER']; |
||
186 | } |
||
187 | if (!$this->redirectBackURL) { |
||
188 | $this->redirectBackURL = Director::absoluteBaseURL(); |
||
189 | } |
||
190 | return $this->redirectBackURL; |
||
191 | } |
||
192 | |||
193 | |||
194 | protected function makeMailtoString($user, $domain, $subject = '') |
||
195 | { |
||
196 | $target = 'mailto:' . $user . '@' . $domain; |
||
197 | if ($subject) { |
||
198 | $target .= '?subject=' . Convert::raw2mailto($subject); |
||
199 | } |
||
200 | $target = str_replace(".", "&x2e;", $target); |
||
201 | $target = str_replace("@", "&x40;", $target); |
||
202 | return $target; |
||
203 | } |
||
204 | } |
||
205 |
This check marks private properties in classes that are never used. Those properties can be removed.