This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | |||
4 | class HideMailto extends SiteTreeExtension |
||
5 | { |
||
6 | private static $email_field = "Email"; |
||
7 | |||
8 | private static $default_subject = "enquiry"; |
||
9 | |||
10 | private static $replace_characters = array( |
||
11 | "." => ".", |
||
12 | "@" => "@", |
||
13 | "a" => "a", |
||
14 | "b" => "b", |
||
15 | "c" => "c", |
||
16 | "d" => "d", |
||
17 | "e" => "e", |
||
18 | "f" => "f", |
||
19 | "g" => "g", |
||
20 | "h" => "h", |
||
21 | "i" => "i" |
||
22 | ); |
||
23 | |||
24 | /** |
||
25 | * |
||
26 | * @param String $email |
||
27 | * @param String $subject |
||
28 | * @return Obj (MailTo, Text, Original, Subject) |
||
29 | */ |
||
30 | public static function convert_email($email, $subject = '') |
||
31 | { |
||
32 | $obj = new ViewableData(); |
||
33 | if (!$subject) { |
||
34 | $subject = self::$default_subject; |
||
35 | } |
||
36 | //mailto part |
||
37 | $mailTo = "mailto:".$email."?subject=".Convert::raw2mailto($subject); |
||
38 | $mailToConverted = self::string_encoder($mailTo); |
||
39 | $convertedEmail = self::string_encoder($email); |
||
40 | $obj->MailTo = $mailToConverted; |
||
41 | $obj->Text = $convertedEmail; |
||
42 | $obj->Original = $email; |
||
43 | $obj->Subject = $subject; |
||
44 | //$obj->OnClick = "jQuery(this).attr('href', HideMailto2Email('".self::get_dot_replacer()."', '".$array[0]."', '".$array[1]."', '".Convert::raw2mailto($subject)."')); return true;"; |
||
0 ignored issues
–
show
|
|||
45 | //TO DO: add a JS function that puts the |
||
46 | Requirements::javascript(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
47 | //Requirements::javascript("hidemailto/javascript/HideMailto2Email.js"); |
||
0 ignored issues
–
show
Unused Code
Comprehensibility
introduced
by
72% of this comment could be valid code. Did you maybe forget this after debugging?
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. ![]() |
|||
48 | return $obj; |
||
49 | } |
||
50 | |||
51 | |||
52 | /** |
||
53 | * encodes a string - randomly |
||
54 | * @param String $string |
||
55 | * @return String |
||
56 | */ |
||
57 | private static function string_encoder($string) |
||
58 | { |
||
59 | $encodedString = ''; |
||
60 | $nowCodeString = ''; |
||
61 | $originalLength = strlen($string); |
||
62 | for ($i = 0; $i < $originalLength; $i++) { |
||
63 | $encodeMode = rand(1, 2); |
||
64 | switch ($encodeMode) { |
||
65 | case 1: // Decimal code |
||
66 | $nowCodeString = '&#' . ord($string[$i]) . ';'; |
||
67 | break; |
||
68 | case 2: // Hexadecimal code |
||
69 | $nowCodeString = '&#x' . dechex(ord($string[$i])) . ';'; |
||
70 | break; |
||
71 | default: |
||
72 | return 'ERROR: wrong encoding mode.'; |
||
73 | } |
||
74 | $encodedString .= $nowCodeString; |
||
75 | } |
||
76 | return $encodedString; |
||
77 | } |
||
78 | |||
79 | public function HideMailToObject() |
||
80 | { |
||
81 | if ($email = $this->getHiddenEmailData()) { |
||
82 | $obj = self::convert_email($email); |
||
83 | return $obj; |
||
84 | } |
||
85 | } |
||
86 | |||
87 | private function getHiddenEmailData() |
||
88 | { |
||
89 | if ($field = self::$email_field) { |
||
90 | if ($email = $this->owner->$field) { |
||
91 | return $this->isEmail($email); |
||
92 | } |
||
93 | } |
||
94 | } |
||
95 | |||
96 | private function isEmail($email) |
||
97 | { |
||
98 | if (!preg_match("/^([A-Za-z0-9._-])+\@(([A-Za-z0-9-])+\.)+([A-Za-z0-9])+$/", trim($email))) { |
||
99 | return ""; |
||
100 | } else { |
||
101 | return $email; |
||
102 | } |
||
103 | } |
||
104 | } |
||
105 | |||
106 | class HideMailto_Role extends DataExtension |
||
107 | { |
||
108 | |||
109 | //member link |
||
110 | |||
111 | public function HideMailtoLink() |
||
112 | { |
||
113 | return "mailto/" . $this->owner->ID; |
||
114 | } |
||
115 | } |
||
116 | |||
117 | /** |
||
118 | * Generates obfusticated links, and also holds the method called when /mailto/ |
||
119 | * is called via the URL. As noted above, take a look at the _config.php file to |
||
120 | * see how mailto/ maps to this class. |
||
121 | */ |
||
122 | class HideMailto_Controller extends ContentController |
||
123 | { |
||
124 | /** |
||
125 | * The list of allowed domains to create a mailto: link to. By default, allow |
||
126 | * all domains. |
||
127 | * |
||
128 | * TODO Maybe the default should be to allow the current domain only? |
||
129 | */ |
||
130 | private static $allowed_domains = '*'; |
||
131 | |||
132 | public function __construct($dataRecord = null) |
||
133 | { |
||
134 | parent::__construct($dataRecord); |
||
135 | return $this->index(); |
||
136 | } |
||
137 | |||
138 | public function defaultAction($action) |
||
139 | { |
||
140 | return $this->index(); |
||
141 | } |
||
142 | |||
143 | public $url = ''; |
||
144 | |||
145 | /** |
||
146 | * This is called by default when this controller is executed. |
||
147 | */ |
||
148 | public function index() |
||
149 | { |
||
150 | $member = null; |
||
151 | $user = ''; |
||
152 | $domain = ''; |
||
153 | $subject = ''; |
||
154 | // We have two situations to deal with, where urlParams['Action'] is an int (assume Member ID), or a string (assume username) |
||
155 | if (is_numeric($this->getRequest()->param('Name'))) { |
||
156 | // Action is numeric, assume it's a member ID and optional ID is the email subject |
||
157 | $member = Member::get()->byID($this->getRequest()->param('Name')); |
||
158 | if (!$member) { |
||
159 | user_error("No member found with ID #" . $this->getRequest()->param('Name'), E_USER_ERROR); // No member found with this ID, perhaps we could redirect a user back instead of giving them a 500 error? |
||
160 | } |
||
161 | list($user, $domain) = explode('@', $member->Email); |
||
162 | $subject = $this->getRequest()->param('ID'); |
||
163 | } else { |
||
164 | // Action is not numeric, assume that Action is the username, ID is the domain and optional OtherID is the email subject |
||
165 | $user = urldecode($this->getRequest()->param('Name')); |
||
166 | $domain = urldecode($this->getRequest()->param('URL')); |
||
167 | $subject = $this->getRequest()->param('Subject'); |
||
168 | } |
||
169 | $emailString = "mailto: $user@$domain?subject=".$subject; |
||
170 | // Make sure the domain is in the allowed domains |
||
171 | if ((is_string(self::$allowed_domains) && self::$allowed_domains == '*') || in_array($domain, self::$allowed_domains)) { |
||
172 | // Create the redirect |
||
173 | header("Location: " . $emailString); |
||
174 | header("Refresh: 0; url=". $emailString); |
||
175 | echo $this->customise(array("RedirectBackURL" => $this->RedirectBackURL(), "Email" => $this->makeMailtoString($user, $domain, $subject)))->renderWith("HideMailto"); |
||
176 | $emailString = $this->makeMailtoString($user, $domain, $subject); |
||
177 | } else { |
||
178 | user_error("We're not allowed to redirect to the domain '$domain', because it's not listed in the _config.php file", E_USER_ERROR); |
||
179 | } |
||
180 | } |
||
181 | |||
182 | public function RedirectBackURL() |
||
183 | { |
||
184 | if (isset($_SERVER['HTTP_REFERER'])) { |
||
185 | $this->redirectBackURL = $_SERVER['HTTP_REFERER']; |
||
186 | } |
||
187 | if (!$this->redirectBackURL) { |
||
188 | $this->redirectBackURL = Director::absoluteBaseURL(); |
||
189 | } |
||
190 | return $this->redirectBackURL; |
||
191 | } |
||
192 | |||
193 | |||
194 | protected function makeMailtoString($user, $domain, $subject = '') |
||
195 | { |
||
196 | $target = 'mailto:' . $user . '@' . $domain; |
||
197 | if ($subject) { |
||
198 | $target .= '?subject=' . Convert::raw2mailto($subject); |
||
199 | } |
||
200 | $target = str_replace(".", "&x2e;", $target); |
||
201 | $target = str_replace("@", "&x40;", $target); |
||
202 | return $target; |
||
203 | } |
||
204 | } |
||
205 |
Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.
The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.
This check looks for comments that seem to be mostly valid code and reports them.