Completed
Push — work-fleets ( 4ec5b3...fe2ede )
by SuperNova.WS
10:06
created

txt2html.php ➔ pdump()   C

Complexity

Conditions 7
Paths 17

Size

Total Lines 4
Code Lines 17

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 7
eloc 17
nc 17
nop 2
dl 0
loc 4
rs 6.7272
c 0
b 0
f 0
1
<?php
2
3
function dump($value,$varname = "",$level=0,$dumper = "")
0 ignored issues
show
Best Practice introduced by
The function dump() has been defined more than once; this definition is ignored, only the first definition in classes/debug.php (L287-336) is considered.

This check looks for functions that have already been defined in other files.

Some Codebases, like WordPress, make a practice of defining functions multiple times. This may lead to problems with the detection of function parameters and types. If you really need to do this, you can mark the duplicate definition with the @ignore annotation.

/**
 * @ignore
 */
function getUser() {

}

function getUser($id, $realm) {

}

See also the PhpDoc documentation for @ignore.

Loading history...
4
{
5
  if ($varname) $varname .= " = ";
6
7
  if ($level==-1)
8
  {
9
    $trans[' ']='&there4;';
0 ignored issues
show
Coding Style Comprehensibility introduced by
$trans was never initialized. Although not strictly required by PHP, it is generally a good practice to add $trans = array(); before regardless.

Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.

Let’s take a look at an example:

foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}

As you can see in this example, the array $myArray is initialized the first time when the foreach loop is entered. You can also see that the value of the bar key is only written conditionally; thus, its value might result from a previous iteration.

This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.

Loading history...
10
    $trans["\t"]='&rArr;';
11
    $trans["\n"]='&para;;';
12
    $trans["\r"]='&lArr;';
13
    $trans["\0"]='&oplus;';
14
    return strtr(htmlspecialchars($value),$trans);
15
  }
16
  if ($level==0) $dumper = '<pre>' . $varname;
17
18
  $type = gettype($value);
19
  $dumper .= $type;
20
21
  if ($type=='string')
22
  {
23
    $dumper .= '('.strlen($value).')';
24
    $value = dump($value,"",-1);
25
  }
26
  elseif ($type=='boolean') $value= ($value?'true':'false');
27
  elseif ($type=='object')
28
  {
29
    $props= get_class_vars(get_class($value));
30
    $dumper .= '('.count($props).') <u>'.get_class($value).'</u>';
31
    foreach($props as $key=>$val)
32
    {
33
      $dumper .= "\n".str_repeat("\t",$level+1).$key.' => ';
34
      $dumper .= dump($value->$key,"",$level+1);
35
    }
36
    $value= '';
37
  }
38 View Code Duplication
  elseif ($type=='array')
0 ignored issues
show
Duplication introduced by
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
39
  {
40
    $dumper .= '('.count($value).')';
41
    foreach($value as $key=>$val)
42
    {
43
      $dumper .= "\n".str_repeat("\t",$level+1).dump($key,"",-1).' => ';
44
      $dumper .= dump($val,"",$level+1);
45
    }
46
    $value= '';
47
  }
48
  $dumper .= " <b>$value</b>";
49
  if ($level==0) $dumper .= '</pre>';
50
  return $dumper;
51
}
52
53
function pdump($value, $varname = '')
0 ignored issues
show
Best Practice introduced by
The function pdump() has been defined more than once; this definition is ignored, only the first definition in classes/debug.php (L338-364) is considered.

This check looks for functions that have already been defined in other files.

Some Codebases, like WordPress, make a practice of defining functions multiple times. This may lead to problems with the detection of function parameters and types. If you really need to do this, you can mark the duplicate definition with the @ignore annotation.

/**
 * @ignore
 */
function getUser() {

}

function getUser($id, $realm) {

}

See also the PhpDoc documentation for @ignore.

Loading history...
54
{
55
  print('<span style="text-align: left">' . dump($value, $varname) . '</span>');
0 ignored issues
show
Security Cross-Site Scripting introduced by
'<span style="text-align..., $varname) . '</span>' can contain request data and is used in output context(s) leading to a potential security vulnerability.

5 paths for user data to reach this point

  1. Path: Read from $_GET, and $error_backtrace is assigned in classes/debug.php on line 184
  1. Read from $_GET, and $error_backtrace is assigned
    in classes/debug.php on line 184
  2. $error_backtrace is assigned
    in classes/debug.php on line 185
  3. $error_backtrace is assigned
    in classes/debug.php on line 186
  4. $error_backtrace is assigned
    in classes/debug.php on line 187
  5. $error_backtrace is assigned
    in classes/debug.php on line 188
  6. $error_backtrace is assigned
    in classes/debug.php on line 189
  7. $error_backtrace is assigned
    in classes/debug.php on line 190
  8. $error_backtrace is assigned
    in classes/debug.php on line 191
  9. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 220
  10. $name is assigned
    in classes/debug.php on line 243
  11. $name is passed to pdump()
    in classes/debug.php on line 245
  2. Path: Read from $_POST, and $error_backtrace is assigned in classes/debug.php on line 185
  1. Read from $_POST, and $error_backtrace is assigned
    in classes/debug.php on line 185
  2. $error_backtrace is assigned
    in classes/debug.php on line 186
  3. $error_backtrace is assigned
    in classes/debug.php on line 187
  4. $error_backtrace is assigned
    in classes/debug.php on line 188
  5. $error_backtrace is assigned
    in classes/debug.php on line 189
  6. $error_backtrace is assigned
    in classes/debug.php on line 190
  7. $error_backtrace is assigned
    in classes/debug.php on line 191
  8. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 220
  9. $name is assigned
    in classes/debug.php on line 243
  10. $name is passed to pdump()
    in classes/debug.php on line 245
  3. Path: Read from $_REQUEST, and $error_backtrace is assigned in classes/debug.php on line 186
  1. Read from $_REQUEST, and $error_backtrace is assigned
    in classes/debug.php on line 186
  2. $error_backtrace is assigned
    in classes/debug.php on line 187
  3. $error_backtrace is assigned
    in classes/debug.php on line 188
  4. $error_backtrace is assigned
    in classes/debug.php on line 189
  5. $error_backtrace is assigned
    in classes/debug.php on line 190
  6. $error_backtrace is assigned
    in classes/debug.php on line 191
  7. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 220
  8. $name is assigned
    in classes/debug.php on line 243
  9. $name is passed to pdump()
    in classes/debug.php on line 245
  4. Path: Read from $_COOKIE, and $error_backtrace is assigned in classes/debug.php on line 187
  1. Read from $_COOKIE, and $error_backtrace is assigned
    in classes/debug.php on line 187
  2. $error_backtrace is assigned
    in classes/debug.php on line 188
  3. $error_backtrace is assigned
    in classes/debug.php on line 189
  4. $error_backtrace is assigned
    in classes/debug.php on line 190
  5. $error_backtrace is assigned
    in classes/debug.php on line 191
  6. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 220
  7. $name is assigned
    in classes/debug.php on line 243
  8. $name is passed to pdump()
    in classes/debug.php on line 245
  5. Path: Read from $_SERVER, and $error_backtrace is assigned in classes/debug.php on line 189
  1. Read from $_SERVER, and $error_backtrace is assigned
    in classes/debug.php on line 189
  2. $error_backtrace is assigned
    in classes/debug.php on line 190
  3. $error_backtrace is assigned
    in classes/debug.php on line 191
  4. debug::dump() returns tainted data, and $error_backtrace is assigned
    in classes/debug.php on line 220
  5. $name is assigned
    in classes/debug.php on line 243
  6. $name is passed to pdump()
    in classes/debug.php on line 245

Preventing Cross-Site-Scripting Attacks

Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.

In order to prevent this, make sure to escape all user-provided data:

// for HTML
$sanitized = htmlentities($tainted, ENT_QUOTES);

// for URLs
$sanitized = urlencode($tainted);

General Strategies to prevent injection

In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:

if ( ! in_array($value, array('this-is-allowed', 'and-this-too'), true)) {
    throw new \InvalidArgumentException('This input is not allowed.');
}

For numeric data, we recommend to explicitly cast the data:

$sanitized = (integer) $tainted;
Loading history...
56
}
57
58
function debug($value, $varname = '')
0 ignored issues
show
Best Practice introduced by
The function debug() has been defined more than once; this definition is ignored, only the first definition in classes/debug.php (L366-368) is considered.

This check looks for functions that have already been defined in other files.

Some Codebases, like WordPress, make a practice of defining functions multiple times. This may lead to problems with the detection of function parameters and types. If you really need to do this, you can mark the duplicate definition with the @ignore annotation.

/**
 * @ignore
 */
function getUser() {

}

function getUser($id, $realm) {

}

See also the PhpDoc documentation for @ignore.

Loading history...
59
{
60
  return pdump($value, $varname);
61
}
62
63
function buf_print($string)
64
{
65
  global $output_buffer;
66
67
  $output_buffer .= $string;
68
}
69
70
if(substr(getcwd(), -4) != 'docs')
71
{
72
  $path_prefix = 'docs/';
73
}
74
else
75
{
76
  $path_prefix = '';
77
}
78
79
$output_buffer = '';
80
81
$filename = 'changelog';
82
83
$input =  file_get_contents($path_prefix . $filename . '.txt');
84
//$input = iconv('CP1251', 'UTF-8', $input);
0 ignored issues
show
Unused Code Comprehensibility introduced by
60% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
85
86
$input = preg_replace("/\r\n\d\d\d\d\-\d\d\-\d\d\ \d\d\:\d\d/", "[D] $0", $input);
87
88
while(strpos($input, "\r\n\r\n") !== false)
89
{
90
  $input = str_replace("\r\n\r\n", "\r\n", $input);
91
}
92
while(strpos($input, "~~~") !== false)
93
{
94
  $input = str_replace("~~~", "~~", $input);
95
}
96
$input = str_replace("\r\n~~", "~~", $input);
97
98
while(strpos($input, "===") !== false)
99
{
100
  $input = str_replace("===", "==", $input);
101
}
102
$input = str_replace("\r\n==", "==", $input);
103
104
$input = preg_split("/\r\n(.+)[\~\=]{2}/", $input, -1, PREG_SPLIT_DELIM_CAPTURE + PREG_SPLIT_NO_EMPTY); // 
105
106
$prev_chapter_is_header = false;
107
$output = array();
108
$buffer = array();
109
foreach($input as &$chapter)
110
{
111
  $chapter = preg_split("/(\r\n[\[])/", $chapter, -1, PREG_SPLIT_NO_EMPTY); // , PREG_SPLIT_DELIM_CAPTURE
112
113
  if(count($chapter) == 1 && !$prev_chapter_is_header)
114
  {
115
    if(!empty($chapter))
116
    {
117
      $output[] = $buffer;
118
      $buffer = array();
119
      $buffer['name'] = $chapter[0];
120
    }
121
    $prev_chapter_is_header = true;
122
  }
123
  else
124
  {
125
    $prev_chapter_is_header = false;
126
    foreach($chapter as &$note)
127
    {
128
      $note = explode("\r\n", $note);
129
      $new_note = true;
130
      $buf_str = '';
131
132
      $note_out = array();
133
134
      foreach($note as &$line)
135
      {
136
        if(!$line)
137
        {
138
          continue;
139
        }
140
        if($new_note)
141
        {
142
          // 78 - 3 = 75
143
          $note_out['style'] = $line[0];
144
          $line = substr($line, 3);
145
        }
146
147
        $buf_str .= $line;
148
        if(mb_strlen($line, 'utf-8') < ($new_note ? 75 : 79))
149
        {
150
          if(!isset($note_out['name']))
151
          {
152
            $note_out['name'] = $buf_str;
153
          }
154
          else
155
          {
156
            $note_out['lines'][] = $buf_str;
157
          }
158
          $buf_str = '';
159
        }
160
161
        $new_note = false;
162
      }
163
      $buffer['content'][] = $note_out;
164
    }
165
  }
166
}
167
$output[] = $buffer;
168
169
buf_print('<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
170
<html xmlns="http://www.w3.org/1999/xhtml" lang="ru" xml:lang="ru" dir="LTR">
171
<head>
172
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
173
<style type="text/css"><!--
174
body {font-family: monospace}
175
li, ol, ul, pre {margin: 0}
176
div {margin-bottom: 10px}
177
178
.important {color: green; font-weight: bold;}
179
.added {color: green;}
180
.removed {font-style: italic; color: red}
181
.changed {color: blue}
182
.fixed {color: red}
183
.admin {font-style: italic;}
184
.module {color: purple; font-weight: bold;}
185
.todo {}
186
.date {margin-bottom: 0; color: grey}
187
--></style>
188
</head>
189
<body>
190
');
191
// ; text-decoration: underline;
192
$styles = array(
193
  '!' => 'important',
194
  '+' => 'added',
195
  '-' => 'removed',
196
  '~' => 'changed',
197
  '%' => 'fixed',
198
  '@' => 'admin',
199
  '#' => 'module',
200
  '*' => 'todo',
201
  'D' => 'date',
202
);
203
204
foreach($output as $chapter)
205
{
206
  if(!$chapter)
0 ignored issues
show
Bug Best Practice introduced by
The expression $chapter of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.

This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.

Consider making the comparison explicit by using empty(..) or ! empty(...) instead.

Loading history...
207
  {
208
    continue;
209
  }
210
211
  buf_print("<h1>{$chapter['name']}</h1>\r\n");
212
  foreach($chapter['content'] as $block)
213
  {
214
    buf_print("<div class=\"{$styles[$block['style']]}\">" . ($block['style'] != 'D' ? "[{$block['style']}]&nbsp;" : ''));
215
    buf_print(preg_replace("/\s{2,10}/", " ", $block['name']) . '<br />');
216
    if(isset($block['lines']))
217
    {
218
      $last_spaces = '';
219
      $depth = array();
220
      foreach($block['lines'] as $line)
221
      {
222
        if(preg_match("/^(\s+)(\d*|\s)\.*\s*(.*)/", $line, $matches))
223
        {
224
          //$line = strlen($matches[1]) . '/' . $matches[2] . '/' . $matches[3];
0 ignored issues
show
Unused Code Comprehensibility introduced by
53% of this comment could be valid code. Did you maybe forget this after debugging?

Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it.

The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production.

This check looks for comments that seem to be mostly valid code and reports them.

Loading history...
225
          $line = $matches[3];
226
          if(strlen($matches[1]) > strlen($last_spaces))
227
          {
228
            if($matches[2])
229
            {
230
              buf_print("<ol>\r\n");
231
            }
232
            else
233
            {
234
              buf_print("<ul>\r\n");
235
            }
236
            buf_print('<li>');
237
            $last_spaces = $matches[1];
238
            $depth[] = $matches[2];
239
          }
240
          elseif(strlen($matches[1]) < strlen($last_spaces) && count($depth))
241
          {
242
            if(array_pop($depth))
243
            {
244
              buf_print("</ol>\r\n");
245
            }
246
            else
247
            {
248
              buf_print("</ul>\r\n");
249
            }
250
            $last_spaces = $matches[1];
251
            buf_print('<li>');
252
          }
253
          elseif(strlen($last_spaces) == strlen($matches[1]))
254
          {
255
            if($matches[2] == '' && $depth[count($depth) - 1] != '')
256
            {
257
              buf_print("</ol>\r\n");
258
              buf_print("<ul>\r\n");
259
            }
260
            elseif($matches[2] != '' && $depth[count($depth) - 1] == '')
261
            {
262
              buf_print("</ul>\r\n");
263
              buf_print("<ol>\r\n");
264
            }
265
            $depth[count($depth) - 1] = $matches[2];
266
            buf_print('<li>');
267
          }
268
        }
269
        $line = preg_replace("/\s{2,10}/", " ", $line);
270
        buf_print($line . "<br />\r\n");
271
      }
272
      while(count($depth))
273
      {
274
        if(array_pop($depth))
275
        {
276
          buf_print("</ol>\r\n");
277
        }
278
        else
279
        {
280
          buf_print("</ul>\r\n");
281
        }
282
      }
283
    }
284
    buf_print("</div>\r\n");
285
  }
286
}
287
buf_print("</body>\r\n</html>\r\n");
288
289
$html = file_get_contents($path_prefix . 'html/' . $filename . '.html');
290
if($html != $output_buffer)
291
{
292
  file_put_contents($path_prefix . 'html/' . $filename . '.html', $output_buffer);
293
  if(!$path_prefix)
294
  {
295
    print($output_buffer);
296
  }
297
  exit(1);
298
}
299
exit(0);
300