Issues in task.php (master) - Issues in master - timw4mail/tims-todo - Measure and Improve Code Quality continuously with Scrutinizer

Issues (3)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

application/controllers/task.php (1 issue)

Labels

Bug 1

Severity

Major 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php

/**
 * Task Controller
 */
class Task extends MY_Controller {

	/**
	 * Constructor
	 */
	public function __construct()
	{
		parent::__construct();
		$this->load->model('task_model');
		$this->load->library('pagination');
		$this->page->set_title('Tasks');
		$this->page->set_foot_js_group('js');
	}

	// --------------------------------------------------------------------------

	/**
	 * Redirect to task list
	 */
	public function index()
	{
		$this->todo->redirect_303('task/list');
	}

	// --------------------------------------------------------------------------

	/**
	 * List shared tasks
	 */
	public function shared()
	{
		$this->page->set_title("Shared Tasks");
		$tasks = $this->task_model->get_shared_task_list();

		$data = array();
		$data['task_list'] = $tasks;
		$data['list_type'] = "shared";

		$this->page->build('task/list', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * Get the main task view
	 */
	public function list_tasks()
	{
		$this->page->set_title("View Tasks");
		$tasks = $this->task_model->get_task_list();

		$data = array();
		$data['task_list'] = $tasks;
		$data['list_type'] = 'active';

		$this->page->build('task/list', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * List archived tasks
	 */
	public function archive($page = 1)
	{
		$per_page = 10;
		$this->page->set_title("Archived Tasks");
		$page = (int) $page;
		$tasks = $this->task_model->get_archived_task_list($page, $per_page);

		// Pagination preferences
		$config = [
			'base_url' => 'https://todo.timshomepage.net/task/archive/',
			'total_rows' => $tasks['num_rows'],
			'per_page' => $per_page,
			'uri_segment' => 3,
			'num_links' => 3,
			'full_tag_open' => '<p id="pagination">',
			'full_tag_close' => '</p>',
			'cur_tag_open' => '<strong>',
			'cur_tag_close' => '</strong>'
		];

		$this->pagination->initialize($config);

		$data = array();
		$data['task_list'] = $tasks;
		$data['list_type'] = 'archived';
		$data['pagination'] = $this->pagination->create_links();

		$this->page->build('task/list', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * List overdue tasks
	 */
	public function overdue()
	{
		$this->page->set_title("Overdue Tasks");
		$tasks = $this->task_model->get_overdue_task_list();

		$data = array();
		$data['task_list'] = $tasks;
		$data['list_type'] = 'overdue';

		$this->page->build('task/list', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * Add a task
	 */
	public function add()
	{
		$data = array();
		$data['err'] = '';
		$data['cat_list'] = $this->todo->get_category_select();
		$data['pri_list'] = $this->todo->get_priority_select();
		$data['group_perms'] = '';
		$data['groups'] = $this->todo->get_group_list($this->session->userdata('uid'));
		$data['task_title'] = '';
		$data['description'] = '';
		$data['due'] = mktime(12, 00, 00);
		$data['title'] = '';
		$data['rem_hours'] = 0;
		$data['rem_minutes'] = 30;
		$data['reminder'] = FALSE;
		$data['friends'] = $this->todo->get_friend_list();


		if ($this->input->post('add_sub') == 'Add Task')
		{
			$val = $this->task_model->validate_task();

			if($val === TRUE)
			{
				$done = $this->task_model->add_task();

				if ($done === TRUE)
				{
					//Redirect to task list
					$this->todo->redirect_303('task/list');
				}
				else
				{
					$data['err'][] = "Database Error, Please try again later.";
				}
			}
			else
			{
				//Get form values
				$data = array_merge($data, $this->task_model->form_vals);
				$data['err'] = $val;

			}

		}

		$this->page->set_title("Add Task");
		$this->page->build('task/add', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * Edit a task
	 *
	 * @param int $task_id
	 */
	public function edit(int $task_id)
	{
		$data = $this->task_model->get_task_by_id($task_id);

		$data['cat_list'] = $this->task_model->get_category_select($task_id);
		$data['pri_list'] = $this->task_model->get_priority_select($task_id);
		$data['stat_list'] = $this->task_model->get_status_select($task_id);
		$data['comments'] = $this->task_model->get_task_comments($task_id);
		$data['groups'] = $this->todo->get_group_list($this->session->userdata('uid'));
		$data['friends'] = $this->todo->get_friend_list();
		$data['checklist'] = $this->task_model->get_checklist($task_id);

		if ($this->input->post('edit_sub') == 'Update Task')
		{
			if($this->task_model->validate_task() === TRUE)
			{
				if ($this->task_model->update_task() === TRUE)
				{
					//Redirect to task list
					$this->session->set_flashdata([
						'message_type' => 'success',
						'message' => 'Task was updated successfully.'
					]);

					$this->todo->redirect_303(site_url('task/list'));
					return;
				}

				$data['err'][] = "Database Error, Please try again later.";
			}
			else
			{
				$data['err'] = $val;

			}
		}

		$this->page->set_title("Edit Task");
		$this->page->build('task/edit', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * View an individual task
	 *
	 * @param int $task_id
	 */
	public function view(int $task_id = NULL)
	{
		if( ! is_numeric($task_id))
		{
			show_404();
			return;
		}

		$task_id = (int)$task_id;
		$data = $this->task_model->get_task_by_id($task_id);
		$data['comments'] = $this->task_model->get_task_comments($task_id);
		$data['status_id'] = $this->task_model->get_current_status_id($task_id);
		$data['status'] = $this->task_model->get_status_select($task_id, $data['status_id']);
		$data['category'] = $this->task_model->get_category_select($task_id);
		$data['checklist'] = $this->task_model->get_checklist($task_id);
		$data['task'] = $task_id;

		$this->page->set_title("View Task");
		$this->page->set_body_id("task_details");
		$this->page->build('task/view', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * Delete a task
	 */
	public function delete(int $task_id)
	{
		$this->task_model->delete_task((int) $task_id);
	}

	// --------------------------------------------------------------------------

	/**
	 * Add a task comment
	 */
	public function add_task_comment()
	{
		$res = $this->task_model->add_task_comment($this->input->post('task_id'));
		$this->output->set_output($res);
	}

	// --------------------------------------------------------------------------

	/**
	 * Get a list of comments for the task
	 */
	public function get_task_comments()
	{
		$task_id = (int) $this->input->get('task_id');
		$data = [
			'comments' => $this->task_model->get_task_comments($task_id)
		];
		$this->load->view('task/comments_view', $data);
	}

	// --------------------------------------------------------------------------

	/**
	 * Delete a task comment
	 */
	public function del_task_comment()
	{
		$cid = (int) $this->input->post('comment_id');
		$this->output->set_output($this->task_model->delete_comment($cid));
	}

	// --------------------------------------------------------------------------

	/**
	 * Update the status of a task
	 */
	public function update_status()
	{
		$output = $this->task_model->update_status();
		$this->output->set_output($output);
	}

	// --------------------------------------------------------------------------

	/**
	 * Update the category that the task belongs to.
	 */
	public function update_category()
	{
		$output = $this->task_model->quick_update_category();
		$this->output->set_output($output);
	}

	// --------------------------------------------------------------------------

	/**
	 * Add a checklist item to the task
	 */
	public function add_checklist_item()
	{
		$data = $this->task_model->add_checklist_item();

		if($data == FALSE)
		{
			$this->output->set_output(0);
		}
		else if(is_array($data))
		{
			$this->load->view('task/ajax_checklist', $data);
		}
		else
		{
			$this->output->set_output(-1);
		}
	}

	// --------------------------------------------------------------------------

	/**
	 * Update a task checklist item
	 */
	public function update_checklist_item()
	{
		$check_id = $this->input->post('check_id');
		$checked = $this->input->post('checked');

		$this->output->set_output($this->task_model->update_checklist($check_id, $checked));
	}
}
// End of controllers/task.php

1		<?php
2
3		/**
4		* Task Controller
5		*/
6		class Task extends MY_Controller {
7
8		/**
9		* Constructor
10		*/
11		public function __construct()
12		{
13		parent::__construct();
14		$this->load->model('task_model');
15		$this->load->library('pagination');
16		$this->page->set_title('Tasks');
17		$this->page->set_foot_js_group('js');
18		}
19
20		// --------------------------------------------------------------------------
21
22		/**
23		* Redirect to task list
24		*/
25		public function index()
26		{
27		$this->todo->redirect_303('task/list');
28		}
29
30		// --------------------------------------------------------------------------
31
32		/**
33		* List shared tasks
34		*/
35	View Code Duplication	public function shared()
36		{
37		$this->page->set_title("Shared Tasks");
38		$tasks = $this->task_model->get_shared_task_list();
39
40		$data = array();
41		$data['task_list'] = $tasks;
42		$data['list_type'] = "shared";
43
44		$this->page->build('task/list', $data);
45		}
46
47		// --------------------------------------------------------------------------
48
49		/**
50		* Get the main task view
51		*/
52	View Code Duplication	public function list_tasks()
53		{
54		$this->page->set_title("View Tasks");
55		$tasks = $this->task_model->get_task_list();
56
57		$data = array();
58		$data['task_list'] = $tasks;
59		$data['list_type'] = 'active';
60
61		$this->page->build('task/list', $data);
62		}
63
64		// --------------------------------------------------------------------------
65
66		/**
67		* List archived tasks
68		*/
69		public function archive($page = 1)
70		{
71		$per_page = 10;
72		$this->page->set_title("Archived Tasks");
73		$page = (int) $page;
74		$tasks = $this->task_model->get_archived_task_list($page, $per_page);
75
76		// Pagination preferences
77		$config = [
78		'base_url' => 'https://todo.timshomepage.net/task/archive/',
79		'total_rows' => $tasks['num_rows'],
80		'per_page' => $per_page,
81		'uri_segment' => 3,
82		'num_links' => 3,
83		'full_tag_open' => '<p id="pagination">',
84		'full_tag_close' => '</p>',
85		'cur_tag_open' => '<strong>',
86		'cur_tag_close' => '</strong>'
87		];
88
89		$this->pagination->initialize($config);
90
91		$data = array();
92		$data['task_list'] = $tasks;
93		$data['list_type'] = 'archived';
94		$data['pagination'] = $this->pagination->create_links();
95
96		$this->page->build('task/list', $data);
97		}
98
99		// --------------------------------------------------------------------------
100
101		/**
102		* List overdue tasks
103		*/
104	View Code Duplication	public function overdue()
105		{
106		$this->page->set_title("Overdue Tasks");
107		$tasks = $this->task_model->get_overdue_task_list();
108
109		$data = array();
110		$data['task_list'] = $tasks;
111		$data['list_type'] = 'overdue';
112
113		$this->page->build('task/list', $data);
114		}
115
116		// --------------------------------------------------------------------------
117
118		/**
119		* Add a task
120		*/
121		public function add()
122		{
123		$data = array();
124		$data['err'] = '';
125		$data['cat_list'] = $this->todo->get_category_select();
126		$data['pri_list'] = $this->todo->get_priority_select();
127		$data['group_perms'] = '';
128		$data['groups'] = $this->todo->get_group_list($this->session->userdata('uid'));
129		$data['task_title'] = '';
130		$data['description'] = '';
131		$data['due'] = mktime(12, 00, 00);
132		$data['title'] = '';
133		$data['rem_hours'] = 0;
134		$data['rem_minutes'] = 30;
135		$data['reminder'] = FALSE;
136		$data['friends'] = $this->todo->get_friend_list();
137
138
139		if ($this->input->post('add_sub') == 'Add Task')
140		{
141		$val = $this->task_model->validate_task();
142
143		if($val === TRUE)
144		{
145		$done = $this->task_model->add_task();
146
147		if ($done === TRUE)
148		{
149		//Redirect to task list
150		$this->todo->redirect_303('task/list');
151		}
152		else
153		{
154		$data['err'][] = "Database Error, Please try again later.";
155		}
156		}
157		else
158		{
159		//Get form values
160		$data = array_merge($data, $this->task_model->form_vals);
161		$data['err'] = $val;
162
163		}
164
165		}
166
167		$this->page->set_title("Add Task");
168		$this->page->build('task/add', $data);
169		}
170
171		// --------------------------------------------------------------------------
172
173		/**
174		* Edit a task
175		*
176		* @param int $task_id
177		*/
178		public function edit(int $task_id)
179		{
180		$data = $this->task_model->get_task_by_id($task_id);
181
182		$data['cat_list'] = $this->task_model->get_category_select($task_id);
183		$data['pri_list'] = $this->task_model->get_priority_select($task_id);
184		$data['stat_list'] = $this->task_model->get_status_select($task_id);
185		$data['comments'] = $this->task_model->get_task_comments($task_id);
186		$data['groups'] = $this->todo->get_group_list($this->session->userdata('uid'));
187		$data['friends'] = $this->todo->get_friend_list();
188		$data['checklist'] = $this->task_model->get_checklist($task_id);
189
190		if ($this->input->post('edit_sub') == 'Update Task')
191		{
192		if($this->task_model->validate_task() === TRUE)
193		{
194		if ($this->task_model->update_task() === TRUE)
195		{
196		//Redirect to task list
197		$this->session->set_flashdata([
198		'message_type' => 'success',
199		'message' => 'Task was updated successfully.'
200		]);
201
202		$this->todo->redirect_303(site_url('task/list'));
203		return;
204		}
205
206		$data['err'][] = "Database Error, Please try again later.";
207		}
208		else
209		{
210		$data['err'] = $val;
		0 ignored issues – show Bug introduced 2016-12-30 18:40 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$val` does not exist. Did you forget to declare it? This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. Loading history...
211		}
212		}
213
214		$this->page->set_title("Edit Task");
215		$this->page->build('task/edit', $data);
216		}
217
218		// --------------------------------------------------------------------------
219
220		/**
221		* View an individual task
222		*
223		* @param int $task_id
224		*/
225		public function view(int $task_id = NULL)
226		{
227		if( ! is_numeric($task_id))
228		{
229		show_404();
230		return;
231		}
232
233		$task_id = (int)$task_id;
234		$data = $this->task_model->get_task_by_id($task_id);
235		$data['comments'] = $this->task_model->get_task_comments($task_id);
236		$data['status_id'] = $this->task_model->get_current_status_id($task_id);
237		$data['status'] = $this->task_model->get_status_select($task_id, $data['status_id']);
238		$data['category'] = $this->task_model->get_category_select($task_id);
239		$data['checklist'] = $this->task_model->get_checklist($task_id);
240		$data['task'] = $task_id;
241
242		$this->page->set_title("View Task");
243		$this->page->set_body_id("task_details");
244		$this->page->build('task/view', $data);
245		}
246
247		// --------------------------------------------------------------------------
248
249		/**
250		* Delete a task
251		*/
252		public function delete(int $task_id)
253		{
254		$this->task_model->delete_task((int) $task_id);
255		}
256
257		// --------------------------------------------------------------------------
258
259		/**
260		* Add a task comment
261		*/
262		public function add_task_comment()
263		{
264		$res = $this->task_model->add_task_comment($this->input->post('task_id'));
265		$this->output->set_output($res);
266		}
267
268		// --------------------------------------------------------------------------
269
270		/**
271		* Get a list of comments for the task
272		*/
273		public function get_task_comments()
274		{
275		$task_id = (int) $this->input->get('task_id');
276		$data = [
277		'comments' => $this->task_model->get_task_comments($task_id)
278		];
279		$this->load->view('task/comments_view', $data);
280		}
281
282		// --------------------------------------------------------------------------
283
284		/**
285		* Delete a task comment
286		*/
287		public function del_task_comment()
288		{
289		$cid = (int) $this->input->post('comment_id');
290		$this->output->set_output($this->task_model->delete_comment($cid));
291		}
292
293		// --------------------------------------------------------------------------
294
295		/**
296		* Update the status of a task
297		*/
298		public function update_status()
299		{
300		$output = $this->task_model->update_status();
301		$this->output->set_output($output);
302		}
303
304		// --------------------------------------------------------------------------
305
306		/**
307		* Update the category that the task belongs to.
308		*/
309		public function update_category()
310		{
311		$output = $this->task_model->quick_update_category();
312		$this->output->set_output($output);
313		}
314
315		// --------------------------------------------------------------------------
316
317		/**
318		* Add a checklist item to the task
319		*/
320		public function add_checklist_item()
321		{
322		$data = $this->task_model->add_checklist_item();
323
324		if($data == FALSE)
325		{
326		$this->output->set_output(0);
327		}
328		else if(is_array($data))
329		{
330		$this->load->view('task/ajax_checklist', $data);
331		}
332		else
333		{
334		$this->output->set_output(-1);
335		}
336		}
337
338		// --------------------------------------------------------------------------
339
340		/**
341		* Update a task checklist item
342		*/
343		public function update_checklist_item()
344		{
345		$check_id = $this->input->post('check_id');
346		$checked = $this->input->post('checked');
347
348		$this->output->set_output($this->task_model->update_checklist($check_id, $checked));
349		}
350		}
351		// End of controllers/task.php

timw4mail / tims-todo

Issues (3)

Security Analysis not enabled

application/controllers/task.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like