Issues (964)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Files/CreateStructure.php (5 issues)

1
<?php
2
3
namespace XoopsModules\Tdmcreate\Files;
4
5
use XoopsModules\Tdmcreate;
6
7
/*
8
 You may not change or alter any portion of this comment or credits
9
 of supporting developers from this source code or any supporting source code
10
 which is considered copyrighted (c) material of the original comment or credit authors.
11
12
 This program is distributed in the hope that it will be useful,
13
 but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
15
 */
16
/**
17
 * tdmcreate module.
18
 *
19
 * @copyright       XOOPS Project (https://xoops.org)
20
 * @license         GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
21
 *
22
 * @since           2.5.0
23
 *
24
 * @author          Txmod Xoops http://www.txmodxoops.org
25
 *
26
 */
27
28
/**
29
 * Class TDMCreateStructure.
30
 */
31
class CreateStructure
32
{
33
    /**
34
     * @var string
35
     */
36
    private $moduleName;
37
    /**
38
     * @var string
39
     */
40
    private $folderName;
41
    /**
42
     * @var string
43
     */
44
    private $fileName;
45
    /**
46
     * @var string
47
     */
48
    private $path;
0 ignored issues
show
The private property $path is not used, and could be removed.
Loading history...
49
    /**
50
     * @var mixed
51
     */
52
    private $uploadPath;
53
54
    /**
55
     * @public function constructor class
56
     *
57
     * @param null
58
     */
59
    public function __construct()
60
    {
61
    }
62
63
    /**
64
     * @static function getInstance
65
     *
66
     * @param null
67
     *
68
     * @return Tdmcreate\Files\CreateStructure
69
     */
70
    public static function getInstance()
71
    {
72
        static $instance = false;
73
        if (!$instance) {
74
            $instance = new self();
75
        }
76
77
        return $instance;
78
    }
79
80
    /**
81
     * @protected function setUploadPath
82
     *
83
     * @param $path
84
     */
85
    protected function setUploadPath($path)
86
    {
87
        $this->uploadPath = $path;
88
    }
89
90
    /**
91
     * @protected function getUploadPath
92
     *
93
     * @return string $path
94
     */
95
    protected function getUploadPath()
96
    {
97
        return $this->uploadPath;
98
    }
99
100
    /**
101
     * @protected function setModuleName
102
     * @param $moduleName
103
     */
104
    protected function setModuleName($moduleName)
105
    {
106
        $this->moduleName = $moduleName;
107
    }
108
109
    /**
110
     * @protected function getModuleName
111
     *
112
     * @return string $moduleName
113
     */
114
    protected function getModuleName()
115
    {
116
        return $this->moduleName;
117
    }
118
119
    /**
120
     * @private function setFolderName
121
     *
122
     * @param $folderName
123
     */
124
    private function setFolderName($folderName)
125
    {
126
        $this->folderName = $folderName;
127
    }
128
129
    /**
130
     * @private function getFolderName
131
     * @return string $folderName
132
     */
133
    private function getFolderName()
134
    {
135
        return $this->folderName;
136
    }
137
138
    /**
139
     * @private function setFileName
140
     *
141
     * @param $fileName
142
     */
143
    private function setFileName($fileName)
144
    {
145
        $this->fileName = $fileName;
146
    }
147
148
    /**
149
     * @private function getFileName
150
     *
151
     * @return string $fileName
152
     */
153
    private function getFileName()
154
    {
155
        return $this->fileName;
156
    }
157
158
    /**
159
     * @private function isDir
160
     *
161
     * @param $dname
162
     */
163
    private function isDir($dname)
164
    {
165
        if (!is_dir($dname)) {
166
            if (!mkdir($dname, 0755) && !is_dir($dname)) {
167
                throw new \RuntimeException(sprintf('Directory "%s" was not created', $dname));
168
            }
169
            chmod($dname, 0755);
170
        } else {
171
            chmod($dname, 0755);
172
        }
173
    }
174
175
    /**
176
     * @protected function makeDir
177
     *
178
     * @param string $dir
179
     */
180
    protected function makeDir($dir)
181
    {
182
        $this->isDir(mb_strtolower(trim($dir)));
183
    }
184
185
    /**
186
     * @protected function isDirEmpty
187
     *
188
     * @param string $dir
189
     *
190
     * @return string
191
     */
192
    public function isDirEmpty($dir)
193
    {
194
        $content = [];
195
        $handle  = opendir($dir);
196
        while (false !== ($entry = readdir($handle))) {
0 ignored issues
show
It seems like $handle can also be of type false; however, parameter $dir_handle of readdir() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

196
        while (false !== ($entry = readdir(/** @scrutinizer ignore-type */ $handle))) {
Loading history...
197
            if ('.' !== $entry && '..' !== $entry) {
198
                $content[] = $entry;
199
            }
200
        }
201
        closedir($handle);
0 ignored issues
show
It seems like $handle can also be of type false; however, parameter $dir_handle of closedir() does only seem to accept resource, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

201
        closedir(/** @scrutinizer ignore-type */ $handle);
Loading history...
202
        if (count($content) > 0) {
203
            return true;
0 ignored issues
show
Bug Best Practice introduced by
The expression return true returns the type true which is incompatible with the documented return type string.
Loading history...
204
        }
205
206
        return false;
0 ignored issues
show
Bug Best Practice introduced by
The expression return false returns the type false which is incompatible with the documented return type string.
Loading history...
207
    }
208
209
    /**
210
     * @public function addFolderPath
211
     *
212
     * @param string      $folderName
213
     * @param bool|string $fileName
214
     * @return string
215
     */
216
    private function addFolderPath($folderName, $fileName = false)
217
    {
218
        $this->setFolderName($folderName);
219
        if ($fileName) {
220
            $this->setFileName($fileName);
221
            $ret = $this->getUploadPath() . DS . $this->getModuleName() . DS . $this->getFolderName() . DS . $this->getFileName();
222
        } else {
223
            $ret = $this->getUploadPath() . DS . $this->getModuleName() . DS . $this->getFolderName();
224
        }
225
226
        return $ret;
227
    }
228
229
    /**
230
     * @public function makeDirInModule
231
     *
232
     * @param string $dirName
233
     */
234
    public function makeDirInModule($dirName)
235
    {
236
        $fname = $this->addFolderPath($dirName);
237
        $this->makeDir($fname);
238
    }
239
240
    /**
241
     * @public function makeDir & copy file
242
     *
243
     * @param string $folderName
244
     * @param string $fromFile
245
     * @param string $toFile
246
     */
247
    public function makeDirAndCopyFile($folderName, $fromFile, $toFile)
248
    {
249
        $dname = $this->addFolderPath($folderName);
250
        $this->makeDir($dname);
251
        $this->copyFile($folderName, $fromFile, $toFile);
252
    }
253
254
    /**
255
     * @public function copy file
256
     *
257
     * @param string $folderName
258
     * @param string $fromFile
259
     * @param string $toFile
260
     */
261
    public function copyFile($folderName, $fromFile, $toFile)
262
    {
263
        $dname = $this->addFolderPath($folderName);
264
        $fname = $this->addFolderPath($folderName, $toFile);
265
        $this->setCopy($dname, $fromFile, $fname);
266
    }
267
268
    /**
269
     * @public function setCopy
270
     *
271
     * @param string $dname
272
     * @param string $fromFile
273
     * @param string $fname
274
     */
275
    public function setCopy($dname, $fromFile, $fname)
276
    {
277
        if (is_dir($dname)) {
278
            chmod($dname, 0777);
279
            copy($fromFile, $fname);
280
        } else {
281
            $this->makeDir($dname);
282
            copy($fromFile, $fname);
283
        }
284
    }
285
}
286