Issues (4122)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

includes/Defines.php (1 issue)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
0 ignored issues
show
Coding Style Compatibility introduced by
For compatibility and reusability of your code, PSR1 recommends that a file should introduce either new symbols (like classes, functions, etc.) or have side-effects (like outputting something, or including other files), but not both at the same time. The first symbol is defined on line 28 and the first side effect is on line 100.

The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.

The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.

To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.

Loading history...
2
/**
3
 * A few constants that might be needed during LocalSettings.php.
4
 *
5
 * This program is free software; you can redistribute it and/or modify
6
 * it under the terms of the GNU General Public License as published by
7
 * the Free Software Foundation; either version 2 of the License, or
8
 * (at your option) any later version.
9
 *
10
 * This program is distributed in the hope that it will be useful,
11
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
 * GNU General Public License for more details.
14
 *
15
 * You should have received a copy of the GNU General Public License along
16
 * with this program; if not, write to the Free Software Foundation, Inc.,
17
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18
 * http://www.gnu.org/copyleft/gpl.html
19
 *
20
 * @file
21
 */
22
23
/**
24
 * @defgroup Constants MediaWiki constants
25
 */
26
27
# Obsolete aliases
28
define( 'DB_SLAVE', -1 );
29
30
/**@{
31
 * Obsolete IDatabase::makeList() constants
32
 * These are also available as Database class constants
33
 */
34
define( 'LIST_COMMA', IDatabase::LIST_COMMA );
35
define( 'LIST_AND', IDatabase::LIST_AND );
36
define( 'LIST_SET', IDatabase::LIST_SET );
37
define( 'LIST_NAMES', IDatabase::LIST_NAMES );
38
define( 'LIST_OR', IDatabase::LIST_OR );
39
/**@}*/
40
41
/**@{
42
 * Virtual namespaces; don't appear in the page database
43
 */
44
define( 'NS_MEDIA', -2 );
45
define( 'NS_SPECIAL', -1 );
46
/**@}*/
47
48
/**@{
49
 * Real namespaces
50
 *
51
 * Number 100 and beyond are reserved for custom namespaces;
52
 * DO NOT assign standard namespaces at 100 or beyond.
53
 * DO NOT Change integer values as they are most probably hardcoded everywhere
54
 * see bug #696 which talked about that.
55
 */
56
define( 'NS_MAIN', 0 );
57
define( 'NS_TALK', 1 );
58
define( 'NS_USER', 2 );
59
define( 'NS_USER_TALK', 3 );
60
define( 'NS_PROJECT', 4 );
61
define( 'NS_PROJECT_TALK', 5 );
62
define( 'NS_FILE', 6 );
63
define( 'NS_FILE_TALK', 7 );
64
define( 'NS_MEDIAWIKI', 8 );
65
define( 'NS_MEDIAWIKI_TALK', 9 );
66
define( 'NS_TEMPLATE', 10 );
67
define( 'NS_TEMPLATE_TALK', 11 );
68
define( 'NS_HELP', 12 );
69
define( 'NS_HELP_TALK', 13 );
70
define( 'NS_CATEGORY', 14 );
71
define( 'NS_CATEGORY_TALK', 15 );
72
73
/**
74
 * NS_IMAGE and NS_IMAGE_TALK are the pre-v1.14 names for NS_FILE and
75
 * NS_FILE_TALK respectively, and are kept for compatibility.
76
 *
77
 * When writing code that should be compatible with older MediaWiki
78
 * versions, either stick to the old names or define the new constants
79
 * yourself, if they're not defined already.
80
 *
81
 * @deprecated since 1.14
82
 */
83
define( 'NS_IMAGE', NS_FILE );
84
/**
85
 * @deprecated since 1.14
86
 */
87
define( 'NS_IMAGE_TALK', NS_FILE_TALK );
88
/**@}*/
89
90
/**@{
91
 * Cache type
92
 */
93
define( 'CACHE_ANYTHING', -1 );  // Use anything, as long as it works
94
define( 'CACHE_NONE', 0 );       // Do not cache
95
define( 'CACHE_DB', 1 );         // Store cache objects in the DB
96
define( 'CACHE_MEMCACHED', 2 );  // MemCached, must specify servers in $wgMemCacheServers
97
define( 'CACHE_ACCEL', 3 );      // APC, XCache or WinCache
98
/**@}*/
99
100
require_once __DIR__ . '/libs/mime/defines.php';
101
102
/**@{
103
 * Antivirus result codes, for use in $wgAntivirusSetup.
104
 */
105
define( 'AV_NO_VIRUS', 0 );  # scan ok, no virus found
106
define( 'AV_VIRUS_FOUND', 1 );  # virus found!
107
define( 'AV_SCAN_ABORTED', -1 );  # scan aborted, the file is probably immune
108
define( 'AV_SCAN_FAILED', false );  # scan failed (scanner not found or error in scanner)
109
/**@}*/
110
111
/**@{
112
 * Anti-lock flags
113
 * Was used by $wgAntiLockFlags, which was removed with 1.25
114
 * Constants kept to not have warnings when used in LocalSettings
115
 */
116
define( 'ALF_PRELOAD_LINKS', 1 ); // unused
117
define( 'ALF_PRELOAD_EXISTENCE', 2 ); // unused
118
define( 'ALF_NO_LINK_LOCK', 4 ); // unused
119
define( 'ALF_NO_BLOCK_LOCK', 8 ); // unused
120
/**@}*/
121
122
/**@{
123
 * Date format selectors; used in user preference storage and by
124
 * Language::date() and co.
125
 */
126
define( 'MW_DATE_DEFAULT', 'default' );
127
define( 'MW_DATE_MDY', 'mdy' );
128
define( 'MW_DATE_DMY', 'dmy' );
129
define( 'MW_DATE_YMD', 'ymd' );
130
define( 'MW_DATE_ISO', 'ISO 8601' );
131
/**@}*/
132
133
/**@{
134
 * RecentChange type identifiers
135
 */
136
define( 'RC_EDIT', 0 );
137
define( 'RC_NEW', 1 );
138
define( 'RC_LOG', 3 );
139
define( 'RC_EXTERNAL', 5 );
140
define( 'RC_CATEGORIZE', 6 );
141
/**@}*/
142
143
/**@{
144
 * Article edit flags
145
 */
146
define( 'EDIT_NEW', 1 );
147
define( 'EDIT_UPDATE', 2 );
148
define( 'EDIT_MINOR', 4 );
149
define( 'EDIT_SUPPRESS_RC', 8 );
150
define( 'EDIT_FORCE_BOT', 16 );
151
define( 'EDIT_DEFER_UPDATES', 32 ); // Unused since 1.27
152
define( 'EDIT_AUTOSUMMARY', 64 );
153
define( 'EDIT_INTERNAL', 128 );
154
/**@}*/
155
156
/**
157
 * Database related
158
 */
159
require_once __DIR__ . '/libs/rdbms/defines.php';
160
161
/**
162
 * Unicode and normalisation related
163
 */
164
require_once __DIR__ . '/compat/normal/UtfNormalDefines.php';
165
166
/**@{
167
 * Hook support constants
168
 */
169
define( 'MW_SUPPORTS_PARSERFIRSTCALLINIT', 1 );
170
define( 'MW_SUPPORTS_LOCALISATIONCACHE', 1 );
171
define( 'MW_SUPPORTS_CONTENTHANDLER', 1 );
172
define( 'MW_EDITFILTERMERGED_SUPPORTS_API', 1 );
173
/**@}*/
174
175
/** Support for $wgResourceModules */
176
define( 'MW_SUPPORTS_RESOURCE_MODULES', 1 );
177
178
/**@{
179
 * Allowed values for Parser::$mOutputType
180
 * Parameter to Parser::startExternalParse().
181
 * Use of Parser consts is preferred:
182
 * - Parser::OT_HTML
183
 * - Parser::OT_WIKI
184
 * - Parser::OT_PREPROCESS
185
 * - Parser::OT_MSG
186
 * - Parser::OT_PLAIN
187
 */
188
define( 'OT_HTML', 1 );
189
define( 'OT_WIKI', 2 );
190
define( 'OT_PREPROCESS', 3 );
191
define( 'OT_MSG', 3 );  // b/c alias for OT_PREPROCESS
192
define( 'OT_PLAIN', 4 );
193
/**@}*/
194
195
/**@{
196
 * Flags for Parser::setFunctionHook
197
 * Use of Parser consts is preferred:
198
 * - Parser::SFH_NO_HASH
199
 * - Parser::SFH_OBJECT_ARGS
200
 */
201
define( 'SFH_NO_HASH', 1 );
202
define( 'SFH_OBJECT_ARGS', 2 );
203
/**@}*/
204
205
/**@{
206
 * Autopromote conditions (must be here and not in Autopromote.php, so that
207
 * they're loaded for DefaultSettings.php before AutoLoader.php)
208
 */
209
define( 'APCOND_EDITCOUNT', 1 );
210
define( 'APCOND_AGE', 2 );
211
define( 'APCOND_EMAILCONFIRMED', 3 );
212
define( 'APCOND_INGROUPS', 4 );
213
define( 'APCOND_ISIP', 5 );
214
define( 'APCOND_IPINRANGE', 6 );
215
define( 'APCOND_AGE_FROM_EDIT', 7 );
216
define( 'APCOND_BLOCKED', 8 );
217
define( 'APCOND_ISBOT', 9 );
218
/**@}*/
219
220
/** @{
221
 * Protocol constants for wfExpandUrl()
222
 */
223
define( 'PROTO_HTTP', 'http://' );
224
define( 'PROTO_HTTPS', 'https://' );
225
define( 'PROTO_RELATIVE', '//' );
226
define( 'PROTO_CURRENT', null );
227
define( 'PROTO_CANONICAL', 1 );
228
define( 'PROTO_INTERNAL', 2 );
229
/**@}*/
230
231
/**@{
232
 * Content model ids, used by Content and ContentHandler.
233
 * These IDs will be exposed in the API and XML dumps.
234
 *
235
 * Extensions that define their own content model IDs should take
236
 * care to avoid conflicts. Using the extension name as a prefix is recommended,
237
 * for example 'myextension-somecontent'.
238
 */
239
define( 'CONTENT_MODEL_WIKITEXT', 'wikitext' );
240
define( 'CONTENT_MODEL_JAVASCRIPT', 'javascript' );
241
define( 'CONTENT_MODEL_CSS', 'css' );
242
define( 'CONTENT_MODEL_TEXT', 'text' );
243
define( 'CONTENT_MODEL_JSON', 'json' );
244
/**@}*/
245
246
/**@{
247
 * Content formats, used by Content and ContentHandler.
248
 * These should be MIME types, and will be exposed in the API and XML dumps.
249
 *
250
 * Extensions are free to use the below formats, or define their own.
251
 * It is recommended to stick with the conventions for MIME types.
252
 */
253
// wikitext
254
define( 'CONTENT_FORMAT_WIKITEXT', 'text/x-wiki' );
255
// for js pages
256
define( 'CONTENT_FORMAT_JAVASCRIPT', 'text/javascript' );
257
// for css pages
258
define( 'CONTENT_FORMAT_CSS', 'text/css' );
259
// for future use, e.g. with some plain-html messages.
260
define( 'CONTENT_FORMAT_TEXT', 'text/plain' );
261
// for future use, e.g. with some plain-html messages.
262
define( 'CONTENT_FORMAT_HTML', 'text/html' );
263
// for future use with the api and for extensions
264
define( 'CONTENT_FORMAT_SERIALIZED', 'application/vnd.php.serialized' );
265
// for future use with the api, and for use by extensions
266
define( 'CONTENT_FORMAT_JSON', 'application/json' );
267
// for future use with the api, and for use by extensions
268
define( 'CONTENT_FORMAT_XML', 'application/xml' );
269
/**@}*/
270
271
/**@{
272
 * Max string length for shell invocations; based on binfmts.h
273
 */
274
define( 'SHELL_MAX_ARG_STRLEN', '100000' );
275
/**@}*/
276