This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * This program is free software; you can redistribute it and/or modify |
||
4 | * it under the terms of the GNU General Public License as published by |
||
5 | * the Free Software Foundation; either version 2 of the License, or |
||
6 | * (at your option) any later version. |
||
7 | * |
||
8 | * This program is distributed in the hope that it will be useful, |
||
9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
11 | * GNU General Public License for more details. |
||
12 | * |
||
13 | * You should have received a copy of the GNU General Public License along |
||
14 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
15 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
16 | * http://www.gnu.org/copyleft/gpl.html |
||
17 | * |
||
18 | * @file |
||
19 | * @ingroup RevisionDelete |
||
20 | */ |
||
21 | |||
22 | /** |
||
23 | * Item class for an oldimage table row |
||
24 | */ |
||
25 | class RevDelFileItem extends RevDelItem { |
||
26 | /** @var RevDelFileList */ |
||
27 | protected $list; |
||
28 | /** @var OldLocalFile */ |
||
29 | protected $file; |
||
30 | |||
31 | public function __construct( $list, $row ) { |
||
32 | parent::__construct( $list, $row ); |
||
33 | $this->file = RepoGroup::singleton()->getLocalRepo()->newFileFromRow( $row ); |
||
34 | } |
||
35 | |||
36 | public function getIdField() { |
||
37 | return 'oi_archive_name'; |
||
38 | } |
||
39 | |||
40 | public function getTimestampField() { |
||
41 | return 'oi_timestamp'; |
||
42 | } |
||
43 | |||
44 | public function getAuthorIdField() { |
||
45 | return 'oi_user'; |
||
46 | } |
||
47 | |||
48 | public function getAuthorNameField() { |
||
49 | return 'oi_user_text'; |
||
50 | } |
||
51 | |||
52 | public function getId() { |
||
53 | $parts = explode( '!', $this->row->oi_archive_name ); |
||
54 | |||
55 | return $parts[0]; |
||
56 | } |
||
57 | |||
58 | public function canView() { |
||
59 | return $this->file->userCan( File::DELETED_RESTRICTED, $this->list->getUser() ); |
||
60 | } |
||
61 | |||
62 | public function canViewContent() { |
||
63 | return $this->file->userCan( File::DELETED_FILE, $this->list->getUser() ); |
||
64 | } |
||
65 | |||
66 | public function getBits() { |
||
67 | return $this->file->getVisibility(); |
||
68 | } |
||
69 | |||
70 | public function setBits( $bits ) { |
||
71 | # Queue the file op |
||
72 | # @todo FIXME: Move to LocalFile.php |
||
73 | if ( $this->isDeleted() ) { |
||
74 | if ( $bits & File::DELETED_FILE ) { |
||
0 ignored issues
–
show
|
|||
75 | # Still deleted |
||
76 | } else { |
||
77 | # Newly undeleted |
||
78 | $key = $this->file->getStorageKey(); |
||
79 | $srcRel = $this->file->repo->getDeletedHashPath( $key ) . $key; |
||
0 ignored issues
–
show
It seems like
$key defined by $this->file->getStorageKey() on line 78 can also be of type false ; however, FileRepo::getDeletedHashPath() does only seem to accept string , did you maybe forget to handle an error condition?
This check looks for type mismatches where the missing type is Consider the follow example <?php
function getDate($date)
{
if ($date !== null) {
return new DateTime($date);
}
return false;
}
This function either returns a new ![]() |
|||
80 | $this->list->storeBatch[] = [ |
||
81 | $this->file->repo->getVirtualUrl( 'deleted' ) . '/' . $srcRel, |
||
82 | 'public', |
||
83 | $this->file->getRel() |
||
84 | ]; |
||
85 | $this->list->cleanupBatch[] = $key; |
||
86 | } |
||
87 | } elseif ( $bits & File::DELETED_FILE ) { |
||
88 | # Newly deleted |
||
89 | $key = $this->file->getStorageKey(); |
||
90 | $dstRel = $this->file->repo->getDeletedHashPath( $key ) . $key; |
||
0 ignored issues
–
show
It seems like
$key defined by $this->file->getStorageKey() on line 89 can also be of type false ; however, FileRepo::getDeletedHashPath() does only seem to accept string , did you maybe forget to handle an error condition?
This check looks for type mismatches where the missing type is Consider the follow example <?php
function getDate($date)
{
if ($date !== null) {
return new DateTime($date);
}
return false;
}
This function either returns a new ![]() |
|||
91 | $this->list->deleteBatch[] = [ $this->file->getRel(), $dstRel ]; |
||
92 | } |
||
93 | |||
94 | # Do the database operations |
||
95 | $dbw = wfGetDB( DB_MASTER ); |
||
96 | $dbw->update( 'oldimage', |
||
97 | [ 'oi_deleted' => $bits ], |
||
98 | [ |
||
99 | 'oi_name' => $this->row->oi_name, |
||
100 | 'oi_timestamp' => $this->row->oi_timestamp, |
||
101 | 'oi_deleted' => $this->getBits() |
||
102 | ], |
||
103 | __METHOD__ |
||
104 | ); |
||
105 | |||
106 | return (bool)$dbw->affectedRows(); |
||
107 | } |
||
108 | |||
109 | public function isDeleted() { |
||
110 | return $this->file->isDeleted( File::DELETED_FILE ); |
||
111 | } |
||
112 | |||
113 | /** |
||
114 | * Get the link to the file. |
||
115 | * Overridden by RevDelArchivedFileItem. |
||
116 | * @return string |
||
117 | */ |
||
118 | protected function getLink() { |
||
119 | $date = htmlspecialchars( $this->list->getLanguage()->userTimeAndDate( |
||
120 | $this->file->getTimestamp(), $this->list->getUser() ) ); |
||
121 | |||
122 | if ( !$this->isDeleted() ) { |
||
123 | # Regular files... |
||
124 | return Html::rawElement( 'a', [ 'href' => $this->file->getUrl() ], $date ); |
||
125 | } |
||
126 | |||
127 | # Hidden files... |
||
128 | if ( !$this->canViewContent() ) { |
||
129 | $link = $date; |
||
130 | } else { |
||
131 | $link = Linker::link( |
||
132 | SpecialPage::getTitleFor( 'Revisiondelete' ), |
||
133 | $date, |
||
134 | [], |
||
135 | [ |
||
136 | 'target' => $this->list->title->getPrefixedText(), |
||
137 | 'file' => $this->file->getArchiveName(), |
||
138 | 'token' => $this->list->getUser()->getEditToken( |
||
139 | $this->file->getArchiveName() ) |
||
140 | ] |
||
141 | ); |
||
142 | } |
||
143 | |||
144 | return '<span class="history-deleted">' . $link . '</span>'; |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * Generate a user tool link cluster if the current user is allowed to view it |
||
149 | * @return string HTML |
||
150 | */ |
||
151 | protected function getUserTools() { |
||
152 | if ( $this->file->userCan( Revision::DELETED_USER, $this->list->getUser() ) ) { |
||
153 | $uid = $this->file->getUser( 'id' ); |
||
154 | $name = $this->file->getUser( 'text' ); |
||
155 | $link = Linker::userLink( $uid, $name ) . Linker::userToolLinks( $uid, $name ); |
||
156 | } else { |
||
157 | $link = $this->list->msg( 'rev-deleted-user' )->escaped(); |
||
158 | } |
||
159 | if ( $this->file->isDeleted( Revision::DELETED_USER ) ) { |
||
160 | return '<span class="history-deleted">' . $link . '</span>'; |
||
161 | } |
||
162 | |||
163 | return $link; |
||
164 | } |
||
165 | |||
166 | /** |
||
167 | * Wrap and format the file's comment block, if the current |
||
168 | * user is allowed to view it. |
||
169 | * |
||
170 | * @return string HTML |
||
171 | */ |
||
172 | protected function getComment() { |
||
173 | if ( $this->file->userCan( File::DELETED_COMMENT, $this->list->getUser() ) ) { |
||
174 | $block = Linker::commentBlock( $this->file->getDescription() ); |
||
175 | } else { |
||
176 | $block = ' ' . $this->list->msg( 'rev-deleted-comment' )->escaped(); |
||
177 | } |
||
178 | if ( $this->file->isDeleted( File::DELETED_COMMENT ) ) { |
||
179 | return "<span class=\"history-deleted\">$block</span>"; |
||
180 | } |
||
181 | |||
182 | return $block; |
||
183 | } |
||
184 | |||
185 | public function getHTML() { |
||
186 | $data = |
||
187 | $this->list->msg( 'widthheight' )->numParams( |
||
188 | $this->file->getWidth(), $this->file->getHeight() )->text() . |
||
189 | ' (' . $this->list->msg( 'nbytes' )->numParams( $this->file->getSize() )->text() . ')'; |
||
190 | |||
191 | return '<li>' . $this->getLink() . ' ' . $this->getUserTools() . ' ' . |
||
192 | $data . ' ' . $this->getComment() . '</li>'; |
||
193 | } |
||
194 | |||
195 | public function getApiData( ApiResult $result ) { |
||
196 | $file = $this->file; |
||
197 | $user = $this->list->getUser(); |
||
198 | $ret = [ |
||
199 | 'title' => $this->list->title->getPrefixedText(), |
||
200 | 'archivename' => $file->getArchiveName(), |
||
201 | 'timestamp' => wfTimestamp( TS_ISO_8601, $file->getTimestamp() ), |
||
202 | 'width' => $file->getWidth(), |
||
203 | 'height' => $file->getHeight(), |
||
204 | 'size' => $file->getSize(), |
||
205 | ]; |
||
206 | $ret += $file->isDeleted( Revision::DELETED_USER ) ? [ 'userhidden' => '' ] : []; |
||
207 | $ret += $file->isDeleted( Revision::DELETED_COMMENT ) ? [ 'commenthidden' => '' ] : []; |
||
208 | $ret += $this->isDeleted() ? [ 'contenthidden' => '' ] : []; |
||
209 | if ( !$this->isDeleted() ) { |
||
210 | $ret += [ |
||
211 | 'url' => $file->getUrl(), |
||
212 | ]; |
||
213 | } elseif ( $this->canViewContent() ) { |
||
214 | $ret += [ |
||
215 | 'url' => SpecialPage::getTitleFor( 'Revisiondelete' )->getLinkURL( |
||
216 | [ |
||
217 | 'target' => $this->list->title->getPrefixedText(), |
||
218 | 'file' => $file->getArchiveName(), |
||
219 | 'token' => $user->getEditToken( $file->getArchiveName() ) |
||
220 | ] |
||
221 | ), |
||
222 | ]; |
||
223 | } |
||
224 | if ( $file->userCan( Revision::DELETED_USER, $user ) ) { |
||
225 | $ret += [ |
||
226 | 'userid' => $file->user, |
||
0 ignored issues
–
show
The property
$user is declared private in LocalFile . Since you implemented __get() , maybe consider adding a @property or @property-read annotation. This makes it easier for IDEs to provide auto-completion.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
227 | 'user' => $file->user_text, |
||
0 ignored issues
–
show
The property
$user_text is declared private in LocalFile . Since you implemented __get() , maybe consider adding a @property or @property-read annotation. This makes it easier for IDEs to provide auto-completion.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
228 | ]; |
||
229 | } |
||
230 | if ( $file->userCan( Revision::DELETED_COMMENT, $user ) ) { |
||
231 | $ret += [ |
||
232 | 'comment' => $file->description, |
||
0 ignored issues
–
show
The property
$description is declared private in LocalFile . Since you implemented __get() , maybe consider adding a @property or @property-read annotation. This makes it easier for IDEs to provide auto-completion.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
233 | ]; |
||
234 | } |
||
235 | |||
236 | return $ret; |
||
237 | } |
||
238 | |||
239 | public function lock() { |
||
240 | return $this->file->acquireFileLock(); |
||
241 | } |
||
242 | |||
243 | public function unlock() { |
||
244 | return $this->file->releaseFileLock(); |
||
245 | } |
||
246 | } |
||
247 |
This check looks for the bodies of
if
statements that have no statements or where all statements have been commented out. This may be the result of changes for debugging or the code may simply be obsolete.These
if
bodies can be removed. If you have an empty if but statements in theelse
branch, consider inverting the condition.could be turned into
This is much more concise to read.