This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
0 ignored issues
–
show
|
|||
2 | /** |
||
3 | * Cleanup all spam from a given hostname. |
||
4 | * |
||
5 | * This program is free software; you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU General Public License as published by |
||
7 | * the Free Software Foundation; either version 2 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU General Public License along |
||
16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
18 | * http://www.gnu.org/copyleft/gpl.html |
||
19 | * |
||
20 | * @file |
||
21 | * @ingroup Maintenance |
||
22 | */ |
||
23 | |||
24 | require_once __DIR__ . '/Maintenance.php'; |
||
25 | |||
26 | /** |
||
27 | * Maintenance script to cleanup all spam from a given hostname. |
||
28 | * |
||
29 | * @ingroup Maintenance |
||
30 | */ |
||
31 | class CleanupSpam extends Maintenance { |
||
32 | |||
33 | public function __construct() { |
||
34 | parent::__construct(); |
||
35 | $this->addDescription( 'Cleanup all spam from a given hostname' ); |
||
36 | $this->addOption( 'all', 'Check all wikis in $wgLocalDatabases' ); |
||
37 | $this->addOption( 'delete', 'Delete pages containing only spam instead of blanking them' ); |
||
38 | $this->addArg( |
||
39 | 'hostname', |
||
40 | 'Hostname that was spamming, single * wildcard in the beginning allowed' |
||
41 | ); |
||
42 | } |
||
43 | |||
44 | public function execute() { |
||
45 | global $IP, $wgLocalDatabases, $wgUser; |
||
46 | |||
47 | $username = wfMessage( 'spambot_username' )->text(); |
||
48 | $wgUser = User::newSystemUser( $username ); |
||
49 | if ( !$wgUser ) { |
||
50 | $this->error( "Invalid username specified in 'spambot_username' message: $username", true ); |
||
51 | } |
||
52 | // Create the user if necessary |
||
53 | if ( !$wgUser->getId() ) { |
||
54 | $wgUser->addToDatabase(); |
||
55 | } |
||
56 | $spec = $this->getArg(); |
||
57 | $like = LinkFilter::makeLikeArray( $spec ); |
||
58 | if ( !$like ) { |
||
59 | $this->error( "Not a valid hostname specification: $spec", true ); |
||
60 | } |
||
61 | |||
62 | if ( $this->hasOption( 'all' ) ) { |
||
63 | // Clean up spam on all wikis |
||
64 | $this->output( "Finding spam on " . count( $wgLocalDatabases ) . " wikis\n" ); |
||
65 | $found = false; |
||
66 | foreach ( $wgLocalDatabases as $wikiID ) { |
||
67 | $dbr = $this->getDB( DB_REPLICA, [], $wikiID ); |
||
68 | |||
69 | $count = $dbr->selectField( 'externallinks', 'COUNT(*)', |
||
70 | [ 'el_index' . $dbr->buildLike( $like ) ], __METHOD__ ); |
||
71 | if ( $count ) { |
||
72 | $found = true; |
||
73 | $cmd = wfShellWikiCmd( "$IP/maintenance/cleanupSpam.php", |
||
74 | [ '--wiki', $wikiID, $spec ] ); |
||
75 | passthru( "$cmd | sed 's/^/$wikiID: /'" ); |
||
76 | } |
||
77 | } |
||
78 | if ( $found ) { |
||
79 | $this->output( "All done\n" ); |
||
80 | } else { |
||
81 | $this->output( "None found\n" ); |
||
82 | } |
||
83 | } else { |
||
84 | // Clean up spam on this wiki |
||
85 | |||
86 | $dbr = $this->getDB( DB_REPLICA ); |
||
87 | $res = $dbr->select( 'externallinks', [ 'DISTINCT el_from' ], |
||
88 | [ 'el_index' . $dbr->buildLike( $like ) ], __METHOD__ ); |
||
89 | $count = $dbr->numRows( $res ); |
||
90 | $this->output( "Found $count articles containing $spec\n" ); |
||
91 | foreach ( $res as $row ) { |
||
92 | $this->cleanupArticle( $row->el_from, $spec ); |
||
93 | } |
||
94 | if ( $count ) { |
||
95 | $this->output( "Done\n" ); |
||
96 | } |
||
97 | } |
||
98 | } |
||
99 | |||
100 | private function cleanupArticle( $id, $domain ) { |
||
101 | $title = Title::newFromID( $id ); |
||
102 | if ( !$title ) { |
||
103 | $this->error( "Internal error: no page for ID $id" ); |
||
104 | |||
105 | return; |
||
106 | } |
||
107 | |||
108 | $this->output( $title->getPrefixedDBkey() . " ..." ); |
||
109 | $rev = Revision::newFromTitle( $title ); |
||
110 | $currentRevId = $rev->getId(); |
||
111 | |||
112 | while ( $rev && ( $rev->isDeleted( Revision::DELETED_TEXT ) |
||
113 | || LinkFilter::matchEntry( $rev->getContent( Revision::RAW ), $domain ) ) |
||
0 ignored issues
–
show
It seems like
$rev->getContent(\Revision::RAW) can be null ; however, matchEntry() does not accept null , maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
![]() |
|||
114 | ) { |
||
115 | $rev = $rev->getPrevious(); |
||
116 | } |
||
117 | |||
118 | if ( $rev && $rev->getId() == $currentRevId ) { |
||
119 | // The regex didn't match the current article text |
||
120 | // This happens e.g. when a link comes from a template rather than the page itself |
||
121 | $this->output( "False match\n" ); |
||
122 | } else { |
||
123 | $dbw = $this->getDB( DB_MASTER ); |
||
124 | $this->beginTransaction( $dbw, __METHOD__ ); |
||
0 ignored issues
–
show
It seems like
$dbw defined by $this->getDB(DB_MASTER) on line 123 can be null ; however, Maintenance::beginTransaction() does not accept null , maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
![]() |
|||
125 | $page = WikiPage::factory( $title ); |
||
126 | if ( $rev ) { |
||
127 | // Revert to this revision |
||
128 | $content = $rev->getContent( Revision::RAW ); |
||
129 | |||
130 | $this->output( "reverting\n" ); |
||
131 | $page->doEditContent( |
||
132 | $content, |
||
0 ignored issues
–
show
It seems like
$content defined by $rev->getContent(\Revision::RAW) on line 128 can be null ; however, WikiPage::doEditContent() does not accept null , maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
![]() |
|||
133 | wfMessage( 'spam_reverting', $domain )->inContentLanguage()->text(), |
||
134 | EDIT_UPDATE, |
||
135 | $rev->getId() |
||
136 | ); |
||
137 | } elseif ( $this->hasOption( 'delete' ) ) { |
||
138 | // Didn't find a non-spammy revision, blank the page |
||
139 | $this->output( "deleting\n" ); |
||
140 | $page->doDeleteArticle( |
||
141 | wfMessage( 'spam_deleting', $domain )->inContentLanguage()->text() |
||
142 | ); |
||
143 | } else { |
||
144 | // Didn't find a non-spammy revision, blank the page |
||
145 | $handler = ContentHandler::getForTitle( $title ); |
||
146 | $content = $handler->makeEmptyContent(); |
||
147 | |||
148 | $this->output( "blanking\n" ); |
||
149 | $page->doEditContent( |
||
150 | $content, |
||
151 | wfMessage( 'spam_blanking', $domain )->inContentLanguage()->text() |
||
152 | ); |
||
153 | } |
||
154 | $this->commitTransaction( $dbw, __METHOD__ ); |
||
0 ignored issues
–
show
It seems like
$dbw defined by $this->getDB(DB_MASTER) on line 123 can be null ; however, Maintenance::commitTransaction() does not accept null , maybe add an additional type check?
Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code: /** @return stdClass|null */
function mayReturnNull() { }
function doesNotAcceptNull(stdClass $x) { }
// With potential error.
function withoutCheck() {
$x = mayReturnNull();
doesNotAcceptNull($x); // Potential error here.
}
// Safe - Alternative 1
function withCheck1() {
$x = mayReturnNull();
if ( ! $x instanceof stdClass) {
throw new \LogicException('$x must be defined.');
}
doesNotAcceptNull($x);
}
// Safe - Alternative 2
function withCheck2() {
$x = mayReturnNull();
if ($x instanceof stdClass) {
doesNotAcceptNull($x);
}
}
![]() |
|||
155 | } |
||
156 | } |
||
157 | } |
||
158 | |||
159 | $maintClass = "CleanupSpam"; |
||
160 | require_once RUN_MAINTENANCE_IF_MAIN; |
||
161 |
The PSR-1: Basic Coding Standard recommends that a file should either introduce new symbols, that is classes, functions, constants or similar, or have side effects. Side effects are anything that executes logic, like for example printing output, changing ini settings or writing to a file.
The idea behind this recommendation is that merely auto-loading a class should not change the state of an application. It also promotes a cleaner style of programming and makes your code less prone to errors, because the logic is not spread out all over the place.
To learn more about the PSR-1, please see the PHP-FIG site on the PSR-1.