wikimedia /
mediawiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Print serialized output of MediaWiki config vars. |
||
| 4 | * |
||
| 5 | * This program is free software; you can redistribute it and/or modify |
||
| 6 | * it under the terms of the GNU General Public License as published by |
||
| 7 | * the Free Software Foundation; either version 2 of the License, or |
||
| 8 | * (at your option) any later version. |
||
| 9 | * |
||
| 10 | * This program is distributed in the hope that it will be useful, |
||
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 13 | * GNU General Public License for more details. |
||
| 14 | * |
||
| 15 | * You should have received a copy of the GNU General Public License along |
||
| 16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
| 17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
| 18 | * http://www.gnu.org/copyleft/gpl.html |
||
| 19 | * |
||
| 20 | * @file |
||
| 21 | * @ingroup Maintenance |
||
| 22 | * @author Tim Starling |
||
| 23 | * @author Antoine Musso <[email protected]> |
||
| 24 | */ |
||
| 25 | |||
| 26 | require_once __DIR__ . '/Maintenance.php'; |
||
| 27 | |||
| 28 | /** |
||
| 29 | * Print serialized output of MediaWiki config vars |
||
| 30 | * |
||
| 31 | * @ingroup Maintenance |
||
| 32 | */ |
||
| 33 | class GetConfiguration extends Maintenance { |
||
| 34 | |||
| 35 | protected $regex = null; |
||
| 36 | |||
| 37 | protected $settings_list = []; |
||
| 38 | |||
| 39 | /** |
||
| 40 | * List of format output internally supported. |
||
| 41 | * Each item MUST be lower case. |
||
| 42 | */ |
||
| 43 | protected static $outFormats = [ |
||
| 44 | 'json', |
||
| 45 | 'php', |
||
| 46 | 'serialize', |
||
| 47 | 'vardump', |
||
| 48 | ]; |
||
| 49 | |||
| 50 | public function __construct() { |
||
| 51 | parent::__construct(); |
||
| 52 | $this->addDescription( 'Get serialized MediaWiki site configuration' ); |
||
| 53 | $this->addOption( 'regex', 'regex to filter variables with', false, true ); |
||
| 54 | $this->addOption( 'iregex', 'same as --regex but case insensitive', false, true ); |
||
| 55 | $this->addOption( 'settings', 'Space-separated list of wg* variables', false, true ); |
||
| 56 | $this->addOption( 'format', implode( ', ', self::$outFormats ), false, true ); |
||
| 57 | } |
||
| 58 | |||
| 59 | protected function validateParamsAndArgs() { |
||
| 60 | $error_out = false; |
||
| 61 | |||
| 62 | # Get the format and make sure it is set to a valid default value |
||
| 63 | $format = strtolower( $this->getOption( 'format', 'PHP' ) ); |
||
| 64 | |||
| 65 | $validFormat = in_array( $format, self::$outFormats ); |
||
| 66 | if ( !$validFormat ) { |
||
| 67 | $this->error( "--format set to an unrecognized format", 0 ); |
||
| 68 | $error_out = true; |
||
| 69 | } |
||
| 70 | |||
| 71 | if ( $this->getOption( 'regex' ) && $this->getOption( 'iregex' ) ) { |
||
| 72 | $this->error( "Can only use either --regex or --iregex" ); |
||
| 73 | $error_out = true; |
||
| 74 | } |
||
| 75 | |||
| 76 | parent::validateParamsAndArgs(); |
||
| 77 | |||
| 78 | if ( $error_out ) { |
||
| 79 | # Force help and quit |
||
| 80 | $this->maybeHelp( true ); |
||
| 81 | } |
||
| 82 | } |
||
| 83 | |||
| 84 | /** |
||
| 85 | * finalSetup() since we need MWException |
||
| 86 | */ |
||
| 87 | public function finalSetup() { |
||
| 88 | parent::finalSetup(); |
||
| 89 | |||
| 90 | $this->regex = $this->getOption( 'regex' ) ?: $this->getOption( 'iregex' ); |
||
| 91 | if ( $this->regex ) { |
||
| 92 | $this->regex = '/' . $this->regex . '/'; |
||
| 93 | if ( $this->hasOption( 'iregex' ) ) { |
||
| 94 | $this->regex .= 'i'; # case insensitive regex |
||
| 95 | } |
||
| 96 | } |
||
| 97 | |||
| 98 | if ( $this->hasOption( 'settings' ) ) { |
||
| 99 | $this->settings_list = explode( ' ', $this->getOption( 'settings' ) ); |
||
| 100 | # Values validation |
||
| 101 | foreach ( $this->settings_list as $name ) { |
||
| 102 | if ( !preg_match( '/^wg[A-Z]/', $name ) ) { |
||
| 103 | throw new MWException( "Variable '$name' does start with 'wg'." ); |
||
| 104 | } elseif ( !isset( $GLOBALS[$name] ) ) { |
||
| 105 | throw new MWException( "Variable '$name' is not set." ); |
||
| 106 | } elseif ( !$this->isAllowedVariable( $GLOBALS[$name] ) ) { |
||
| 107 | throw new MWException( "Variable '$name' includes non-array, non-scalar, items." ); |
||
| 108 | } |
||
| 109 | } |
||
| 110 | } |
||
| 111 | } |
||
| 112 | |||
| 113 | public function execute() { |
||
| 114 | // Settings we will display |
||
| 115 | $res = []; |
||
| 116 | |||
| 117 | # Sane default: dump any wg / wmg variable |
||
| 118 | if ( !$this->regex && !$this->getOption( 'settings' ) ) { |
||
| 119 | $this->regex = '/^wm?g/'; |
||
| 120 | } |
||
| 121 | |||
| 122 | # Filter out globals based on the regex |
||
| 123 | if ( $this->regex ) { |
||
| 124 | $res = []; |
||
| 125 | foreach ( $GLOBALS as $name => $value ) { |
||
| 126 | if ( preg_match( $this->regex, $name ) ) { |
||
| 127 | $res[$name] = $value; |
||
| 128 | } |
||
| 129 | } |
||
| 130 | } |
||
| 131 | |||
| 132 | # Explicitly dumps a list of provided global names |
||
| 133 | if ( $this->settings_list ) { |
||
| 134 | foreach ( $this->settings_list as $name ) { |
||
| 135 | $res[$name] = $GLOBALS[$name]; |
||
| 136 | } |
||
| 137 | } |
||
| 138 | |||
| 139 | ksort( $res ); |
||
| 140 | |||
| 141 | $out = null; |
||
|
0 ignored issues
–
show
|
|||
| 142 | switch ( strtolower( $this->getOption( 'format' ) ) ) { |
||
| 143 | case 'serialize': |
||
| 144 | case 'php': |
||
| 145 | $out = serialize( $res ); |
||
| 146 | break; |
||
| 147 | case 'vardump': |
||
| 148 | $out = $this->formatVarDump( $res ); |
||
| 149 | break; |
||
| 150 | case 'json': |
||
| 151 | $out = FormatJson::encode( $res ); |
||
| 152 | break; |
||
| 153 | default: |
||
| 154 | throw new MWException( "Invalid serialization format given." ); |
||
| 155 | } |
||
| 156 | if ( !is_string( $out ) ) { |
||
| 157 | throw new MWException( "Failed to serialize the requested settings." ); |
||
| 158 | } |
||
| 159 | |||
| 160 | if ( $out ) { |
||
| 161 | $this->output( $out . "\n" ); |
||
| 162 | } |
||
| 163 | } |
||
| 164 | |||
| 165 | protected function formatVarDump( $res ) { |
||
| 166 | $ret = ''; |
||
| 167 | foreach ( $res as $key => $value ) { |
||
| 168 | ob_start(); # intercept var_dump() output |
||
| 169 | print "\${$key} = "; |
||
| 170 | var_dump( $value ); |
||
| 171 | # grab var_dump() output and discard it from the output buffer |
||
| 172 | $ret .= trim( ob_get_clean() ) . ";\n"; |
||
| 173 | } |
||
| 174 | |||
| 175 | return trim( $ret, "\n" ); |
||
| 176 | } |
||
| 177 | |||
| 178 | private function isAllowedVariable( $value ) { |
||
| 179 | if ( is_array( $value ) ) { |
||
| 180 | foreach ( $value as $k => $v ) { |
||
| 181 | if ( !$this->isAllowedVariable( $v ) ) { |
||
| 182 | return false; |
||
| 183 | } |
||
| 184 | } |
||
| 185 | |||
| 186 | return true; |
||
| 187 | } elseif ( is_scalar( $value ) || $value === null ) { |
||
| 188 | return true; |
||
| 189 | } |
||
| 190 | |||
| 191 | return false; |
||
| 192 | } |
||
| 193 | } |
||
| 194 | |||
| 195 | $maintClass = "GetConfiguration"; |
||
| 196 | require_once RUN_MAINTENANCE_IF_MAIN; |
||
| 197 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.