This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Helper class for userOptions.php script. |
||
4 | * |
||
5 | * This program is free software; you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU General Public License as published by |
||
7 | * the Free Software Foundation; either version 2 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU General Public License along |
||
16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
18 | * http://www.gnu.org/copyleft/gpl.html |
||
19 | * |
||
20 | * @file |
||
21 | * @ingroup Maintenance |
||
22 | */ |
||
23 | |||
24 | // Options we will use |
||
25 | $options = [ 'list', 'nowarn', 'quiet', 'usage', 'dry' ]; |
||
26 | $optionsWithArgs = [ 'old', 'new' ]; |
||
27 | |||
28 | require_once __DIR__ . '/commandLine.inc'; |
||
29 | |||
30 | /** |
||
31 | * @ingroup Maintenance |
||
32 | */ |
||
33 | class UserOptions { |
||
34 | public $mQuick; |
||
35 | public $mQuiet; |
||
36 | public $mDry; |
||
37 | public $mAnOption; |
||
38 | public $mOldValue; |
||
39 | public $mNewValue; |
||
40 | |||
41 | private $mMode, $mReady; |
||
42 | |||
43 | /** |
||
44 | * Constructor. Will show usage and exit if script options are not correct |
||
45 | * @param array $opts |
||
46 | * @param array $args |
||
47 | */ |
||
48 | function __construct( $opts, $args ) { |
||
49 | if ( !$this->checkOpts( $opts, $args ) ) { |
||
50 | UserOptions::showUsageAndExit(); |
||
51 | } else { |
||
52 | $this->mReady = $this->initializeOpts( $opts, $args ); |
||
53 | } |
||
54 | } |
||
55 | |||
56 | /** |
||
57 | * This is used to check options. Only needed on construction |
||
58 | * |
||
59 | * @param array $opts |
||
60 | * @param array $args |
||
61 | * |
||
62 | * @return bool |
||
63 | */ |
||
64 | private function checkOpts( $opts, $args ) { |
||
65 | // The three possible ways to run the script: |
||
66 | $list = isset( $opts['list'] ); |
||
67 | $usage = isset( $opts['usage'] ) && ( count( $args ) <= 1 ); |
||
68 | $change = isset( $opts['old'] ) && isset( $opts['new'] ) && ( count( $args ) <= 1 ); |
||
69 | |||
70 | // We want only one of them |
||
71 | $isValid = ( ( $list + $usage + $change ) == 1 ); |
||
72 | |||
73 | return $isValid; |
||
74 | } |
||
75 | |||
76 | /** |
||
77 | * load script options in the object |
||
78 | * |
||
79 | * @param array $opts |
||
80 | * @param array $args |
||
81 | * |
||
82 | * @return bool |
||
83 | */ |
||
84 | private function initializeOpts( $opts, $args ) { |
||
85 | |||
86 | $this->mQuick = isset( $opts['nowarn'] ); |
||
87 | $this->mQuiet = isset( $opts['quiet'] ); |
||
88 | $this->mDry = isset( $opts['dry'] ); |
||
89 | |||
90 | // Set object properties, specially 'mMode' used by run() |
||
91 | if ( isset( $opts['list'] ) ) { |
||
92 | $this->mMode = 'LISTER'; |
||
93 | } elseif ( isset( $opts['usage'] ) ) { |
||
94 | $this->mMode = 'USAGER'; |
||
95 | $this->mAnOption = isset( $args[0] ) ? $args[0] : false; |
||
96 | } elseif ( isset( $opts['old'] ) && isset( $opts['new'] ) ) { |
||
97 | $this->mMode = 'CHANGER'; |
||
98 | $this->mOldValue = $opts['old']; |
||
99 | $this->mNewValue = $opts['new']; |
||
100 | $this->mAnOption = $args[0]; |
||
101 | } else { |
||
102 | die( "There is a bug in the software, this should never happen\n" ); |
||
103 | } |
||
104 | |||
105 | return true; |
||
106 | } |
||
107 | |||
108 | /** |
||
109 | * Dumb stuff to run a mode. |
||
110 | */ |
||
111 | public function run() { |
||
112 | if ( !$this->mReady ) { |
||
113 | return false; |
||
114 | } |
||
115 | |||
116 | $this->{$this->mMode}(); |
||
117 | |||
118 | return true; |
||
119 | } |
||
120 | |||
121 | /** |
||
122 | * List default options and their value |
||
123 | */ |
||
124 | private function LISTER() { |
||
125 | $def = User::getDefaultOptions(); |
||
126 | ksort( $def ); |
||
127 | $maxOpt = 0; |
||
128 | foreach ( $def as $opt => $value ) { |
||
129 | $maxOpt = max( $maxOpt, strlen( $opt ) ); |
||
130 | } |
||
131 | foreach ( $def as $opt => $value ) { |
||
132 | printf( "%-{$maxOpt}s: %s\n", $opt, $value ); |
||
133 | } |
||
134 | } |
||
135 | |||
136 | /** |
||
137 | * List options usage |
||
138 | */ |
||
139 | private function USAGER() { |
||
140 | $ret = []; |
||
141 | $defaultOptions = User::getDefaultOptions(); |
||
142 | |||
143 | // We list user by user_id from one of the replica DBs |
||
144 | $dbr = wfGetDB( DB_REPLICA ); |
||
145 | $result = $dbr->select( 'user', |
||
146 | [ 'user_id' ], |
||
147 | [], |
||
148 | __METHOD__ |
||
149 | ); |
||
150 | |||
151 | foreach ( $result as $id ) { |
||
152 | |||
153 | $user = User::newFromId( $id->user_id ); |
||
154 | |||
155 | // Get the options and update stats |
||
156 | if ( $this->mAnOption ) { |
||
157 | |||
158 | if ( !array_key_exists( $this->mAnOption, $defaultOptions ) ) { |
||
159 | print "Invalid user option. Use --list to see valid choices\n"; |
||
160 | exit; |
||
161 | } |
||
162 | |||
163 | $userValue = $user->getOption( $this->mAnOption ); |
||
164 | if ( $userValue <> $defaultOptions[$this->mAnOption] ) { |
||
165 | // @codingStandardsIgnoreStart Ignore silencing errors is discouraged warning |
||
166 | @$ret[$this->mAnOption][$userValue]++; |
||
0 ignored issues
–
show
|
|||
167 | // @codingStandardsIgnoreEnd |
||
168 | } |
||
169 | } else { |
||
170 | |||
171 | foreach ( $defaultOptions as $name => $defaultValue ) { |
||
0 ignored issues
–
show
The expression
$defaultOptions of type null|array<?,?,{"skin":"string"}> is not guaranteed to be traversable. How about adding an additional type check?
There are different options of fixing this problem.
![]() |
|||
172 | $userValue = $user->getOption( $name ); |
||
173 | if ( $userValue <> $defaultValue ) { |
||
174 | // @codingStandardsIgnoreStart Ignore silencing errors is discouraged warning |
||
175 | @$ret[$name][$userValue]++; |
||
0 ignored issues
–
show
It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.
If you suppress an error, we recommend checking for the error condition explicitly: // For example instead of
@mkdir($dir);
// Better use
if (@mkdir($dir) === false) {
throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
![]() |
|||
176 | // @codingStandardsIgnoreEnd |
||
177 | } |
||
178 | } |
||
179 | } |
||
180 | } |
||
181 | |||
182 | foreach ( $ret as $optionName => $usageStats ) { |
||
183 | print "Usage for <$optionName> (default: '{$defaultOptions[$optionName]}'):\n"; |
||
184 | foreach ( $usageStats as $value => $count ) { |
||
185 | print " $count user(s): '$value'\n"; |
||
186 | } |
||
187 | print "\n"; |
||
188 | } |
||
189 | } |
||
190 | |||
191 | /** |
||
192 | * Change our users options |
||
193 | */ |
||
194 | private function CHANGER() { |
||
195 | $this->warn(); |
||
196 | |||
197 | // We list user by user_id from one of the replica DBs |
||
198 | $dbr = wfGetDB( DB_REPLICA ); |
||
199 | $result = $dbr->select( 'user', |
||
200 | [ 'user_id' ], |
||
201 | [], |
||
202 | __METHOD__ |
||
203 | ); |
||
204 | |||
205 | foreach ( $result as $id ) { |
||
206 | |||
207 | $user = User::newFromId( $id->user_id ); |
||
208 | |||
209 | $curValue = $user->getOption( $this->mAnOption ); |
||
210 | $username = $user->getName(); |
||
211 | |||
212 | if ( $curValue == $this->mOldValue ) { |
||
213 | |||
214 | if ( !$this->mQuiet ) { |
||
215 | print "Setting {$this->mAnOption} for $username from '{$this->mOldValue}' " . |
||
216 | "to '{$this->mNewValue}'): "; |
||
217 | } |
||
218 | |||
219 | // Change value |
||
220 | $user->setOption( $this->mAnOption, $this->mNewValue ); |
||
221 | |||
222 | // Will not save the settings if run with --dry |
||
223 | if ( !$this->mDry ) { |
||
224 | $user->saveSettings(); |
||
225 | } |
||
226 | if ( !$this->mQuiet ) { |
||
227 | print " OK\n"; |
||
228 | } |
||
229 | } elseif ( !$this->mQuiet ) { |
||
230 | print "Not changing '$username' using <{$this->mAnOption}> = '$curValue'\n"; |
||
231 | } |
||
232 | } |
||
233 | } |
||
234 | |||
235 | /** |
||
236 | * Return an array of option names |
||
237 | * @return array |
||
238 | */ |
||
239 | public static function getDefaultOptionsNames() { |
||
240 | $def = User::getDefaultOptions(); |
||
241 | $ret = []; |
||
242 | foreach ( $def as $optname => $defaultValue ) { |
||
0 ignored issues
–
show
The expression
$def of type null|array<?,?,{"skin":"string"}> is not guaranteed to be traversable. How about adding an additional type check?
There are different options of fixing this problem.
![]() |
|||
243 | array_push( $ret, $optname ); |
||
244 | } |
||
245 | |||
246 | return $ret; |
||
247 | } |
||
248 | |||
249 | public static function showUsageAndExit() { |
||
250 | print <<<USAGE |
||
251 | |||
252 | This script pass through all users and change one of their options. |
||
253 | The new option is NOT validated. |
||
254 | |||
255 | Usage: |
||
256 | php userOptions.php --list |
||
257 | php userOptions.php [user option] --usage |
||
258 | php userOptions.php [options] <user option> --old <old value> --new <new value> |
||
259 | |||
260 | Switchs: |
||
261 | --list : list available user options and their default value |
||
262 | |||
263 | --usage : report all options statistics or just one if you specify it. |
||
264 | |||
265 | --old <old value> : the value to look for |
||
266 | --new <new value> : new value to update users with |
||
267 | |||
268 | Options: |
||
269 | --nowarn: hides the 5 seconds warning |
||
270 | --quiet : do not print what is happening |
||
271 | --dry : do not save user settings back to database |
||
272 | |||
273 | USAGE; |
||
274 | exit( 0 ); |
||
275 | } |
||
276 | |||
277 | /** |
||
278 | * The warning message and countdown |
||
279 | * @return bool |
||
280 | */ |
||
281 | public function warn() { |
||
282 | |||
283 | if ( $this->mQuick ) { |
||
284 | return true; |
||
285 | } |
||
286 | |||
287 | print <<<WARN |
||
288 | The script is about to change the skin for ALL USERS in the database. |
||
289 | Users with option <$this->mAnOption> = '$this->mOldValue' will be made to use '$this->mNewValue'. |
||
290 | |||
291 | Abort with control-c in the next five seconds.... |
||
292 | WARN; |
||
293 | wfCountDown( 5 ); |
||
294 | |||
295 | return true; |
||
296 | } |
||
297 | } |
||
298 |
If you suppress an error, we recommend checking for the error condition explicitly: