- Yioop Repo - Seekquarry

#!/bin/sh
# No code writes a PHP file and then runs it, and no code hands PHP a
# string of code to run with php -r. Chris wants every PHP process
# started the same way, from a script already in the tree. The one
# exception is the profile, Profile.php, which Yioop writes as settings.
#
#   sh devlog/devscripts/check_php_writes.sh <file>...
#
# With no arguments it reads every changed PHP file, as
# check_deprecated.sh does. It names the file and the line of:
#   - a write whose text holds a PHP opening tag;
#   - a write, copy or rename whose target names a .php file other than
#     Profile.php;
#   - a -r argument, which runs a string of code.
# It exits non-zero when it finds one, so cut_patch.sh and audit.sh can
# refuse. A line that is word for word in the file at confirmed-head is
# named as already there and does not refuse: a patch is held to what it
# adds, so a write made before this rule, such as the configure page
# rewriting Config.php's work directory block, does not stop every later
# patch that touches the same file.
if [ $# -eq 0 ]; then
    files=`git diff --name-only confirmed-head 2>/dev/null | grep '\.php$'`
else
    files="$@"
fi
writes_php='(file_put_contents|fwrite)\(.*<\?php'
names_php='(file_put_contents|fopen|copy|rename|tempnam)\(.*\.php'
runs_string="['\"]-r['\"]"
found=0
for one in $files
do
    case "$one" in
        *.php) ;;
        *) continue ;;
    esac
    if [ ! -f "$one" ]; then
        continue
    fi
    hits=`grep -nE "$writes_php|$names_php|$runs_string" "$one" |
        grep -v "Profile\.php"`
    if [ -z "$hits" ]; then
        continue
    fi
    old_text=`git show "confirmed-head:$one" 2>/dev/null`
    echo "$hits" | while IFS= read -r hit; do
        line_text=`echo "$hit" | sed 's/^[0-9]*://'`
        if [ -n "$old_text" ] &&
            printf '%s\n' "$old_text" | grep -qxF -- "$line_text"; then
            echo "$one:$hit (already there)"
        else
            echo "$one:$hit"
            echo "$one" >> /tmp/check_php_writes_new.$$
        fi
    done
    if [ -s /tmp/check_php_writes_new.$$ ]; then
        found=1
    fi
done
rm -f /tmp/check_php_writes_new.$$
if [ "$found" = "1" ]; then
    echo "check: code above writes PHP to a file or runs a string of" \
        "code; start a script already in the tree through CrawlDaemon"
    exit 1
fi
echo "check: no PHP file is written and no code string is run"
exit 0