<?php

// Copyright (c) 2014 Robin Bailey @ Dionach Ltd.

$classlist = get_declared_classes();

// The methods we're interested in

$magic = array("__wakeup", "__destruct", "__toString", "__get", "__set", "__call");

foreach($classlist as $class)

{

$reflClass = new ReflectionClass($class);

// Ignore classes from PHP core/extensions

if ($reflClass->isUserDefined())

{

foreach($magic as $method)

{

try

{

if ($reflClass->getMethod($method))

{

$reflMethod = new ReflectionMethod($class, $method);

$parent = $reflMethod->getDeclaringClass()->getName();

$filename = $reflMethod->getDeclaringClass()->getFileName();

$startline = $reflMethod->getStartLine();

// If filename is not defined the class inherits from a core/extension class

if ($filename)

{

// Get the source code of the method

$exp = $reflMethod->export($class, $method, 1);

// Extract the filename, start and end line numbers

preg_match("/@@\s(.*)\s(\d+)\s-\s(\d+)/i", $exp, $matches);

$source = file($filename);

// -1/+1 to include the first and last lines, incase code is on same line as method declaration

$functionBody = implode("", array_slice($source, $matches[2] - 1, ($matches[3]-$matches[2] + 1)));

// Check for interesting function calls

if (preg_match("/eval|assert|call_user_func|system|popen|shell_exec|include|require|file_get_contents|unlink|exec/",

$functionBody, $m))

{

$interesting = $m[0];

}

print $class . "::" . $method . "() ";

if ($parent !== $class)

{

print "[extends " . $parent . "] ";

}

if (isset($interesting))

{

print "{calls " . $interesting . "} ";

unset($interesting);

}

print "- " . $filename . ':' . $startline . "\n" . "<br>";

}

}

}

catch (Exception $e) {}

}

}

}

exit;