ZAP Scanning Report

Summary of Alerts

Risk LevelNumber of Alerts
High2
Medium3
Low8
Informational5

Alert Detail

High (Medium)External Redirect
Description

URL redirectors represent common functionality employed by web sites to forward an incoming request to an alternate resource. This can be done for a variety of reasons and is often done to allow resources to be moved within the directory structure and to avoid breaking functionality for users that request the resource at its previous location. URL redirectors may also be used to implement load balancing, leveraging abbreviated URLs or recording outgoing links. It is this last implementation which is often used in phishing attacks as described in the example below. URL redirectors do not necessarily represent a direct security vulnerability but can be abused by attackers trying to social engineer victims into believing that they are navigating to a site other than the true destination.

URLhttps://ptsp.sumedangkab.go.id/ptsp/home/direct?c=http%3A%2F%2F6523029354018194860.owasp.org&s=ZAP
MethodGET
Parameterc
Attackhttp://6523029354018194860.owasp.org
Evidencehttp://6523029354018194860.owasp.org
Instances1
Solution

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if you are expecting colors such as "red" or "blue."

Use a whitelist of approved URLs or domains to be used for redirection.

Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving your site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems when generating the disclaimer page.

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap provide this capability.

Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.

Other information

The response contains a redirect in its Location header which allows an external Url to be set.

Reference

http://projects.webappsec.org/URL-Redirector-Abuse

http://cwe.mitre.org/data/definitions/601.html

CWE Id601
WASC Id38
Source ID1
High (Medium)Remote File Inclusion
Description

Remote File Include (RFI) is an attack technique used to exploit "dynamic file include" mechanisms in web applications. When web applications take user input (URL, parameter value, etc.) and pass them into file include commands, the web application might be tricked into including remote files with malicious code.

Almost all web application frameworks support file inclusion. File inclusion is mainly used for packaging common code into separate files that are later referenced by main application modules. When a web application references an include file, the code in this file may be executed implicitly or explicitly by calling specific procedures. If the choice of module to load is based on elements from the HTTP request, the web application might be vulnerable to RFI.

An attacker can use RFI for:

* Running malicious code on the server: any code in the included malicious files will be run by the server. If the file include is not executed using some wrapper, code in include files is executed in the context of the server user. This could lead to a complete system compromise.

* Running malicious code on clients: the attacker's malicious code can manipulate the content of the response sent to the client. The attacker can embed malicious code in the response that will be run by the client (for example, JavaScript to steal the client session cookies).

PHP is particularly vulnerable to RFI attacks due to the extensive use of "file includes" in PHP programming and due to default server configurations that increase susceptibility to an RFI attack.

URLhttps://ptsp.sumedangkab.go.id/ptsp/home/direct?c=http%3A%2F%2Fwww.google.com%2F&s=ZAP
MethodGET
Parameterc
Attackhttp://www.google.com/
Evidence<title>Google</title>
Instances1
Solution

Phase: Architecture and Design

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.

Phases: Architecture and Design; Operation

Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by your software.

OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows you to specify restrictions on file operations.

This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.

Be careful to avoid CWE-243 and other weaknesses related to jails.

For PHP, the interpreter offers restrictions such as open basedir or safe mode which can make it more difficult for an attacker to escape out of the application. Also consider Suhosin, a hardened PHP extension, which includes various options that disable some of the more dangerous PHP features.

Phase: Implementation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a whitelist of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. Do not rely exclusively on looking for malicious or malformed inputs (i.e., do not rely on a blacklist). However, blacklists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if you are expecting colors such as "red" or "blue."

For filenames, use stringent whitelists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a whitelist of allowable file extensions, which will help to avoid CWE-434.

Phases: Architecture and Design; Operation

Store library, include, and utility files outside of the web document root, if possible. Otherwise, store them in a separate directory and use the web server's access control capabilities to prevent attackers from directly requesting them. One common practice is to define a fixed constant in each calling program, then check for the existence of the constant in the library/include file; if the constant does not exist, then the file was directly requested, and it can exit immediately.

This significantly reduces the chance of an attacker being able to bypass any protection mechanisms that are in the base program but not in the include files. It will also reduce your attack surface.

Phases: Architecture and Design; Implementation

Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

Many file inclusion problems occur because the programmer assumed that certain inputs could not be modified, especially for cookies and URL components.

Reference

http://projects.webappsec.org/Remote-File-Inclusion

http://cwe.mitre.org/data/definitions/98.html

CWE Id98
WASC Id5
Source ID1
Medium (Medium)Directory Browsing
Description

It is possible to view the directory listing. Directory listing may reveal hidden scripts, include files, backup source files, etc. which can be accessed to read sensitive information.

URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/scripts/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/iCheck/skins/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-bs/css/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/select2/dist/css/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/frontend/js/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/pixel/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/jquery-ui/js/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/pdfmake/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/font-awesome/css/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-fixedheader/js/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-responsive-bs/js/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/bootstrap/dist/css/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/jszip/dist/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/css/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-keytable/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/flat/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/plugins/
MethodGET
AttackParent Directory
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-responsive-bs/
MethodGET
AttackParent Directory
Instances95
Solution

Disable directory browsing. If this is required, make sure the listed files does not induce risks.

Reference

http://httpd.apache.org/docs/mod/core.html#options

http://alamo.satlug.org/pipermail/satlug/2002-February/000053.html

CWE Id548
WASC Id48
Source ID1
Medium (Medium)Secure Pages Include Mixed Content (Including Scripts)
Description

The page includes mixed content, that is content accessed via HTTP instead of HTTPS.

URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/49
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/63
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/68
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/66
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/home
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/siice
MethodGET
Evidencehttp://aplikasiperizinan.com/asset/siice/img/scr-img/mockapple.png
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/84
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/87
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/86
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/85
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/91
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/agenda/read_agenda/lauching-sistem-informasi-ptsp
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/index/?per_page=10
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/index/?per_page=15
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/grafikizin/index/
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/12
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/11
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/maklumat
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/tag/android
MethodGET
Evidencehttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Instances114
Solution

A page that is available over SSL/TLS must be comprised completely of content which is transmitted over SSL/TLS.

The page must not contain any content that is transmitted over unencrypted HTTP.

This includes content from third party sites.

Other information

tag=script src=http://maps.google.com/maps/api/js?sensor=true&key=apikey

tag=script src=http://maps.google.com/maps/api/js?sensor=false&language=en

Reference

https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html

CWE Id311
WASC Id4
Source ID3
Medium (Medium)Application Error Disclosure
Description

This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.

URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/40
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/43
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/46
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/47
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/49
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/171
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/170
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/173
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/172
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/175
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/174
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/63
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/161
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/66
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/160
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/163
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/68
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/162
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/165
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/164
MethodGET
EvidencePHP Error
Instances83
Solution

Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.

Reference

CWE Id200
WASC Id13
Source ID3
Low (Medium)X-Content-Type-Options Header Missing
Description

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171113095437_14_1_REKOMENDASI_PERIZINAN.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/200903042659_16_1_Data_Lampiran_IMB.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171113095546_14_1_SURAT_PERNYATAAN_BAHWA_TANAH_TIDAK_DALAM_STATUS_SENGKETA.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/180129085918_109_4_Surat_Pernyataan.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/180129085952_109_4_DATA_LAIN.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/210207083338_25_4_SURAT_PERNYATAAN_PENYEHAT_TRADISIONAL.pdf
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/Formulir_TDI.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/190129033853_14_1_surat_pernyataan_penyediaan_CCTV.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/200825033643_164_1_Lampiran_Penelitian.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/Permohonan_Izin_Kerja_Refraksionis_Optisien.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/200914114643_85_1_PERMOHONAN_SIP_DOKTER_HEWAN.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/200903125657_109_1_LAMPIRAN_DATA_PRODUKSI,_MESIN_DAN_LAIN_LAIN.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/201127072444_164_4_200825033643_164_1_Lampiran_Penelitian.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/Permohonan_pencabutan_Izin_Praktik_Tenaga_Kefarmasian.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/180109092103_29_1_isian_permohonan_apotik.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/181213083909_14_1_surat_pernyataan_penyediaan_TPU.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/210207081813_25_1_SURAT_PERNYATAAN_PENYEHAT_TRADISIONAL.pdf
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171113095313_14_1_SURAT_PERNYATAAN_TEKNIS_PEMBANGUNAN.docx
MethodGET
ParameterX-Content-Type-Options
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171113095510_14_1_SURAT_PERNYATAAN_UNTUK_MENGIKUTI_KETENTUAN_DALAM_RT_RW.docx
MethodGET
ParameterX-Content-Type-Options
Instances32
Solution

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

Other information

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At "High" threshold this scan rule will not alert on client or server error responses.

Reference

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

CWE Id16
WASC Id15
Source ID3
Low (Medium)X-Content-Type-Options Header Missing
Description

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/minimal/_all.css
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/frontend/images/cta2/cta2-bg.jpg
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/scripts/markerclusterer.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/scripts/slick.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/js/modernizrr.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/fonts/simple-line-icons.ttf?thkwh4
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/frontend/js/smoothscroll.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/jszip/dist/jszip.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/css/icons.css
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/pengumuman/pengumuman1.jpeg
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/scripts/popper.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/scripts/jquery-2.2.0.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/logo/disdik11.png
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/polaris/polaris.css
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/morris.min.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/flat/_all.css
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/pdfmake/build/vfs_fonts.js
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/css/colors/orange.css
MethodGET
ParameterX-Content-Type-Options
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/icon/imb.jpg
MethodGET
ParameterX-Content-Type-Options
Instances170
Solution

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

Other information

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At "High" threshold this scan rule will not alert on client or server error responses.

Reference

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

CWE Id16
WASC Id15
Source ID3
Low (Medium)Absence of Anti-CSRF Tokens
Description

No Anti-CSRF tokens were found in a HTML submission form.

A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

CSRF attacks are effective in a number of situations, including:

* The victim has an active session on the target site.

* The victim is authenticated via HTTP auth on the target site.

* The victim is on the same local network as the target site.

CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of the same-origin policy.

URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/68
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/66
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/63
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingkungan-3-desember-2018
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/agenda/read_agenda/lauching-sistem-informasi-ptsp
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/47
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/46
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/43
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/40
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/pemohon/forgot
MethodGET
Evidence<form method="post" class="login-form" role="form" id="">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/49
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/36
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/33
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/grafikizin/index/
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/bersyarat-pemprov-jabar-keluarkan-18-iup-dan-wiup
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingkungan-3-desember-2018
MethodGET
Evidence<form action="https://ptsp.sumedangkab.go.id/ptsp/berita" method='get'>
URLhttps://ptsp.sumedangkab.go.id/ptsp/grafikizin
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/29
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/28
MethodGET
Evidence<form method="post" role="form" id="" action="https://ptsp.sumedangkab.go.id/ptsp/pemohon/login" class="login">
Instances142
Solution

Phase: Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

For example, use anti-CSRF packages such as the OWASP CSRFGuard.

Phase: Implementation

Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-controlled script.

Phase: Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330).

Note that this can be bypassed using XSS.

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Note that this can be bypassed using XSS.

Use the ESAPI Session Management control.

This control includes a component for CSRF.

Do not use the GET method for any request that triggers a state change.

Phase: Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Other information

No known Anti-CSRF token [anticsrf, CSRFToken, __RequestVerificationToken, csrfmiddlewaretoken, authenticity_token, OWASP_CSRFTOKEN, anoncsrf, csrf_token, _csrf, _csrfSecret] was found in the following HTML form: [Form 1: "login_username" "login_password" "login" ].

Reference

http://projects.webappsec.org/Cross-Site-Request-Forgery

http://cwe.mitre.org/data/definitions/352.html

CWE Id352
WASC Id9
Source ID3
Low (Medium)Cross-Domain JavaScript Source File Inclusion
Description

The page includes one or more script files from a third-party domain.

URLhttps://ptsp.sumedangkab.go.id/ptsp/
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/profil
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/pemberutahuan-yang-telah-mengajukan-dan-mendapatkan-izin-lingkungan-dari-kepala-dpmptsp-kabupaten-su
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingklungan-22-oktober-2018
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/tag/php
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/oss
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/maklumat
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/panduan
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/mobil_pelayanan
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingkungan-26-nopember-2018
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/kpk-dorong-17-provinsi-manfaakan-aplikasi-e-government-pemprov-jabar-sebagai-daerah-percontohan
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingkungan-10-oktober-2018
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingkungan-26-nopember-2018
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingkungan-2-nopember-2018
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/persyaratan
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=false&language=en
Evidence<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false&amp;language=en"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/persyaratan
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/25
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/26
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/28
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/29
MethodGET
Parameterhttp://maps.google.com/maps/api/js?sensor=true&key=apikey
Evidence<script src="http://maps.google.com/maps/api/js?sensor=true&key=apikey"></script>
Instances228
Solution

Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.

Reference

CWE Id829
WASC Id15
Source ID3
Low (Medium)Information Disclosure - Debug Error Messages
Description

The response appeared to contain common error messages returned by platforms such as ASP.NET, and Web-servers such as IIS and Apache. You can configure the list of common debug messages.

URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/66
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/63
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/68
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/84
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/85
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/86
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/87
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/91
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/110
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/category/
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/129
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/120
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/124
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/121
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/122
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/127
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/128
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/125
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/126
MethodGET
EvidencePHP Error
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/107
MethodGET
EvidencePHP Error
Instances83
Solution

Disable debugging messages before pushing to production.

Reference

CWE Id200
WASC Id13
Source ID3
Low (Medium)Incomplete or No Cache-control and Pragma HTTP Header Set
Description

The cache-control and pragma HTTP header have not been set properly or are missing allowing the browser and proxies to cache content.

URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/css/font-awesome.min.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/css/bootstrap.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/css/colors/beige.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/css/colors/green.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/css/plugins/revolutionslider.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/bootstrap/dist/css/bootstrap.min.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/frontend/css/animate.min.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/flat/_all.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-buttons-bs/css/buttons.bootstrap.min.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/css/icons.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/polaris/polaris.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/select2/select2-bootstrap.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/font-awesome/css/font-awesome.min.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/bootstrap-vertical-tabs-master/bootstrap.vertical-tabs.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/css/venobox.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/minimal/_all.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-scroller-bs/css/scroller.bootstrap.min.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/bootstrap-progressbar/css/bootstrap-progressbar-3.3.4.min.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/icheck/skins/square/_all.css
MethodGET
ParameterCache-Control
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/css/colors/pink.css
MethodGET
ParameterCache-Control
Instances50
Solution

Whenever possible ensure the cache-control HTTP header is set with no-cache, no-store, must-revalidate; and that the pragma HTTP header is set with no-cache.

Reference

https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching

CWE Id525
WASC Id13
Source ID3
Low (Medium)Cookie Without Secure Flag
Description

A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections.

URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/26
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/28
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/29
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/pengaduan
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/25
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/33
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/maklumat
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/36
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/oss
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/onestopservices
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/19
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/14
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/15
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/16
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/tag/android
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/11
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/12
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/home
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/index/?per_page=10
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/index/?per_page=15
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
Instances126
Solution

Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such sensitive information.

Reference

https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes.html

CWE Id614
WASC Id13
Source ID3
Low (Medium)Cookie Without SameSite Attribute
Description

A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.

URLhttps://ptsp.sumedangkab.go.id/ptsp/download
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/bersyarat-pemprov-jabar-keluarkan-18-iup-dan-wiup
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/home/direct?c=potensi&s=ZAP
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/pemohon/forgot
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/read/berita-izin-lingkungan-3-desember-2018
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/pemohon/login
MethodPOST
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/home
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/berita/category/
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/33
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/36
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/25
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/26
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/28
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/29
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/maklumat
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/tracking/noreg/
MethodPOST
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/helpdesk
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/46
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
URLhttps://ptsp.sumedangkab.go.id/ptsp/izin/detail/47
MethodGET
ParameterPHPSESSID
EvidenceSet-Cookie: PHPSESSID
Instances126
Solution

Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.

Reference

https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site

CWE Id16
WASC Id13
Source ID3
Informational (Medium)Information Disclosure - Suspicious Comments
Description

The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.

URLhttps://ptsp.sumedangkab.go.id/ptsp/grafikizin/index/
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/grafikizin
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/pengaduan
MethodGET
Instances3
Solution

Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.

Other information

The following comment/snippet was identified via the pattern: \bSELECT\b

<!--

<div class="form-group">

<label>Bulan <i>(wajib)</i></label>

</div>

<div class="form-group" >

<select class="form-control" name="bulan" id="bulan">

<option value="" selected>Pilih</option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='1'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='2'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='3'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='4'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='5'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='6'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='7'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='8'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='9'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='10'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='11'></option>

<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

<h4>A PHP Error was encountered</h4>

Severity: Notice

Message: Undefined variable: bulan

Filename: blog/grafikizin.php

Line Number: 72

Backtrace:

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/views/blog/grafikizin.php<br />

Line: 72<br />

Function: _error_handler

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/application/controllers/Grafikizin.php<br />

Line: 91<br />

Function: view

<p style="margin-left:10px">

File: /var/www/perizinan/ptsp/index.php<br />

Line: 294<br />

Function: require_once

</div><option value='12'></option> </select>

</div>-->

Reference

CWE Id200
WASC Id13
Source ID3
Informational (Medium)Content-Type Header Missing
Description

The Content-Type header was either missing or empty.

URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/frontend/fonts/fontawesome-webfont.woff2?v=4.7.0
MethodGET
Instances1
Solution

Ensure each page is setting the specific and appropriate content-type value for the content being delivered.

Reference

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

CWE Id345
WASC Id12
Source ID3
Informational (Low)Timestamp Disclosure - Unix
Description

A timestamp was disclosed by the application/web server - Unix

URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000200
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000030
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000397
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000283
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000353
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000106
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/210207083338_25_4_SURAT_PERNYATAAN_PENYEHAT_TRADISIONAL.pdf
MethodGET
Evidence0000000053
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000074
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000188
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000244
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000300
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000359
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/210207081813_25_1_SURAT_PERNYATAAN_PENYEHAT_TRADISIONAL.pdf
MethodGET
Evidence0000000051
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000130
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/210207075556_25_1_Surat_Permohonan_Pendaftaran_Penyehat_Tradisional.pdf
MethodGET
Evidence0000000020
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000036
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000000383
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/210207075556_25_1_Surat_Permohonan_Pendaftaran_Penyehat_Tradisional.pdf
MethodGET
Evidence0000000034
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/171213084325_11_1_FORMAT_SOSIALISASI.pdf
MethodGET
Evidence0000094245
URLhttp://ptsp.sumedangkab.go.id/global/persyaratan_izin/210207083008_25_4_Surat_Permohonan_Pendaftaran_Penyehat_Tradisional.pdf
MethodGET
Evidence0000000020
Instances707
Solution

Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

Other information

0000000200, which evaluates to: 1970-01-01 07:03:20

Reference

http://projects.webappsec.org/w/page/13246936/Information%20Leakage

CWE Id200
WASC Id13
Source ID3
Informational (Low)Timestamp Disclosure - Unix
Description

A timestamp was disclosed by the application/web server - Unix

URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/7._Renja_DPMPTSP_2021.pdf
MethodGET
Evidence0000002488
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/7._Renja_DPMPTSP_2021.pdf
MethodGET
Evidence0000001620
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/7._Renja_DPMPTSP_2021.pdf
MethodGET
Evidence0000002192
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0001687955
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/7._Renja_DPMPTSP_2021.pdf
MethodGET
Evidence0000000867
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000005326
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000000194
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000007085
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/7._Renja_DPMPTSP_2021.pdf
MethodGET
Evidence0000000571
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/7._Renja_DPMPTSP_2021.pdf
MethodGET
Evidence0000003041
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000005264
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/7._Renja_DPMPTSP_2021.pdf
MethodGET
Evidence0000000929
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/jszip/dist/jszip.min.js
MethodGET
Evidence453092731
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000002699
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000003452
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000006879
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000007009
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000000256
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000006609
URLhttps://ptsp.sumedangkab.go.id/ptsp/data/download/PERBUP_No._77_Tahun_2019_Tentang_Renstra_DPMPTSP_2018-2023.pdf
MethodGET
Evidence0000003390
Instances12680
Solution

Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.

Other information

0000002488, which evaluates to: 1970-01-01 07:41:28

Reference

http://projects.webappsec.org/w/page/13246936/Information%20Leakage

CWE Id200
WASC Id13
Source ID3
Informational (Low)Information Disclosure - Suspicious Comments
Description

The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments.

URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/raphael-min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/verifikasi
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/custom.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/typeahead.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/select2/select2.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/rickshaw/vendor/d3.v3.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/jquery/dist/jquery.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/persyaratan
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/pdfmake/build/pdfmake.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/gsap/main-gsap.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/js/jquery.nicescroll.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/js/count-to.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/selectboxit/jquery.selectBoxIt.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/admin/js/vendors/datatables.net-buttons/js/buttons.html5.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/js/owl.carousel.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/bootstrap-datepicker.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/neon-chat.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/blog/js/jquery-2.1.1.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/neon/neon-admin/assets/js/jquery-ui/js/jquery-ui-1.10.3.minimal.min.js
MethodGET
URLhttps://ptsp.sumedangkab.go.id/ptsp/asset/list/scripts/markerclusterer.js
MethodGET
Instances58
Solution

Remove all comments that return information that may help an attacker and fix any underlying problems they refer to.

Other information

The following comment/snippet was identified via the pattern: \bDB\b

!function(a){var b,c,d="0.4.2",e="hasOwnProperty",f=/[\.\/]/,g="*",h=function(){},i=function(a,b){return a-b},j={n:{}},k=function(a,d){a=String(a);var e,f=c,g=Array.prototype.slice.call(arguments,2),h=k.listeners(a),j=0,l=[],m={},n=[],o=b;b=a,c=0;for(var p=0,q=h.length;q>p;p++)"zIndex"in h[p]&&(l.push(h[p].zIndex),h[p].zIndex<0&&(m[h[p].zIndex]=h[p]));for(l.sort(i);l[j]<0;)if(e=m[l[j++]],n.push(e.apply(d,g)),c)return c=f,n;for(p=0;q>p;p++)if(e=h[p],"zIndex"in e)if(e.zIndex==l[j]){if(n.push(e.apply(d,g)),c)break;do if(j++,e=m[l[j]],e&&n.push(e.apply(d,g)),c)break;while(e)}else m[e.zIndex]=e;else if(n.push(e.apply(d,g)),c)break;return c=f,b=o,n.length?n:null};k._events=j,k.listeners=function(a){var b,c,d,e,h,i,k,l,m=a.split(f),n=j,o=[n],p=[];for(e=0,h=m.length;h>e;e++){for(l=[],i=0,k=o.length;k>i;i++)for(n=o[i].n,c=[n[m[e]],n[g]],d=2;d--;)b=c[d],b&&(l.push(b),p=p.concat(b.f||[]));o=l}return p},k.on=function(a,b){if(a=String(a),"function"!=typeof b)return function(){};for(var c=a.split(f),d=j,e=0,g=c.length;g>e;e++)d=d.n,d=d.hasOwnProperty(c[e])&&d[c[e]]||(d[c[e]]={n:{}});for(d.f=d.f||[],e=0,g=d.f.length;g>e;e++)if(d.f[e]==b)return h;return d.f.push(b),function(a){+a==+a&&(b.zIndex=+a)}},k.f=function(a){var b=[].slice.call(arguments,1);return function(){k.apply(null,[a,null].concat(b).concat([].slice.call(arguments,0)))}},k.stop=function(){c=1},k.nt=function(a){return a?new RegExp("(?:\\.|\\/|^)"+a+"(?:\\.|\\/|$)").test(b):b},k.nts=function(){return b.split(f)},k.off=k.unbind=function(a,b){if(!a)return k._events=j={n:{}},void 0;var c,d,h,i,l,m,n,o=a.split(f),p=[j];for(i=0,l=o.length;l>i;i++)for(m=0;m<p.length;m+=h.length-2){if(h=[m,1],c=p[m].n,o[i]!=g)c[o[i]]&&h.push(c[o[i]]);else for(d in c)c[e](d)&&h.push(c[d]);p.splice.apply(p,h)}for(i=0,l=p.length;l>i;i++)for(c=p[i];c.n;){if(b){if(c.f){for(m=0,n=c.f.length;n>m;m++)if(c.f[m]==b){c.f.splice(m,1);break}!c.f.length&&delete c.f}for(d in c.n)if(c.n[e](d)&&c.n[d].f){var q=c.n[d].f;for(m=0,n=q.length;n>m;m++)if(q[m]==b){q.splice(m,1);break}!q.length&&delete c.n[d].f}}else{delete c.f;for(d in c.n)c.n[e](d)&&c.n[d].f&&delete c.n[d].f}c=c.n}},k.once=function(a,b){var c=function(){return k.unbind(a,c),b.apply(this,arguments)};return k.on(a,c)},k.version=d,k.toString=function(){return"You are running Eve "+d},"undefined"!=typeof module&&module.exports?module.exports=k:"undefined"!=typeof define?define("eve",[],function(){return k}):a.eve=k}(this),function(a,b){"function"==typeof define&&define.amd?define(["eve"],function(c){return b(a,c)}):b(a,a.eve)}(this,function(a,b){function c(a){if(c.is(a,"function"))return u?a():b.on("raphael.DOMload",a);if(c.is(a,V))return c._engine.create[D](c,a.splice(0,3+c.is(a[0],T))).add(a);var d=Array.prototype.slice.call(arguments,0);if(c.is(d[d.length-1],"function")){var e=d.pop();return u?e.call(c._engine.create[D](c,d)):b.on("raphael.DOMload",function(){e.call(c._engine.create[D](c,d))})}return c._engine.create[D](c,arguments)}function d(a){if("function"==typeof a||Object(a)!==a)return a;var b=new a.constructor;for(var c in a)a[z](c)&&(b[c]=d(a[c]));return b}function e(a,b){for(var c=0,d=a.length;d>c;c++)if(a[c]===b)return a.push(a.splice(c,1)[0])}function f(a,b,c){function d(){var f=Array.prototype.slice.call(arguments,0),g=f.join("␀"),h=d.cache=d.cache||{},i=d.count=d.count||[];return h[z](g)?(e(i,g),c?c(h[g]):h[g]):(i.length>=1e3&&delete h[i.shift()],i.push(g),h[g]=a[D](b,f),c?c(h[g]):h[g])}return d}function g(){return this.hex}function h(a,b){for(var c=[],d=0,e=a.length;e-2*!b>d;d+=2){var f=[{x:+a[d-2],y:+a[d-1]},{x:+a[d],y:+a[d+1]},{x:+a[d+2],y:+a[d+3]},{x:+a[d+4],y:+a[d+5]}];b?d?e-4==d?f[3]={x:+a[0],y:+a[1]}:e-2==d&&(f[2]={x:+a[0],y:+a[1]},f[3]={x:+a[2],y:+a[3]}):f[0]={x:+a[e-2],y:+a[e-1]}:e-4==d?f[3]=f[2]:d||(f[0]={x:+a[d],y:+a[d+1]}),c.push(["C",(-f[0].x+6*f[1].x+f[2].x)/6,(-f[0].y+6*f[1].y+f[2].y)/6,(f[1].x+6*f[2].x-f[3].x)/6,(f[1].y+6*f[2].y-f[3].y)/6,f[2].x,f[2].y])}return c}function i(a,b,c,d,e){var f=-3*b+9*c-9*d+3*e,g=a*f+6*b-12*c+6*d;return a*g-3*b+3*c}function j(a,b,c,d,e,f,g,h,j){null==j&&(j=1),j=j>1?1:0>j?0:j;for(var k=j/2,l=12,m=[-.1252,.1252,-.3678,.3678,-.5873,.5873,-.7699,.7699,-.9041,.9041,-.9816,.9816],n=[.2491,.2491,.2335,.2335,.2032,.2032,.1601,.1601,.1069,.1069,.0472,.0472],o=0,p=0;l>p;p++){var q=k*m[p]+k,r=i(q,a,c,e,g),s=i(q,b,d,f,h),t=r*r+s*s;o+=n[p]*N.sqrt(t)}return k*o}function k(a,b,c,d,e,f,g,h,i){if(!(0>i||j(a,b,c,d,e,f,g,h)<i)){var k,l=1,m=l/2,n=l-m,o=.01;for(k=j(a,b,c,d,e,f,g,h,n);Q(k-i)>o;)m/=2,n+=(i>k?1:-1)*m,k=j(a,b,c,d,e,f,g,h,n);return n}}function l(a,b,c,d,e,f,g,h){if(!(O(a,c)<P(e,g)||P(a,c)>O(e,g)||O(b,d)<P(f,h)||P(b,d)>O(f,h))){var i=(a*d-b*c)*(e-g)-(a-c)*(e*h-f*g),j=(a*d-b*c)*(f-h)-(b-d)*(e*h-f*g),k=(a-c)*(f-h)-(b-d)*(e-g);if(k){var l=i/k,m=j/k,n=+l.toFixed(2),o=+m.toFixed(2);if(!(n<+P(a,c).toFixed(2)||n>+O(a,c).toFixed(2)||n<+P(e,g).toFixed(2)||n>+O(e,g).toFixed(2)||o<+P(b,d).toFixed(2)||o>+O(b,d).toFixed(2)||o<+P(f,h).toFixed(2)||o>+O(f,h).toFixed(2)))return{x:l,y:m}}}}function m(a,b,d){var e=c.bezierBBox(a),f=c.bezierBBox(b);if(!c.isBBoxIntersect(e,f))return d?0:[];for(var g=j.apply(0,a),h=j.apply(0,b),i=O(~~(g/5),1),k=O(~~(h/5),1),m=[],n=[],o={},p=d?0:[],q=0;i+1>q;q++){var r=c.findDotsAtSegment.apply(c,a.concat(q/i));m.push({x:r.x,y:r.y,t:q/i})}for(q=0;k+1>q;q++)r=c.findDotsAtSegment.apply(c,b.concat(q/k)),n.push({x:r.x,y:r.y,t:q/k});for(q=0;i>q;q++)for(var s=0;k>s;s++){var t=m[q],u=m[q+1],v=n[s],w=n[s+1],x=Q(u.x-t.x)<.001?"y":"x",y=Q(w.x-v.x)<.001?"y":"x",z=l(t.x,t.y,u.x,u.y,v.x,v.y,w.x,w.y);if(z){if(o[z.x.toFixed(4)]==z.y.toFixed(4))continue;o[z.x.toFixed(4)]=z.y.toFixed(4);var A=t.t+Q((z[x]-t[x])/(u[x]-t[x]))*(u.t-t.t),B=v.t+Q((z[y]-v[y])/(w[y]-v[y]))*(w.t-v.t);A>=0&&1.001>=A&&B>=0&&1.001>=B&&(d?p++:p.push({x:z.x,y:z.y,t1:P(A,1),t2:P(B,1)}))}}return p}function n(a,b,d){a=c._path2curve(a),b=c._path2curve(b);for(var e,f,g,h,i,j,k,l,n,o,p=d?0:[],q=0,r=a.length;r>q;q++){var s=a[q];if("M"==s[0])e=i=s[1],f=j=s[2];else{"C"==s[0]?(n=[e,f].concat(s.slice(1)),e=n[6],f=n[7]):(n=[e,f,e,f,i,j,i,j],e=i,f=j);for(var t=0,u=b.length;u>t;t++){var v=b[t];if("M"==v[0])g=k=v[1],h=l=v[2];else{"C"==v[0]?(o=[g,h].concat(v.slice(1)),g=o[6],h=o[7]):(o=[g,h,g,h,k,l,k,l],g=k,h=l);var w=m(n,o,d);if(d)p+=w;else{for(var x=0,y=w.length;y>x;x++)w[x].segment1=q,w[x].segment2=t,w[x].bez1=n,w[x].bez2=o;p=p.concat(w)}}}}}return p}function o(a,b,c,d,e,f){null!=a?(this.a=+a,this.b=+b,this.c=+c,this.d=+d,this.e=+e,this.f=+f):(this.a=1,this.b=0,this.c=0,this.d=1,this.e=0,this.f=0)}function p(){return this.x+H+this.y+H+this.width+" × "+this.height}function q(a,b,c,d,e,f){function g(a){return((l*a+k)*a+j)*a}function h(a,b){var c=i(a,b);return((o*c+n)*c+m)*c}function i(a,b){var c,d,e,f,h,i;for(e=a,i=0;8>i;i++){if(f=g(e)-a,Q(f)<b)return e;if(h=(3*l*e+2*k)*e+j,Q(h)<1e-6)break;e-=f/h}if(c=0,d=1,e=a,c>e)return c;if(e>d)return d;for(;d>c;){if(f=g(e),Q(f-a)<b)return e;a>f?c=e:d=e,e=(d-c)/2+c}return e}var j=3*b,k=3*(d-b)-j,l=1-j-k,m=3*c,n=3*(e-c)-m,o=1-m-n;return h(a,1/(200*f))}function r(a,b){var c=[],d={};if(this.ms=b,this.times=1,a){for(var e in a)a[z](e)&&(d[_(e)]=a[e],c.push(_(e)));c.sort(lb)}this.anim=d,this.top=c[c.length-1],this.percents=c}function s(a,d,e,f,g,h){e=_(e);var i,j,k,l,m,n,p=a.ms,r={},s={},t={};if(f)for(v=0,x=ic.length;x>v;v++){var u=ic[v];if(u.el.id==d.id&&u.anim==a){u.percent!=e?(ic.splice(v,1),k=1):j=u,d.attr(u.totalOrigin);break}}else f=+s;for(var v=0,x=a.percents.length;x>v;v++){if(a.percents[v]==e||a.percents[v]>f*a.top){e=a.percents[v],m=a.percents[v-1]||0,p=p/a.top*(e-m),l=a.percents[v+1],i=a.anim[e];break}f&&d.attr(a.anim[a.percents[v]])}if(i){if(j)j.initstatus=f,j.start=new Date-j.ms*f;else{for(var y in i)if(i[z](y)&&(db[z](y)||d.paper.customAttributes[z](y)))switch(r[y]=d.attr(y),null==r[y]&&(r[y]=cb[y]),s[y]=i[y],db[y]){case T:t[y]=(s[y]-r[y])/p;break;case"colour":r[y]=c.getRGB(r[y]);var A=c.getRGB(s[y]);t[y]={r:(A.r-r[y].r)/p,g:(A.g-r[y].g)/p,b:(A.b-r[y].b)/p};break;case"path":var B=Kb(r[y],s[y]),C=B[1];for(r[y]=B[0],t[y]=[],v=0,x=r[y].length;x>v;v++){t[y][v]=[0];for(var D=1,F=r[y][v].length;F>D;D++)t[y][v][D]=(C[v][D]-r[y][v][D])/p}break;case"transform":var G=d._,H=Pb(G[y],s[y]);if(H)for(r[y]=H.from,s[y]=H.to,t[y]=[],t[y].real=!0,v=0,x=r[y].length;x>v;v++)for(t[y][v]=[r[y][v][0]],D=1,F=r[y][v].length;F>D;D++)t[y][v][D]=(s[y][v][D]-r[y][v][D])/p;else{var K=d.matrix||new o,L={_:{transform:G.transform},getBBox:function(){return d.getBBox(1)}};r[y]=[K.a,K.b,K.c,K.d,K.e,K.f],Nb(L,s[y]),s[y]=L._.transform,t[y]=[(L.matrix.a-K.a)/p,(L.matrix.b-K.b)/p,(L.matrix.c-K.c)/p,(L.matrix.d-K.d)/p,(L.matrix.e-K.e)/p,(L.matrix.f-K.f)/p]}break;case"csv":var M=I(i[y])[J](w),N=I(r[y])[J](w);if("clip-rect"==y)for(r[y]=N,t[y]=[],v=N.length;v--;)t[y][v]=(M[v]-r[y][v])/p;s[y]=M;break;default:for(M=[][E](i[y]),N=[][E](r[y]),t[y]=[],v=d.paper.customAttributes[y].length;v--;)t[y][v]=((M[v]||0)-(N[v]||0))/p}var O=i.easing,P=c.easing_formulas[O];if(!P)if(P=I(O).match(Z),P&&5==P.length){var Q=P;P=function(a){return q(a,+Q[1],+Q[2],+Q[3],+Q[4],p)}}else P=nb;if(n=i.start||a.start||+new Date,u={anim:a,percent:e,timestamp:n,start:n+(a.del||0),status:0,initstatus:f||0,stop:!1,ms:p,easing:P,from:r,diff:t,to:s,el:d,callback:i.callback,prev:m,next:l,repeat:h||a.times,origin:d.attr(),totalOrigin:g},ic.push(u),f&&!j&&!k&&(u.stop=!0,u.start=new Date-p*f,1==ic.length))return kc();k&&(u.start=new Date-u.ms*f),1==ic.length&&jc(kc)}b("raphael.anim.start."+d.id,d,a)}}function t(a){for(var b=0;b<ic.length;b++)ic[b].el.paper==a&&ic.splice(b--,1)}c.version="2.1.2",c.eve=b;var u,v,w=/[, ]+/,x={circle:1,rect:1,path:1,ellipse:1,text:1,image:1},y=/\{(\d+)\}/g,z="hasOwnProperty",A={doc:document,win:a},B={was:Object.prototype[z].call(A.win,"Raphael"),is:A.win.Raphael},C=function(){this.ca=this.customAttributes={}},D="apply",E="concat",F="ontouchstart"in A.win||A.win.DocumentTouch&&A.doc instanceof DocumentTouch,G="",H=" ",I=String,J="split",K="click dblclick mousedown mousemove mouseout mouseover mouseup touchstart touchmove touchend touchcancel"[J](H),L={mousedown:"touchstart",mousemove:"touchmove",mouseup:"touchend"},M=I.prototype.toLowerCase,N=Math,O=N.max,P=N.min,Q=N.abs,R=N.pow,S=N.PI,T="number",U="string",V="array",W=Object.prototype.toString,X=(c._ISURL=/^url\(['"]?([^\)]+?)['"]?\)$/i,/^\s*((#[a-f\d]{6})|(#[a-f\d]{3})|rgba?\(\s*([\d\.]+%?\s*,\s*[\d\.]+%?\s*,\s*[\d\.]+%?(?:\s*,\s*[\d\.]+%?)?)\s*\)|hsba?\(\s*([\d\.]+(?:deg|\xb0|%)?\s*,\s*[\d\.]+%?\s*,\s*[\d\.]+(?:%?\s*,\s*[\d\.]+)?)%?\s*\)|hsla?\(\s*([\d\.]+(?:deg|\xb0|%)?\s*,\s*[\d\.]+%?\s*,\s*[\d\.]+(?:%?\s*,\s*[\d\.]+)?)%?\s*\))\s*$/i),Y={NaN:1,Infinity:1,"-Infinity":1},Z=/^(?:cubic-)?bezier\(([^,]+),([^,]+),([^,]+),([^\)]+)\)/,$=N.round,_=parseFloat,ab=parseInt,bb=I.prototype.toUpperCase,cb=c._availableAttrs={"arrow-end":"none","arrow-start":"none",blur:0,"clip-rect":"0 0 1e9 1e9",cursor:"default",cx:0,cy:0,fill:"#fff","fill-opacity":1,font:'10px "Arial"',"font-family":'"Arial"',"font-size":"10","font-style":"normal","font-weight":400,gradient:0,height:0,href:"http://raphaeljs.com/","letter-spacing":0,opacity:1,path:"M0,0",r:0,rx:0,ry:0,src:"",stroke:"#000","stroke-dasharray":"","stroke-linecap":"butt","stroke-linejoin":"butt","stroke-miterlimit":0,"stroke-opacity":1,"stroke-width":1,target:"_blank","text-anchor":"middle",title:"Raphael",transform:"",width:0,x:0,y:0},db=c._availableAnimAttrs={blur:T,"clip-rect":"csv",cx:T,cy:T,fill:"colour","fill-opacity":T,"font-size":T,height:T,opacity:T,path:"path",r:T,rx:T,ry:T,stroke:"colour","stroke-opacity":T,"stroke-width":T,transform:"transform",width:T,x:T,y:T},eb=/[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*,[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*/,fb={hs:1,rg:1},gb=/,?([achlmqrstvxz]),?/gi,hb=/([achlmrqstvz])[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029,]*((-?\d*\.?\d*(?:e[\-+]?\d+)?[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*,?[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*)+)/gi,ib=/([rstm])[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029,]*((-?\d*\.?\d*(?:e[\-+]?\d+)?[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*,?[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*)+)/gi,jb=/(-?\d*\.?\d*(?:e[\-+]?\d+)?)[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*,?[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*/gi,kb=(c._radial_gradient=/^r(?:\(([^,]+?)[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*,[\x09\x0a\x0b\x0c\x0d\x20\xa0\u1680\u180e\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029]*([^\)]+?)\))?/,{}),lb=function(a,b){return _(a)-_(b)},mb=function(){},nb=function(a){return a},ob=c._rectPath=function(a,b,c,d,e){return e?[["M",a+e,b],["l",c-2*e,0],["a",e,e,0,0,1,e,e],["l",0,d-2*e],["a",e,e,0,0,1,-e,e],["l",2*e-c,0],["a",e,e,0,0,1,-e,-e],["l",0,2*e-d],["a",e,e,0,0,1,e,-e],["z"]]:[["M",a,b],["l",c,0],["l",0,d],["l",-c,0],["z"]]},pb=function(a,b,c,d){return null==d&&(d=c),[["M",a,b],["m",0,-d],["a",c,d,0,1,1,0,2*d],["a",c,d,0,1,1,0,-2*d],["z"]]},qb=c._getPath={path:function(a){return a.attr("path")},circle:function(a){var b=a.attrs;return pb(b.cx,b.cy,b.r)},ellipse:function(a){var b=a.attrs;return pb(b.cx,b.cy,b.rx,b.ry)},rect:function(a){var b=a.attrs;return ob(b.x,b.y,b.width,b.height,b.r)},image:function(a){var b=a.attrs;return ob(b.x,b.y,b.width,b.height)},text:function(a){var b=a._getBBox();return ob(b.x,b.y,b.width,b.height)},set:function(a){var b=a._getBBox();return ob(b.x,b.y,b.width,b.height)}},rb=c.mapPath=function(a,b){if(!b)return a;var c,d,e,f,g,h,i;for(a=Kb(a),e=0,g=a.length;g>e;e++)for(i=a[e],f=1,h=i.length;h>f;f+=2)c=b.x(i[f],i[f+1]),d=b.y(i[f],i[f+1]),i[f]=c,i[f+1]=d;return a};if(c._g=A,c.type=A.win.SVGAngle||A.doc.implementation.hasFeature("http://www.w3.org/TR/SVG11/feature#BasicStructure","1.1")?"SVG":"VML","VML"==c.type){var sb,tb=A.doc.createElement("div");if(tb.innerHTML='<v:shape adj="1"/>',sb=tb.firstChild,sb.style.behavior="url(#default#VML)",!sb||"object"!=typeof sb.adj)return c.type=G;tb=null}c.svg=!(c.vml="VML"==c.type),c._Paper=C,c.fn=v=C.prototype=c.prototype,c._id=0,c._oid=0,c.is=function(a,b){return b=M.call(b),"finite"==b?!Y[z](+a):"array"==b?a instanceof Array:"null"==b&&null===a||b==typeof a&&null!==a||"object"==b&&a===Object(a)||"array"==b&&Array.isArray&&Array.isArray(a)||W.call(a).slice(8,-1).toLowerCase()==b},c.angle=function(a,b,d,e,f,g){if(null==f){var h=a-d,i=b-e;return h||i?(180+180*N.atan2(-i,-h)/S+360)%360:0}return c.angle(a,b,f,g)-c.angle(d,e,f,g)},c.rad=function(a){return a%360*S/180},c.deg=function(a){return 180*a/S%360},c.snapTo=function(a,b,d){if(d=c.is(d,"finite")?d:10,c.is(a,V)){for(var e=a.length;e--;)if(Q(a[e]-b)<=d)return a[e]}else{a=+a;var f=b%a;if(d>f)return b-f;if(f>a-d)return b-f+a}return b},c.createUUID=function(a,b){return function(){return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(a,b).toUpperCase()}}(/[xy]/g,function(a){var b=0|16*N.random(),c="x"==a?b:8|3&b;return c.toString(16)}),c.setWindow=function(a){b("raphael.setWindow",c,A.win,a),A.win=a,A.doc=A.win.document,c._engine.initWin&&c._engine.initWin(A.win)};var ub=function(a){if(c.vml){var b,d=/^\s+|\s+$/g;try{var e=new ActiveXObject("htmlfile");e.write("<body>"),e.close(),b=e.body}catch(g){b=createPopup().document.body}var h=b.createTextRange();ub=f(function(a){try{b.style.color=I(a).replace(d,G);var c=h.queryCommandValue("ForeColor");return c=(255&c)<<16|65280&c|(16711680&c)>>>16,"#"+("000000"+c.toString(16)).slice(-6)}catch(e){return"none"}})}else{var i=A.doc.createElement("i");i.title="Raphaël Colour Picker",i.style.display="none",A.doc.body.appendChild(i),ub=f(function(a){return i.style.color=a,A.doc.defaultView.getComputedStyle(i,G).getPropertyValue("color")})}return ub(a)},vb=function(){return"hsb("+[this.h,this.s,this.b]+")"},wb=function(){return"hsl("+[this.h,this.s,this.l]+")"},xb=function(){return this.hex},yb=function(a,b,d){if(null==b&&c.is(a,"object")&&"r"in a&&"g"in a&&"b"in a&&(d=a.b,b=a.g,a=a.r),null==b&&c.is(a,U)){var e=c.getRGB(a);a=e.r,b=e.g,d=e.b}return(a>1||b>1||d>1)&&(a/=255,b/=255,d/=255),[a,b,d]},zb=function(a,b,d,e){a*=255,b*=255,d*=255;var f={r:a,g:b,b:d,hex:c.rgb(a,b,d),toString:xb};return c.is(e,"finite")&&(f.opacity=e),f};c.color=function(a){var b;return c.is(a,"object")&&"h"in a&&"s"in a&&"b"in a?(b=c.hsb2rgb(a),a.r=b.r,a.g=b.g,a.b=b.b,a.hex=b.hex):c.is(a,"object")&&"h"in a&&"s"in a&&"l"in a?(b=c.hsl2rgb(a),a.r=b.r,a.g=b.g,a.b=b.b,a.hex=b.hex):(c.is(a,"string")&&(a=c.getRGB(a)),c.is(a,"object")&&"r"in a&&"g"in a&&"b"in a?(b=c.rgb2hsl(a),a.h=b.h,a.s=b.s,a.l=b.l,b=c.rgb2hsb(a),a.v=b.b):(a={hex:"none"},a.r=a.g=a.b=a.h=a.s=a.v=a.l=-1)),a.toString=xb,a},c.hsb2rgb=function(a,b,c,d){this.is(a,"object")&&"h"in a&&"s"in a&&"b"in a&&(c=a.b,b=a.s,a=a.h,d=a.o),a*=360;var e,f,g,h,i;return a=a%360/60,i=c*b,h=i*(1-Q(a%2-1)),e=f=g=c-i,a=~~a,e+=[i,h,0,0,h,i][a],f+=[h,i,i,h,0,0][a],g+=[0,0,h,i,i,h][a],zb(e,f,g,d)},c.hsl2rgb=function(a,b,c,d){this.is(a,"object")&&"h"in a&&"s"in a&&"l"in a&&(c=a.l,b=a.s,a=a.h),(a>1||b>1||c>1)&&(a/=360,b/=100,c/=100),a*=360;var e,f,g,h,i;return a=a%360/60,i=2*b*(.5>c?c:1-c),h=i*(1-Q(a%2-1)),e=f=g=c-i/2,a=~~a,e+=[i,h,0,0,h,i][a],f+=[h,i,i,h,0,0][a],g+=[0,0,h,i,i,h][a],zb(e,f,g,d)},c.rgb2hsb=function(a,b,c){c=yb(a,b,c),a=c[0],b=c[1],c=c[2];var d,e,f,g;return f=O(a,b,c),g=f-P(a,b,c),d=0==g?null:f==a?(b-c)/g:f==b?(c-a)/g+2:(a-b)/g+4,d=60*((d+360)%6)/360,e=0==g?0:g/f,{h:d,s:e,b:f,toString:vb}},c.rgb2hsl=function(a,b,c){c=yb(a,b,c),a=c[0],b=c[1],c=c[2];var d,e,f,g,h,i;return g=O(a,b,c),h=P(a,b,c),i=g-h,d=0==i?null:g==a?(b-c)/i:g==b?(c-a)/i+2:(a-b)/i+4,d=60*((d+360)%6)/360,f=(g+h)/2,e=0==i?0:.5>f?i/(2*f):i/(2-2*f),{h:d,s:e,l:f,toString:wb}},c._path2string=function(){return this.join(",").replace(gb,"$1")},c._preload=function(a,b){var c=A.doc.createElement("img");c.style.cssText="position:absolute;left:-9999em;top:-9999em",c.onload=function(){b.call(this),this.onload=null,A.doc.body.removeChild(this)},c.onerror=function(){A.doc.body.removeChild(this)},A.doc.body.appendChild(c),c.src=a},c.getRGB=f(function(a){if(!a||(a=I(a)).indexOf("-")+1)return{r:-1,g:-1,b:-1,hex:"none",error:1,toString:g};if("none"==a)return{r:-1,g:-1,b:-1,hex:"none",toString:g};!(fb[z](a.toLowerCase().substring(0,2))||"#"==a.charAt())&&(a=ub(a));var b,d,e,f,h,i,j=a.match(X);return j?(j[2]&&(e=ab(j[2].substring(5),16),d=ab(j[2].substring(3,5),16),b=ab(j[2].substring(1,3),16)),j[3]&&(e=ab((h=j[3].charAt(3))+h,16),d=ab((h=j[3].charAt(2))+h,16),b=ab((h=j[3].charAt(1))+h,16)),j[4]&&(i=j[4][J](eb),b=_(i[0]),"%"==i[0].slice(-1)&&(b*=2.55),d=_(i[1]),"%"==i[1].slice(-1)&&(d*=2.55),e=_(i[2]),"%"==i[2].slice(-1)&&(e*=2.55),"rgba"==j[1].toLowerCase().slice(0,4)&&(f=_(i[3])),i[3]&&"%"==i[3].slice(-1)&&(f/=100)),j[5]?(i=j[5][J](eb),b=_(i[0]),"%"==i[0].slice(-1)&&(b*=2.55),d=_(i[1]),"%"==i[1].slice(-1)&&(d*=2.55),e=_(i[2]),"%"==i[2].slice(-1)&&(e*=2.55),("deg"==i[0].slice(-3)||"°"==i[0].slice(-1))&&(b/=360),"hsba"==j[1].toLowerCase().slice(0,4)&&(f=_(i[3])),i[3]&&"%"==i[3].slice(-1)&&(f/=100),c.hsb2rgb(b,d,e,f)):j[6]?(i=j[6][J](eb),b=_(i[0]),"%"==i[0].slice(-1)&&(b*=2.55),d=_(i[1]),"%"==i[1].slice(-1)&&(d*=2.55),e=_(i[2]),"%"==i[2].slice(-1)&&(e*=2.55),("deg"==i[0].slice(-3)||"°"==i[0].slice(-1))&&(b/=360),"hsla"==j[1].toLowerCase().slice(0,4)&&(f=_(i[3])),i[3]&&"%"==i[3].slice(-1)&&(f/=100),c.hsl2rgb(b,d,e,f)):(j={r:b,g:d,b:e,toString:g},j.hex="#"+(16777216|e|d<<8|b<<16).toString(16).slice(1),c.is(f,"finite")&&(j.opacity=f),j)):{r:-1,g:-1,b:-1,hex:"none",error:1,toString:g}},c),c.hsb=f(function(a,b,d){return c.hsb2rgb(a,b,d).hex}),c.hsl=f(function(a,b,d){return c.hsl2rgb(a,b,d).hex}),c.rgb=f(function(a,b,c){return"#"+(16777216|c|b<<8|a<<16).toString(16).slice(1)}),c.getColor=function(a){var b=this.getColor.start=this.getColor.start||{h:0,s:1,b:a||.75},c=this.hsb2rgb(b.h,b.s,b.b);return b.h+=.075,b.h>1&&(b.h=0,b.s-=.2,b.s<=0&&(this.getColor.start={h:0,s:1,b:b.b})),c.hex},c.getColor.reset=function(){delete this.start},c.parsePathString=function(a){if(!a)return null;var b=Ab(a);if(b.arr)return Cb(b.arr);var d={a:7,c:6,h:1,l:2,m:2,r:4,q:4,s:4,t:2,v:1,z:0},e=[];return c.is(a,V)&&c.is(a[0],V)&&(e=Cb(a)),e.length||I(a).replace(hb,function(a,b,c){var f=[],g=b.toLowerCase();if(c.replace(jb,function(a,b){b&&f.push(+b)}),"m"==g&&f.length>2&&(e.push([b][E](f.splice(0,2))),g="l",b="m"==b?"l":"L"),"r"==g)e.push([b][E](f));else for(;f.length>=d[g]&&(e.push([b][E](f.splice(0,d[g]))),d[g]););}),e.toString=c._path2string,b.arr=Cb(e),e},c.parseTransformString=f(function(a){if(!a)return null;var b=[];return c.is(a,V)&&c.is(a[0],V)&&(b=Cb(a)),b.length||I(a).replace(ib,function(a,c,d){var e=[];M.call(c),d.replace(jb,function(a,b){b&&e.push(+b)}),b.push([c][E](e))}),b.toString=c._path2string,b});var Ab=function(a){var b=Ab.ps=Ab.ps||{};return b[a]?b[a].sleep=100:b[a]={sleep:100},setTimeout(function(){for(var c in b)b[z](c)&&c!=a&&(b[c].sleep--,!b[c].sleep&&delete b[c])}),b[a]};c.findDotsAtSegment=function(a,b,c,d,e,f,g,h,i){var j=1-i,k=R(j,3),l=R(j,2),m=i*i,n=m*i,o=k*a+3*l*i*c+3*j*i*i*e+n*g,p=k*b+3*l*i*d+3*j*i*i*f+n*h,q=a+2*i*(c-a)+m*(e-2*c+a),r=b+2*i*(d-b)+m*(f-2*d+b),s=c+2*i*(e-c)+m*(g-2*e+c),t=d+2*i*(f-d)+m*(h-2*f+d),u=j*a+i*c,v=j*b+i*d,w=j*e+i*g,x=j*f+i*h,y=90-180*N.atan2(q-s,r-t)/S;return(q>s||t>r)&&(y+=180),{x:o,y:p,m:{x:q,y:r},n:{x:s,y:t},start:{x:u,y:v},end:{x:w,y:x},alpha:y}},c.bezierBBox=function(a,b,d,e,f,g,h,i){c.is(a,"array")||(a=[a,b,d,e,f,g,h,i]);var j=Jb.apply(null,a);return{x:j.min.x,y:j.min.y,x2:j.max.x,y2:j.max.y,width:j.max.x-j.min.x,height:j.max.y-j.min.y}},c.isPointInsideBBox=function(a,b,c){return b>=a.x&&b<=a.x2&&c>=a.y&&c<=a.y2},c.isBBoxIntersect=function(a,b){var d=c.isPointInsideBBox;return d(b,a.x,a.y)||d(b,a.x2,a.y)||d(b,a.x,a.y2)||d(b,a.x2,a.y2)||d(a,b.x,b.y)||d(a,b.x2,b.y)||d(a,b.x,b.y2)||d(a,b.x2,b.y2)||(a.x<b.x2&&a.x>b.x||b.x<a.x2&&b.x>a.x)&&(a.y<b.y2&&a.y>b.y||b.y<a.y2&&b.y>a.y)},c.pathIntersection=function(a,b){return n(a,b)},c.pathIntersectionNumber=function(a,b){return n(a,b,1)},c.isPointInsidePath=function(a,b,d){var e=c.pathBBox(a);return c.isPointInsideBBox(e,b,d)&&1==n(a,[["M",b,d],["H",e.x2+10]],1)%2},c._removedFactory=function(a){return function(){b("raphael.log",null,"Raphaël: you are calling to method “"+a+"” of removed object",a)}};var Bb=c.pathBBox=function(a){var b=Ab(a);if(b.bbox)return d(b.bbox);if(!a)return{x:0,y:0,width:0,height:0,x2:0,y2:0};a=Kb(a);for(var c,e=0,f=0,g=[],h=[],i=0,j=a.length;j>i;i++)if(c=a[i],"M"==c[0])e=c[1],f=c[2],g.push(e),h.push(f);else{var k=Jb(e,f,c[1],c[2],c[3],c[4],c[5],c[6]);g=g[E](k.min.x,k.max.x),h=h[E](k.min.y,k.max.y),e=c[5],f=c[6]}var l=P[D](0,g),m=P[D](0,h),n=O[D](0,g),o=O[D](0,h),p=n-l,q=o-m,r={x:l,y:m,x2:n,y2:o,width:p,height:q,cx:l+p/2,cy:m+q/2};return b.bbox=d(r),r},Cb=function(a){var b=d(a);return b.toString=c._path2string,b},Db=c._pathToRelative=function(a){var b=Ab(a);if(b.rel)return Cb(b.rel);c.is(a,V)&&c.is(a&&a[0],V)||(a=c.parsePathString(a));var d=[],e=0,f=0,g=0,h=0,i=0;"M"==a[0][0]&&(e=a[0][1],f=a[0][2],g=e,h=f,i++,d.push(["M",e,f]));for(var j=i,k=a.length;k>j;j++){var l=d[j]=[],m=a[j];if(m[0]!=M.call(m[0]))switch(l[0]=M.call(m[0]),l[0]){case"a":l[1]=m[1],l[2]=m[2],l[3]=m[3],l[4]=m[4],l[5]=m[5],l[6]=+(m[6]-e).toFixed(3),l[7]=+(m[7]-f).toFixed(3);break;case"v":l[1]=+(m[1]-f).toFixed(3);break;case"m":g=m[1],h=m[2];default:for(var n=1,o=m.length;o>n;n++)l[n]=+(m[n]-(n%2?e:f)).toFixed(3)}else{l=d[j]=[],"m"==m[0]&&(g=m[1]+e,h=m[2]+f);for(var p=0,q=m.length;q>p;p++)d[j][p]=m[p]}var r=d[j].length;switch(d[j][0]){case"z":e=g,f=h;break;case"h":e+=+d[j][r-1];break;case"v":f+=+d[j][r-1];break;default:e+=+d[j][r-2],f+=+d[j][r-1]}}return d.toString=c._path2string,b.rel=Cb(d),d},Eb=c._pathToAbsolute=function(a){var b=Ab(a);if(b.abs)return Cb(b.abs);if(c.is(a,V)&&c.is(a&&a[0],V)||(a=c.parsePathString(a)),!a||!a.length)return[["M",0,0]];var d=[],e=0,f=0,g=0,i=0,j=0;"M"==a[0][0]&&(e=+a[0][1],f=+a[0][2],g=e,i=f,j++,d[0]=["M",e,f]);for(var k,l,m=3==a.length&&"M"==a[0][0]&&"R"==a[1][0].toUpperCase()&&"Z"==a[2][0].toUpperCase(),n=j,o=a.length;o>n;n++){if(d.push(k=[]),l=a[n],l[0]!=bb.call(l[0]))switch(k[0]=bb.call(l[0]),k[0]){case"A":k[1]=l[1],k[2]=l[2],k[3]=l[3],k[4]=l[4],k[5]=l[5],k[6]=+(l[6]+e),k[7]=+(l[7]+f);break;case"V":k[1]=+l[1]+f;break;case"H":k[1]=+l[1]+e;break;case"R":for(var p=[e,f][E](l.slice(1)),q=2,r=p.length;r>q;q++)p[q]=+p[q]+e,p[++q]=+p[q]+f;d.pop(),d=d[E](h(p,m));break;case"M":g=+l[1]+e,i=+l[2]+f;default:for(q=1,r=l.length;r>q;q++)k[q]=+l[q]+(q%2?e:f)}else if("R"==l[0])p=[e,f][E](l.slice(1)),d.pop(),d=d[E](h(p,m)),k=["R"][E](l.slice(-2));else for(var s=0,t=l.length;t>s;s++)k[s]=l[s];switch(k[0]){case"Z":e=g,f=i;break;case"H":e=k[1];break;case"V":f=k[1];break;case"M":g=k[k.length-2],i=k[k.length-1];default:e=k[k.length-2],f=k[k.length-1]}}return d.toString=c._path2string,b.abs=Cb(d),d},Fb=function(a,b,c,d){return[a,b,c,d,c,d]},Gb=function(a,b,c,d,e,f){var g=1/3,h=2/3;return[g*a+h*c,g*b+h*d,g*e+h*c,g*f+h*d,e,f]},Hb=function(a,b,c,d,e,g,h,i,j,k){var l,m=120*S/180,n=S/180*(+e||0),o=[],p=f(function(a,b,c){var d=a*N.cos(c)-b*N.sin(c),e=a*N.sin(c)+b*N.cos(c);return{x:d,y:e}});if(k)y=k[0],z=k[1],w=k[2],x=k[3];else{l=p(a,b,-n),a=l.x,b=l.y,l=p(i,j,-n),i=l.x,j=l.y;var q=(N.cos(S/180*e),N.sin(S/180*e),(a-i)/2),r=(b-j)/2,s=q*q/(c*c)+r*r/(d*d);s>1&&(s=N.sqrt(s),c=s*c,d=s*d);var t=c*c,u=d*d,v=(g==h?-1:1)*N.sqrt(Q((t*u-t*r*r-u*q*q)/(t*r*r+u*q*q))),w=v*c*r/d+(a+i)/2,x=v*-d*q/c+(b+j)/2,y=N.asin(((b-x)/d).toFixed(9)),z=N.asin(((j-x)/d).toFixed(9));y=w>a?S-y:y,z=w>i?S-z:z,0>y&&(y=2*S+y),0>z&&(z=2*S+z),h&&y>z&&(y-=2*S),!h&&z>y&&(z-=2*S)}var A=z-y;if(Q(A)>m){var B=z,C=i,D=j;z=y+m*(h&&z>y?1:-1),i=w+c*N.cos(z),j=x+d*N.sin(z),o=Hb(i,j,c,d,e,0,h,C,D,[z,B,w,x])}A=z-y;var F=N.cos(y),G=N.sin(y),H=N.cos(z),I=N.sin(z),K=N.tan(A/4),L=4/3*c*K,M=4/3*d*K,O=[a,b],P=[a+L*G,b-M*F],R=[i+L*I,j-M*H],T=[i,j];if(P[0]=2*O[0]-P[0],P[1]=2*O[1]-P[1],k)return[P,R,T][E](o);o=[P,R,T][E](o).join()[J](",");for(var U=[],V=0,W=o.length;W>V;V++)U[V]=V%2?p(o[V-1],o[V],n).y:p(o[V],o[V+1],n).x;return U},Ib=function(a,b,c,d,e,f,g,h,i){var j=1-i;return{x:R(j,3)*a+3*R(j,2)*i*c+3*j*i*i*e+R(i,3)*g,y:R(j,3)*b+3*R(j,2)*i*d+3*j*i*i*f+R(i,3)*h}},Jb=f(function(a,b,c,d,e,f,g,h){var i,j=e-2*c+a-(g-2*e+c),k=2*(c-a)-2*(e-c),l=a-c,m=(-k+N.sqrt(k*k-4*j*l))/2/j,n=(-k-N.sqrt(k*k-4*j*l))/2/j,o=[b,h],p=[a,g];return Q(m)>"1e12"&&(m=.5),Q(n)>"1e12"&&(n=.5),m>0&&1>m&&(i=Ib(a,b,c,d,e,f,g,h,m),p.push(i.x),o.push(i.y)),n>0&&1>n&&(i=Ib(a,b,c,d,e,f,g,h,n),p.push(i.x),o.push(i.y)),j=f-2*d+b-(h-2*f+d),k=2*(d-b)-2*(f-d),l=b-d,m=(-k+N.sqrt(k*k-4*j*l))/2/j,n=(-k-N.sqrt(k*k-4*j*l))/2/j,Q(m)>"1e12"&&(m=.5),Q(n)>"1e12"&&(n=.5),m>0&&1>m&&(i=Ib(a,b,c,d,e,f,g,h,m),p.push(i.x),o.push(i.y)),n>0&&1>n&&(i=Ib(a,b,c,d,e,f,g,h,n),p.push(i.x),o.push(i.y)),{min:{x:P[D](0,p),y:P[D](0,o)},max:{x:O[D](0,p),y:O[D](0,o)}}}),Kb=c._path2curve=f(function(a,b){var c=!b&&Ab(a);if(!b&&c.curve)return Cb(c.curve);for(var d=Eb(a),e=b&&Eb(b),f={x:0,y:0,bx:0,by:0,X:0,Y:0,qx:null,qy:null},g={x:0,y:0,bx:0,by:0,X:0,Y:0,qx:null,qy:null},h=(function(a,b,c){var d,e;if(!a)return["C",b.x,b.y,b.x,b.y,b.x,b.y];switch(!(a[0]in{T:1,Q:1})&&(b.qx=b.qy=null),a[0]){case"M":b.X=a[1],b.Y=a[2];break;case"A":a=["C"][E](Hb[D](0,[b.x,b.y][E](a.slice(1))));break;case"S":"C"==c||"S"==c?(d=2*b.x-b.bx,e=2*b.y-b.by):(d=b.x,e=b.y),a=["C",d,e][E](a.slice(1));break;case"T":"Q"==c||"T"==c?(b.qx=2*b.x-b.qx,b.qy=2*b.y-b.qy):(b.qx=b.x,b.qy=b.y),a=["C"][E](Gb(b.x,b.y,b.qx,b.qy,a[1],a[2]));break;case"Q":b.qx=a[1],b.qy=a[2],a=["C"][E](Gb(b.x,b.y,a[1],a[2],a[3],a[4]));break;case"L":a=["C"][E](Fb(b.x,b.y,a[1],a[2]));break;case"H":a=["C"][E](Fb(b.x,b.y,a[1],b.y));break;case"V":a=["C"][E](Fb(b.x,b.y,b.x,a[1]));break;case"Z":a=["C"][E](Fb(b.x,b.y,b.X,b.Y))}return a}),i=function(a,b){if(a[b].length>7){a[b].shift();for(var c=a[b];c.length;)a.splice(b++,0,["C"][E](c.splice(0,6)));a.splice(b,1),l=O(d.length,e&&e.length||0)}},j=function(a,b,c,f,g){a&&b&&"M"==a[g][0]&&"M"!=b[g][0]&&(b.splice(g,0,["M",f.x,f.y]),c.bx=0,c.by=0,c.x=a[g][1],c.y=a[g][2],l=O(d.length,e&&e.length||0))},k=0,l=O(d.length,e&&e.length||0);l>k;k++){d[k]=h(d[k],f),i(d,k),e&&(e[k]=h(e[k],g)),e&&i(e,k),j(d,e,f,g,k),j(e,d,g,f,k);var m=d[k],n=e&&e[k],o=m.length,p=e&&n.length;f.x=m[o-2],f.y=m[o-1],f.bx=_(m[o-4])||f.x,f.by=_(m[o-3])||f.y,g.bx=e&&(_(n[p-4])||g.x),g.by=e&&(_(n[p-3])||g.y),g.x=e&&n[p-2],g.y=e&&n[p-1]}return e||(c.curve=Cb(d)),e?[d,e]:d},null,Cb),Lb=(c._parseDots=f(function(a){for(var b=[],d=0,e=a.length;e>d;d++){var f={},g=a[d].match(/^([^:]*):?([\d\.]*)/);if(f.color=c.getRGB(g[1]),f.color.error)return null;f.color=f.color.hex,g[2]&&(f.offset=g[2]+"%"),b.push(f)}for(d=1,e=b.length-1;e>d;d++)if(!b[d].offset){for(var h=_(b[d-1].offset||0),i=0,j=d+1;e>j;j++)if(b[j].offset){i=b[j].offset;break}i||(i=100,j=e),i=_(i);for(var k=(i-h)/(j-d+1);j>d;d++)h+=k,b[d].offset=h+"%"}return b}),c._tear=function(a,b){a==b.top&&(b.top=a.prev),a==b.bottom&&(b.bottom=a.next),a.next&&(a.next.prev=a.prev),a.prev&&(a.prev.next=a.next)}),Mb=(c._tofront=function(a,b){b.top!==a&&(Lb(a,b),a.next=null,a.prev=b.top,b.top.next=a,b.top=a)},c._toback=function(a,b){b.bottom!==a&&(Lb(a,b),a.next=b.bottom,a.prev=null,b.bottom.prev=a,b.bottom=a)},c._insertafter=function(a,b,c){Lb(a,c),b==c.top&&(c.top=a),b.next&&(b.next.prev=a),a.next=b.next,a.prev=b,b.next=a},c._insertbefore=function(a,b,c){Lb(a,c),b==c.bottom&&(c.bottom=a),b.prev&&(b.prev.next=a),a.prev=b.prev,b.prev=a,a.next=b},c.toMatrix=function(a,b){var c=Bb(a),d={_:{transform:G},getBBox:function(){return c}};return Nb(d,b),d.matrix}),Nb=(c.transformPath=function(a,b){return rb(a,Mb(a,b))},c._extractTransform=function(a,b){if(null==b)return a._.transform;b=I(b).replace(/\.{3}|\u2026/g,a._.transform||G);var d=c.parseTransformString(b),e=0,f=0,g=0,h=1,i=1,j=a._,k=new o;if(j.transform=d||[],d)for(var l=0,m=d.length;m>l;l++){var n,p,q,r,s,t=d[l],u=t.length,v=I(t[0]).toLowerCase(),w=t[0]!=v,x=w?k.invert():0;"t"==v&&3==u?w?(n=x.x(0,0),p=x.y(0,0),q=x.x(t[1],t[2]),r=x.y(t[1],t[2]),k.translate(q-n,r-p)):k.translate(t[1],t[2]):"r"==v?2==u?(s=s||a.getBBox(1),k.rotate(t[1],s.x+s.width/2,s.y+s.height/2),e+=t[1]):4==u&&(w?(q=x.x(t[2],t[3]),r=x.y(t[2],t[3]),k.rotate(t[1],q,r)):k.rotate(t[1],t[2],t[3]),e+=t[1]):"s"==v?2==u||3==u?(s=s||a.getBBox(1),k.scale(t[1],t[u-1],s.x+s.width/2,s.y+s.height/2),h*=t[1],i*=t[u-1]):5==u&&(w?(q=x.x(t[3],t[4]),r=x.y(t[3],t[4]),k.scale(t[1],t[2],q,r)):k.scale(t[1],t[2],t[3],t[4]),h*=t[1],i*=t[2]):"m"==v&&7==u&&k.add(t[1],t[2],t[3],t[4],t[5],t[6]),j.dirtyT=1,a.matrix=k}a.matrix=k,j.sx=h,j.sy=i,j.deg=e,j.dx=f=k.e,j.dy=g=k.f,1==h&&1==i&&!e&&j.bbox?(j.bbox.x+=+f,j.bbox.y+=+g):j.dirtyT=1}),Ob=function(a){var b=a[0];switch(b.toLowerCase()){case"t":return[b,0,0];case"m":return[b,1,0,0,1,0,0];case"r":return 4==a.length?[b,0,a[2],a[3]]:[b,0];case"s":return 5==a.length?[b,1,1,a[3],a[4]]:3==a.length?[b,1,1]:[b,1]}},Pb=c._equaliseTransform=function(a,b){b=I(b).replace(/\.{3}|\u2026/g,a),a=c.parseTransformString(a)||[],b=c.parseTransformString(b)||[];for(var d,e,f,g,h=O(a.length,b.length),i=[],j=[],k=0;h>k;k++){if(f=a[k]||Ob(b[k]),g=b[k]||Ob(f),f[0]!=g[0]||"r"==f[0].toLowerCase()&&(f[2]!=g[2]||f[3]!=g[3])||"s"==f[0].toLowerCase()&&(f[3]!=g[3]||f[4]!=g[4]))return;for(i[k]=[],j[k]=[],d=0,e=O(f.length,g.length);e>d;d++)d in f&&(i[k][d]=f[d]),d in g&&(j[k][d]=g[d])

The following comment/snippet was identified via the pattern: \bDB\b

}return{from:i,to:j}};c._getContainer=function(a,b,d,e){var f;return f=null!=e||c.is(a,"object")?a:A.doc.getElementById(a),null!=f?f.tagName?null==b?{container:f,width:f.style.pixelWidth||f.offsetWidth,height:f.style.pixelHeight||f.offsetHeight}:{container:f,width:b,height:d}:{container:1,x:a,y:b,width:d,height:e}:void 0},c.pathToRelative=Db,c._engine={},c.path2curve=Kb,c.matrix=function(a,b,c,d,e,f){return new o(a,b,c,d,e,f)},function(a){function b(a){return a[0]*a[0]+a[1]*a[1]}function d(a){var c=N.sqrt(b(a));a[0]&&(a[0]/=c),a[1]&&(a[1]/=c)}a.add=function(a,b,c,d,e,f){var g,h,i,j,k=[[],[],[]],l=[[this.a,this.c,this.e],[this.b,this.d,this.f],[0,0,1]],m=[[a,c,e],[b,d,f],[0,0,1]];for(a&&a instanceof o&&(m=[[a.a,a.c,a.e],[a.b,a.d,a.f],[0,0,1]]),g=0;3>g;g++)for(h=0;3>h;h++){for(j=0,i=0;3>i;i++)j+=l[g][i]*m[i][h];k[g][h]=j}this.a=k[0][0],this.b=k[1][0],this.c=k[0][1],this.d=k[1][1],this.e=k[0][2],this.f=k[1][2]},a.invert=function(){var a=this,b=a.a*a.d-a.b*a.c;return new o(a.d/b,-a.b/b,-a.c/b,a.a/b,(a.c*a.f-a.d*a.e)/b,(a.b*a.e-a.a*a.f)/b)},a.clone=function(){return new o(this.a,this.b,this.c,this.d,this.e,this.f)},a.translate=function(a,b){this.add(1,0,0,1,a,b)},a.scale=function(a,b,c,d){null==b&&(b=a),(c||d)&&this.add(1,0,0,1,c,d),this.add(a,0,0,b,0,0),(c||d)&&this.add(1,0,0,1,-c,-d)},a.rotate=function(a,b,d){a=c.rad(a),b=b||0,d=d||0;var e=+N.cos(a).toFixed(9),f=+N.sin(a).toFixed(9);this.add(e,f,-f,e,b,d),this.add(1,0,0,1,-b,-d)},a.x=function(a,b){return a*this.a+b*this.c+this.e},a.y=function(a,b){return a*this.b+b*this.d+this.f},a.get=function(a){return+this[I.fromCharCode(97+a)].toFixed(4)},a.toString=function(){return c.svg?"matrix("+[this.get(0),this.get(1),this.get(2),this.get(3),this.get(4),this.get(5)].join()+")":[this.get(0),this.get(2),this.get(1),this.get(3),0,0].join()},a.toFilter=function(){return"progid:DXImageTransform.Microsoft.Matrix(M11="+this.get(0)+", M12="+this.get(2)+", M21="+this.get(1)+", M22="+this.get(3)+", Dx="+this.get(4)+", Dy="+this.get(5)+", sizingmethod='auto expand')"},a.offset=function(){return[this.e.toFixed(4),this.f.toFixed(4)]},a.split=function(){var a={};a.dx=this.e,a.dy=this.f;var e=[[this.a,this.c],[this.b,this.d]];a.scalex=N.sqrt(b(e[0])),d(e[0]),a.shear=e[0][0]*e[1][0]+e[0][1]*e[1][1],e[1]=[e[1][0]-e[0][0]*a.shear,e[1][1]-e[0][1]*a.shear],a.scaley=N.sqrt(b(e[1])),d(e[1]),a.shear/=a.scaley;var f=-e[0][1],g=e[1][1];return 0>g?(a.rotate=c.deg(N.acos(g)),0>f&&(a.rotate=360-a.rotate)):a.rotate=c.deg(N.asin(f)),a.isSimple=!(+a.shear.toFixed(9)||a.scalex.toFixed(9)!=a.scaley.toFixed(9)&&a.rotate),a.isSuperSimple=!+a.shear.toFixed(9)&&a.scalex.toFixed(9)==a.scaley.toFixed(9)&&!a.rotate,a.noRotation=!+a.shear.toFixed(9)&&!a.rotate,a},a.toTransformString=function(a){var b=a||this[J]();return b.isSimple?(b.scalex=+b.scalex.toFixed(4),b.scaley=+b.scaley.toFixed(4),b.rotate=+b.rotate.toFixed(4),(b.dx||b.dy?"t"+[b.dx,b.dy]:G)+(1!=b.scalex||1!=b.scaley?"s"+[b.scalex,b.scaley,0,0]:G)+(b.rotate?"r"+[b.rotate,0,0]:G)):"m"+[this.get(0),this.get(1),this.get(2),this.get(3),this.get(4),this.get(5)]}}(o.prototype);var Qb=navigator.userAgent.match(/Version\/(.*?)\s/)||navigator.userAgent.match(/Chrome\/(\d+)/);v.safari="Apple Computer, Inc."==navigator.vendor&&(Qb&&Qb[1]<4||"iP"==navigator.platform.slice(0,2))||"Google Inc."==navigator.vendor&&Qb&&Qb[1]<8?function(){var a=this.rect(-99,-99,this.width+99,this.height+99).attr({stroke:"none"});setTimeout(function(){a.remove()})}:mb;for(var Rb=function(){this.returnValue=!1},Sb=function(){return this.originalEvent.preventDefault()},Tb=function(){this.cancelBubble=!0},Ub=function(){return this.originalEvent.stopPropagation()},Vb=function(a){var b=A.doc.documentElement.scrollTop||A.doc.body.scrollTop,c=A.doc.documentElement.scrollLeft||A.doc.body.scrollLeft;return{x:a.clientX+c,y:a.clientY+b}},Wb=function(){return A.doc.addEventListener?function(a,b,c,d){var e=function(a){var b=Vb(a);return c.call(d,a,b.x,b.y)};if(a.addEventListener(b,e,!1),F&&L[b]){var f=function(b){for(var e=Vb(b),f=b,g=0,h=b.targetTouches&&b.targetTouches.length;h>g;g++)if(b.targetTouches[g].target==a){b=b.targetTouches[g],b.originalEvent=f,b.preventDefault=Sb,b.stopPropagation=Ub;break}return c.call(d,b,e.x,e.y)};a.addEventListener(L[b],f,!1)}return function(){return a.removeEventListener(b,e,!1),F&&L[b]&&a.removeEventListener(L[b],e,!1),!0}}:A.doc.attachEvent?function(a,b,c,d){var e=function(a){a=a||A.win.event;var b=A.doc.documentElement.scrollTop||A.doc.body.scrollTop,e=A.doc.documentElement.scrollLeft||A.doc.body.scrollLeft,f=a.clientX+e,g=a.clientY+b;return a.preventDefault=a.preventDefault||Rb,a.stopPropagation=a.stopPropagation||Tb,c.call(d,a,f,g)};a.attachEvent("on"+b,e);var f=function(){return a.detachEvent("on"+b,e),!0};return f}:void 0}(),Xb=[],Yb=function(a){for(var c,d=a.clientX,e=a.clientY,f=A.doc.documentElement.scrollTop||A.doc.body.scrollTop,g=A.doc.documentElement.scrollLeft||A.doc.body.scrollLeft,h=Xb.length;h--;){if(c=Xb[h],F&&a.touches){for(var i,j=a.touches.length;j--;)if(i=a.touches[j],i.identifier==c.el._drag.id){d=i.clientX,e=i.clientY,(a.originalEvent?a.originalEvent:a).preventDefault();break}}else a.preventDefault();var k,l=c.el.node,m=l.nextSibling,n=l.parentNode,o=l.style.display;A.win.opera&&n.removeChild(l),l.style.display="none",k=c.el.paper.getElementByPoint(d,e),l.style.display=o,A.win.opera&&(m?n.insertBefore(l,m):n.appendChild(l)),k&&b("raphael.drag.over."+c.el.id,c.el,k),d+=g,e+=f,b("raphael.drag.move."+c.el.id,c.move_scope||c.el,d-c.el._drag.x,e-c.el._drag.y,d,e,a)}},Zb=function(a){c.unmousemove(Yb).unmouseup(Zb);for(var d,e=Xb.length;e--;)d=Xb[e],d.el._drag={},b("raphael.drag.end."+d.el.id,d.end_scope||d.start_scope||d.move_scope||d.el,a);Xb=[]},$b=c.el={},_b=K.length;_b--;)!function(a){c[a]=$b[a]=function(b,d){return c.is(b,"function")&&(this.events=this.events||[],this.events.push({name:a,f:b,unbind:Wb(this.shape||this.node||A.doc,a,b,d||this)})),this},c["un"+a]=$b["un"+a]=function(b){for(var d=this.events||[],e=d.length;e--;)d[e].name!=a||!c.is(b,"undefined")&&d[e].f!=b||(d[e].unbind(),d.splice(e,1),!d.length&&delete this.events);return this}}(K[_b]);$b.data=function(a,d){var e=kb[this.id]=kb[this.id]||{};if(0==arguments.length)return e;if(1==arguments.length){if(c.is(a,"object")){for(var f in a)a[z](f)&&this.data(f,a[f]);return this}return b("raphael.data.get."+this.id,this,e[a],a),e[a]}return e[a]=d,b("raphael.data.set."+this.id,this,d,a),this},$b.removeData=function(a){return null==a?kb[this.id]={}:kb[this.id]&&delete kb[this.id][a],this},$b.getData=function(){return d(kb[this.id]||{})},$b.hover=function(a,b,c,d){return this.mouseover(a,c).mouseout(b,d||c)},$b.unhover=function(a,b){return this.unmouseover(a).unmouseout(b)};var ac=[];$b.drag=function(a,d,e,f,g,h){function i(i){(i.originalEvent||i).preventDefault();var j=i.clientX,k=i.clientY,l=A.doc.documentElement.scrollTop||A.doc.body.scrollTop,m=A.doc.documentElement.scrollLeft||A.doc.body.scrollLeft;if(this._drag.id=i.identifier,F&&i.touches)for(var n,o=i.touches.length;o--;)if(n=i.touches[o],this._drag.id=n.identifier,n.identifier==this._drag.id){j=n.clientX,k=n.clientY;break}this._drag.x=j+m,this._drag.y=k+l,!Xb.length&&c.mousemove(Yb).mouseup(Zb),Xb.push({el:this,move_scope:f,start_scope:g,end_scope:h}),d&&b.on("raphael.drag.start."+this.id,d),a&&b.on("raphael.drag.move."+this.id,a),e&&b.on("raphael.drag.end."+this.id,e),b("raphael.drag.start."+this.id,g||f||this,i.clientX+m,i.clientY+l,i)}return this._drag={},ac.push({el:this,start:i}),this.mousedown(i),this},$b.onDragOver=function(a){a?b.on("raphael.drag.over."+this.id,a):b.unbind("raphael.drag.over."+this.id)},$b.undrag=function(){for(var a=ac.length;a--;)ac[a].el==this&&(this.unmousedown(ac[a].start),ac.splice(a,1),b.unbind("raphael.drag.*."+this.id));!ac.length&&c.unmousemove(Yb).unmouseup(Zb),Xb=[]},v.circle=function(a,b,d){var e=c._engine.circle(this,a||0,b||0,d||0);return this.__set__&&this.__set__.push(e),e},v.rect=function(a,b,d,e,f){var g=c._engine.rect(this,a||0,b||0,d||0,e||0,f||0);return this.__set__&&this.__set__.push(g),g},v.ellipse=function(a,b,d,e){var f=c._engine.ellipse(this,a||0,b||0,d||0,e||0);return this.__set__&&this.__set__.push(f),f},v.path=function(a){a&&!c.is(a,U)&&!c.is(a[0],V)&&(a+=G);var b=c._engine.path(c.format[D](c,arguments),this);return this.__set__&&this.__set__.push(b),b},v.image=function(a,b,d,e,f){var g=c._engine.image(this,a||"about:blank",b||0,d||0,e||0,f||0);return this.__set__&&this.__set__.push(g),g},v.text=function(a,b,d){var e=c._engine.text(this,a||0,b||0,I(d));return this.__set__&&this.__set__.push(e),e},v.set=function(a){!c.is(a,"array")&&(a=Array.prototype.splice.call(arguments,0,arguments.length));var b=new mc(a);return this.__set__&&this.__set__.push(b),b.paper=this,b.type="set",b},v.setStart=function(a){this.__set__=a||this.set()},v.setFinish=function(){var a=this.__set__;return delete this.__set__,a},v.setSize=function(a,b){return c._engine.setSize.call(this,a,b)},v.setViewBox=function(a,b,d,e,f){return c._engine.setViewBox.call(this,a,b,d,e,f)},v.top=v.bottom=null,v.raphael=c;var bc=function(a){var b=a.getBoundingClientRect(),c=a.ownerDocument,d=c.body,e=c.documentElement,f=e.clientTop||d.clientTop||0,g=e.clientLeft||d.clientLeft||0,h=b.top+(A.win.pageYOffset||e.scrollTop||d.scrollTop)-f,i=b.left+(A.win.pageXOffset||e.scrollLeft||d.scrollLeft)-g;return{y:h,x:i}};v.getElementByPoint=function(a,b){var c=this,d=c.canvas,e=A.doc.elementFromPoint(a,b);if(A.win.opera&&"svg"==e.tagName){var f=bc(d),g=d.createSVGRect();g.x=a-f.x,g.y=b-f.y,g.width=g.height=1;var h=d.getIntersectionList(g,null);h.length&&(e=h[h.length-1])}if(!e)return null;for(;e.parentNode&&e!=d.parentNode&&!e.raphael;)e=e.parentNode;return e==c.canvas.parentNode&&(e=d),e=e&&e.raphael?c.getById(e.raphaelid):null},v.getElementsByBBox=function(a){var b=this.set();return this.forEach(function(d){c.isBBoxIntersect(d.getBBox(),a)&&b.push(d)}),b},v.getById=function(a){for(var b=this.bottom;b;){if(b.id==a)return b;b=b.next}return null},v.forEach=function(a,b){for(var c=this.bottom;c;){if(a.call(b,c)===!1)return this;c=c.next}return this},v.getElementsByPoint=function(a,b){var c=this.set();return this.forEach(function(d){d.isPointInside(a,b)&&c.push(d)}),c},$b.isPointInside=function(a,b){var d=this.realPath=qb[this.type](this);return this.attr("transform")&&this.attr("transform").length&&(d=c.transformPath(d,this.attr("transform"))),c.isPointInsidePath(d,a,b)},$b.getBBox=function(a){if(this.removed)return{};var b=this._;return a?((b.dirty||!b.bboxwt)&&(this.realPath=qb[this.type](this),b.bboxwt=Bb(this.realPath),b.bboxwt.toString=p,b.dirty=0),b.bboxwt):((b.dirty||b.dirtyT||!b.bbox)&&((b.dirty||!this.realPath)&&(b.bboxwt=0,this.realPath=qb[this.type](this)),b.bbox=Bb(rb(this.realPath,this.matrix)),b.bbox.toString=p,b.dirty=b.dirtyT=0),b.bbox)},$b.clone=function(){if(this.removed)return null;var a=this.paper[this.type]().attr(this.attr());return this.__set__&&this.__set__.push(a),a},$b.glow=function(a){if("text"==this.type)return null;a=a||{};var b={width:(a.width||10)+(+this.attr("stroke-width")||1),fill:a.fill||!1,opacity:a.opacity||.5,offsetx:a.offsetx||0,offsety:a.offsety||0,color:a.color||"#000"},c=b.width/2,d=this.paper,e=d.set(),f=this.realPath||qb[this.type](this);f=this.matrix?rb(f,this.matrix):f;for(var g=1;c+1>g;g++)e.push(d.path(f).attr({stroke:b.color,fill:b.fill?b.color:"none","stroke-linejoin":"round","stroke-linecap":"round","stroke-width":+(b.width/c*g).toFixed(3),opacity:+(b.opacity/c).toFixed(3)}));return e.insertBefore(this).translate(b.offsetx,b.offsety)};var cc=function(a,b,d,e,f,g,h,i,l){return null==l?j(a,b,d,e,f,g,h,i):c.findDotsAtSegment(a,b,d,e,f,g,h,i,k(a,b,d,e,f,g,h,i,l))},dc=function(a,b){return function(d,e,f){d=Kb(d);for(var g,h,i,j,k,l="",m={},n=0,o=0,p=d.length;p>o;o++){if(i=d[o],"M"==i[0])g=+i[1],h=+i[2];else{if(j=cc(g,h,i[1],i[2],i[3],i[4],i[5],i[6]),n+j>e){if(b&&!m.start){if(k=cc(g,h,i[1],i[2],i[3],i[4],i[5],i[6],e-n),l+=["C"+k.start.x,k.start.y,k.m.x,k.m.y,k.x,k.y],f)return l;m.start=l,l=["M"+k.x,k.y+"C"+k.n.x,k.n.y,k.end.x,k.end.y,i[5],i[6]].join(),n+=j,g=+i[5],h=+i[6];continue}if(!a&&!b)return k=cc(g,h,i[1],i[2],i[3],i[4],i[5],i[6],e-n),{x:k.x,y:k.y,alpha:k.alpha}}n+=j,g=+i[5],h=+i[6]}l+=i.shift()+i}return m.end=l,k=a?n:b?m:c.findDotsAtSegment(g,h,i[0],i[1],i[2],i[3],i[4],i[5],1),k.alpha&&(k={x:k.x,y:k.y,alpha:k.alpha}),k}},ec=dc(1),fc=dc(),gc=dc(0,1);c.getTotalLength=ec,c.getPointAtLength=fc,c.getSubpath=function(a,b,c){if(this.getTotalLength(a)-c<1e-6)return gc(a,b).end;var d=gc(a,c,1);return b?gc(d,b).end:d},$b.getTotalLength=function(){var a=this.getPath();if(a)return this.node.getTotalLength?this.node.getTotalLength():ec(a)},$b.getPointAtLength=function(a){var b=this.getPath();if(b)return fc(b,a)},$b.getPath=function(){var a,b=c._getPath[this.type];if("text"!=this.type&&"set"!=this.type)return b&&(a=b(this)),a},$b.getSubpath=function(a,b){var d=this.getPath();if(d)return c.getSubpath(d,a,b)};var hc=c.easing_formulas={linear:function(a){return a},"<":function(a){return R(a,1.7)},">":function(a){return R(a,.48)},"<>":function(a){var b=.48-a/1.04,c=N.sqrt(.1734+b*b),d=c-b,e=R(Q(d),1/3)*(0>d?-1:1),f=-c-b,g=R(Q(f),1/3)*(0>f?-1:1),h=e+g+.5;return 3*(1-h)*h*h+h*h*h},backIn:function(a){var b=1.70158;return a*a*((b+1)*a-b)},backOut:function(a){a-=1;var b=1.70158;return a*a*((b+1)*a+b)+1},elastic:function(a){return a==!!a?a:R(2,-10*a)*N.sin((a-.075)*2*S/.3)+1},bounce:function(a){var b,c=7.5625,d=2.75;return 1/d>a?b=c*a*a:2/d>a?(a-=1.5/d,b=c*a*a+.75):2.5/d>a?(a-=2.25/d,b=c*a*a+.9375):(a-=2.625/d,b=c*a*a+.984375),b}};hc.easeIn=hc["ease-in"]=hc["<"],hc.easeOut=hc["ease-out"]=hc[">"],hc.easeInOut=hc["ease-in-out"]=hc["<>"],hc["back-in"]=hc.backIn,hc["back-out"]=hc.backOut;var ic=[],jc=a.requestAnimationFrame||a.webkitRequestAnimationFrame||a.mozRequestAnimationFrame||a.oRequestAnimationFrame||a.msRequestAnimationFrame||function(a){setTimeout(a,16)},kc=function(){for(var a=+new Date,d=0;d<ic.length;d++){var e=ic[d];if(!e.el.removed&&!e.paused){var f,g,h=a-e.start,i=e.ms,j=e.easing,k=e.from,l=e.diff,m=e.to,n=(e.t,e.el),o={},p={};if(e.initstatus?(h=(e.initstatus*e.anim.top-e.prev)/(e.percent-e.prev)*i,e.status=e.initstatus,delete e.initstatus,e.stop&&ic.splice(d--,1)):e.status=(e.prev+(e.percent-e.prev)*(h/i))/e.anim.top,!(0>h))if(i>h){var q=j(h/i);for(var r in k)if(k[z](r)){switch(db[r]){case T:f=+k[r]+q*i*l[r];break;case"colour":f="rgb("+[lc($(k[r].r+q*i*l[r].r)),lc($(k[r].g+q*i*l[r].g)),lc($(k[r].b+q*i*l[r].b))].join(",")+")";break;case"path":f=[];for(var t=0,u=k[r].length;u>t;t++){f[t]=[k[r][t][0]];for(var v=1,w=k[r][t].length;w>v;v++)f[t][v]=+k[r][t][v]+q*i*l[r][t][v];f[t]=f[t].join(H)}f=f.join(H);break;case"transform":if(l[r].real)for(f=[],t=0,u=k[r].length;u>t;t++)for(f[t]=[k[r][t][0]],v=1,w=k[r][t].length;w>v;v++)f[t][v]=k[r][t][v]+q*i*l[r][t][v];else{var x=function(a){return+k[r][a]+q*i*l[r][a]};f=[["m",x(0),x(1),x(2),x(3),x(4),x(5)]]}break;case"csv":if("clip-rect"==r)for(f=[],t=4;t--;)f[t]=+k[r][t]+q*i*l[r][t];break;default:var y=[][E](k[r]);for(f=[],t=n.paper.customAttributes[r].length;t--;)f[t]=+y[t]+q*i*l[r][t]}o[r]=f}n.attr(o),function(a,c,d){setTimeout(function(){b("raphael.anim.frame."+a,c,d)})}(n.id,n,e.anim)}else{if(function(a,d,e){setTimeout(function(){b("raphael.anim.frame."+d.id,d,e),b("raphael.anim.finish."+d.id,d,e),c.is(a,"function")&&a.call(d)})}(e.callback,n,e.anim),n.attr(m),ic.splice(d--,1),e.repeat>1&&!e.next){for(g in m)m[z](g)&&(p[g]=e.totalOrigin[g]);e.el.attr(p),s(e.anim,e.el,e.anim.percents[0],null,e.totalOrigin,e.repeat-1)}e.next&&!e.stop&&s(e.anim,e.el,e.next,null,e.totalOrigin,e.repeat)}}}c.svg&&n&&n.paper&&n.paper.safari(),ic.length&&jc(kc)},lc=function(a){return a>255?255:0>a?0:a};$b.animateWith=function(a,b,d,e,f,g){var h=this;if(h.removed)return g&&g.call(h),h;var i=d instanceof r?d:c.animation(d,e,f,g);s(i,h,i.percents[0],null,h.attr());for(var j=0,k=ic.length;k>j;j++)if(ic[j].anim==b&&ic[j].el==a){ic[k-1].start=ic[j].start;break}return h},$b.onAnimation=function(a){return a?b.on("raphael.anim.frame."+this.id,a):b.unbind("raphael.anim.frame."+this.id),this},r.prototype.delay=function(a){var b=new r(this.anim,this.ms);return b.times=this.times,b.del=+a||0,b},r.prototype.repeat=function(a){var b=new r(this.anim,this.ms);return b.del=this.del,b.times=N.floor(O(a,0))||1,b},c.animation=function(a,b,d,e){if(a instanceof r)return a;(c.is(d,"function")||!d)&&(e=e||d||null,d=null),a=Object(a),b=+b||0;var f,g,h={};for(g in a)a[z](g)&&_(g)!=g&&_(g)+"%"!=g&&(f=!0,h[g]=a[g]);return f?(d&&(h.easing=d),e&&(h.callback=e),new r({100:h},b)):new r(a,b)},$b.animate=function(a,b,d,e){var f=this;if(f.removed)return e&&e.call(f),f;var g=a instanceof r?a:c.animation(a,b,d,e);return s(g,f,g.percents[0],null,f.attr()),f},$b.setTime=function(a,b){return a&&null!=b&&this.status(a,P(b,a.ms)/a.ms),this},$b.status=function(a,b){var c,d,e=[],f=0;if(null!=b)return s(a,this,-1,P(b,1)),this;for(c=ic.length;c>f;f++)if(d=ic[f],d.el.id==this.id&&(!a||d.anim==a)){if(a)return d.status;e.push({anim:d.anim,status:d.status})}return a?0:e},$b.pause=function(a){for(var c=0;c<ic.length;c++)ic[c].el.id!=this.id||a&&ic[c].anim!=a||b("raphael.anim.pause."+this.id,this,ic[c].anim)!==!1&&(ic[c].paused=!0);return this},$b.resume=function(a){for(var c=0;c<ic.length;c++)if(ic[c].el.id==this.id&&(!a||ic[c].anim==a)){var d=ic[c];b("raphael.anim.resume."+this.id,this,d.anim)!==!1&&(delete d.paused,this.status(d.anim,d.status))}return this},$b.stop=function(a){for(var c=0;c<ic.length;c++)ic[c].el.id!=this.id||a&&ic[c].anim!=a||b("raphael.anim.stop."+this.id,this,ic[c].anim)!==!1&&ic.splice(c--,1);return this},b.on("raphael.remove",t),b.on("raphael.clear",t),$b.toString=function(){return"Raphaël’s object"};var mc=function(a){if(this.items=[],this.length=0,this.type="set",a)for(var b=0,c=a.length;c>b;b++)!a[b]||a[b].constructor!=$b.constructor&&a[b].constructor!=mc||(this[this.items.length]=this.items[this.items.length]=a[b],this.length++)},nc=mc.prototype;nc.push=function(){for(var a,b,c=0,d=arguments.length;d>c;c++)a=arguments[c],!a||a.constructor!=$b.constructor&&a.constructor!=mc||(b=this.items.length,this[b]=this.items[b]=a,this.length++);return this},nc.pop=function(){return this.length&&delete this[this.length--],this.items.pop()},nc.forEach=function(a,b){for(var c=0,d=this.items.length;d>c;c++)if(a.call(b,this.items[c],c)===!1)return this;return this};for(var oc in $b)$b[z](oc)&&(nc[oc]=function(a){return function(){var b=arguments;return this.forEach(function(c){c[a][D](c,b)})}}(oc));return nc.attr=function(a,b){if(a&&c.is(a,V)&&c.is(a[0],"object"))for(var d=0,e=a.length;e>d;d++)this.items[d].attr(a[d]);else for(var f=0,g=this.items.length;g>f;f++)this.items[f].attr(a,b);return this},nc.clear=function(){for(;this.length;)this.pop()},nc.splice=function(a,b){a=0>a?O(this.length+a,0):a,b=O(0,P(this.length-a,b));var c,d=[],e=[],f=[];for(c=2;c<arguments.length;c++)f.push(arguments[c]);for(c=0;b>c;c++)e.push(this[a+c]);for(;c<this.length-a;c++)d.push(this[a+c]);var g=f.length;for(c=0;c<g+d.length;c++)this.items[a+c]=this[a+c]=g>c?f[c]:d[c-g];for(c=this.items.length=this.length-=b-g;this[c];)delete this[c++];return new mc(e)},nc.exclude=function(a){for(var b=0,c=this.length;c>b;b++)if(this[b]==a)return this.splice(b,1),!0},nc.animate=function(a,b,d,e){(c.is(d,"function")||!d)&&(e=d||null);var f,g,h=this.items.length,i=h,j=this;if(!h)return this;e&&(g=function(){!--h&&e.call(j)}),d=c.is(d,U)?d:g;var k=c.animation(a,b,d,g);for(f=this.items[--i].animate(k);i--;)this.items[i]&&!this.items[i].removed&&this.items[i].animateWith(f,k,k),this.items[i]&&!this.items[i].removed||h--;return this},nc.insertAfter=function(a){for(var b=this.items.length;b--;)this.items[b].insertAfter(a);return this},nc.getBBox=function(){for(var a=[],b=[],c=[],d=[],e=this.items.length;e--;)if(!this.items[e].removed){var f=this.items[e].getBBox();a.push(f.x),b.push(f.y),c.push(f.x+f.width),d.push(f.y+f.height)}return a=P[D](0,a),b=P[D](0,b),c=O[D](0,c),d=O[D](0,d),{x:a,y:b,x2:c,y2:d,width:c-a,height:d-b}},nc.clone=function(a){a=this.paper.set();for(var b=0,c=this.items.length;c>b;b++)a.push(this.items[b].clone());return a},nc.toString=function(){return"Raphaël‘s set"},nc.glow=function(a){var b=this.paper.set();return this.forEach(function(c){var d=c.glow(a);null!=d&&d.forEach(function(a){b.push(a)})}),b},nc.isPointInside=function(a,b){var c=!1;return this.forEach(function(d){return d.isPointInside(a,b)?(console.log("runned"),c=!0,!1):void 0}),c},c.registerFont=function(a){if(!a.face)return a;this.fonts=this.fonts||{};var b={w:a.w,face:{},glyphs:{}},c=a.face["font-family"];for(var d in a.face)a.face[z](d)&&(b.face[d]=a.face[d]);if(this.fonts[c]?this.fonts[c].push(b):this.fonts[c]=[b],!a.svg){b.face["units-per-em"]=ab(a.face["units-per-em"],10);for(var e in a.glyphs)if(a.glyphs[z](e)){var f=a.glyphs[e];if(b.glyphs[e]={w:f.w,k:{},d:f.d&&"M"+f.d.replace(/[mlcxtrv]/g,function(a){return{l:"L",c:"C",x:"z",t:"m",r:"l",v:"c"}[a]||"M"})+"z"},f.k)for(var g in f.k)f[z](g)&&(b.glyphs[e].k[g]=f.k[g])}}return a},v.getFont=function(a,b,d,e){if(e=e||"normal",d=d||"normal",b=+b||{normal:400,bold:700,lighter:300,bolder:800}[b]||400,c.fonts){var f=c.fonts[a];if(!f){var g=new RegExp("(^|\\s)"+a.replace(/[^\w\d\s+!~.:_-]/g,G)+"(\\s|$)","i");for(var h in c.fonts)if(c.fonts[z](h)&&g.test(h)){f=c.fonts[h];break}}var i;if(f)for(var j=0,k=f.length;k>j&&(i=f[j],i.face["font-weight"]!=b||i.face["font-style"]!=d&&i.face["font-style"]||i.face["font-stretch"]!=e);j++);return i}},v.print=function(a,b,d,e,f,g,h,i){g=g||"middle",h=O(P(h||0,1),-1),i=O(P(i||1,3),1);var j,k=I(d)[J](G),l=0,m=0,n=G;if(c.is(e,"string")&&(e=this.getFont(e)),e){j=(f||16)/e.face["units-per-em"];for(var o=e.face.bbox[J](w),p=+o[0],q=o[3]-o[1],r=0,s=+o[1]+("baseline"==g?q+ +e.face.descent:q/2),t=0,u=k.length;u>t;t++){if("\n"==k[t])l=0,x=0,m=0,r+=q*i;else{var v=m&&e.glyphs[k[t-1]]||{},x=e.glyphs[k[t]];l+=m?(v.w||e.w)+(v.k&&v.k[k[t]]||0)+e.w*h:0,m=1}x&&x.d&&(n+=c.transformPath(x.d,["t",l*j,r*j,"s",j,j,p,s,"t",(a-p)/j,(b-s)/j]))}}return this.path(n).attr({fill:"#000",stroke:"none"})},v.add=function(a){if(c.is(a,"array"))for(var b,d=this.set(),e=0,f=a.length;f>e;e++)b=a[e]||{},x[z](b.type)&&d.push(this[b.type]().attr(b));return d},c.format=function(a,b){var d=c.is(b,V)?[0][E](b):arguments;return a&&c.is(a,U)&&d.length-1&&(a=a.replace(y,function(a,b){return null==d[++b]?G:d[b]})),a||G},c.fullfill=function(){var a=/\{([^\}]+)\}/g,b=/(?:(?:^|\.)(.+?)(?=\[|\.|$|\()|\[('|")(.+?)\2\])(\(\))?/g,c=function(a,c,d){var e=d;return c.replace(b,function(a,b,c,d,f){b=b||d,e&&(b in e&&(e=e[b]),"function"==typeof e&&f&&(e=e()))}),e=(null==e||e==d?a:e)+""};return function(b,d){return String(b).replace(a,function(a,b){return c(a,b,d)})}}(),c.ninja=function(){return B.was?A.win.Raphael=B.is:delete Raphael,c},c.st=nc,function(a,b,d){function e(){/in/.test(a.readyState)?setTimeout(e,9):c.eve("raphael.DOMload")}null==a.readyState&&a.addEventListener&&(a.addEventListener(b,d=function(){a.removeEventListener(b,d,!1),a.readyState="complete"},!1),a.readyState="loading"),e()}(document,"DOMContentLoaded"),b.on("raphael.DOMload",function(){u=!0}),function(){if(c.svg){var a="hasOwnProperty",b=String,d=parseFloat,e=parseInt,f=Math,g=f.max,h=f.abs,i=f.pow,j=/[, ]+/,k=c.eve,l="",m=" ",n="http://www.w3.org/1999/xlink",o={block:"M5,0 0,2.5 5,5z",classic:"M5,0 0,2.5 5,5 3.5,3 3.5,2z",diamond:"M2.5,0 5,2.5 2.5,5 0,2.5z",open:"M6,1 1,3.5 6,6",oval:"M2.5,0A2.5,2.5,0,0,1,2.5,5 2.5,2.5,0,0,1,2.5,0z"},p={};c.toString=function(){return"Your browser supports SVG.\nYou are running Raphaël "+this.version};var q=function(d,e){if(e){"string"==typeof d&&(d=q(d));for(var f in e)e[a](f)&&("xlink:"==f.substring(0,6)?d.setAttributeNS(n,f.substring(6),b(e[f])):d.setAttribute(f,b(e[f])))}else d=c._g.doc.createElementNS("http://www.w3.org/2000/svg",d),d.style&&(d.style.webkitTapHighlightColor="rgba(0,0,0,0)");return d},r=function(a,e){var j="linear",k=a.id+e,m=.5,n=.5,o=a.node,p=a.paper,r=o.style,s=c._g.doc.getElementById(k);if(!s){if(e=b(e).replace(c._radial_gradient,function(a,b,c){if(j="radial",b&&c){m=d(b),n=d(c);var e=2*(n>.5)-1;i(m-.5,2)+i(n-.5,2)>.25&&(n=f.sqrt(.25-i(m-.5,2))*e+.5)&&.5!=n&&(n=n.toFixed(5)-1e-5*e)}return l}),e=e.split(/\s*\-\s*/),"linear"==j){var t=e.shift();if(t=-d(t),isNaN(t))return null;var u=[0,0,f.cos(c.rad(t)),f.sin(c.rad(t))],v=1/(g(h(u[2]),h(u[3]))||1);u[2]*=v,u[3]*=v,u[2]<0&&(u[0]=-u[2],u[2]=0),u[3]<0&&(u[1]=-u[3],u[3]=0)}var w=c._parseDots(e);if(!w)return null;if(k=k.replace(/[\(\)\s,\xb0#]/g,"_"),a.gradient&&k!=a.gradient.id&&(p.defs.removeChild(a.gradient),delete a.gradient),!a.gradient){s=q(j+"Gradient",{id:k}),a.gradient=s,q(s,"radial"==j?{fx:m,fy:n}:{x1:u[0],y1:u[1],x2:u[2],y2:u[3],gradientTransform:a.matrix.invert()}),p.defs.appendChild(s);for(var x=0,y=w.length;y>x;x++)s.appendChild(q("stop",{offset:w[x].offset?w[x].offset:x?"100%":"0%","stop-color":w[x].color||"#fff"}))}}return q(o,{fill:"url(#"+k+")",opacity:1,"fill-opacity":1}),r.fill=l,r.opacity=1,r.fillOpacity=1,1},s=function(a){var b=a.getBBox(1);q(a.pattern,{patternTransform:a.matrix.invert()+" translate("+b.x+","+b.y+")"})},t=function(d,e,f){if("path"==d.type){for(var g,h,i,j,k,m=b(e).toLowerCase().split("-"),n=d.paper,r=f?"end":"start",s=d.node,t=d.attrs,u=t["stroke-width"],v=m.length,w="classic",x=3,y=3,z=5;v--;)switch(m[v]){case"block":case"classic":case"oval":case"diamond":case"open":case"none":w=m[v];break;case"wide":y=5;break;case"narrow":y=2;break;case"long":x=5;break;case"short":x=2}if("open"==w?(x+=2,y+=2,z+=2,i=1,j=f?4:1,k={fill:"none",stroke:t.stroke}):(j=i=x/2,k={fill:t.stroke,stroke:"none"}),d._.arrows?f?(d._.arrows.endPath&&p[d._.arrows.endPath]--,d._.arrows.endMarker&&p[d._.arrows.endMarker]--):(d._.arrows.startPath&&p[d._.arrows.startPath]--,d._.arrows.startMarker&&p[d._.arrows.startMarker]--):d._.arrows={},"none"!=w){var A="raphael-marker-"+w,B="raphael-marker-"+r+w+x+y;c._g.doc.getElementById(A)?p[A]++:(n.defs.appendChild(q(q("path"),{"stroke-linecap":"round",d:o[w],id:A})),p[A]=1);var C,D=c._g.doc.getElementById(B);D?(p[B]++,C=D.getElementsByTagName("use")[0]):(D=q(q("marker"),{id:B,markerHeight:y,markerWidth:x,orient:"auto",refX:j,refY:y/2}),C=q(q("use"),{"xlink:href":"#"+A,transform:(f?"rotate(180 "+x/2+" "+y/2+") ":l)+"scale("+x/z+","+y/z+")","stroke-width":(1/((x/z+y/z)/2)).toFixed(4)}),D.appendChild(C),n.defs.appendChild(D),p[B]=1),q(C,k);var E=i*("diamond"!=w&&"oval"!=w);f?(g=d._.arrows.startdx*u||0,h=c.getTotalLength(t.path)-E*u):(g=E*u,h=c.getTotalLength(t.path)-(d._.arrows.enddx*u||0)),k={},k["marker-"+r]="url(#"+B+")",(h||g)&&(k.d=c.getSubpath(t.path,g,h)),q(s,k),d._.arrows[r+"Path"]=A,d._.arrows[r+"Marker"]=B,d._.arrows[r+"dx"]=E,d._.arrows[r+"Type"]=w,d._.arrows[r+"String"]=e}else f?(g=d._.arrows.startdx*u||0,h=c.getTotalLength(t.path)-g):(g=0,h=c.getTotalLength(t.path)-(d._.arrows.enddx*u||0)),d._.arrows[r+"Path"]&&q(s,{d:c.getSubpath(t.path,g,h)}),delete d._.arrows[r+"Path"],delete d._.arrows[r+"Marker"],delete d._.arrows[r+"dx"],delete d._.arrows[r+"Type"],delete d._.arrows[r+"String"];for(k in p)if(p[a](k)&&!p[k]){var F=c._g.doc.getElementById(k);F&&F.parentNode.removeChild(F)}}},u={"":[0],none:[0],"-":[3,1],".":[1,1],"-.":[3,1,1,1],"-..":[3,1,1,1,1,1],". ":[1,3],"- ":[4,3],"--":[8,3],"- .":[4,3,1,3],"--.":[8,3,1,3],"--..":[8,3,1,3,1,3]},v=function(a,c,d){if(c=u[b(c).toLowerCase()]){for(var e=a.attrs["stroke-width"]||"1",f={round:e,square:e,butt:0}[a.attrs["stroke-linecap"]||d["stroke-linecap"]]||0,g=[],h=c.length;h--;)g[h]=c[h]*e+(h%2?1:-1)*f;q(a.node,{"stroke-dasharray":g.join(",")})}},w=function(d,f){var i=d.node,k=d.attrs,m=i.style.visibility;i.style.visibility="hidden";for(var o in f)if(f[a](o)){if(!c._availableAttrs[a](o))continue;var p=f[o];switch(k[o]=p,o){case"blur":d.blur(p);break;case"href":case"title":var u=q("title"),w=c._g.doc.createTextNode(p);u.appendChild(w),i.appendChild(u);break;case"target":var x=i.parentNode;if("a"!=x.tagName.toLowerCase()){var u=q("a");x.insertBefore(u,i),u.appendChild(i),x=u}"target"==o?x.setAttributeNS(n,"show","blank"==p?"new":p):x.setAttributeNS(n,o,p);break;case"cursor":i.style.cursor=p;break;case"transform":d.transform(p);break;case"arrow-start":t(d,p);break;case"arrow-end":t(d,p,1);break;case"clip-rect":var z=b(p).split(j);if(4==z.length){d.clip&&d.clip.parentNode.parentNode.removeChild(d.clip.parentNode);var A=q("clipPath"),B=q("rect");A.id=c.createUUID(),q(B,{x:z[0],y:z[1],width:z[2],height:z[3]}),A.appendChild(B),d.paper.defs.appendChild(A),q(i,{"clip-path":"url(#"+A.id+")"}),d.clip=B}if(!p){var C=i.getAttribute("clip-path");if(C){var D=c._g.doc.getElementById(C.replace(/(^url\(#|\)$)/g,l));D&&D.parentNode.removeChild(D),q(i,{"clip-path":l}),delete d.clip}}break;case"path":"path"==d.type&&(q(i,{d:p?k.path=c._pathToAbsolute(p):"M0,0"}),d._.dirty=1,d._.arrows&&("startString"in d._.arrows&&t(d,d._.arrows.startString),"endString"in d._.arrows&&t(d,d._.arrows.endString,1)));break;case"width":if(i.setAttribute(o,p),d._.dirty=1,!k.fx)break;o="x",p=k.x;case"x":k.fx&&(p=-k.x-(k.width||0));case"rx":if("rx"==o&&"rect"==d.type)break;case"cx":i.setAttribute(o,p),d.pattern&&s(d),d._.dirty=1;break;case"height":if(i.setAttribute(o,p),d._.dirty=1,!k.fy)break;o="y",p=k.y;case"y":k.fy&&(p=-k.y-(k.height||0));case"ry":if("ry"==o&&"rect"==d.type)break;case"cy":i.setAttribute(o,p),d.pattern&&s(d),d._.dirty=1;break;case"r":"rect"==d.type?q(i,{rx:p,ry:p}):i.setAttribute(o,p),d._.dirty=1;break;case"src":"image"==d.type&&i.setAttributeNS(n,"href",p);break;case"stroke-width":(1!=d._.sx||1!=d._.sy)&&(p/=g(h(d._.sx),h(d._.sy))||1),d.paper._vbSize&&(p*=d.paper._vbSize),i.setAttribute(o,p),k["stroke-dasharray"]&&v(d,k["stroke-dasharray"],f),d._.arrows&&("startString"in d._.arrows&&t(d,d._.arrows.startString),"endString"in d._.arrows&&t(d,d._.arrows.endString,1));break;case"stroke-dasharray":v(d,p,f);break;case"fill":var E=b(p).match(c._ISURL);if(E){A=q("pattern");var F=q("image");A.id=c.createUUID(),q(A,{x:0,y:0,patternUnits:"userSpaceOnUse",height:1,width:1}),q(F,{x:0,y:0,"xlink:href":E[1]}),A.appendChild(F),function(a){c._preload(E[1],function(){var b=this.offsetWidth,c=this.offsetHeight;q(a,{width:b,height:c}),q(F,{width:b,height:c}),d.paper.safari()})}(A),d.paper.defs.appendChild(A),q(i,{fill:"url(#"+A.id+")"}),d.pattern=A,d.pattern&&s(d);break}var G=c.getRGB(p);if(G.error){if(("circle"==d.type||"ellipse"==d.type||"r"!=b(p).charAt())&&r(d,p)){if("opacity"in k||"fill-opacity"in k){var H=c._g.doc.getElementById(i.getAttribute("fill").replace(/^url\(#|\)$/g,l));if(H){var I=H.getElementsByTagName("stop");q(I[I.length-1],{"stop-opacity":("opacity"in k?k.opacity:1)*("fill-opacity"in k?k["fill-opacity"]:1)})}}k.gradient=p,k.fill="none";break}}else delete f.gradient,delete k.gradient,!c.is(k.opacity,"undefined")&&c.is(f.opacity,"undefined")&&q(i,{opacity:k.opacity}),!c.is(k["fill-opacity"],"undefined")&&c.is(f["fill-opacity"],"undefined")&&q(i,{"fill-opacity":k["fill-opacity"]});G[a]("opacity")&&q(i,{"fill-opacity":G.opacity>1?G.opacity/100:G.opacity});case"stroke":G=c.getRGB(p),i.setAttribute(o,G.hex),"stroke"==o&&G[a]("opacity")&&q(i,{"stroke-opacity":G.opacity>1?G.opacity/100:G.opacity}),"stroke"==o&&d._.arrows&&("startString"in d._.arrows&&t(d,d._.arrows.startString),"endString"in d._.arrows&&t(d,d._.arrows.endString,1));break;case"gradient":("circle"==d.type||"ellipse"==d.type||"r"!=b(p).charAt())&&r(d,p);break;case"opacity":k.gradient&&!k[a]("stroke-opacity")&&q(i,{"stroke-opacity":p>1?p/100:p});case"fill-opacity":if(k.gradient){H=c._g.doc.getElementById(i.getAttribute("fill").replace(/^url\(#|\)$/g,l)),H&&(I=H.getElementsByTagName("stop"),q(I[I.length-1],{"stop-opacity":p}));break}default:"font-size"==o&&(p=e(p,10)+"px");var J=o.replace(/(\-.)/g,function(a){return a.substring(1).toUpperCase()});i.style[J]=p,d._.dirty=1,i.setAttribute(o,p)}}y(d,f),i.style.visibility=m},x=1.2,y=function(d,f){if("text"==d.type&&(f[a]("text")||f[a]("font")||f[a]("font-size")||f[a]("x")||f[a]("y"))){var g=d.attrs,h=d.node,i=h.firstChild?e(c._g.doc.defaultView.getComputedStyle(h.firstChild,l).getPropertyValue("font-size"),10):10;

Reference

CWE Id200
WASC Id13
Source ID3