Ariadne-CMS /
ariadne
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | DEFINE(CAPTCHA_TTF_FOLDER, $this->store->get_config('files').'/fonts/'); |
||
| 3 | |||
| 4 | require_once($this->store->get_config('code')."modules/mod_captcha/hn_captcha.class.x1.php"); |
||
| 5 | |||
| 6 | class mod_captcha extends hn_captcha_X1 { |
||
| 7 | |||
| 8 | public function __construct($config) { |
||
| 9 | $this->config = $config; |
||
|
0 ignored issues
–
show
|
|||
| 10 | parent::__construct($config); |
||
| 11 | } |
||
| 12 | |||
| 13 | public function get_filename_url($public="", $url='') { |
||
| 14 | if ($public == "") { |
||
| 15 | $public = $this->public_key; |
||
| 16 | } |
||
| 17 | if (!$url) { |
||
| 18 | return $this->config['url'].$this->config['template']."?show=$public"; |
||
| 19 | } else { |
||
| 20 | return $url."?show=$public"; |
||
| 21 | } |
||
| 22 | } |
||
| 23 | |||
| 24 | } |
||
| 25 | |||
| 26 | class captcha { |
||
| 27 | |||
| 28 | public static function process($aconfig='') { |
||
| 29 | global $ARCurrent; |
||
| 30 | $ARCurrent->arDontCache = true; |
||
| 31 | |||
| 32 | $context = pobject::getContext(); |
||
| 33 | $me = $context["arCurrentObject"]; |
||
| 34 | // ConfigArray |
||
| 35 | $context = $me->getContext(); |
||
| 36 | $template = $me->getvar('arCallFunction'); |
||
| 37 | |||
| 38 | if (!is_array($aconfig)) { |
||
| 39 | $aconfig = array(); |
||
| 40 | } |
||
| 41 | |||
| 42 | $temp = $me->store->get_config('files').'temp/'; |
||
| 43 | $config = array( |
||
| 44 | 'template' => $template, |
||
| 45 | 'url' => $me->make_url(), |
||
| 46 | 'tempfolder' => $temp, |
||
| 47 | 'TTF_folder' => CAPTCHA_TTF_FOLDER, |
||
| 48 | // mixed (array or string): basename(s) of TrueType-Fontfiles |
||
| 49 | 'TTF_RANGE' => array( |
||
| 50 | 'andalemo.ttf', |
||
| 51 | 'arial.ttf', |
||
| 52 | 'ariblk.ttf', |
||
| 53 | 'comic.ttf', |
||
| 54 | 'cour.ttf', |
||
| 55 | 'georgia.ttf', |
||
| 56 | 'impact.ttf', |
||
| 57 | 'times.ttf', |
||
| 58 | 'trebuc.ttf', |
||
| 59 | 'verdana.ttf', |
||
| 60 | ), |
||
| 61 | |||
| 62 | 'chars' => 5, // integer: number of chars to use for ID |
||
| 63 | 'minsize' => 20, // integer: minimal size of chars |
||
| 64 | 'maxsize' => 30, // integer: maximal size of chars |
||
| 65 | 'maxrotation' => 25, // integer: define the maximal angle for char-rotation, good results are between 0 and 30 |
||
| 66 | |||
| 67 | 'noise' => FALSE, // boolean: TRUE = noisy chars | FALSE = grid |
||
| 68 | 'websafecolors' => FALSE, // boolean |
||
| 69 | 'refreshlink' => TRUE, // boolean |
||
| 70 | 'lang' => 'en', // string: ['en'|'de'] |
||
| 71 | 'maxtry' => 3, // integer: [1-9] |
||
| 72 | |||
| 73 | 'badguys_url' => '/', // string: URL |
||
| 74 | 'secretstring' => 'A very, very secret string which is used to generate a md5-key!', |
||
| 75 | 'secretposition' => 15, // integer: [1-32] |
||
| 76 | |||
| 77 | 'debug' => FALSE |
||
| 78 | ); |
||
| 79 | |||
| 80 | foreach ($aconfig as $akey => $aval) { |
||
| 81 | switch ($akey) { |
||
| 82 | case 'maxsize': |
||
| 83 | case 'maxrotation': |
||
| 84 | case 'noise': |
||
| 85 | case 'websafecolors': |
||
| 86 | case 'lang': |
||
| 87 | case 'maxtry': |
||
| 88 | case 'badguys_url': |
||
| 89 | case 'secretstring': |
||
| 90 | case 'secretposition': |
||
| 91 | case 'minsize': |
||
| 92 | case 'chars': |
||
| 93 | case 'debug': |
||
| 94 | $config[$akey] = $aval; |
||
| 95 | break; |
||
| 96 | } |
||
| 97 | } |
||
| 98 | |||
| 99 | $captcha = new mod_captcha($config); |
||
| 100 | if ($me->getvar('show')) { |
||
| 101 | $captchaCase = 'show'; |
||
| 102 | } else { |
||
| 103 | $case = $captcha->validate_submit(); |
||
| 104 | switch ($case) { |
||
| 105 | case 1: |
||
| 106 | $captchaCase = 'valid'; |
||
| 107 | break; |
||
| 108 | case 2: |
||
| 109 | $captchaCase = 'invalid'; |
||
| 110 | break; |
||
| 111 | case 3: |
||
| 112 | $captchaCase = 'expired'; |
||
| 113 | break; |
||
| 114 | default: |
||
| 115 | $captchaCase = 'normal'; |
||
| 116 | break; |
||
| 117 | } |
||
| 118 | } |
||
| 119 | |||
| 120 | $context['captcha'] = $captcha; |
||
| 121 | $me->setContext($context); |
||
| 122 | return $captchaCase; |
||
| 123 | } |
||
| 124 | |||
| 125 | public static function showImg() { |
||
| 126 | global $ARCurrent; |
||
| 127 | $ARCurrent->arDontCache = true; |
||
| 128 | $context = pobject::getContext(); |
||
| 129 | $me = $context["arCurrentObject"]; |
||
| 130 | $captchaImg = $me->getvar('show'); |
||
| 131 | $captchaImg = preg_replace("|[\\\/]|", "", $captchaImg); |
||
| 132 | $filename = $me->store->get_config('files').'temp/hn_captcha_'.$captchaImg.'.jpg'; |
||
| 133 | // ldSetContent('image/jpg'); |
||
| 134 | if( file_exists($filename) ) { |
||
| 135 | readfile($filename); |
||
| 136 | } |
||
| 137 | } |
||
| 138 | |||
| 139 | public static function getImgSrc($url='') { |
||
| 140 | global $ARCurrent; |
||
| 141 | $ARCurrent->arDontCache = true; |
||
| 142 | $context = pobject::getContext(); |
||
| 143 | $me = $context["arCurrentObject"]; |
||
| 144 | $context = $me->getContext(); |
||
| 145 | $captcha = $context['captcha']; |
||
| 146 | $captcha->make_captcha(); |
||
| 147 | return $captcha->get_filename_url('', $url); |
||
| 148 | } |
||
| 149 | |||
| 150 | public static function getFormField() { |
||
| 151 | global $ARCurrent; |
||
| 152 | $ARCurrent->arDontCache = true; |
||
| 153 | $context = pobject::getContext(); |
||
| 154 | $me = $context["arCurrentObject"]; |
||
| 155 | $context = $me->getContext(); |
||
| 156 | $captcha = $context['captcha']; |
||
| 157 | $captcha->make_captcha(); |
||
| 158 | $elements = $captcha->public_key_input(); |
||
| 159 | $try = $captcha->get_try(FALSE); |
||
| 160 | $elements .= "<input type=\"hidden\" name=\"hncaptcha\" value=\"$try\">"; |
||
| 161 | $elements .= "<input type=\"text\" class=\"captcha\" name=\"private_key\" value=\"\" maxlength=\"".$captcha->chars."\" size=\"".$captcha->chars."\">"; |
||
| 162 | return $elements; |
||
| 163 | } |
||
| 164 | } |
||
| 165 | |||
| 166 | class pinp_captcha { |
||
| 167 | public static function _process($config='') { |
||
| 168 | return captcha::process($config); |
||
| 169 | } |
||
| 170 | |||
| 171 | public static function _showImg() { |
||
| 172 | return captcha::showImg(); |
||
| 173 | } |
||
| 174 | |||
| 175 | public static function _getImgSrc($url='') { |
||
| 176 | return captcha::getImgSrc($url); |
||
| 177 | } |
||
| 178 | |||
| 179 | public static function _getFormField() { |
||
| 180 | return captcha::getFormField(); |
||
| 181 | } |
||
| 182 | } |
||
| 183 |
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: