DeuxHuitHuit /
entry_relationship_field
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * Copyright: Deux Huit Huit 2016 |
||
| 4 | * LICENCE: MIT https://deuxhuithuit.mit-license.org |
||
| 5 | */ |
||
| 6 | |||
| 7 | if(!defined("__IN_SYMPHONY__")) die("<h2>Error</h2><p>You cannot directly access this file</p>"); |
||
| 8 | |||
| 9 | class ERFXSLTUTilities { |
||
| 10 | public static function processXSLT($parentField, $entry, $entrySectionHandle, $entryFields, $mode, $debug = false, $select = 'entry', $position = 0) |
||
| 11 | { |
||
| 12 | $date = new DateTime(); |
||
| 13 | $params = array( |
||
| 14 | 'today' => $date->format('Y-m-d'), |
||
| 15 | 'current-time' => $date->format('H:i'), |
||
| 16 | 'this-year' => $date->format('Y'), |
||
| 17 | 'this-month' => $date->format('m'), |
||
| 18 | 'this-day' => $date->format('d'), |
||
| 19 | 'timezone' => $date->format('P'), |
||
| 20 | 'website-name' => Symphony::Configuration()->get('sitename', 'general'), |
||
| 21 | 'root' => URL, |
||
| 22 | 'workspace' => URL . '/workspace', |
||
| 23 | 'http-host' => HTTP_HOST |
||
| 24 | ); |
||
| 25 | |||
| 26 | $xslFilePath = WORKSPACE . '/er-templates/' . $entrySectionHandle . '.xsl'; |
||
| 27 | if (!!@file_exists($xslFilePath)) { |
||
| 28 | $xmlData = new XMLElement('data'); |
||
| 29 | $xmlData->setIncludeHeader(true); |
||
| 30 | |||
| 31 | // params |
||
| 32 | $xmlData->appendChild(self::getXmlParams($params)); |
||
| 33 | |||
| 34 | // entry data |
||
| 35 | if ($entry) { |
||
| 36 | $includedElements = FieldEntry_relationship::parseElements($parentField); |
||
| 37 | $xmlData->appendChild(self::entryToXML($entry, $entrySectionHandle, $includedElements, $entryFields, $position)); |
||
| 38 | } |
||
| 39 | |||
| 40 | // field data |
||
| 41 | $xmlData->appendChild(self::fieldToXML($parentField)); |
||
| 42 | |||
| 43 | // process XSLT |
||
| 44 | $indent = false; |
||
| 45 | $mode = $parentField->get($mode); |
||
| 46 | if ($debug) { |
||
| 47 | $mode = 'debug'; |
||
| 48 | } |
||
| 49 | if ($mode == 'debug') { |
||
| 50 | $indent = true; |
||
| 51 | } |
||
| 52 | $xmlMode = empty($mode) ? '' : 'mode="' . $mode . '"'; |
||
| 53 | $xmlString = $xmlData->generate($indent, 0); |
||
| 54 | $xsl = '<?xml version="1.0" encoding="UTF-8"?> |
||
| 55 | <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> |
||
| 56 | <xsl:import href="' . str_replace('\\', '/', $xslFilePath) . '"/> |
||
| 57 | <xsl:output method="xml" omit-xml-declaration="yes" encoding="UTF-8" indent="no" /> |
||
| 58 | <xsl:template match="/"> |
||
| 59 | <xsl:apply-templates select="/data" ' . $xmlMode . ' /> |
||
| 60 | </xsl:template> |
||
| 61 | <xsl:template match="/data" ' . $xmlMode . '> |
||
| 62 | <xsl:apply-templates select="' . $select . '" ' . $xmlMode . ' /> |
||
| 63 | </xsl:template> |
||
| 64 | <xsl:template match="/data" mode="debug"> |
||
| 65 | <xsl:copy-of select="/" /> |
||
| 66 | </xsl:template> |
||
| 67 | </xsl:stylesheet>'; |
||
| 68 | $xslt = new XsltProcess(); |
||
| 69 | $result = $xslt->process($xmlString, $xsl, $params); |
||
| 70 | |||
| 71 | if ($mode == 'debug') { |
||
| 72 | $result = '<pre><code>' . |
||
| 73 | str_replace('<', '<', str_replace('>', '>', $xmlString)) . |
||
| 74 | '</code></pre>'; |
||
| 75 | } |
||
| 76 | |||
| 77 | if ($xslt->isErrors()) { |
||
| 78 | $error = $xslt->getError(); |
||
| 79 | $result = $error[1]['message']; |
||
| 80 | } |
||
| 81 | |||
| 82 | if (General::strlen(trim($result)) > 0) { |
||
| 83 | return $result; |
||
| 84 | } |
||
| 85 | } |
||
| 86 | return null; |
||
| 87 | } |
||
| 88 | |||
| 89 | public static function getXmlParams(array $params) { |
||
| 90 | $xmlparams = new XMLElement('params'); |
||
| 91 | foreach ($params as $key => $value) { |
||
| 92 | $xmlparams->appendChild(new XMLElement($key, $value)); |
||
| 93 | } |
||
| 94 | return $xmlparams; |
||
| 95 | } |
||
| 96 | |||
| 97 | public static function fieldToXML($field) { |
||
| 98 | // field data |
||
| 99 | $xmlField = new XMLElement('field'); |
||
| 100 | $xmlField->setAttribute('id', $field->get('id')); |
||
| 101 | $xmlField->setAttribute('handle', $field->get('element_name')); |
||
| 102 | $xmlField->appendChild(new XMLElement('allow-new', $field->get('allow_new'))); |
||
| 103 | $xmlField->appendChild(new XMLElement('allow-edit', $field->get('allow_edit'))); |
||
| 104 | $xmlField->appendChild(new XMLElement('allow-delete', $field->get('allow_delete'))); |
||
| 105 | $xmlField->appendChild(new XMLElement('allow-link', $field->get('allow_link'))); |
||
| 106 | $xmlField->appendChild(new XMLElement('allow-collapse', $field->get('allow_collapse'))); |
||
| 107 | $xmlField->appendChild(new XMLElement('allow-search', $field->get('allow_search'))); |
||
| 108 | $xmlField->appendChild(new XMLElement('show-header', $field->get('show_header'))); |
||
| 109 | $xmlField->appendChild(new XMLElement('show-association', $field->get('show_association'))); |
||
| 110 | $xmlField->appendChild(new XMLElement('deepness', $field->get('deepness'))); |
||
| 111 | $xmlField->appendChild(new XMLElement('required', $field->get('required'))); |
||
| 112 | $xmlField->appendChild(new XMLElement('min-entries', $field->get('min_entries'))); |
||
| 113 | $xmlField->appendChild(new XMLElement('max-entries', $field->get('max_entries'))); |
||
| 114 | $xmlField->appendChild(new XMLElement('sort-order', $field->get('sortorder'))); |
||
| 115 | $sections = $field->getArray('sections'); |
||
| 116 | $sections = SectionManager::fetch($sections); |
||
| 117 | $xmlSections = new XMLElement('sections'); |
||
| 118 | foreach ($sections as $section) { |
||
| 119 | $xmlSections->appendChild(new XMLElement('section', $section->get('name'), array( |
||
| 120 | 'id' => $section->get('id'), |
||
| 121 | 'handle' => $section->get('handle'), |
||
| 122 | ))); |
||
| 123 | } |
||
| 124 | $xmlField->appendChild($xmlSections); |
||
| 125 | return $xmlField; |
||
| 126 | } |
||
| 127 | |||
| 128 | public static function entryToXML($entry, $entrySectionHandle, $includedElements, $entryFields, $position = 0) { |
||
| 129 | $entryData = $entry->getData(); |
||
| 130 | $entryId = General::intval($entry->get('id')); |
||
| 131 | $xml = new XMLElement('entry'); |
||
| 132 | $xml->setAttribute('id', $entryId); |
||
| 133 | $xml->setAttribute('section-id', $entry->get('section_id')); |
||
| 134 | $xml->setAttribute('section', $entrySectionHandle); |
||
| 135 | if ($position) { |
||
| 136 | $xml->setAttribute('position', (string)$position); |
||
| 137 | } |
||
| 138 | if (!empty($entryData)) { |
||
| 139 | foreach ($entryData as $fieldId => $data) { |
||
| 140 | $filteredData = array_filter($data, function ($value) { |
||
| 141 | return $value != null; |
||
| 142 | }); |
||
| 143 | if (empty($filteredData)) { |
||
| 144 | continue; |
||
| 145 | } |
||
| 146 | $field = $entryFields[$fieldId]; |
||
| 147 | $fieldName = $field->get('element_name'); |
||
| 148 | $fieldIncludedElement = $includedElements[$entrySectionHandle]; |
||
| 149 | |||
| 150 | try { |
||
| 151 | if (FieldEntry_relationship::isFieldIncluded($fieldName, $fieldIncludedElement)) { |
||
| 152 | $submodes = FieldEntry_relationship::getAllSelectedFieldModes($fieldName, $fieldIncludedElement); |
||
| 153 | |||
| 154 | // Special treatments for ERF |
||
| 155 | if ($field instanceof FieldEntry_relationship) { |
||
| 156 | // Increment recursive level |
||
| 157 | $field->incrementRecursiveLevel(); |
||
| 158 | $field->setRecursiveDeepness($deepness); |
||
|
0 ignored issues
–
show
|
|||
| 159 | } |
||
| 160 | |||
| 161 | if ($submodes == null) { |
||
| 162 | if ($field instanceof FieldEntry_Relationship) { |
||
| 163 | $field->expandIncludableElements = false; |
||
| 164 | } |
||
| 165 | $submodes = array_map(function ($fieldIncludableElement) use ($fieldName) { |
||
| 166 | return FieldEntry_relationship::extractMode($fieldName, $fieldIncludableElement); |
||
| 167 | }, $field->fetchIncludableElements()); |
||
| 168 | if ($field instanceof FieldEntry_Relationship) { |
||
| 169 | $field->expandIncludableElements = true; |
||
| 170 | } |
||
| 171 | } |
||
| 172 | |||
| 173 | foreach ($submodes as $submode) { |
||
| 174 | $field->appendFormattedElement($xml, $filteredData, false, $submode, $entryId); |
||
| 175 | } |
||
| 176 | } |
||
| 177 | } |
||
| 178 | catch (Exception $ex) { |
||
| 179 | $xml->appendChild(new XMLElement('error', $ex->getMessage() . ' on ' . $ex->getLine() . ' of file ' . $ex->getFile())); |
||
| 180 | } |
||
| 181 | } |
||
| 182 | } |
||
| 183 | return $xml; |
||
| 184 | } |
||
| 185 | } |
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.