This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Copyright: Deux Huit Huit 2016 |
||
4 | * LICENCE: MIT https://deuxhuithuit.mit-license.org |
||
5 | */ |
||
6 | |||
7 | if(!defined("__IN_SYMPHONY__")) die("<h2>Error</h2><p>You cannot directly access this file</p>"); |
||
8 | |||
9 | class ERFXSLTUTilities { |
||
10 | public static function processXSLT($parentField, $entry, $entrySectionHandle, $entryFields, $mode, $debug = false, $select = 'entry', $position = 0) |
||
11 | { |
||
12 | $date = new DateTime(); |
||
13 | $params = array( |
||
14 | 'today' => $date->format('Y-m-d'), |
||
15 | 'current-time' => $date->format('H:i'), |
||
16 | 'this-year' => $date->format('Y'), |
||
17 | 'this-month' => $date->format('m'), |
||
18 | 'this-day' => $date->format('d'), |
||
19 | 'timezone' => $date->format('P'), |
||
20 | 'website-name' => Symphony::Configuration()->get('sitename', 'general'), |
||
21 | 'root' => URL, |
||
22 | 'workspace' => URL . '/workspace', |
||
23 | 'http-host' => HTTP_HOST |
||
24 | ); |
||
25 | |||
26 | $xslFilePath = WORKSPACE . '/er-templates/' . $entrySectionHandle . '.xsl'; |
||
27 | if (!!@file_exists($xslFilePath)) { |
||
28 | $xmlData = new XMLElement('data'); |
||
29 | $xmlData->setIncludeHeader(true); |
||
30 | |||
31 | // params |
||
32 | $xmlData->appendChild(self::getXmlParams($params)); |
||
33 | |||
34 | // entry data |
||
35 | if ($entry) { |
||
36 | $includedElements = FieldEntry_relationship::parseElements($parentField); |
||
37 | $xmlData->appendChild(self::entryToXML($entry, $entrySectionHandle, $includedElements, $entryFields, $position)); |
||
38 | } |
||
39 | |||
40 | // field data |
||
41 | $xmlData->appendChild(self::fieldToXML($parentField)); |
||
42 | |||
43 | // process XSLT |
||
44 | $indent = false; |
||
45 | $mode = $parentField->get($mode); |
||
46 | if ($debug) { |
||
47 | $mode = 'debug'; |
||
48 | } |
||
49 | if ($mode == 'debug') { |
||
50 | $indent = true; |
||
51 | } |
||
52 | $xmlMode = empty($mode) ? '' : 'mode="' . $mode . '"'; |
||
53 | $xmlString = $xmlData->generate($indent, 0); |
||
54 | $xsl = '<?xml version="1.0" encoding="UTF-8"?> |
||
55 | <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> |
||
56 | <xsl:import href="' . str_replace('\\', '/', $xslFilePath) . '"/> |
||
57 | <xsl:output method="xml" omit-xml-declaration="yes" encoding="UTF-8" indent="no" /> |
||
58 | <xsl:template match="/"> |
||
59 | <xsl:apply-templates select="/data" ' . $xmlMode . ' /> |
||
60 | </xsl:template> |
||
61 | <xsl:template match="/data" ' . $xmlMode . '> |
||
62 | <xsl:apply-templates select="' . $select . '" ' . $xmlMode . ' /> |
||
63 | </xsl:template> |
||
64 | <xsl:template match="/data" mode="debug"> |
||
65 | <xsl:copy-of select="/" /> |
||
66 | </xsl:template> |
||
67 | </xsl:stylesheet>'; |
||
68 | $xslt = new XsltProcess(); |
||
69 | $result = $xslt->process($xmlString, $xsl, $params); |
||
70 | |||
71 | if ($mode == 'debug') { |
||
72 | $result = '<pre><code>' . |
||
73 | str_replace('<', '<', str_replace('>', '>', $xmlString)) . |
||
74 | '</code></pre>'; |
||
75 | } |
||
76 | |||
77 | if ($xslt->isErrors()) { |
||
78 | $error = $xslt->getError(); |
||
79 | $result = $error[1]['message']; |
||
80 | } |
||
81 | |||
82 | if (General::strlen(trim($result)) > 0) { |
||
83 | return $result; |
||
84 | } |
||
85 | } |
||
86 | return null; |
||
87 | } |
||
88 | |||
89 | public static function getXmlParams(array $params) { |
||
90 | $xmlparams = new XMLElement('params'); |
||
91 | foreach ($params as $key => $value) { |
||
92 | $xmlparams->appendChild(new XMLElement($key, $value)); |
||
93 | } |
||
94 | return $xmlparams; |
||
95 | } |
||
96 | |||
97 | public static function fieldToXML($field) { |
||
98 | // field data |
||
99 | $xmlField = new XMLElement('field'); |
||
100 | $xmlField->setAttribute('id', $field->get('id')); |
||
101 | $xmlField->setAttribute('handle', $field->get('element_name')); |
||
102 | $xmlField->appendChild(new XMLElement('allow-new', $field->get('allow_new'))); |
||
103 | $xmlField->appendChild(new XMLElement('allow-edit', $field->get('allow_edit'))); |
||
104 | $xmlField->appendChild(new XMLElement('allow-delete', $field->get('allow_delete'))); |
||
105 | $xmlField->appendChild(new XMLElement('allow-link', $field->get('allow_link'))); |
||
106 | $xmlField->appendChild(new XMLElement('allow-collapse', $field->get('allow_collapse'))); |
||
107 | $xmlField->appendChild(new XMLElement('allow-search', $field->get('allow_search'))); |
||
108 | $xmlField->appendChild(new XMLElement('show-header', $field->get('show_header'))); |
||
109 | $xmlField->appendChild(new XMLElement('show-association', $field->get('show_association'))); |
||
110 | $xmlField->appendChild(new XMLElement('deepness', $field->get('deepness'))); |
||
111 | $xmlField->appendChild(new XMLElement('required', $field->get('required'))); |
||
112 | $xmlField->appendChild(new XMLElement('min-entries', $field->get('min_entries'))); |
||
113 | $xmlField->appendChild(new XMLElement('max-entries', $field->get('max_entries'))); |
||
114 | $xmlField->appendChild(new XMLElement('sort-order', $field->get('sortorder'))); |
||
115 | $sections = $field->getArray('sections'); |
||
116 | $sections = SectionManager::fetch($sections); |
||
117 | $xmlSections = new XMLElement('sections'); |
||
118 | foreach ($sections as $section) { |
||
119 | $xmlSections->appendChild(new XMLElement('section', $section->get('name'), array( |
||
120 | 'id' => $section->get('id'), |
||
121 | 'handle' => $section->get('handle'), |
||
122 | ))); |
||
123 | } |
||
124 | $xmlField->appendChild($xmlSections); |
||
125 | return $xmlField; |
||
126 | } |
||
127 | |||
128 | public static function entryToXML($entry, $entrySectionHandle, $includedElements, $entryFields, $position = 0) { |
||
129 | $entryData = $entry->getData(); |
||
130 | $entryId = General::intval($entry->get('id')); |
||
131 | $xml = new XMLElement('entry'); |
||
132 | $xml->setAttribute('id', $entryId); |
||
133 | $xml->setAttribute('section-id', $entry->get('section_id')); |
||
134 | $xml->setAttribute('section', $entrySectionHandle); |
||
135 | if ($position) { |
||
136 | $xml->setAttribute('position', (string)$position); |
||
137 | } |
||
138 | if (!empty($entryData)) { |
||
139 | foreach ($entryData as $fieldId => $data) { |
||
140 | $filteredData = array_filter($data, function ($value) { |
||
141 | return $value != null; |
||
142 | }); |
||
143 | if (empty($filteredData)) { |
||
144 | continue; |
||
145 | } |
||
146 | $field = $entryFields[$fieldId]; |
||
147 | $fieldName = $field->get('element_name'); |
||
148 | $fieldIncludedElement = $includedElements[$entrySectionHandle]; |
||
149 | |||
150 | try { |
||
151 | if (FieldEntry_relationship::isFieldIncluded($fieldName, $fieldIncludedElement)) { |
||
152 | $submodes = FieldEntry_relationship::getAllSelectedFieldModes($fieldName, $fieldIncludedElement); |
||
153 | |||
154 | // Special treatments for ERF |
||
155 | if ($field instanceof FieldEntry_relationship) { |
||
156 | // Increment recursive level |
||
157 | $field->incrementRecursiveLevel(); |
||
158 | $field->setRecursiveDeepness($deepness); |
||
0 ignored issues
–
show
|
|||
159 | } |
||
160 | |||
161 | if ($submodes == null) { |
||
162 | if ($field instanceof FieldEntry_Relationship) { |
||
163 | $field->expandIncludableElements = false; |
||
164 | } |
||
165 | $submodes = array_map(function ($fieldIncludableElement) use ($fieldName) { |
||
166 | return FieldEntry_relationship::extractMode($fieldName, $fieldIncludableElement); |
||
167 | }, $field->fetchIncludableElements()); |
||
168 | if ($field instanceof FieldEntry_Relationship) { |
||
169 | $field->expandIncludableElements = true; |
||
170 | } |
||
171 | } |
||
172 | |||
173 | foreach ($submodes as $submode) { |
||
174 | $field->appendFormattedElement($xml, $filteredData, false, $submode, $entryId); |
||
175 | } |
||
176 | } |
||
177 | } |
||
178 | catch (Exception $ex) { |
||
179 | $xml->appendChild(new XMLElement('error', $ex->getMessage() . ' on ' . $ex->getLine() . ' of file ' . $ex->getFile())); |
||
180 | } |
||
181 | } |
||
182 | } |
||
183 | return $xml; |
||
184 | } |
||
185 | } |
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.