This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | // |
||
3 | // SourceForge: Breaking Down the Barriers to Open Source Development |
||
4 | // Copyright 1999-2000 (c) The SourceForge Crew |
||
5 | // http://sourceforge.net |
||
6 | // |
||
7 | // |
||
8 | |||
9 | |||
10 | $USER_RES=array(); |
||
11 | |||
12 | |||
13 | //Deprecated. Use User->isLoggedIn() instead |
||
14 | function user_isloggedin() { |
||
15 | return UserManager::instance()->getCurrentUser()->isLoggedIn(); |
||
16 | } |
||
17 | |||
18 | //Deprecated. Use User->isRestricted() instead |
||
19 | function user_isrestricted() { |
||
20 | return UserManager::instance()->getCurrentUser()->isRestricted(); |
||
21 | } |
||
22 | |||
23 | //Deprecated. Use User->isSuperUser() instead |
||
24 | function user_is_super_user() { |
||
25 | return UserManager::instance()->getCurrentUser()->isSuperUser(); |
||
26 | } |
||
27 | |||
28 | //Deprecated. Use User->isMember() instead |
||
29 | function user_ismember($group_id,$type=0) { |
||
30 | return UserManager::instance()->getCurrentUser()->isMember($group_id,$type); |
||
31 | } |
||
32 | |||
33 | //Deprecated. Use User->getId() instead |
||
34 | function user_getid() { |
||
35 | return UserManager::instance()->getCurrentUser()->getId(); |
||
36 | } |
||
37 | |||
38 | //Deprecated. Use User->getName() instead |
||
39 | function user_getname($user_id = 0) { |
||
40 | global $USER_NAMES,$Language; |
||
41 | // use current user if one is not passed in |
||
42 | if (!$user_id) { |
||
43 | return UserManager::instance()->getCurrentUser()->getUserName(); |
||
44 | } |
||
45 | // else must lookup name |
||
46 | else { |
||
47 | if (isset($USER_NAMES["user_$user_id"]) && $USER_NAMES["user_$user_id"]) { |
||
48 | //user name was fetched previously |
||
49 | return $USER_NAMES["user_$user_id"]; |
||
50 | } else { |
||
51 | //fetch the user name and store it for future reference |
||
52 | $result = db_query("SELECT user_id,user_name FROM user WHERE user_id='".db_es($user_id)."'"); |
||
53 | if ($result && db_numrows($result) > 0) { |
||
54 | //valid user - store and return |
||
55 | $USER_NAMES["user_$user_id"]=db_result($result,0,"user_name"); |
||
56 | return $USER_NAMES["user_$user_id"]; |
||
57 | } else { |
||
58 | //invalid user - store and return |
||
59 | $USER_NAMES["user_$user_id"]="<B>".$Language->getText('include_user','invalid_u_id')."</B>"; |
||
60 | return $USER_NAMES["user_$user_id"]; |
||
61 | } |
||
62 | } |
||
63 | } |
||
64 | } |
||
65 | |||
66 | //quick hack - this entire library needs a rewrite similar to groups library |
||
67 | //Deprecated. Use User->getRealName() instead |
||
68 | function user_getrealname($user_id) { |
||
69 | global $Language; |
||
70 | $result = user_get_result_set($user_id); |
||
71 | if ($result && db_numrows($result) > 0) { |
||
72 | return db_result($result,0,"realname"); |
||
73 | } else { |
||
74 | return $Language->getText('include_user','not_found'); |
||
75 | } |
||
76 | } |
||
77 | |||
78 | // LJ - Added here because we use the real e-mail addresse |
||
79 | // on Codendi - No e-mail aliases like on SF |
||
80 | //Deprecated. Use User->getEmail() instead |
||
81 | function user_getemail($user_id) { |
||
82 | global $Language; |
||
83 | $result = user_get_result_set($user_id); |
||
84 | if ($result && db_numrows($result) > 0) { |
||
85 | return db_result($result,0,"email"); |
||
86 | } else { |
||
87 | return $Language->getText('include_user','email_not_found'); |
||
88 | } |
||
89 | } |
||
90 | |||
91 | function user_getid_from_email($email) { |
||
92 | global $Language; |
||
93 | $result = db_query("SELECT user_id FROM user WHERE email='".db_es($email)."'"); |
||
94 | if ($result && db_numrows($result) > 0) { |
||
95 | return db_result($result,0,"user_id"); |
||
96 | } else { |
||
97 | return $Language->getText('include_user','not_found'); |
||
98 | } |
||
99 | } |
||
100 | |||
101 | //Deprectaed. Use User->getEmail() and UserManager->getUserByUserName() instead |
||
102 | function user_getemail_from_unix($user_name) { |
||
103 | global $Language; |
||
104 | $result = user_get_result_set_from_unix($user_name); |
||
105 | if ($result && db_numrows($result) > 0) { |
||
106 | return db_result($result,0,"email"); |
||
107 | } else { |
||
108 | return $Language->getText('include_user','email_not_found'); |
||
109 | } |
||
110 | } |
||
111 | |||
112 | //Deprecated. Use UserManager->getUserById() instead and don't use db_result in all code |
||
113 | function user_get_result_set($user_id) { |
||
114 | //create a common set of user result sets, |
||
115 | //so it doesn't have to be fetched each time |
||
116 | |||
117 | global $USER_RES; |
||
118 | if (!isset($USER_RES["_".$user_id."_"]) || !$USER_RES["_".$user_id."_"]) { |
||
119 | $USER_RES["_".$user_id."_"]=db_query("SELECT * FROM user WHERE user_id='".db_es($user_id)."'"); |
||
120 | return $USER_RES["_".$user_id."_"]; |
||
121 | } else { |
||
122 | return $USER_RES["_".$user_id."_"]; |
||
123 | } |
||
124 | } |
||
125 | |||
126 | //Deprecated. Use UserManager->getUserByUserName() instead and don't use db_result in all code |
||
127 | function user_get_result_set_from_unix($user_name) { |
||
128 | //create a common set of user result sets, |
||
129 | //so it doesn't have to be fetched each time |
||
130 | |||
131 | global $USER_RES; |
||
132 | $res = db_query("SELECT * FROM user WHERE user_name='".db_es($user_name)."'"); |
||
133 | $user_id = db_result($res,0,'user_id'); |
||
134 | $USER_RES["_".$user_id."_"] = $res; |
||
135 | return $USER_RES["_".$user_id."_"]; |
||
136 | } |
||
137 | function user_get_result_set_from_email($email) { |
||
138 | //create a common set of user result sets, |
||
139 | //so it doesn't have to be fetched each time |
||
140 | |||
141 | global $USER_RES; |
||
142 | $sql = "SELECT * FROM user WHERE (user_name='".db_es($email)."' or email='".db_es($email)."')"; |
||
143 | $res = db_query($sql); |
||
144 | $user_id = db_result($res,0,'user_id'); |
||
145 | $USER_RES["_".$user_id."_"] = $res; |
||
146 | return $USER_RES["_".$user_id."_"]; |
||
147 | } |
||
148 | |||
149 | //Deprecated. Use user->getTimezone() instead |
||
150 | function user_get_timezone() { |
||
151 | $current_user = UserManager::instance()->getCurrentUser(); |
||
152 | if ($current_user->isLoggedIn()) { |
||
153 | return $current_user->getTimezone(); |
||
154 | } else { |
||
155 | return ''; |
||
156 | } |
||
157 | } |
||
158 | |||
159 | //Deprecated. Use User->setPreference() instead. |
||
160 | function user_set_preference($preference_name,$value) { |
||
161 | GLOBAL $user_pref; |
||
162 | if (user_isloggedin()) { |
||
163 | $preference_name=strtolower(trim($preference_name)); |
||
164 | $result=db_query("UPDATE user_preferences SET preference_value='".db_es($value)."' ". |
||
165 | "WHERE user_id='".user_getid()."' AND preference_name='".db_es($preference_name)."'"); |
||
166 | if (db_affected_rows($result) < 1) { |
||
167 | echo db_error(); |
||
168 | $result=db_query("INSERT INTO user_preferences (user_id,preference_name,preference_value) ". |
||
169 | "VALUES ('".user_getid()."','".db_es($preference_name)."','".db_es($value)."')"); |
||
170 | } |
||
171 | |||
172 | // Update the Preference cache if it was setup by a user_get_preference |
||
173 | if (isset($user_pref)) { $user_pref[$preference_name] = $value; } |
||
174 | |||
175 | return true; |
||
176 | |||
177 | } else { |
||
178 | return false; |
||
179 | } |
||
180 | } |
||
181 | |||
182 | //Deprecated. Use User->getPreference() instead. |
||
183 | function user_get_preference($preference_name) { |
||
184 | GLOBAL $user_pref; |
||
185 | if (user_isloggedin()) { |
||
186 | $preference_name=strtolower(trim($preference_name)); |
||
187 | /* |
||
188 | First check to see if we have already fetched the preferences |
||
189 | */ |
||
190 | if ($user_pref) { |
||
191 | if (isset($user_pref["$preference_name"]) && $user_pref["$preference_name"]) { |
||
192 | //we have fetched prefs - return part of array |
||
193 | return $user_pref["$preference_name"]; |
||
194 | } else { |
||
195 | //we have fetched prefs, but this pref hasn't been set |
||
196 | return false; |
||
197 | } |
||
198 | } else { |
||
199 | //we haven't returned prefs - go to the db |
||
200 | $result=db_query("SELECT preference_name,preference_value FROM user_preferences ". |
||
201 | "WHERE user_id='".user_getid()."'"); |
||
202 | |||
203 | if (db_numrows($result) < 1) { |
||
204 | return false; |
||
205 | } else { |
||
206 | //iterate and put the results into an array |
||
207 | while($row = db_fetch_array($result)) { |
||
208 | $user_pref[$row['preference_name']]=$row['preference_value']; |
||
209 | } |
||
210 | if (isset($user_pref["$preference_name"])) { |
||
211 | //we have fetched prefs - return part of array |
||
212 | return $user_pref["$preference_name"]; |
||
213 | } else { |
||
214 | //we have fetched prefs, but this pref hasn't been set |
||
215 | return false; |
||
216 | } |
||
217 | } |
||
218 | } |
||
219 | } else { |
||
220 | return false; |
||
221 | } |
||
222 | } |
||
223 | |||
224 | //Deprecated. Use User->delPreference() instead. |
||
225 | function user_del_preference($preference_name) { |
||
226 | GLOBAL $user_pref; |
||
227 | if (user_isloggedin()) { |
||
228 | if ($user_pref && array_key_exists($preference_name, $user_pref)) { |
||
229 | unset($user_pref[$preference_name]); |
||
230 | } |
||
231 | $sql = 'DELETE FROM user_preferences' |
||
232 | .' WHERE preference_name="'.db_es($preference_name).'"' |
||
233 | .' AND user_id='.user_getid(); |
||
234 | $res = db_query($sql); |
||
235 | if(db_affected_rows($res) != 1) { |
||
236 | return false; |
||
237 | } |
||
238 | else { |
||
239 | return true; |
||
240 | } |
||
241 | } |
||
242 | else { |
||
243 | return false; |
||
244 | } |
||
245 | } |
||
246 | |||
247 | function user_display_choose_password($page,$user_id = false) { |
||
248 | $request = & HTTPRequest :: instance(); |
||
249 | ?> |
||
250 | <table><tr valign='top'><td> |
||
251 | <? |
||
0 ignored issues
–
show
|
|||
252 | |||
253 | if ($page == 'admin_creation') { |
||
254 | echo $GLOBALS['Language']->getText('account_change_pw', 'new_password'); |
||
255 | ?>: |
||
256 | <br><div class="input-append"><input type="text" value="" id="form_pw" name="form_pw"></div> |
||
257 | <script type="text/javascript" src="/scripts/user.js"></script> |
||
258 | |||
259 | |||
260 | <? } else { echo $GLOBALS['Language']->getText('account_change_pw', 'new_password'); ?>: |
||
261 | <br><input type="password" value="" id="form_pw" name="form_pw"> |
||
262 | <p><? echo $GLOBALS['Language']->getText('account_change_pw', 'new_password2'); ?>: |
||
263 | <br><input type="password" value="" name="form_pw2"> |
||
264 | <? } ?> |
||
265 | </td><td> |
||
266 | <div class="password_strategy"> |
||
267 | <p class="robustness"><?=$GLOBALS['Language']->getText('account_check_pw', 'password_robustness')?> |
||
268 | <span class="password_strategy_good"><?php echo $GLOBALS['Language']->getText('account_check_pw', 'good'); ?></span> |
||
269 | <span class="password_strategy_bad"><?php echo $GLOBALS['Language']->getText('account_check_pw', 'bad'); ?></span></p> |
||
270 | <?php |
||
271 | $password_strategy = new PasswordStrategy(); |
||
272 | include($GLOBALS['Language']->getContent('account/password_strategy')); |
||
273 | foreach($password_strategy->validators as $key => $v) { |
||
274 | echo '<p class="password_validator_msg_'. $key .'"><i class="icon-remove password_strategy_bad"></i> '. $v->description() .'</p>'; |
||
275 | } |
||
276 | ?> |
||
277 | </blockquote> |
||
278 | </td></tr></table> |
||
279 | <script type="text/javascript"> |
||
280 | var password_validators = [<?= implode(', ', array_keys($password_strategy->validators)) ?>]; |
||
281 | </script> |
||
282 | <?php |
||
283 | if ($user_id) { |
||
284 | echo '<input type="hidden" name="user_id" value="'. $user_id .'" />'; |
||
285 | } |
||
286 | } |
||
287 | |||
288 | ?> |
||
289 |
Short opening tags are disabled in PHP’s default configuration. In such a case, all content of this file is output verbatim to the browser without being parsed, or executed.
As a precaution to avoid these problems better use the long opening tag
<?php
.