This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | // |
||
3 | // SourceForge: Breaking Down the Barriers to Open Source Development |
||
4 | // Copyright 1999-2000 (c) The SourceForge Crew |
||
5 | // http://sourceforge.net |
||
6 | // Copyright (c) Enalean, 2015. All rights reserved |
||
7 | // |
||
8 | |||
9 | require_once('pre.php'); |
||
10 | require_once('common/mail/MailManager.class.php'); |
||
11 | require_once('common/include/HTTPRequest.class.php'); |
||
12 | |||
13 | define('FORMAT_TEXT', 0); |
||
14 | define('FORMAT_HTML', 1); |
||
15 | |||
16 | $request = HTTPRequest::instance(); |
||
17 | $func = $request->getValidated('func', new Valid_WhiteList('restricted_user_request', 'private_project_request'), ''); |
||
18 | |||
19 | if ($request->isPost() && $request->exist('Submit') && $request->existAndNonEmpty('func')) { |
||
20 | $defaultMsg = $GLOBALS['Language']->getText('project_admin_index', 'member_request_delegation_msg_to_requester'); |
||
21 | $pm = ProjectManager::instance(); |
||
22 | $dar = $pm->getMessageToRequesterForAccessProject($request->get('groupId')); |
||
23 | if ($dar && !$dar->isError() && $dar->rowCount() == 1) { |
||
24 | $row = $dar->current(); |
||
25 | if ($row['msg_to_requester'] != "member_request_delegation_msg_to_requester" ) { |
||
26 | $defaultMsg = $row['msg_to_requester']; |
||
27 | } |
||
28 | } |
||
29 | |||
30 | switch ($func) { |
||
31 | case 'restricted_user_request': |
||
32 | $sendMail = new Error_PermissionDenied_RestrictedUser(); |
||
33 | $vMessage = new Valid_Text('msg_restricted_user'); |
||
34 | $vMessage->required(); |
||
35 | if ($request->valid($vMessage) && (trim($request->get('msg_restricted_user'))!= $defaultMsg )) { |
||
36 | $messageToAdmin = $request->get('msg_restricted_user'); |
||
37 | } else { |
||
38 | exit_error($Language->getText('include_exit', 'error'),$Language->getText('sendmessage','invalid_msg')); |
||
39 | } |
||
40 | break; |
||
41 | |||
42 | case 'private_project_request': |
||
43 | $sendMail = new Error_PermissionDenied_PrivateProject(); |
||
44 | $vMessage = new Valid_Text('msg_private_project'); |
||
45 | $vMessage->required(); |
||
46 | if ($request->valid($vMessage) && (trim($request->get('msg_private_project')) != $defaultMsg )) { |
||
47 | $messageToAdmin = $request->get('msg_private_project'); |
||
48 | } else { |
||
49 | exit_error($Language->getText('include_exit', 'error'),$Language->getText('sendmessage','invalid_msg')); |
||
50 | } |
||
51 | break; |
||
52 | |||
53 | default: |
||
54 | break; |
||
55 | } |
||
56 | $sendMail->processMail($messageToAdmin); |
||
57 | exit; |
||
58 | } |
||
59 | |||
60 | $um = UserManager::instance(); |
||
61 | $user = $um->getCurrentUser(); |
||
62 | if (!$user->isLoggedIn()) { |
||
63 | exit_error($Language->getText('include_exit', 'error'),$Language->getText('include_exit', 'not_logged_in')); |
||
64 | } |
||
65 | |||
66 | $email = $user->getEmail(); |
||
67 | |||
68 | $valid = new Valid_Email('toaddress'); |
||
69 | $valid->required(); |
||
70 | if ($request->valid($valid)) { |
||
71 | $toaddress = $request->get('toaddress'); |
||
72 | } |
||
73 | |||
74 | $valid = new Valid_Email('touser'); |
||
75 | $valid->required(); |
||
76 | if ($request->valid($valid)) { |
||
77 | $touser = $request->get('touser'); |
||
78 | } |
||
79 | |||
80 | if (!isset($toaddress) && !isset($touser)) { |
||
81 | exit_error($Language->getText('include_exit', 'error'),$Language->getText('sendmessage','err_noparam')); |
||
82 | } |
||
83 | |||
84 | if (strpos(':', $GLOBALS['sys_default_domain']) === false) { |
||
85 | $host = $GLOBALS['sys_default_domain']; |
||
86 | } else { |
||
87 | list($host,$port) = explode(':',$GLOBALS['sys_default_domain']); |
||
88 | } |
||
89 | |||
90 | if (isset($toaddress) && !eregi($host,$toaddress)) { |
||
91 | exit_error($Language->getText('include_exit', 'error'), |
||
92 | $Language->getText('sendmessage','err_host',array($host))); |
||
93 | } |
||
94 | |||
95 | $valid = new Valid_Text('subject'); |
||
96 | $valid->required(); |
||
97 | if ($request->valid($valid)) { |
||
98 | $subject = $request->get('subject'); |
||
99 | } |
||
100 | |||
101 | $valid = new Valid_Text('body'); |
||
102 | $valid->required(); |
||
103 | if ($request->valid($valid)) { |
||
104 | $body = $request->get('body'); |
||
105 | } |
||
106 | |||
107 | $csrf_token = new CSRFSynchronizerToken('sendmessage.php'); |
||
108 | $purifier = Codendi_HTMLPurifier::instance(); |
||
109 | |||
110 | if (isset($send_mail)) { |
||
111 | if (!$subject || !$body || !$email) { |
||
112 | /* |
||
113 | force them to enter all vars |
||
114 | */ |
||
115 | exit_missing_param(); |
||
116 | } |
||
117 | $csrf_token->check(); |
||
118 | |||
119 | |||
120 | $valid = new Valid_Text('cc'); |
||
121 | $valid->required(); |
||
122 | if ($request->valid($valid)) { |
||
123 | $cc = $request->get('cc'); |
||
124 | } |
||
125 | |||
126 | $mailMgr = new MailManager(); |
||
127 | |||
128 | $mail = $mailMgr->getMailByType(); |
||
129 | if (isset($touser)) { |
||
130 | //Return the user given its user_id |
||
131 | $to = $um->getUserById($touser); |
||
132 | if (!$to) { |
||
133 | exit_error($Language->getText('include_exit', 'error'), |
||
134 | $Language->getText('sendmessage','err_nouser')); |
||
135 | } |
||
136 | $mail->setToUser(array($to)); |
||
137 | $dest = $to->getRealName(); |
||
138 | } else if (isset($toaddress)) { |
||
139 | $to=eregi_replace('_maillink_','@',$toaddress); |
||
140 | $mail->setTo($to); |
||
141 | $dest = $to; |
||
142 | } |
||
143 | |||
144 | if (isset($cc) && strlen($cc) > 0) { |
||
145 | $mail->setCc($cc); |
||
146 | $dest .= ','. $cc; |
||
147 | } |
||
148 | |||
149 | $mail->setSubject($subject); |
||
150 | |||
151 | $vFormat = new Valid_WhiteList('body_format', array(FORMAT_HTML, FORMAT_TEXT)); |
||
152 | $bodyFormat = $request->getValidated('body_format', $vFormat, FORMAT_HTML); |
||
153 | if ($bodyFormat == FORMAT_HTML) { |
||
154 | $mail->getLookAndFeelTemplate()->set('title', $purifier->purify($subject, CODENDI_PURIFIER_CONVERT_HTML)); |
||
155 | $mail->setBodyHtml($body); |
||
0 ignored issues
–
show
|
|||
156 | } else { |
||
157 | $mail->setBodyText($body); |
||
0 ignored issues
–
show
|
|||
158 | } |
||
159 | $mail->clearFrom(); |
||
160 | $mail->setFrom($email); |
||
161 | |||
162 | if ($mail->send()) { |
||
163 | $GLOBALS['Response']->addFeedback('info', $GLOBALS['Language']->getText('sendmessage', 'title_sent', str_replace(',', ', ',$dest))); |
||
164 | } else { |
||
165 | $GLOBALS['Response']->addFeedback('error', $GLOBALS['Language']->getText('global', 'mail_failed', array($GLOBALS['sys_email_admin']))); |
||
166 | |||
167 | } |
||
168 | $GLOBALS['Response']->redirect('/users/'.urlencode($to->getUserName())); |
||
169 | exit; |
||
170 | } |
||
171 | |||
172 | if ($toaddress) { |
||
173 | $to_msg = $toaddress; |
||
174 | } else { |
||
175 | $to_msg = $to->getUserName(); |
||
176 | } |
||
177 | $to_msg = $purifier->purify($to_msg); |
||
178 | |||
179 | $HTML->header(array('title'=>$Language->getText('sendmessage', 'title',array($to_msg)))); |
||
180 | |||
181 | ?> |
||
182 | |||
183 | <H2><?php echo $Language->getText('sendmessage', 'title',array($to_msg)); ?></H2> |
||
184 | <P> |
||
185 | <?php echo $Language->getText('sendmessage', 'message'); ?> |
||
186 | <P> |
||
187 | <FORM ACTION="?" METHOD="POST"> |
||
188 | <INPUT TYPE="HIDDEN" NAME="toaddress" VALUE="<?php echo $purifier->purify($toaddress); ?>"> |
||
189 | <INPUT TYPE="HIDDEN" NAME="touser" VALUE="<?php echo $purifier->purify($touser); ?>"> |
||
190 | <?php echo $csrf_token->fetchHTMLInput(); ?> |
||
191 | |||
192 | <B><?php echo $Language->getText('sendmessage', 'email'); ?>:</B> <?php echo $purifier->purify($email); ?> |
||
193 | <P> |
||
194 | <B><?php echo $Language->getText('sendmessage', 'subject'); ?>:</B><BR> |
||
195 | <INPUT TYPE="TEXT" NAME="subject" SIZE="30" MAXLENGTH="40" VALUE="<?php echo $purifier->purify($subject); ?>"> |
||
196 | <P> |
||
197 | <B><?php echo $Language->getText('sendmessage', 'message_body'); ?>:</B><BR> |
||
198 | <TEXTAREA NAME="body" ROWS="15" COLS="60" WRAP="HARD"></TEXTAREA> |
||
199 | <P> |
||
200 | <CENTER> |
||
201 | <INPUT TYPE="SUBMIT" NAME="send_mail" VALUE="<?php echo $Language->getText('sendmessage', 'send_btn'); ?>"> |
||
202 | </CENTER> |
||
203 | </FORM> |
||
204 | <?php |
||
205 | $HTML->footer(array()); |
||
206 | |||
207 | ?> |
||
208 |
This check marks calls to methods that do not seem to exist on an object.
This is most likely the result of a method being renamed without all references to it being renamed likewise.