XoopsUserUtility::validate()

Complexity

Conditions	41
Paths	> 20000

Size

Total Lines	139
Code Lines	92

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public static function validate()
    {
        global $xoopsUser;

        $args     = func_get_args();
        $args_num = func_num_args();

        $user  = null;
        $uname = null;
        $email = null;
        $pass  = null;
        $vpass = null;

        switch ($args_num) {
            case 1:
                $user = $args[0];
                break;
            case 2:
                [$uname, $email] = $args;
                break;
            case 3:
                [$user, $pass, $vpass] = $args;
                break;
            case 4:
                [$uname, $email, $pass, $vpass] = $args;
                break;
            default:
                return false;
        }
        if (is_object($user)) {
            $uname = $user->getVar('uname', 'n');
            $email = $user->getVar('email', 'n');
        }
        /** @var XoopsConfigHandler $config_handler */
        $config_handler  = xoops_getHandler('config');
        $xoopsConfigUser = $config_handler->getConfigsByCat(XOOPS_CONF_USER);

        xoops_loadLanguage('user');
        $myts = \MyTextSanitizer::getInstance();

The assignment to $myts is dead and can be removed.

        $xoopsUser_isAdmin = is_object($xoopsUser) && $xoopsUser->isAdmin();
        $stop              = '';
        // Invalid email address
        if (!checkEmail($email)) {
            $stop .= _US_INVALIDMAIL . '<br>';
        }
        if (strrpos($email, ' ') > 0) {
            $stop .= _US_EMAILNOSPACES . '<br>';
        }
        // Check forbidden email address if current operator is not an administrator
        if (!$xoopsUser_isAdmin) {
            foreach ($xoopsConfigUser['bad_emails'] as $be) {
                if (!empty($be) && preg_match('/' . $be . '/i', $email)) {
                    $stop .= _US_INVALIDMAIL . '<br>';
                    break;
                }
            }
        }
        $uname = xoops_trim($uname);
        switch ($xoopsConfigUser['uname_test_level']) {
            case 0:
                // strict
                $restriction = '/[^a-zA-Z0-9\_\-]/';
                break;
            case 1:
                // medium
                $restriction = '/[^a-zA-Z0-9\_\-\<\>\,\.\$\%\#\@\!\\\'\']/';
                break;
            case 2:
                // loose
                $restriction = '/[\000-\040]/';
                break;
        }
        if (empty($uname) || preg_match($restriction, $uname)) {

The variable $restriction does not seem to be defined for all execution paths leading up to this point.

            $stop .= _US_INVALIDNICKNAME . '<br>';
        }
        // Check uname settings if current operator is not an administrator
        if (!$xoopsUser_isAdmin) {
            if (strlen($uname) > $xoopsConfigUser['maxuname']) {
                $stop .= sprintf(_US_NICKNAMETOOLONG, $xoopsConfigUser['maxuname']) . '<br>';
            }
            if (strlen($uname) < $xoopsConfigUser['minuname']) {
                $stop .= sprintf(_US_NICKNAMETOOSHORT, $xoopsConfigUser['minuname']) . '<br>';
            }
            foreach ($xoopsConfigUser['bad_unames'] as $bu) {
                if (!empty($bu) && preg_match('/' . $bu . '/i', $uname)) {
                    $stop .= _US_NAMERESERVED . '<br>';
                    break;
                }
            }
            /**
             * if (strrpos($uname, ' ') > 0) {
             * $stop .= _US_NICKNAMENOSPACES . '<br>';
             * }
             */
        }
        /** @var XoopsMySQLDatabase $xoopsDB */
        $xoopsDB = XoopsDatabaseFactory::getDatabaseConnection();
        // Check if uname/email already exists if the user is a new one
        $uid    = is_object($user) ? $user->getVar('uid') : 0;
        $sql    = 'SELECT COUNT(*) FROM `' . $xoopsDB->prefix('users') . '` WHERE `uname` = ' . $xoopsDB->quote(addslashes($uname)) . (($uid > 0) ? " AND `uid` <> {$uid}" : '');
        $result = $xoopsDB->query($sql);
        if (!$xoopsDB->isResultSet($result)) {
            throw new \RuntimeException(
                \sprintf(_DB_QUERY_ERROR, $sql) . $xoopsDB->error(),
                E_USER_ERROR,
            );
        }
        [$count] = $xoopsDB->fetchRow($result);

It seems like $result can also be of type boolean; however, parameter $result of XoopsMySQLDatabase::fetchRow() does only seem to accept mysqli_result, maybe add an additional type check?

        if ((int) $count > 0) {
            $stop .= _US_NICKNAMETAKEN . '<br>';
        }
        $sql    = 'SELECT COUNT(*) FROM `' . $xoopsDB->prefix('users') . '` WHERE `email` = ' . $xoopsDB->quote(addslashes($email)) . (($uid > 0) ? " AND `uid` <> {$uid}" : '');
        $result = $xoopsDB->query($sql);
        if (!$xoopsDB->isResultSet($result)) {
            throw new \RuntimeException(
                \sprintf(_DB_QUERY_ERROR, $sql) . $xoopsDB->error(),
                E_USER_ERROR,
            );
        }
        [$count] = $xoopsDB->fetchRow($result);
        if ((int) $count > 0) {
            $stop .= _US_EMAILTAKEN . '<br>';
        }
        // If password is not set, skip password validation
        if ($pass === null && $vpass === null) {
            return $stop;
        }

        if (!isset($pass) || $pass == '' || !isset($vpass) || $vpass == '') {
            $stop .= _US_ENTERPWD . '<br>';
        }
        if (isset($pass) && ($pass != $vpass)) {
            $stop .= _US_PASSNOTSAME . '<br>';
        } elseif (($pass != '') && (strlen($pass) < $xoopsConfigUser['minpass'])) {
            $stop .= sprintf(_US_PWDTOOSHORT, $xoopsConfigUser['minpass']) . '<br>';
        }

        return $stop;
    }