XOOPS / XoopsCore25

htdocs/xoops_lib/modules/protector/class/protector.php

Spacing +57 added lines, -57 removed lines

@@ -126,7 +126,7 @@ 
                     $this->_safe_contami   = false;
                     $this->last_error_type = 'CONTAMI';
                 }
-                $this->_initial_recursive($subval, $key . '_' . base64_encode($subkey));
+                $this->_initial_recursive($subval, $key.'_'.base64_encode($subkey));
             }
         } else {
             // check nullbyte attack
@@ -163,13 +163,13 @@ 
      */
     public function updateConfFromDb()
     {
-        $constpref = '_MI_' . strtoupper($this->mydirname);
+        $constpref = '_MI_'.strtoupper($this->mydirname);
 
         if (empty($this->_conn)) {
             return false;
         }
 
-        $result = @mysqli_query($this->_conn, 'SELECT conf_name,conf_value FROM ' . XOOPS_DB_PREFIX . "_config WHERE conf_title like '" . $constpref . "%'");
+        $result = @mysqli_query($this->_conn, 'SELECT conf_name,conf_value FROM '.XOOPS_DB_PREFIX."_config WHERE conf_title like '".$constpref."%'");
         if (!$result || mysqli_num_rows($result) < 5) {
             return false;
         }
@@ -214,7 +214,7 @@ 
         $this->purgeNoExit();
 
         if ($redirect_to_top) {
-            header('Location: ' . XOOPS_URL . '/');
+            header('Location: '.XOOPS_URL.'/');
             exit;
         } else {
             $ret = $this->call_filter('prepurge_exit');
@@ -240,7 +240,7 @@ 
     public function purgeCookies()
     {
         if (!headers_sent()) {
-            $domain =  defined(XOOPS_COOKIE_DOMAIN) ? XOOPS_COOKIE_DOMAIN : '';
+            $domain = defined(XOOPS_COOKIE_DOMAIN) ? XOOPS_COOKIE_DOMAIN : '';
             $past = time() - 3600;
             foreach ($_COOKIE as $key => $value) {
                 setcookie($key, '', $past, '', $domain);
@@ -303,7 +303,7 @@ 
         $agent = @$_SERVER['HTTP_USER_AGENT'];
 
         if ($unique_check) {
-            $result = mysqli_query($this->_conn, 'SELECT ip,type FROM ' . XOOPS_DB_PREFIX . '_' . $this->mydirname . '_log ORDER BY timestamp DESC LIMIT 1');
+            $result = mysqli_query($this->_conn, 'SELECT ip,type FROM '.XOOPS_DB_PREFIX.'_'.$this->mydirname.'_log ORDER BY timestamp DESC LIMIT 1');
             list($last_ip, $last_type) = mysqli_fetch_row($result);
             if ($last_ip == $ip && $last_type == $type) {
                 $this->_logged = true;
@@ -314,12 +314,12 @@ 
 
         mysqli_query(
             $this->_conn,
-            'INSERT INTO ' . XOOPS_DB_PREFIX . '_' . $this->mydirname . "_log SET ip='"
-            . mysqli_real_escape_string($this->_conn, $ip) . "',agent='"
-            . mysqli_real_escape_string($this->_conn, $agent) . "',type='"
-            . mysqli_real_escape_string($this->_conn, $type) . "',description='"
-            . mysqli_real_escape_string($this->_conn, $this->message) . "',uid='"
-            . (int)$uid . "',timestamp=NOW()"
+            'INSERT INTO '.XOOPS_DB_PREFIX.'_'.$this->mydirname."_log SET ip='"
+            . mysqli_real_escape_string($this->_conn, $ip)."',agent='"
+            . mysqli_real_escape_string($this->_conn, $agent)."',type='"
+            . mysqli_real_escape_string($this->_conn, $type)."',description='"
+            . mysqli_real_escape_string($this->_conn, $this->message)."',uid='"
+            . (int)$uid."',timestamp=NOW()"
         );
         $this->_logged = true;
 
@@ -338,7 +338,7 @@ 
         $fp = @fopen($this->get_filepath4bwlimit(), 'w');
         if ($fp) {
             @flock($fp, LOCK_EX);
-            fwrite($fp, $expire . "\n");
+            fwrite($fp, $expire."\n");
             @flock($fp, LOCK_UN);
             fclose($fp);
 
@@ -364,7 +364,7 @@ 
      */
     public static function get_filepath4bwlimit()
     {
-        return XOOPS_VAR_PATH . '/protector/bwlimit' . substr(md5(XOOPS_ROOT_PATH . XOOPS_DB_USER . XOOPS_DB_PREFIX), 0, 6);
+        return XOOPS_VAR_PATH.'/protector/bwlimit'.substr(md5(XOOPS_ROOT_PATH.XOOPS_DB_USER.XOOPS_DB_PREFIX), 0, 6);
     }
 
     /**
@@ -379,7 +379,7 @@ 
         $fp = @fopen($this->get_filepath4badips(), 'w');
         if ($fp) {
             @flock($fp, LOCK_EX);
-            fwrite($fp, serialize($bad_ips) . "\n");
+            fwrite($fp, serialize($bad_ips)."\n");
             @flock($fp, LOCK_UN);
             fclose($fp);
 
@@ -445,7 +445,7 @@ 
      */
     public static function get_filepath4badips()
     {
-        return XOOPS_VAR_PATH . '/protector/badips' . substr(md5(XOOPS_ROOT_PATH . XOOPS_DB_USER . XOOPS_DB_PREFIX), 0, 6);
+        return XOOPS_VAR_PATH.'/protector/badips'.substr(md5(XOOPS_ROOT_PATH.XOOPS_DB_USER.XOOPS_DB_PREFIX), 0, 6);
     }
 
     /**
@@ -473,7 +473,7 @@ 
      */
     public static function get_filepath4group1ips()
     {
-        return XOOPS_VAR_PATH . '/protector/group1ips' . substr(md5(XOOPS_ROOT_PATH . XOOPS_DB_USER . XOOPS_DB_PREFIX), 0, 6);
+        return XOOPS_VAR_PATH.'/protector/group1ips'.substr(md5(XOOPS_ROOT_PATH.XOOPS_DB_USER.XOOPS_DB_PREFIX), 0, 6);
     }
 
     /**
@@ -481,7 +481,7 @@ 
      */
     public function get_filepath4confighcache()
     {
-        return XOOPS_VAR_PATH . '/protector/configcache' . substr(md5(XOOPS_ROOT_PATH . XOOPS_DB_USER . XOOPS_DB_PREFIX), 0, 6);
+        return XOOPS_VAR_PATH.'/protector/configcache'.substr(md5(XOOPS_ROOT_PATH.XOOPS_DB_USER.XOOPS_DB_PREFIX), 0, 6);
     }
 
     /**
@@ -560,8 +560,8 @@ 
             return false;
         }
 
-        $target_htaccess = XOOPS_ROOT_PATH . '/.htaccess';
-        $backup_htaccess = XOOPS_ROOT_PATH . '/uploads/.htaccess.bak';
+        $target_htaccess = XOOPS_ROOT_PATH.'/.htaccess';
+        $backup_htaccess = XOOPS_ROOT_PATH.'/uploads/.htaccess.bak';
 
         $ht_body = file_get_contents($target_htaccess);
 
@@ -586,9 +586,9 @@ 
             if (substr($regs[2], -strlen($ip)) == $ip) {
                 return true;
             }
-            $new_ht_body = $regs[1] . "#PROTECTOR#\n" . $regs[2] . " $ip\n#PROTECTOR#\n" . $regs[3];
+            $new_ht_body = $regs[1]."#PROTECTOR#\n".$regs[2]." $ip\n#PROTECTOR#\n".$regs[3];
         } else {
-            $new_ht_body = "#PROTECTOR#\nDENY FROM $ip\n#PROTECTOR#\n" . $ht_body;
+            $new_ht_body = "#PROTECTOR#\nDENY FROM $ip\n#PROTECTOR#\n".$ht_body;
         }
 
         // error_log( "$new_ht_body\n" , 3 , "/tmp/error_log" ) ;
@@ -653,7 +653,7 @@ 
 
         if (!empty($this->_dblayertrap_doubtfuls) || $force_override) {
             @define('XOOPS_DB_ALTERNATIVE', 'ProtectorMysqlDatabase');
-            require_once dirname(__DIR__) . '/class/ProtectorMysqlDatabase.class.php';
+            require_once dirname(__DIR__).'/class/ProtectorMysqlDatabase.class.php';
         }
     }
 
@@ -837,7 +837,7 @@ 
             if (!is_array($current)) {
                 return false;
             }
-            $current =& $current[$index];
+            $current = & $current[$index];
         }
 
         return $current;
@@ -857,16 +857,16 @@ 
 
         switch ($base_array) {
             case 'G' :
-                $main_ref   =& $this->get_ref_from_base64index($_GET, $indexes);
-                $legacy_ref =& $this->get_ref_from_base64index($HTTP_GET_VARS, $indexes);
+                $main_ref   = & $this->get_ref_from_base64index($_GET, $indexes);
+                $legacy_ref = & $this->get_ref_from_base64index($HTTP_GET_VARS, $indexes);
                 break;
             case 'P' :
-                $main_ref   =& $this->get_ref_from_base64index($_POST, $indexes);
-                $legacy_ref =& $this->get_ref_from_base64index($HTTP_POST_VARS, $indexes);
+                $main_ref   = & $this->get_ref_from_base64index($_POST, $indexes);
+                $legacy_ref = & $this->get_ref_from_base64index($HTTP_POST_VARS, $indexes);
                 break;
             case 'C' :
-                $main_ref   =& $this->get_ref_from_base64index($_COOKIE, $indexes);
-                $legacy_ref =& $this->get_ref_from_base64index($HTTP_COOKIE_VARS, $indexes);
+                $main_ref   = & $this->get_ref_from_base64index($_COOKIE, $indexes);
+                $legacy_ref = & $this->get_ref_from_base64index($HTTP_COOKIE_VARS, $indexes);
                 break;
             default :
                 exit;
@@ -874,7 +874,7 @@ 
         if (!isset($main_ref)) {
             exit;
         }
-        $request_ref =& $this->get_ref_from_base64index($_REQUEST, $indexes);
+        $request_ref = & $this->get_ref_from_base64index($_REQUEST, $indexes);
         if ($request_ref !== false && $main_ref == $request_ref) {
             $request_ref = $val;
         }
@@ -945,7 +945,7 @@ 
                     $image_attributes = @getimagesize($_file['tmp_name']);
                     if ($image_attributes === false && is_uploaded_file($_file['tmp_name'])) {
                         // open_basedir restriction
-                        $temp_file = XOOPS_ROOT_PATH . '/uploads/protector_upload_temporary' . md5(time());
+                        $temp_file = XOOPS_ROOT_PATH.'/uploads/protector_upload_temporary'.md5(time());
                         move_uploaded_file($_file['tmp_name'], $temp_file);
                         $image_attributes = @getimagesize($temp_file);
                         @unlink($temp_file);
@@ -1002,7 +1002,7 @@ 
                 if ($str === false) {
                     $this->message .= "Isolated comment-in found. ($val)\n";
                     if ($sanitize) {
-                        $this->replace_doubtful($key, $val . '*/');
+                        $this->replace_doubtful($key, $val.'*/');
                     }
                     $this->_safe_isocom    = false;
                     $this->last_error_type = 'ISOCOM';
@@ -1089,16 +1089,16 @@ 
                 break;
             case 'san' :
                 $_POST = array();
-                $this->message .= 'POST deleted for IP:' . $_SERVER['REMOTE_ADDR'];
+                $this->message .= 'POST deleted for IP:'.$_SERVER['REMOTE_ADDR'];
                 break;
             case 'biptime0' :
                 $_POST = array();
-                $this->message .= 'BAN and POST deleted for IP:' . $_SERVER['REMOTE_ADDR'];
+                $this->message .= 'BAN and POST deleted for IP:'.$_SERVER['REMOTE_ADDR'];
                 $this->_should_be_banned_time0 = true;
                 break;
             case 'bip' :
                 $_POST = array();
-                $this->message .= 'Ban and POST deleted for IP:' . $_SERVER['REMOTE_ADDR'];
+                $this->message .= 'Ban and POST deleted for IP:'.$_SERVER['REMOTE_ADDR'];
                 $this->_should_be_banned = true;
                 break;
         }
@@ -1115,15 +1115,15 @@ 
         }
 
         $query = '';
-        $query .= (empty($ip)) ? '' : '&ip=' . $ip;
-        $query .= (empty($email)) ? '' : '&email=' . $email;
-        $query .= (empty($username)) ? '' : '&username=' . $username;
+        $query .= (empty($ip)) ? '' : '&ip='.$ip;
+        $query .= (empty($email)) ? '' : '&email='.$email;
+        $query .= (empty($username)) ? '' : '&username='.$username;
 
         if (empty($query)) {
             return false;
         }
 
-        $url = 'http://www.stopforumspam.com/api?f=json' . $query;
+        $url = 'http://www.stopforumspam.com/api?f=json'.$query;
         $ch  = curl_init();
         curl_setopt($ch, CURLOPT_URL, $url);
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
@@ -1153,7 +1153,7 @@ 
             return true;
         }
 
-        $ip      = \Xmf\IPAddress::fromRequest();
+        $ip = \Xmf\IPAddress::fromRequest();
         if (false === $ip->asReadable()) {
             return true;
         }
@@ -1164,7 +1164,7 @@ 
 
         // gargage collection
         $result = $xoopsDB->queryF(
-            'DELETE FROM ' . $xoopsDB->prefix($this->mydirname . '_access')
+            'DELETE FROM '.$xoopsDB->prefix($this->mydirname.'_access')
             . ' WHERE expire < UNIX_TIMESTAMP()'
         );
 
@@ -1176,13 +1176,13 @@ 
         }
 
         // sql for recording access log (INSERT should be placed after SELECT)
-        $sql4insertlog = 'INSERT INTO ' . $xoopsDB->prefix($this->mydirname . '_access')
+        $sql4insertlog = 'INSERT INTO '.$xoopsDB->prefix($this->mydirname.'_access')
                          . " SET ip={$ip4sql}, request_uri={$uri4sql},"
-                         . " expire=UNIX_TIMESTAMP()+'" . (int)$this->_conf['dos_expire'] . "'";
+                         . " expire=UNIX_TIMESTAMP()+'".(int)$this->_conf['dos_expire']."'";
 
         // bandwidth limitation
         if (@$this->_conf['bwlimit_count'] >= 10) {
-            $result = $xoopsDB->query('SELECT COUNT(*) FROM ' . $xoopsDB->prefix($this->mydirname . '_access'));
+            $result = $xoopsDB->query('SELECT COUNT(*) FROM '.$xoopsDB->prefix($this->mydirname.'_access'));
             list($bw_count) = $xoopsDB->fetchRow($result);
             if ($bw_count > $this->_conf['bwlimit_count']) {
                 $this->write_file_bwlimit(time() + $this->_conf['dos_expire']);
@@ -1191,7 +1191,7 @@ 
 
         // F5 attack check (High load & same URI)
         $result = $xoopsDB->query(
-            'SELECT COUNT(*) FROM ' . $xoopsDB->prefix($this->mydirname . '_access')
+            'SELECT COUNT(*) FROM '.$xoopsDB->prefix($this->mydirname.'_access')
             . " WHERE ip={$ip4sql} AND request_uri={$uri4sql}");
         list($f5_count) = $xoopsDB->fetchRow($result);
         if ($f5_count > $this->_conf['dos_f5count']) {
@@ -1250,7 +1250,7 @@ 
 
         // Crawler check (High load & different URI)
         $result = $xoopsDB->query(
-            'SELECT COUNT(*) FROM ' . $xoopsDB->prefix($this->mydirname . '_access') . " WHERE ip={$ip4sql}"
+            'SELECT COUNT(*) FROM '.$xoopsDB->prefix($this->mydirname.'_access')." WHERE ip={$ip4sql}"
         );
         list($crawler_count) = $xoopsDB->fetchRow($result);
 
@@ -1308,7 +1308,7 @@ 
     {
         global $xoopsDB;
 
-        $ip      = \Xmf\IPAddress::fromRequest();
+        $ip = \Xmf\IPAddress::fromRequest();
         if (false === $ip->asReadable()) {
             return true;
         }
@@ -1325,23 +1325,23 @@ 
 
         // gargage collection
         $result = $xoopsDB->queryF(
-            'DELETE FROM ' . $xoopsDB->prefix($this->mydirname . '_access') . ' WHERE expire < UNIX_TIMESTAMP()'
+            'DELETE FROM '.$xoopsDB->prefix($this->mydirname.'_access').' WHERE expire < UNIX_TIMESTAMP()'
         );
 
         // sql for recording access log (INSERT should be placed after SELECT)
-        $sql4insertlog = 'INSERT INTO ' . $xoopsDB->prefix($this->mydirname . '_access')
+        $sql4insertlog = 'INSERT INTO '.$xoopsDB->prefix($this->mydirname.'_access')
                          . " SET ip={$ip4sql}, request_uri={$uri4sql}, malicious_actions={$mal4sql}, expire=UNIX_TIMESTAMP()+600";
 
         // count check
         $result = $xoopsDB->query(
-            'SELECT COUNT(*) FROM ' . $xoopsDB->prefix($this->mydirname . '_access')
+            'SELECT COUNT(*) FROM '.$xoopsDB->prefix($this->mydirname.'_access')
             . " WHERE ip={$ip4sql} AND malicious_actions like 'BRUTE FORCE:%'"
         );
         list($bf_count) = $xoopsDB->fetchRow($result);
         if ($bf_count > $this->_conf['bf_count']) {
             $this->register_bad_ips(time() + $this->_conf['banip_time0']);
             $this->last_error_type = 'BruteForce';
-            $this->message .= "Trying to login as '" . addslashes($victim_uname) . "' found.\n";
+            $this->message .= "Trying to login as '".addslashes($victim_uname)."' found.\n";
             $this->output_log('BRUTE FORCE', 0, true, 1);
             $ret = $this->call_filter('bruteforce_overrun');
             if ($ret == false) {
@@ -1379,7 +1379,7 @@ 
             }
 
             // count BBCode likd [url=www....] up (without [url=http://...])
-            $this->_spamcount_uri += count(preg_split('/\[url=(?!http|\\"http|\\\'http|' . $http_host . ')/i', $val)) - 1;
+            $this->_spamcount_uri += count(preg_split('/\[url=(?!http|\\"http|\\\'http|'.$http_host.')/i', $val)) - 1;
         }
     }
 
@@ -1393,7 +1393,7 @@ 
         $this->_spam_check_point_recursive($_POST);
 
         if ($this->_spamcount_uri >= $points4deny) {
-            $this->message .= @$_SERVER['REQUEST_URI'] . " SPAM POINT: $this->_spamcount_uri\n";
+            $this->message .= @$_SERVER['REQUEST_URI']." SPAM POINT: $this->_spamcount_uri\n";
             $this->output_log('URI SPAM', $uid, false, 128);
             $ret = $this->call_filter('spamcheck_overrun');
             if ($ret == false) {
@@ -1467,11 +1467,11 @@ 
 
             // preview CSRF zx 2004/12/14
             // news submit.php
-            if (substr(@$_SERVER['SCRIPT_NAME'], -23) === 'modules/news/submit.php' && isset($_POST['preview']) && strpos(@$_SERVER['HTTP_REFERER'], XOOPS_URL . '/modules/news/submit.php') !== 0) {
+            if (substr(@$_SERVER['SCRIPT_NAME'], -23) === 'modules/news/submit.php' && isset($_POST['preview']) && strpos(@$_SERVER['HTTP_REFERER'], XOOPS_URL.'/modules/news/submit.php') !== 0) {
                 $HTTP_POST_VARS['nohtml'] = $_POST['nohtml'] = 1;
             }
             // news admin/index.php
-            if (substr(@$_SERVER['SCRIPT_NAME'], -28) === 'modules/news/admin/index.php' && ($_POST['op'] === 'preview' || $_GET['op'] === 'preview') && strpos(@$_SERVER['HTTP_REFERER'], XOOPS_URL . '/modules/news/admin/index.php') !== 0) {
+            if (substr(@$_SERVER['SCRIPT_NAME'], -28) === 'modules/news/admin/index.php' && ($_POST['op'] === 'preview' || $_GET['op'] === 'preview') && strpos(@$_SERVER['HTTP_REFERER'], XOOPS_URL.'/modules/news/admin/index.php') !== 0) {
                 $HTTP_POST_VARS['nohtml'] = $_POST['nohtml'] = 1;
             }
             // comment comment_post.php
@@ -1502,7 +1502,7 @@ 
      */
     public function call_filter($type, $dying_message = '')
     {
-        require_once __DIR__ . '/ProtectorFilter.php';
+        require_once __DIR__.'/ProtectorFilter.php';
         $filter_handler = ProtectorFilterHandler::getInstance();
         $ret            = $filter_handler->execute($type);
         if ($ret == false && $dying_message) {

htdocs/ajaxfineupload.php

Spacing +6 added lines, -6 removed lines

@@ -57,10 +57,10 @@ 
  * SOFTWARE.
  */
 
-if(isset($_POST['Authorization'])) {
+if (isset($_POST['Authorization'])) {
     define('PROTECTOR_SKIP_DOS_CHECK', 1);
 }
-include __DIR__ . '/mainfile.php';
+include __DIR__.'/mainfile.php';
 $xoopsLogger->activated = false;
 
 /**
@@ -91,11 +91,11 @@ 
 XoopsLoad::load('fineuploadhandler', 'system');
 
 $handler = (property_exists($claims, 'handler')) ? $claims->handler : 'fineuploadhandler';
-$moddir  = (property_exists($claims, 'moddir'))  ? $claims->moddir  : 'system';
+$moddir  = (property_exists($claims, 'moddir')) ? $claims->moddir : 'system';
 
 XoopsLoad::load($handler, $moddir);
 
-$className = $moddir . $handler;
+$className = $moddir.$handler;
 /* $uploader XoopsFineUploadHandler */
 $uploader = new $className($claims);
 
@@ -119,10 +119,10 @@ 
     // Assumes you have a chunking.success.endpoint set to point here with a query parameter of "done".
     // For example: /myserver/handlers/endpoint.php?done
     if (isset($_GET["done"])) {
-        $result = $uploader->combineChunks(XOOPS_ROOT_PATH . "/uploads");
+        $result = $uploader->combineChunks(XOOPS_ROOT_PATH."/uploads");
     } else { // Handle upload requests
         // Call handleUpload() with the name of the folder, relative to PHP's getcwd()
-        $result = $uploader->handleUpload(XOOPS_ROOT_PATH . "/uploads");
+        $result = $uploader->handleUpload(XOOPS_ROOT_PATH."/uploads");
 
         // To return a name used for uploaded file you can use the following line.
         $result["uploadName"] = $uploader->getUploadName();