This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* |
||
3 | * You may not change or alter any portion of this comment or credits |
||
4 | * of supporting developers from this source code or any supporting source code |
||
5 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
6 | * |
||
7 | * This program is distributed in the hope that it will be useful, |
||
8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
10 | */ |
||
11 | |||
12 | /** |
||
13 | * @copyright {@link http://xoops.org/ XOOPS Project} |
||
14 | * @license {@link http://www.fsf.org/copyleft/gpl.html GNU public license} |
||
15 | * @package |
||
16 | * @since |
||
17 | * @author XOOPS Development Team, |
||
18 | * @author GIJ=CHECKMATE (PEAK Corp. http://www.peak.ne.jp/) |
||
19 | */ |
||
20 | |||
21 | // a plugin for APCal (Don't refer this plugin!) |
||
22 | |||
23 | defined('XOOPS_ROOT_PATH') || exit('XOOPS Root Path not defined'); |
||
24 | |||
25 | /* |
||
26 | $db : db instance |
||
27 | $myts : MyTextSanitizer instance |
||
28 | $this->year : year |
||
29 | $this->month : month |
||
30 | $this->user_TZ : user's timezone (+1.5 etc) |
||
31 | $this->server_TZ : server's timezone (-2.5 etc) |
||
32 | $tzoffset_s2u : the offset from server to user |
||
33 | $now : the result of time() |
||
34 | $plugin = array('dirname'=>'dirname','name'=>'name','dotgif'=>'*.gif') |
||
35 | $just1gif : 0 or 1 |
||
36 | |||
37 | $plugin_returns[ DATE ][] |
||
38 | */ |
||
39 | |||
40 | // for Duplicatable |
||
41 | View Code Duplication | if (!preg_match('/^(\D+)(\d*)$/', $plugin['dirname'], $regs)) { |
|
0 ignored issues
–
show
|
|||
42 | echo('invalid dirname: ' . htmlspecialchars($plugin['dirname'])); |
||
43 | } |
||
44 | $mydirnumber = $regs[2] === '' ? '' : (int)$regs[2]; |
||
45 | |||
46 | if ($this->base_url == XOOPS_URL . '/modules/' . $plugin['dirname']) { |
||
47 | $cal = $this; |
||
48 | } else { |
||
49 | // create a targeting instance of APCal |
||
50 | $cal = new APCal_xoops('', $this->language, true); |
||
51 | |||
52 | // this should not be affected by $_GET['cid'] |
||
53 | $cal->now_cid = ''; |
||
0 ignored issues
–
show
The property
$now_cid was declared of type integer , but '' is of type string . Maybe add a type cast?
This check looks for assignments to scalar types that may be of the wrong type. To ensure the code behaves as expected, it may be a good idea to add an explicit type cast. $answer = 42;
$correct = false;
$correct = (bool) $answer;
![]() |
|||
54 | |||
55 | // setting properties of APCal |
||
56 | global $xoopsDB; |
||
57 | $cal->conn = $GLOBALS['xoopsDB']->conn; |
||
58 | include XOOPS_ROOT_PATH . "/modules/{$plugin['dirname']}/include/read_configs.php"; |
||
59 | $cal->base_url = XOOPS_URL . '/modules/' . $plugin['dirname']; |
||
60 | $cal->base_path = XOOPS_ROOT_PATH . '/modules/' . $plugin['dirname']; |
||
61 | $cal->images_url = "$cal->base_url/assets/images/$skin_folder"; |
||
62 | $cal->images_path = "$cal->base_path/assets/images/$skin_folder"; |
||
63 | } |
||
64 | |||
65 | // options |
||
66 | $options = explode('|', $plugin['options']); |
||
67 | // options[0] : category extract |
||
68 | if (!empty($options[0])) { |
||
69 | $cids = explode(',', $options[0]); |
||
70 | $whr_cid_limit = '0'; |
||
71 | foreach ($cids as $cid) { |
||
72 | $whr_cid_limit .= " OR categories LIKE '%" . sprintf('%05d,', (int)$cid) . "%'"; |
||
73 | } |
||
74 | } else { |
||
75 | $whr_cid_limit = '1'; |
||
76 | } |
||
77 | |||
78 | // ¥«¥Æ¥´¥ê¡¼´ØÏ¢¤ÎWHERE¾ò·ï¼èÆÀ |
||
79 | $whr_categories = $cal->get_where_about_categories(); |
||
80 | |||
81 | // CLASS´ØÏ¢¤ÎWHERE¾ò·ï¼èÆÀ |
||
82 | $whr_class = $cal->get_where_about_class(); |
||
83 | |||
84 | // ÈϰϤμèÆÀ |
||
85 | $range_start_s = mktime(0, 0, 0, $this->month, 0, $this->year); |
||
86 | $range_end_s = mktime(0, 0, 0, $this->month + 1, 1, $this->year); |
||
87 | |||
88 | // Á´Æü¥¤¥Ù¥ó¥È°Ê³°¤Î½èÍý |
||
89 | $result = $GLOBALS['xoopsDB']->query("SELECT summary,id,start FROM $cal->table WHERE admission > 0 AND start >= $range_start_s AND start < $range_end_s AND ($whr_categories) AND ($whr_class) AND ($whr_cid_limit) AND allday <= 0"); |
||
90 | |||
91 | while (list($title, $id, $server_time) = $db->fetchRow($result)) { |
||
92 | $user_time = $server_time + $tzoffset_s2u; |
||
93 | if (date('n', $user_time) != $this->month) { |
||
94 | continue; |
||
95 | } |
||
96 | $target_date = date('j', $user_time); |
||
97 | $tmp_array = array( |
||
98 | 'dotgif' => $plugin['dotgif'], |
||
99 | 'dirname' => $plugin['dirname'], |
||
100 | 'link' => XOOPS_URL . "/modules/{$plugin['dirname']}/index.php?smode=Daily&caldate={$this->year}-{$this->month}-{$target_date}", |
||
101 | 'id' => $id, |
||
102 | 'server_time' => $server_time, |
||
103 | 'user_time' => $user_time, |
||
104 | 'name' => 'id', |
||
105 | 'title' => $this->text_sanitizer_for_show($title) |
||
106 | ); |
||
107 | if ($just1gif) { |
||
108 | // just 1 gif per a plugin & per a day |
||
109 | $plugin_returns[$target_date][$plugin['dirname']] = $tmp_array; |
||
110 | } else { |
||
111 | // multiple gifs allowed per a plugin & per a day |
||
112 | $plugin_returns[$target_date][] = $tmp_array; |
||
113 | } |
||
114 | } |
||
115 | |||
116 | // Á´Æü¥¤¥Ù¥ó¥ÈÀìÍѤνèÍý |
||
117 | $result = $GLOBALS['xoopsDB']->query("SELECT summary,id,start,end FROM $cal->table WHERE admission > 0 AND start >= $range_start_s AND start < $range_end_s AND ($whr_categories) AND ($whr_class) AND ($whr_cid_limit) AND allday > 0"); |
||
118 | |||
119 | while (list($title, $id, $start_s, $end_s) = $db->fetchRow($result)) { |
||
120 | if ($start_s < $range_start_s) { |
||
121 | $start_s = $range_start_s; |
||
122 | } |
||
123 | if ($end_s > $range_end_s) { |
||
124 | $end_s = $range_end_s; |
||
125 | } |
||
126 | |||
127 | while ($start_s < $end_s) { |
||
128 | $user_time = $start_s + $tzoffset_s2u; |
||
129 | if (date('n', $user_time) == $this->month) { |
||
130 | $target_date = date('j', $user_time); |
||
131 | $tmp_array = array( |
||
132 | 'dotgif' => $plugin['dotgif'], |
||
133 | 'dirname' => $plugin['dirname'], |
||
134 | 'link' => XOOPS_URL . "/modules/{$plugin['dirname']}/index.php?smode=Daily&caldate={$this->year}-{$this->month}-{$target_date}", |
||
135 | 'id' => $id, |
||
136 | 'server_time' => $server_time, |
||
137 | 'user_time' => $user_time, |
||
138 | 'name' => 'id', |
||
139 | 'title' => $this->text_sanitizer_for_show($title) |
||
140 | ); |
||
141 | if ($just1gif) { |
||
142 | // just 1 gif per a plugin & per a day |
||
143 | $plugin_returns[$target_date][$plugin['dirname']] = $tmp_array; |
||
144 | } else { |
||
145 | // multiple gifs allowed per a plugin & per a day |
||
146 | $plugin_returns[$target_date][] = $tmp_array; |
||
147 | } |
||
148 | } |
||
149 | $start_s += 86400; |
||
150 | } |
||
151 | } |
||
152 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.