XoopsModules25x /
groupmanager
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||||
| 2 | |||||||
| 3 | /* |
||||||
| 4 | * You may not change or alter any portion of this comment or credits |
||||||
| 5 | * of supporting developers from this source code or any supporting source code |
||||||
| 6 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||||
| 7 | * |
||||||
| 8 | * This program is distributed in the hope that it will be useful, |
||||||
| 9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
| 10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||
| 11 | */ |
||||||
| 12 | |||||||
| 13 | /** |
||||||
| 14 | * @copyright XOOPS Project (https://xoops.org) |
||||||
| 15 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||||
| 16 | * @author Kaotik, GigaPHP, XOOPS Development Team |
||||||
| 17 | */ |
||||||
| 18 | |||||||
| 19 | use Xmf\Module\Admin; |
||||||
| 20 | /** @var Admin $adminObject */ |
||||||
| 21 | /** @var \XoopsMemberHandler $memberHandler */ |
||||||
| 22 | /** @var \XoopsGroupPermHandler $grouppermHandler */ |
||||||
| 23 | |||||||
| 24 | require_once __DIR__ . '/admin_header.php'; |
||||||
| 25 | |||||||
| 26 | require_once XOOPS_ROOT_PATH . '/class/template.php'; |
||||||
| 27 | if (!isset($xoopsTpl)) { |
||||||
| 28 | $xoopsTpl = new XoopsTpl(); |
||||||
| 29 | } |
||||||
| 30 | $xoopsTpl->caching = 0; |
||||||
| 31 | $xoopsTpl->assign('xoops_dirname', $xoopsModule->getVar('dirname')); |
||||||
| 32 | |||||||
| 33 | // CHECK IF SUBMIT WAS PRESSED |
||||||
| 34 | if (isset($_POST['add_x']) || isset($_POST['del_x'])) { |
||||||
| 35 | if (isset($_POST['add_x'])) { |
||||||
| 36 | $memberHandler = xoops_getHandler('member'); |
||||||
| 37 | $membership = $memberHandler->addUserToGroup($_POST['groupid'], $_POST['all']); |
||||||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||||||
| 38 | } |
||||||
| 39 | |||||||
| 40 | if (isset($_POST['del_x'])) { |
||||||
| 41 | $memberHandler = xoops_getHandler('member'); |
||||||
| 42 | $membership = $memberHandler->removeUsersFromGroup($_POST['groupid'], [$_POST['curr']]); |
||||||
|
0 ignored issues
–
show
The method
removeUsersFromGroup() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 43 | } |
||||||
| 44 | } |
||||||
| 45 | |||||||
| 46 | /* |
||||||
| 47 | CREATE USER LIST |
||||||
| 48 | */ |
||||||
| 49 | |||||||
| 50 | xoops_cp_header(); |
||||||
| 51 | $adminObject->displayNavigation(basename(__FILE__)); |
||||||
| 52 | |||||||
| 53 | /* |
||||||
| 54 | //Check user permission to display permission page |
||||||
| 55 | $perm_name = 'allowedgrp'; |
||||||
| 56 | $perm_itemid = 1; |
||||||
| 57 | if ($xoopsUser) { |
||||||
| 58 | $groups = $xoopsUser->getGroups(); |
||||||
| 59 | } else { |
||||||
| 60 | $groups = XOOPS_GROUP_ANONYMOUS; |
||||||
| 61 | } |
||||||
| 62 | $module_id = $xoopsModule->getVar('mid'); |
||||||
| 63 | |||||||
| 64 | $grouppermHandler = xoops_getHandler('groupperm'); |
||||||
| 65 | if ($grouppermHandler->checkRight($perm_name, $perm_itemid, $groups, $module_id)) { |
||||||
| 66 | // allowed, so display contents within the category |
||||||
| 67 | $xoopsTpl->assign('perallow', 1); |
||||||
| 68 | } else { |
||||||
| 69 | // not allowed, display an error message or redirect to another page |
||||||
| 70 | $xoopsTpl->assign('perallow', 0); |
||||||
| 71 | } |
||||||
| 72 | //--------------------------------------- |
||||||
| 73 | */ |
||||||
| 74 | |||||||
| 75 | $grpInfo = []; |
||||||
| 76 | |||||||
| 77 | $memberHandler = xoops_getHandler('member'); |
||||||
| 78 | $groups = $memberHandler->getGroups(); |
||||||
|
0 ignored issues
–
show
The method
getGroups() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 79 | |||||||
| 80 | $count = count($groups); |
||||||
| 81 | for ($i = 0; $i < $count; ++$i) { |
||||||
| 82 | $id = $groups[$i]->getVar('groupid'); |
||||||
| 83 | $name = $groups[$i]->getVar('name'); |
||||||
| 84 | //Skip anonymous group |
||||||
| 85 | if (3 == $id) { |
||||||
| 86 | continue; |
||||||
| 87 | } |
||||||
| 88 | |||||||
| 89 | //check if user has permission to change this group |
||||||
| 90 | $perm_name = 'groupper'; |
||||||
| 91 | $perm_itemid = $id; |
||||||
| 92 | $groups2 = XOOPS_GROUP_ANONYMOUS; |
||||||
| 93 | if ($xoopsUser) { |
||||||
| 94 | $groups2 = $xoopsUser->getGroups(); |
||||||
| 95 | } |
||||||
| 96 | $module_id = $xoopsModule->getVar('mid'); |
||||||
| 97 | /** @var \XoopsGroupPermHandler $grouppermHandler */ |
||||||
| 98 | $grouppermHandler = xoops_getHandler('groupperm'); |
||||||
| 99 | if ($grouppermHandler->checkRight($perm_name, $perm_itemid, $groups2, $module_id)) { |
||||||
| 100 | } else { |
||||||
| 101 | continue; |
||||||
| 102 | } |
||||||
| 103 | //----------------*/ |
||||||
| 104 | |||||||
| 105 | $uids = $memberHandler->getUsersByGroup($id); |
||||||
|
0 ignored issues
–
show
The method
getUsersByGroup() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsMembershipHandler or XoopsPersistableObjectHandler.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 106 | $criteria = new Criteria('uid', '(' . implode(',', $uids) . ')', 'IN'); |
||||||
| 107 | $criteria->setSort('uname'); |
||||||
| 108 | $users = $memberHandler->getUserList($criteria); |
||||||
|
0 ignored issues
–
show
The method
getUserList() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 109 | |||||||
| 110 | $grpInfo[$i]['users'] = $users; |
||||||
| 111 | $grpInfo[$i]['name'] = $name; |
||||||
| 112 | $grpInfo[$i]['id'] = $id; |
||||||
| 113 | } |
||||||
| 114 | |||||||
| 115 | /*---------------------------// |
||||||
| 116 | Get all users |
||||||
| 117 | //----------------------------------*/ |
||||||
| 118 | $allUsr = []; |
||||||
| 119 | /** @var \XoopsMemberHandler $memberHandler */ |
||||||
| 120 | $memberHandler = xoops_getHandler('member'); |
||||||
| 121 | $foundusers = $memberHandler->getUsers(); |
||||||
| 122 | foreach (array_keys($foundusers) as $j) { |
||||||
| 123 | //echo $foundusers[$j]->getVar('uname').'<br>'; |
||||||
| 124 | $uid = $foundusers[$j]->getVar('uid'); |
||||||
| 125 | $username = $foundusers[$j]->getVar('uname'); |
||||||
| 126 | $allUsr[$uid] = $username; |
||||||
| 127 | } |
||||||
| 128 | //--------------------------// |
||||||
| 129 | |||||||
| 130 | $xoopsTpl->assign('allUsr', $allUsr); |
||||||
| 131 | $xoopsTpl->assign('grpInfo', $grpInfo); |
||||||
| 132 | $xoopsTpl->assign('mod_url', XOOPS_URL . '/modules/' . $moduleDirName); |
||||||
| 133 | |||||||
| 134 | $xoopsTpl->display('db:gm_main.tpl'); |
||||||
| 135 | |||||||
| 136 | require_once __DIR__ . '/admin_footer.php'; |
||||||
| 137 | //xoops_cp_footer(); |
||||||
| 138 |