This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | |||||
3 | /* |
||||
4 | You may not change or alter any portion of this comment or credits |
||||
5 | of supporting developers from this source code or any supporting source code |
||||
6 | which is considered copyrighted (c) material of the original comment or credit authors. |
||||
7 | |||||
8 | This program is distributed in the hope that it will be useful, |
||||
9 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
10 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
11 | */ |
||||
12 | |||||
13 | /** |
||||
14 | * Module: lexikon |
||||
15 | * |
||||
16 | * @category Module |
||||
17 | * @package lexikon |
||||
18 | * @author XOOPS Development Team <[email protected]> - <https://xoops.org> |
||||
19 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||
20 | * @license GPL 2.0 or later |
||||
21 | * @link https://xoops.org/ |
||||
22 | * @since 1.0.0 |
||||
23 | */ |
||||
24 | |||||
25 | use Xmf\Module\Admin; |
||||
26 | use Xmf\Module\Helper\Permission; |
||||
27 | use Xmf\Request; |
||||
28 | use XoopsModules\Lexikon\{ |
||||
29 | Common\Configurator, |
||||
30 | CategoriesHandler, |
||||
31 | Entries, |
||||
32 | EntriesHandler, |
||||
33 | Helper, |
||||
34 | Utility |
||||
35 | }; |
||||
36 | /** @var Helper $helper */ |
||||
37 | /** @var Admin $adminObject */ |
||||
38 | |||||
39 | require_once __DIR__ . '/admin_header.php'; |
||||
40 | xoops_cp_header(); |
||||
41 | //It recovered the value of argument op in URL$ |
||||
42 | $op = Request::getString('op', 'list'); |
||||
43 | $order = Request::getString('order', 'desc'); |
||||
44 | $sort = Request::getString('sort', ''); |
||||
45 | |||||
46 | $configurator = new Configurator(); |
||||
47 | $icons = $configurator->icons; |
||||
48 | |||||
49 | xoops_load('XoopsUserUtility'); |
||||
50 | $moduleDirName = \basename(\dirname(__DIR__)); |
||||
51 | |||||
52 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
53 | $permHelper = new Permission($moduleDirName); |
||||
54 | $uploadDir = XOOPS_UPLOAD_PATH . "/$moduleDirName/images/"; |
||||
55 | $uploadUrl = XOOPS_UPLOAD_URL . "/$moduleDirName/images/"; |
||||
56 | |||||
57 | $db = \XoopsDatabaseFactory::getDatabaseConnection(); |
||||
58 | $entriesHandler = new EntriesHandler($db); |
||||
59 | $categoriesHandler = new CategoriesHandler($db); |
||||
60 | |||||
61 | switch ($op) { |
||||
62 | case 'list': |
||||
63 | default: |
||||
64 | $adminObject->addItemButton(_AM_LEXIKON_ADD_ENTRIES, 'entries.php?op=new', 'add'); |
||||
65 | echo $adminObject->displayButton('left'); |
||||
66 | $start = Request::getInt('start', 0); |
||||
67 | $entriesPaginationLimit = $GLOBALS['xoopsModuleConfig']['perpage']; |
||||
68 | |||||
69 | $criteria = new \CriteriaCompo(); |
||||
70 | $criteria->setSort('entryID ASC, term'); |
||||
71 | $criteria->setOrder('ASC'); |
||||
72 | $criteria->setLimit($entriesPaginationLimit); |
||||
73 | $criteria->setStart($start); |
||||
74 | $entriesTempRows = $entriesHandler->getCount(); |
||||
75 | $entriesTempArray = $entriesHandler->getAll($criteria); |
||||
76 | |||||
77 | // Display Page Navigation |
||||
78 | if ($entriesTempRows > $entriesPaginationLimit) { |
||||
79 | require_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||||
80 | |||||
81 | $pagenav = new \XoopsPageNav($entriesTempRows, $entriesPaginationLimit, $start, 'start', 'op=list' . '&sort=' . $sort . '&order=' . $order . ''); |
||||
82 | $GLOBALS['xoopsTpl']->assign('pagenav', null === $pagenav ? $pagenav->renderNav() : ''); |
||||
83 | } |
||||
84 | |||||
85 | $GLOBALS['xoopsTpl']->assign('entriesRows', $entriesTempRows); |
||||
86 | $entriesArray = []; |
||||
87 | |||||
88 | $criteria = new \CriteriaCompo(); |
||||
89 | $criteria->setSort($sort); |
||||
90 | $criteria->setOrder($order); |
||||
91 | $criteria->setLimit($entriesPaginationLimit); |
||||
92 | $criteria->setStart($start); |
||||
93 | |||||
94 | $entriesCount = $entriesHandler->getCount($criteria); |
||||
95 | $entriesTempArray = $entriesHandler->getAll($criteria); |
||||
96 | |||||
97 | if ($entriesCount > 0) { |
||||
98 | foreach (array_keys($entriesTempArray) as $i) { |
||||
99 | $selectorentryID = Utility::selectSorting(_AM_LEXIKON_ENTRIES_ENTRYID, 'entryID'); |
||||
100 | $GLOBALS['xoopsTpl']->assign('selectorentryID', $selectorentryID); |
||||
101 | $entryID = $entriesTempArray[$i]->getVar('entryID'); |
||||
102 | $entriesArray['entryID'] = $entryID; |
||||
103 | |||||
104 | $selectorcategoryID = Utility::selectSorting(_AM_LEXIKON_ENTRIES_CATEGORYID, 'categoryID'); |
||||
105 | $GLOBALS['xoopsTpl']->assign('selectorcategoryID', $selectorcategoryID); |
||||
106 | $categoryID = $entriesTempArray[$i]->getVar('categoryID'); |
||||
107 | $categoryName = $categoriesHandler->get($entriesTempArray[$i]->getVar('categoryID'))->getVar('name'); |
||||
108 | $entriesArray['categoryID'] = "<a href='../category.php?categoryID=" . $categoryID . "'>" . $categoryName . '</a>'; |
||||
109 | |||||
110 | $selectorterm = Utility::selectSorting(_AM_LEXIKON_ENTRIES_TERM, 'term'); |
||||
111 | $GLOBALS['xoopsTpl']->assign('selectorterm', $selectorterm); |
||||
112 | $entriesArray['term'] = $entriesTempArray[$i]->getVar('term'); |
||||
113 | $entryTerm = $entriesTempArray[$i]->getVar('term'); |
||||
114 | $entriesArray['term'] = "<a href='../entry.php?entryID=" . $entryID . "'>" . $entryTerm . '</a>'; |
||||
115 | |||||
116 | $selectorinit = Utility::selectSorting(_AM_LEXIKON_ENTRIES_INIT, 'init'); |
||||
117 | $GLOBALS['xoopsTpl']->assign('selectorinit', $selectorinit); |
||||
118 | $entriesArray['init'] = $entriesTempArray[$i]->getVar('init'); |
||||
119 | |||||
120 | $selectordefinition = Utility::selectSorting(_AM_LEXIKON_ENTRIES_DEFINITION, 'definition'); |
||||
121 | $GLOBALS['xoopsTpl']->assign('selectordefinition', $selectordefinition); |
||||
122 | |||||
123 | $entriesArray['definition'] = Utility::truncateTagSafe($entriesTempArray[$i]->getVar('definition'), 80, $etc = '...', $breakWords = false); |
||||
124 | |||||
125 | $selectorref = Utility::selectSorting(_AM_LEXIKON_ENTRIES_REF, 'ref'); |
||||
126 | $GLOBALS['xoopsTpl']->assign('selectorref', $selectorref); |
||||
127 | $entriesArray['ref'] = $entriesTempArray[$i]->getVar('ref'); |
||||
128 | |||||
129 | $selectorurl = Utility::selectSorting(_AM_LEXIKON_ENTRIES_URL, 'url'); |
||||
130 | $GLOBALS['xoopsTpl']->assign('selectorurl', $selectorurl); |
||||
131 | $entriesArray['url'] = $entriesTempArray[$i]->getVar('url'); |
||||
132 | |||||
133 | $selectorsubmit = Utility::selectSorting(_SUBMIT, 'submit'); |
||||
134 | $GLOBALS['xoopsTpl']->assign('selectorsubmit', $selectorsubmit); |
||||
135 | $entriesArray['submit'] = $entriesTempArray[$i]->getVar('submit'); |
||||
136 | |||||
137 | $selectordatesub = Utility::selectSorting(_AM_LEXIKON_ENTRIES_DATESUB, 'datesub'); |
||||
138 | $GLOBALS['xoopsTpl']->assign('selectordatesub', $selectordatesub); |
||||
139 | $date = $entriesTempArray[$i]->getVar('datesub'); |
||||
140 | $entriesArray['datesub'] = formatTimestamp($date, _SHORTDATESTRING); |
||||
141 | |||||
142 | $selectoruid = Utility::selectSorting(_AM_LEXIKON_ENTRIES_UID, 'uid'); |
||||
143 | $GLOBALS['xoopsTpl']->assign('selectoruid', $selectoruid); |
||||
144 | $userId = $entriesTempArray[$i]->getVar('uid'); |
||||
145 | $userName = \XoopsUserUtility::getUnameFromId($entriesTempArray[$i]->getVar('uid')); |
||||
146 | |||||
147 | $entriesArray['uid'] = "<a href='" . XOOPS_URL . '/modules/profile/userinfo.php?uid=' . $userId . "'>" . $userName . '</a>'; |
||||
148 | |||||
149 | $selectorcounter = Utility::selectSorting(_AM_LEXIKON_ENTRIES_COUNTER, 'counter'); |
||||
150 | $GLOBALS['xoopsTpl']->assign('selectorcounter', $selectorcounter); |
||||
151 | $entriesArray['counter'] = $entriesTempArray[$i]->getVar('counter'); |
||||
152 | |||||
153 | $selectorhtml = Utility::selectSorting(_AM_LEXIKON_ENTRIES_HTML, 'html'); |
||||
154 | $GLOBALS['xoopsTpl']->assign('selectorhtml', $selectorhtml); |
||||
155 | $entriesArray['html'] = $entriesTempArray[$i]->getVar('html'); |
||||
156 | |||||
157 | $selectorsmiley = Utility::selectSorting(_AM_LEXIKON_ENTRIES_SMILEY, 'smiley'); |
||||
158 | $GLOBALS['xoopsTpl']->assign('selectorsmiley', $selectorsmiley); |
||||
159 | $entriesArray['smiley'] = $entriesTempArray[$i]->getVar('smiley'); |
||||
160 | |||||
161 | $selectorxcodes = Utility::selectSorting(_AM_LEXIKON_ENTRIES_XCODES, 'xcodes'); |
||||
162 | $GLOBALS['xoopsTpl']->assign('selectorxcodes', $selectorxcodes); |
||||
163 | $entriesArray['xcodes'] = $entriesTempArray[$i]->getVar('xcodes'); |
||||
164 | |||||
165 | $selectorbreaks = Utility::selectSorting(_AM_LEXIKON_ENTRIES_BREAKS, 'breaks'); |
||||
166 | $GLOBALS['xoopsTpl']->assign('selectorbreaks', $selectorbreaks); |
||||
167 | $entriesArray['breaks'] = $entriesTempArray[$i]->getVar('breaks'); |
||||
168 | |||||
169 | $selectorblock = Utility::selectSorting(_AM_LEXIKON_ENTRIES_BLOCK, 'block'); |
||||
170 | $GLOBALS['xoopsTpl']->assign('selectorblock', $selectorblock); |
||||
171 | $entriesArray['block'] = $entriesTempArray[$i]->getVar('block'); |
||||
172 | |||||
173 | $selectoroffline = Utility::selectSorting(_MD_LEXIKON_ENTRIES_ONLINE, 'online'); |
||||
174 | $GLOBALS['xoopsTpl']->assign('selectoroffline', $selectoroffline); |
||||
175 | // $entriesArray['offline'] = $entriesTempArray[$i]->getVar('offline'); |
||||
176 | $entriesArray['offline'] = (1 == $entriesTempArray[$i]->getVar('offline') ? $icons['0'] : "<border='0'>" . $icons['1']); |
||||
177 | |||||
178 | $selectornotifypub = Utility::selectSorting(_AM_LEXIKON_ENTRIES_NOTIFYPUB, 'notifypub'); |
||||
179 | $GLOBALS['xoopsTpl']->assign('selectornotifypub', $selectornotifypub); |
||||
180 | $entriesArray['notifypub'] = $entriesTempArray[$i]->getVar('notifypub'); |
||||
181 | |||||
182 | $selectorrequest = Utility::selectSorting(_AM_LEXIKON_ENTRIES_REQUEST, 'request'); |
||||
183 | $GLOBALS['xoopsTpl']->assign('selectorrequest', $selectorrequest); |
||||
184 | $entriesArray['request'] = $entriesTempArray[$i]->getVar('request'); |
||||
185 | |||||
186 | $selectorcomments = Utility::selectSorting(_AM_LEXIKON_ENTRIES_COMMENTS, 'comments'); |
||||
187 | $GLOBALS['xoopsTpl']->assign('selectorcomments', $selectorcomments); |
||||
188 | $entriesArray['comments'] = $entriesTempArray[$i]->getVar('comments'); |
||||
189 | |||||
190 | $selectoritem_tag = Utility::selectSorting(_AM_LEXIKON_ENTRIES_ITEM_TAG, 'item_tag'); |
||||
191 | $GLOBALS['xoopsTpl']->assign('selectoritem_tag', $selectoritem_tag); |
||||
192 | $entriesArray['item_tag'] = strip_tags($entriesTempArray[$i]->getVar('item_tag')); |
||||
193 | $entriesArray['edit_delete'] = "<a href='entries.php?op=edit&entryID=" . $i . "'><img src=" . $pathIcon16 . "/edit.png alt='" . _EDIT . "' title='" . _EDIT . "'></a> |
||||
194 | <a href='entries.php?op=delete&entryID=" . $i . "'><img src=" . $pathIcon16 . "/delete.png alt='" . _DELETE . "' title='" . _DELETE . "'></a> |
||||
195 | <a href='entries.php?op=clone&entryID=" . $i . "'><img src=" . $pathIcon16 . "/editcopy.png alt='" . _CLONE . "' title='" . _CLONE . "'></a>"; |
||||
196 | |||||
197 | $GLOBALS['xoopsTpl']->append_by_ref('entriesArrays', $entriesArray); |
||||
198 | unset($entriesArray); |
||||
199 | } |
||||
200 | unset($entriesTempArray); |
||||
201 | // Display Navigation |
||||
202 | if ($entriesCount > $entriesPaginationLimit) { |
||||
203 | require_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||||
204 | $pagenav = new \XoopsPageNav($entriesCount, $entriesPaginationLimit, $start, 'start', 'op=list' . '&sort=' . $sort . '&order=' . $order . ''); |
||||
205 | $GLOBALS['xoopsTpl']->assign('pagenav', $pagenav->renderNav(4)); |
||||
206 | } |
||||
207 | |||||
208 | echo $GLOBALS['xoopsTpl']->fetch(XOOPS_ROOT_PATH . '/modules/' . $GLOBALS['xoopsModule']->getVar('dirname') . '/templates/admin/lexikon_admin_entries.tpl'); |
||||
209 | |||||
210 | } |
||||
211 | |||||
212 | break; |
||||
213 | case 'new': |
||||
214 | $adminObject->addItemButton(_AM_LEXIKON_ENTRIES_LIST, 'entries.php', 'list'); |
||||
215 | echo $adminObject->displayButton('left'); |
||||
216 | |||||
217 | /** @var Entries $entriesObject */ |
||||
218 | $entriesObject = $entriesHandler->create(); |
||||
219 | $form = $entriesObject->getForm(); |
||||
220 | $form->display(); |
||||
221 | break; |
||||
222 | case 'save': |
||||
223 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||
224 | redirect_header('entries.php', 3, implode(',', $GLOBALS['xoopsSecurity']->getErrors())); |
||||
225 | } |
||||
226 | if (0 != Request::getInt('entryID', 0)) { |
||||
227 | $entriesObject = $entriesHandler->get(Request::getInt('entryID', 0)); |
||||
228 | } else { |
||||
229 | $entriesObject = $entriesHandler->create(); |
||||
230 | } |
||||
231 | // Form save fields |
||||
232 | $entriesObject->setVar('categoryID', Request::getVar('categoryID', '')); |
||||
233 | $entriesObject->setVar('term', Request::getVar('term', '')); |
||||
234 | $entriesObject->setVar('init', Request::getVar('init', '')); |
||||
235 | $entriesObject->setVar('definition', Request::getText('definition', '')); |
||||
236 | $entriesObject->setVar('ref', Request::getText('ref', '')); |
||||
237 | $entriesObject->setVar('url', Request::getVar('url', '')); |
||||
238 | $entriesObject->setVar('uid', Request::getVar('uid', '')); |
||||
239 | $entriesObject->setVar('submit', ((1 == Request::getInt('submit', 0)) ? '1' : '0')); |
||||
240 | $entriesObject->setVar('datesub', strtotime($_REQUEST['datesub']['date']) + $_REQUEST['datesub']['time']); |
||||
241 | $resDate = Request::getArray('datesub', [], 'POST'); |
||||
242 | $dateTimeObj = \DateTime::createFromFormat(_SHORTDATESTRING, $resDate['date']); |
||||
243 | $dateTimeObj->setTime(0, 0, 0); |
||||
244 | $entriesObject->setVar('datesub', $dateTimeObj->getTimestamp() + $resDate['time']); |
||||
245 | |||||
246 | $entriesObject->setVar('counter', Request::getVar('counter', '')); |
||||
247 | $entriesObject->setVar('html', ((1 == Request::getInt('html', 0)) ? '1' : '0')); |
||||
248 | $entriesObject->setVar('smiley', ((1 == Request::getInt('smiley', 0)) ? '1' : '0')); |
||||
249 | $entriesObject->setVar('xcodes', ((1 == Request::getInt('xcodes', 0)) ? '1' : '0')); |
||||
250 | $entriesObject->setVar('breaks', ((1 == Request::getInt('breaks', 0)) ? '1' : '0')); |
||||
251 | $entriesObject->setVar('block', ((1 == Request::getInt('block', 0)) ? '1' : '0')); |
||||
252 | $entriesObject->setVar('offline', ((1 == Request::getInt('offline', 0)) ? '1' : '0')); |
||||
253 | $entriesObject->setVar('notifypub', ((1 == Request::getInt('notifypub', 0)) ? '1' : '0')); |
||||
254 | $entriesObject->setVar('request', ((1 == Request::getInt('request', 0)) ? '1' : '0')); |
||||
255 | $entriesObject->setVar('comments', Request::getVar('comments', '')); |
||||
256 | $entriesObject->setVar('item_tag', Request::getVar('item_tag', '')); |
||||
257 | if ($entriesHandler->insert($entriesObject)) { |
||||
258 | redirect_header('entries.php?op=list', 2, _AM_LEXIKON_FORMOK); |
||||
259 | } |
||||
260 | |||||
261 | echo $entriesObject->getHtmlErrors(); |
||||
262 | $form = $entriesObject->getForm(); |
||||
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||||
263 | $form->display(); |
||||
264 | break; |
||||
265 | case 'edit': |
||||
266 | case 'mod': |
||||
267 | $adminObject->addItemButton(_AM_LEXIKON_ADD_ENTRIES, 'entries.php?op=new', 'add'); |
||||
268 | $adminObject->addItemButton(_AM_LEXIKON_ENTRIES_LIST, 'entries.php', 'list'); |
||||
269 | echo $adminObject->displayButton('left'); |
||||
270 | $entriesObject = $entriesHandler->get(Request::getString('entryID', '')); |
||||
271 | $form = $entriesObject->getForm(); |
||||
272 | $form->display(); |
||||
273 | break; |
||||
274 | case 'delete': |
||||
275 | $entriesObject = $entriesHandler->get(Request::getString('entryID', '')); |
||||
276 | if (1 == Request::getInt('ok', 0)) { |
||||
277 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||
278 | redirect_header('entries.php', 3, implode(', ', $GLOBALS['xoopsSecurity']->getErrors())); |
||||
279 | } |
||||
280 | if ($entriesHandler->delete($entriesObject)) { |
||||
281 | redirect_header('entries.php', 3, _AM_LEXIKON_FORMDELOK); |
||||
282 | } else { |
||||
283 | echo $entriesObject->getHtmlErrors(); |
||||
284 | } |
||||
285 | } else { |
||||
286 | xoops_confirm(['ok' => 1, 'entryID' => Request::getString('entryID', ''), 'op' => 'delete'], Request::getCmd('REQUEST_URI', '', 'SERVER'), sprintf(_AM_LEXIKON_FORMSUREDEL, $entriesObject->getVar('term'))); |
||||
0 ignored issues
–
show
It seems like
$entriesObject->getVar('term') can also be of type array and array ; however, parameter $values of sprintf() does only seem to accept double|integer|string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
287 | } |
||||
288 | break; |
||||
289 | case 'clone': |
||||
290 | |||||
291 | $id_field = Request::getString('entryID', ''); |
||||
292 | |||||
293 | if ((int)$id_field > 0 && Utility::cloneRecord('lxentries', 'entryID', (int)$id_field)) { |
||||
294 | redirect_header('entries.php', 3, _AM_LEXIKON_CLONED_OK); |
||||
295 | } else { |
||||
296 | redirect_header('entries.php', 3, _AM_LEXIKON_CLONED_FAILED); |
||||
297 | } |
||||
298 | |||||
299 | break; |
||||
300 | } |
||||
301 | require_once __DIR__ . '/admin_footer.php'; |
||||
302 |