Issues (330)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/functions.php (6 issues)

1
<?php
2
/**
3
 * Module: lexikon
4
 * Author: Yerres
5
 * Licence: GNU
6
 */
7
8
use XoopsModules\Lexikon\{
9
    Helper
10
};
11
/** @var Helper $helper */
12
13
global $xoopsUser;
14
15
if (is_object($xoopsUser)) {
16
    $xoopsModule = XoopsModule::getByDirname('lexikon');
17
    if (!$xoopsUser->isAdmin($xoopsModule->mid())) {
18
        redirect_header(XOOPS_URL . '/', 1, _NOPERM);
19
    }
20
} else {
21
    redirect_header(XOOPS_URL . '/', 1, _NOPERM);
22
}
23
/**
24
 * Function used to display an horizontal menu inside the admin panel
25
 * Enable webmasters to navigate thru the module's features.
26
 * Each time you select an option in the admin panel of the news module, this option is highlighted in this menu
27
 * @param int    $currentoption
28
 * @param string $breadcrumb
29
 * @package          lexikon
30
 * @orig             author: hsalazar, The smartfactory
31
 * @copyright    (c) XOOPS Project (https://xoops.org)
32
 */
33
function lx_adminMenu($currentoption = 0, $breadcrumb = '')
34
{
35
    require_once XOOPS_ROOT_PATH . '/class/template.php';
36
37
    global $xoopsDB, $xoopsModule, $xoopsConfig;
38
39
    $helper = Helper::getInstance();
40
    $helper->loadLanguage('admin');
41
    $helper->loadLanguage('modinfo');
42
43
    require __DIR__ . '/menu.php';
44
45
    $tpl = new \XoopsTpl();
46
    $tpl->assign(
47
        [
48
            'headermenu'      => $headermenu,
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $headermenu seems to be never defined.
Loading history...
49
            'adminmenu'       => $adminmenu,
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $adminmenu seems to be never defined.
Loading history...
50
            'current'         => $currentoption,
51
            'breadcrumb'      => $breadcrumb,
52
            'headermenucount' => count($headermenu),
53
        ]
54
    );
55
    $tpl->display('db:lx_adminmenu.tpl');
56
    echo "<br>\n";
57
}
58
59
/**
60
 * Add a field to a mysql table
61
 *
62
 * @param $field
63
 * @param $table
64
 * @return bool|\mysqli_result
65
 * @package       Lexikon
66
 * @author        Instant Zero (http://xoops.instant-zero.com)
67
 * @copyright (c) Instant Zero
68
 */
69
function lx_AddField($field, $table)
70
{
71
    global $xoopsDB;
72
    //naja !
73
    $result = $xoopsDB->queryF('ALTER TABLE ' . $table . ' ADD ' . $field . ' ');
74
75
    return $result;
76
}
77
78
/**
79
 * Change a field to a mysql table
80
 * desuet
81
 * @param $field
82
 * @param $table
83
 * @return bool
84
 * @package       Lexikon
85
 * @author        Instant Zero (http://xoops.instant-zero.com)
86
 * @copyright (c) Instant Zero
87
 */
88
function lx_alterTable($field, $table)
89
{
90
    global $xoopsDB;
91
    $sql    = 'SHOW COLUMNS FROM ' . $table . " LIKE '" . $field . "'";
92
    $result = $xoopsDB->queryF($sql);
93
    if (0 == $xoopsDB->getRowsNum($result)) {
94
        $sql    = 'ALTER TABLE ' . $xoopsDB->prefix($table) . ' ADD `' . $field . '`';
95
        $result = $xoopsDB->query($sql);
96
        return $result;
97
        //   }
98
    }
99
100
    return true;
101
}
102
103
/*
104
 * Sub-Menu for Importscripts
105
 * @package lexikon
106
 * @copyright (c) XOOPS Project (https://xoops.org)
107
*/
108
109
/**
110
 * @param int    $currentoption
111
 * @param string $breadcrumb
112
 */
113
function lx_importMenu($currentoption = 0, $breadcrumb = '')
0 ignored issues
show
The parameter $currentoption is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

113
function lx_importMenu(/** @scrutinizer ignore-unused */ $currentoption = 0, $breadcrumb = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $breadcrumb is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

113
function lx_importMenu($currentoption = 0, /** @scrutinizer ignore-unused */ $breadcrumb = '')

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
114
{
115
    global $cf;
116
    echo "<table style='border:0; width:99%;'>
117
              <tr><td style='vertical-align:top;'>
118
              <strong style='color: #2F5376; margin-top:6px; font-size:medium'>" . _AM_LEXIKON_IMPORT_MENU . '</strong><br>';
119
    if ($cf > 0) {
120
        echo '<span style="font-size:x-small">' . _AM_LEXIKON_OTHERMODS . '</span><br><br>';
121
    } else {
122
        echo '<span style="font-size:x-small; color:red;">' . _AM_LEXIKON_NOOTHERMODS . '</span><br><br>';
123
    }
124
125
    echo "</td><td style='vertical-align:top;'>
126
              <div id='menu'>";
127
    // show only modules located on the system
128
    /** @var \XoopsModuleHandler $moduleHandler */
129
    $moduleHandler  = xoops_getHandler('module');
130
    $wordbookModule = $moduleHandler->getByDirname('wordbook');
131
    $got_options    = false;
0 ignored issues
show
The assignment to $got_options is dead and can be removed.
Loading history...
132
    $cf             = 0;
133
    if (is_object($wordbookModule)) {
134
        $wb_imgurl = XOOPS_URL . '/modules/wordbook/images';
135
        ++$cf;
136
        echo "<a href='importwordbook.php'>
137
                  <img src='" . $wb_imgurl . "/wb_slogo.png' alt='wb_slogo.png' title='Wordbook' style='height:39px; width:69px;'><span>" . _AM_LEXIKON_IMPORT_WORDBOOK . '</span></a>';
138
    } //else { echo "". 'wordbook' ."";}
139
    $dictionaryModule = $moduleHandler->getByDirname('dictionary');
140
    $got_options      = false;
141
    if (is_object($dictionaryModule)) {
142
        $dic_imgurl = XOOPS_URL . '/modules/dictionary/images';
143
        ++$cf;
144
        echo "<a href='importdictionary.php'>
145
                  <img src='" . $dic_imgurl . "/dictionary_logo.png' alt='Dictionary' title='Dictionary' style='height:39px; width:69px;'><span>" . _AM_LEXIKON_IMPORT_DICTIONARY . '</span></a>';
146
    } //else { echo "<B>&middot;</B>". 'dictionary' ."";}
147
    $glossaireModule = $moduleHandler->getByDirname('glossaire');
148
    $got_options     = false;
149
    if (is_object($glossaireModule)) {
150
        $glo_imgurl = XOOPS_URL . '/modules/glossaire.';
151
        ++$cf;
152
        echo "<a href='importglossaire.php'>
153
                  <img src='" . $glo_imgurl . "/glossaire_logo.jpg' alt='Glossaire' title='Glossaire' style='height:31px; width:88px;'><span>" . _AM_LEXIKON_IMPORT_GLOSSAIRE . '</span></a>';
154
    } //else { echo "<B>&middot;</B>". 'glossaire' ."";}
155
    $wiwimodModule = $moduleHandler->getByDirname('wiwimod');
156
    $got_options   = false;
157
    if (is_object($wiwimodModule)) {
158
        $wiwi_imgurl = XOOPS_URL . '/modules/wiwimod/images';
159
        ++$cf;
160
        echo "<a href='importwiwimod.php'>
161
                  <img src='" . $wiwi_imgurl . "/wiwilogo.gif' alt='Wiwimod' title='Wiwimod' style='height:39px; width:69px;'><span>" . _AM_LEXIKON_IMPORT_WIWIMOD . '</span></a>';
162
    } //else { echo "<B>&middot;</B>". 'wiwimod' ."";}
163
    $xwordsModule = $moduleHandler->getByDirname('xwords');
164
    $got_options  = false;
165
    if (is_object($xwordsModule)) {
166
        $xwd_imgurl = XOOPS_URL . '/modules/xwords/images';
167
        ++$cf;
168
        echo "<a href='importxwords.php'>
169
                  <img src='" . $xwd_imgurl . "/xwords_slogo.png' alt='Xwords' title='Xwords' style='height:39px; width:69px;'><span>" . _AM_LEXIKON_IMPORT_XWORDS . '</span></a>';
170
    }// else { echo "<B>&middot;</B>". 'xwords' ."";}
171
    echo '</div></td><tr></table>';
172
}
173
174
/**
175
 * collapsable bar for items lists
176
 * @param string $tablename
177
 * @param string $iconname
178
 * @package       lexikon
179
 * @copyright (c) XOOPS Project (https://xoops.org)
180
 */
181
function lx_collapsableBar($tablename = '', $iconname = '')
182
{
183
    ?>
184
    <script type="text/javascript"><!--
185
        function goto_URL(object) {
186
            window.location.href = object.options[object.selectedIndex].value;
187
        }
188
189
        function toggle(id) {
190
            if (document.getElementById) {
191
                obj = document.getElementById(id);
192
            }
193
            if (document.all) {
194
                obj = document.all[id];
195
            }
196
            if (document.layers) {
197
                obj = document.layers[id];
198
            }
199
            if (obj) {
200
                if (obj.style.display === "none") {
201
                    obj.style.display = "";
202
                } else {
203
                    obj.style.display = "none";
204
                }
205
            }
206
207
            return false;
208
        }
209
210
        var iconClose = new Image();
211
        iconClose.src = '../assets/images/close12.gif';
212
        var iconOpen = new Image();
213
        iconOpen.src = '../assets/images/open12.gif';
214
215
        function toggleIcon(iconName) {
216
            if (document.images[iconName].src == window.iconOpen.src) {
217
                document.images[iconName].src = window.iconClose.src;
218
            }
219
            elseif(document.images[iconName].src == window.iconClose.src)
220
            {
221
                document.images[iconName].src = window.iconOpen.src;
222
            }
223
        }
224
225
        //-->
226
    </script>
227
    <?php
228
    // HTML Error Fixed by 5Vision
229
    echo "<div style='color:#2F5376; margin:6px 0 0 0;'><a href='#' onClick=\"toggle('" . $tablename . "'); toggleIcon('" . $iconname . "');\">";
230
}
231
232
/**
233
 * Returns statistics about the Glossary
234
 * adapted from news module 1.0
235
 * @param $limit
236
 * @return array
237
 */
238
function lx_GetStatistics($limit)
239
{
240
    $ret  = [];
241
    $db   = \XoopsDatabaseFactory::getDatabaseConnection();
242
    $tbls = $db->prefix('lxentries');
243
    $tblt = $db->prefix('lxcategories');
244
245
    $db = \XoopsDatabaseFactory::getDatabaseConnection();
246
    // Number of Definitions per Category, including offline and submitted terms
247
    $ret2   = [];
248
    $sql    = "SELECT count(s.entryID) as cpt, s.categoryID, t.name FROM $tbls s, $tblt t WHERE s.categoryID=t.categoryID GROUP BY s.categoryID ORDER BY t.name";
249
    $result = $db->query($sql);
250
    while (false !== ($myrow = $db->fetchArray($result))) {
251
        $ret2[$myrow['categoryID']] = $myrow;
252
    }
253
    $ret['termspercategory'] = $ret2;
254
    unset($ret2);
255
256
    // Total reads per category
257
    $ret2   = [];
258
    $sql    = "SELECT Sum(counter) as cpt, categoryID FROM $tbls GROUP BY categoryID ORDER BY categoryID";
259
    $result = $db->query($sql);
260
    while (false !== ($myrow = $db->fetchArray($result))) {
261
        $ret2[$myrow['categoryID']] = $myrow['cpt'];
262
    }
263
    $ret['readspercategory'] = $ret2;
264
265
    // unused terms per category i.e. offline or submitted
266
    $ret2   = [];
267
    $sql    = "SELECT Count(entryID) as cpt, categoryID FROM $tbls WHERE offline > 0 OR submit > 0 GROUP BY categoryID ORDER BY categoryID";
268
    $result = $db->query($sql);
269
    while (false !== ($myrow = $db->fetchArray($result))) {
270
        $ret2[$myrow['categoryID']] = $myrow['cpt'];
271
    }
272
    $ret['offlinepercategory'] = $ret2;
273
    unset($ret2);
274
275
    // Number of unique authors per category
276
    $ret2   = [];
277
    $sql    = "SELECT Count(Distinct(uid)) as cpt, categoryID FROM $tbls GROUP BY categoryID ORDER BY categoryID";
278
    $result = $db->query($sql);
279
    while (false !== ($myrow = $db->fetchArray($result))) {
280
        $ret2[$myrow['categoryID']] = $myrow['cpt'];
281
    }
282
    $ret['authorspercategory'] = $ret2;
283
    unset($ret2);
284
285
    // Most read terms
286
    $ret2   = [];
287
    $sql    = "SELECT s.entryID, s.uid, s.term, s.counter, s.categoryID, t.name  FROM $tbls s, $tblt t WHERE s.categoryID=t.categoryID ORDER BY s.counter DESC";
288
    $result = $db->query($sql, (int)$limit);
289
    while (false !== ($myrow = $db->fetchArray($result))) {
290
        $ret2[$myrow['entryID']] = $myrow;
291
    }
292
    $ret['mostreadterms'] = $ret2;
293
    unset($ret2);
294
295
    // Less read terms
296
    $ret2   = [];
297
    $sql    = "SELECT s.entryID, s.uid, s.term, s.counter, s.categoryID, t.name  FROM $tbls s, $tblt t WHERE s.categoryID=t.categoryID ORDER BY s.counter";
298
    $result = $db->query($sql, (int)$limit);
299
    while (false !== ($myrow = $db->fetchArray($result))) {
300
        $ret2[$myrow['entryID']] = $myrow;
301
    }
302
    $ret['lessreadterms'] = $ret2;
303
    unset($ret2);
304
305
    // Most read authors
306
    $ret2   = [];
307
    $sql    = "SELECT Sum(counter) as cpt, uid FROM $tbls GROUP BY uid ORDER BY cpt DESC";
308
    $result = $db->query($sql, (int)$limit);
309
    while (false !== ($myrow = $db->fetchArray($result))) {
310
        $ret2[$myrow['uid']] = $myrow['cpt'];
311
    }
312
    $ret['mostreadauthors'] = $ret2;
313
    unset($ret2);
314
315
    // Biggest contributors
316
    $ret2   = [];
317
    $sql    = "SELECT Count(*) as cpt, uid FROM $tbls GROUP BY uid ORDER BY cpt DESC";
318
    $result = $db->query($sql, (int)$limit);
319
    while (false !== ($myrow = $db->fetchArray($result))) {
320
        $ret2[$myrow['uid']] = $myrow['cpt'];
321
    }
322
    $ret['biggestcontributors'] = $ret2;
323
    unset($ret2);
324
325
    return $ret;
326
}
327
328
//-- build a table header
329
/**
330
 *
331
 */
332
function lx_buildTable()
333
{
334
    global $xoopsConfig, $xoopsModuleConfig, $xoopsModule;
335
    echo "<div style='color: #2F5376; margin: 6px 0 0 0; '>";
336
    echo "<table class='outer' style='width:100%;'>";
337
    echo '<tr >';
338
    echo "<th style='width:40px; text-align:center;'>" . _AM_LEXIKON_ENTRYID . '</td>';
339
    echo "<th style='width:100px; text-align:center;'>" . _AM_LEXIKON_ENTRYCATNAME . '</td>';
340
    echo "<th style='text-align:center;'>" . _AM_LEXIKON_TERM . '</td>';
341
    echo "<th style='width:90px; text-align:center;'>" . _AM_LEXIKON_AUTHOR . '</td>';
342
    echo "<th style='width:90px; text-align:center;'>" . _AM_LEXIKON_ENTRYCREATED . '</td>';
343
    echo "<th style='width:40px; text-align:center;'>" . _AM_LEXIKON_STATUS . '</td>';
344
    echo "<th style='width:60px; text-align:center;'>" . _AM_LEXIKON_ACTION . '</td>';
345
    echo '</tr>';
346
}
347
348
/**
349
 * save_permissions()
350
 * adapted from WF-Downloads
351
 * @param $groups
352
 * @param $id
353
 * @param $perm_name
354
 * @return bool
355
 */
356
function lx_save_Permissions($groups, $id, $perm_name)
357
{
358
    $result = true;
359
    /** @var \XoopsModuleHandler $moduleHandler */
360
    $moduleHandler = xoops_getHandler('module');
361
    $lxModule      = $moduleHandler->getByDirname('lexikon');
362
363
    $module_id = $lxModule->getVar('mid');
364
    /** @var \XoopsGroupPermHandler $grouppermHandler */
365
    $grouppermHandler = xoops_getHandler('groupperm');
366
367
    /*
368
    * First, if the permissions are already there, delete them
369
    */
370
    $grouppermHandler->deleteByModule($module_id, $perm_name, $id);
371
    /*
372
    *  Save the new permissions
373
    */
374
    if (is_array($groups)) {
375
        foreach ($groups as $group_id) {
376
            $grouppermHandler->addRight($perm_name, $id, $group_id, $module_id);
377
        }
378
    }
379
380
    return $result;
381
}
382
383
//-- Initial Selector
384
/**
385
 * @param $init
386
 */
387
function lx_getinit($init)
0 ignored issues
show
The parameter $init is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

387
function lx_getinit(/** @scrutinizer ignore-unused */ $init)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
388
{
389
    global $init;
390
    echo "<div><select name='init'>";
391
    echo "<option value='#'>&nbsp; # &nbsp;</option>";
392
    for ($a = 48; $a < (48 + 10); ++$a) {
393
        if (uchr($a) == $init) {
394
            $opt_selected = 'selected';
395
        } else {
396
            $opt_selected = '';
397
        }
398
        echo "<option value='" . uchr($a) . "' $opt_selected>&nbsp;" . uchr($a) . '&nbsp;</option>';
399
    }
400
    for ($a = 65; $a < (65 + 26); ++$a) {
401
        if (uchr($a) == $init) {
402
            $opt_selected = 'selected';
403
        } else {
404
            $opt_selected = '';
405
        }
406
        echo "<option value='" . uchr($a) . "' $opt_selected>&nbsp;" . uchr($a) . '&nbsp;</option>';
407
    }
408
    /*for ($a = 1040; $a < (1040 + 32); ++$a) {
409
        if (uchr($a) == $init) {
410
            $opt_selected = 'selected';
411
        } else {
412
            $opt_selected = '';
413
        }
414
        echo "<option value='" . uchr($a) . "' $opt_selected>&nbsp;" . uchr($a) . "&nbsp;</option>";
415
    }*/
416
    echo '</select></div>';
417
}
418
419
/**
420
 * @param $a
421
 * @return string
422
 */
423
function uchr($a)
424
{
425
    if (is_scalar($a)) {
426
        $a = func_get_args();
427
    }
428
    $str = '';
429
    foreach ($a as $code) {
430
        $str .= html_entity_decode('&#' . $code . ';', ENT_NOQUOTES, 'UTF-8');
431
    }
432
433
    return $str;
434
}
435