This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | /** |
||
3 | * Module: Lexikon |
||
4 | * Version: v 1.00 |
||
5 | * Release Date: 8 May 2004 |
||
6 | * Author: hsalazar |
||
7 | * Licence: GNU |
||
8 | */ |
||
9 | |||
10 | use XoopsModules\Lexikon\{ |
||
11 | Helper, |
||
12 | Utility |
||
13 | }; |
||
14 | /** @var Helper $helper */ |
||
15 | |||
16 | defined('XOOPS_ROOT_PATH') || exit('Restricted access'); |
||
17 | |||
18 | /** |
||
19 | * @param $queryarray |
||
20 | * @param $andor |
||
21 | * @param $limit |
||
22 | * @param $offset |
||
23 | * @param $userid |
||
24 | * @return array |
||
25 | */ |
||
26 | function lx_search($queryarray, $andor, $limit, $offset, $userid) |
||
27 | { |
||
28 | global $xoopsDB, $xoopsUser; |
||
29 | // -- search comments + highlighter |
||
30 | $highlight = false; |
||
0 ignored issues
–
show
Unused Code
introduced
by
![]() |
|||
31 | $searchincomments = false; |
||
0 ignored issues
–
show
|
|||
32 | require_once XOOPS_ROOT_PATH . '/modules/lexikon/include/common.inc.php'; |
||
33 | // require_once XOOPS_ROOT_PATH . '/modules/lexikon/class/Utility.php'; |
||
34 | $utility = new Utility(); |
||
35 | $hightlight_key = ''; |
||
36 | $highlight = $utility::getModuleOption('config_highlighter'); |
||
37 | $searchincomments = CONFIG_SEARCH_COMMENTS; |
||
38 | /** @var \XoopsModuleHandler $moduleHandler */ |
||
39 | $moduleHandler = xoops_getHandler('module'); |
||
40 | $module = $moduleHandler->getByDirname('lexikon'); |
||
41 | $module_id = $module->getVar('mid'); |
||
42 | // Permissions |
||
43 | /** @var \XoopsGroupPermHandler $grouppermHandler */ |
||
44 | $grouppermHandler = xoops_getHandler('groupperm'); |
||
45 | $groups = is_object($xoopsUser) ? $xoopsUser->getGroups() : XOOPS_GROUP_ANONYMOUS; |
||
46 | $allowed_cats = $grouppermHandler->getItemIds('lexikon_view', $groups, $module_id); |
||
47 | $catids = implode(',', $allowed_cats); |
||
48 | |||
49 | $sql = 'SELECT entryID, categoryID, term, definition, ref, uid, datesub FROM ' . $xoopsDB->prefix('lxentries') . ' WHERE submit = 0 AND offline = 0 '; |
||
50 | $sql .= " AND categoryID IN ($catids) "; |
||
51 | |||
52 | if (0 != $userid) { |
||
53 | $sql .= ' AND uid=' . $userid . ' '; |
||
54 | } |
||
55 | if ($highlight) { |
||
56 | if ('' == $queryarray) { |
||
57 | $keywords = ''; |
||
58 | $hightlight_key = ''; |
||
59 | } else { |
||
60 | $keywords = implode('+', $queryarray); |
||
61 | $hightlight_key = '&keywords=' . $keywords; |
||
62 | } |
||
63 | } |
||
64 | // because count() returns 1 even if a supplied variable |
||
65 | // is not an array, we must check if $querryarray is really an array |
||
66 | $count = 0; |
||
67 | if (is_array($queryarray)) { |
||
68 | $count = count($queryarray); |
||
69 | } |
||
70 | if ($count > 0 ) { |
||
71 | $sql .= "AND ((term LIKE '%$queryarray[0]%' OR definition LIKE '%$queryarray[0]%' OR ref LIKE '%$queryarray[0]%')"; |
||
72 | for ($i = 1; $i < $count; ++$i) { |
||
73 | $sql .= " $andor "; |
||
74 | $sql .= "(term LIKE '%$queryarray[$i]%' OR definition LIKE '%$queryarray[$i]%' OR ref LIKE '%$queryarray[$i]%')"; |
||
75 | } |
||
76 | $sql .= ') '; |
||
77 | } |
||
78 | $sql .= 'ORDER BY entryID DESC'; |
||
79 | $result = $xoopsDB->query($sql, $limit, $offset); |
||
80 | $ret = []; |
||
81 | $i = 0; |
||
82 | |||
83 | while (false !== ($myrow = $xoopsDB->fetchArray($result))) { |
||
84 | $display = true; |
||
85 | if ($module_id && $grouppermHandler) { |
||
86 | if (!$grouppermHandler->checkRight('lexikon_view', $myrow['categoryID'], $groups, $module_id)) { |
||
87 | //if (!$grouppermHandler->checkRight("lexikon_view", $categoryID, $groups, $module_id)) { |
||
88 | $display = false; |
||
89 | } |
||
90 | } |
||
91 | if ($display) { |
||
92 | $ret[$i]['image'] = 'assets/images/lx.png'; |
||
93 | $ret[$i]['link'] = 'entry.php?entryID=' . $myrow['entryID'] . $hightlight_key; |
||
94 | $ret[$i]['title'] = $myrow['term']; |
||
95 | $ret[$i]['time'] = $myrow['datesub']; |
||
96 | $ret[$i]['uid'] = $myrow['uid']; |
||
97 | ++$i; |
||
98 | } |
||
99 | } |
||
100 | //return $ret; |
||
101 | //} |
||
102 | // --- comments search --- |
||
103 | if ($searchincomments && (isset($limit) && $i <= $limit)) { |
||
0 ignored issues
–
show
|
|||
104 | require XOOPS_ROOT_PATH . '/include/comment_constants.php'; |
||
105 | $ind = $i; |
||
106 | $sql = 'SELECT com_id, com_modid, com_itemid, com_created, com_uid, com_title, com_text, com_status |
||
107 | FROM ' . $xoopsDB->prefix('xoopscomments') . " |
||
108 | WHERE (com_id>0) AND (com_modid=$module_id) AND (com_status=" . XOOPS_COMMENT_ACTIVE . ') '; |
||
109 | if (0 != $userid) { |
||
110 | $sql .= ' AND com_uid=' . $userid . ' '; |
||
111 | } |
||
112 | |||
113 | if (is_array($queryarray) && $count = count($queryarray)) { |
||
114 | $sql .= " AND ((com_title LIKE '%$queryarray[0]%' OR com_text LIKE '%$queryarray[0]%')"; |
||
115 | for ($i = 1; $i < $count; ++$i) { |
||
116 | $sql .= " $andor "; |
||
117 | $sql .= "(com_title LIKE '%$queryarray[$i]%' OR com_text LIKE '%$queryarray[$i]%')"; |
||
118 | } |
||
119 | $sql .= ') '; |
||
120 | } |
||
121 | $i = $ind; |
||
122 | $sql .= 'ORDER BY com_created DESC'; |
||
123 | $result = $xoopsDB->query($sql, $limit, $offset); |
||
124 | while (false !== ($myrow = $xoopsDB->fetchArray($result))) { |
||
125 | $display = true; |
||
126 | [$entryID, $offline] = $xoopsDB->fetchRow( |
||
127 | $xoopsDB->query( |
||
128 | ' |
||
129 | SELECT entryID, offline |
||
130 | FROM ' . $xoopsDB->prefix('lxentries') . ' WHERE entryID = ' . $myrow['com_itemid'] . ' ' |
||
131 | ) |
||
132 | ); |
||
133 | if (1 == $offline) { |
||
134 | $display = false; |
||
135 | } |
||
136 | if ($i + 1 > $limit) { |
||
137 | $display = false; |
||
138 | } |
||
139 | |||
140 | if ($display) { |
||
141 | $ret[$i]['image'] = 'assets/images/lx.png'; |
||
142 | $ret[$i]['link'] = 'entry.php?entryID=' . $myrow['com_itemid'] . $hightlight_key; |
||
143 | $ret[$i]['title'] = $myrow['com_title']; |
||
144 | $ret[$i]['time'] = $myrow['com_created']; |
||
145 | $ret[$i]['uid'] = $myrow['com_uid']; |
||
146 | ++$i; |
||
147 | } |
||
148 | } |
||
149 | } |
||
150 | |||
151 | return $ret; |
||
152 | } |
||
153 |