XoopsModules25x /
mylinks
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | /** |
||
| 4 | * @param $param |
||
| 5 | * @return array |
||
| 6 | */ |
||
| 7 | function mylinks_get_new($param) |
||
| 8 | { |
||
| 9 | $modulename = basename(dirname(__DIR__)); |
||
| 10 | include_once XOOPS_ROOT_PATH . "/modules/{$modulename}/include/feeddata.inc.php"; |
||
| 11 | |||
| 12 | // parameter |
||
| 13 | $limit_show = isset($param['show']) ? (int)$param['show'] : 10; |
||
| 14 | $limit_image = isset($param['image']) ? (int)$param['image'] : 1; |
||
|
0 ignored issues
–
show
|
|||
| 15 | |||
| 16 | // get new from each module |
||
| 17 | $i = 0; |
||
| 18 | $result_array = array(); |
||
| 19 | $time_array = array(); |
||
| 20 | |||
| 21 | $limit = $limit_show; |
||
| 22 | |||
| 23 | $res_array = mylinks_feednew($limit); |
||
| 24 | $count = count($res_array); |
||
| 25 | if (is_array($res_array) && $count > 0) { |
||
| 26 | for ($j = 0; $j < $count; $j++) { |
||
| 27 | $result_array[$i] = $res_array[$j]; |
||
| 28 | $time_array[$i] = $res_array[$j]['time']; |
||
| 29 | $i++; |
||
| 30 | } |
||
| 31 | } |
||
| 32 | |||
| 33 | // sort by time |
||
| 34 | arsort($time_array); |
||
| 35 | $i = 0; |
||
| 36 | $new_array = array(); |
||
| 37 | |||
| 38 | foreach ($time_array as $num => $time) { |
||
| 39 | $new_array[$i++] = $result_array[$num]; |
||
| 40 | if ($i >= $limit_show) { |
||
| 41 | break; |
||
| 42 | } |
||
| 43 | } |
||
| 44 | |||
| 45 | return $new_array; |
||
| 46 | } |
||
| 47 | |||
| 48 | /** |
||
| 49 | * @param $title |
||
| 50 | * @return mixed|string |
||
| 51 | */ |
||
| 52 | function wani_make_html_title($title) |
||
| 53 | { |
||
| 54 | if (!isset($title) or empty($title)) { |
||
| 55 | return ''; |
||
| 56 | } |
||
| 57 | $title = strip_tags($title); |
||
| 58 | $title = (mb_strlen($title) > 100) ? mb_strimwidth($title, 0, 100, ' ...') : $title; |
||
| 59 | $title = wani_html_special_chars($title); |
||
| 60 | |||
| 61 | return $title; |
||
| 62 | } |
||
| 63 | |||
| 64 | /** |
||
| 65 | * @param $sum |
||
| 66 | * @param $max |
||
| 67 | * @return mixed|string |
||
| 68 | */ |
||
| 69 | function wani_make_html_summary($sum, $max) |
||
| 70 | { |
||
| 71 | $FLAG_STRIP_CONTROL = 1; |
||
| 72 | $FLAG_STRIP_CRLF = 1; |
||
| 73 | $FLAG_STRIP_STYLE = 1; |
||
| 74 | $FLAG_STRIP_SPACE = 1; |
||
| 75 | $FLAG_ADD_SPACE = 1; |
||
| 76 | $FLAG_IMAGE_FORCE = 1; |
||
|
0 ignored issues
–
show
$FLAG_IMAGE_FORCE is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the Loading history...
|
|||
| 77 | |||
| 78 | if ($FLAG_STRIP_CONTROL) { |
||
| 79 | $sum = wani_strip_control_code($sum); |
||
| 80 | } |
||
| 81 | |||
| 82 | if ($FLAG_STRIP_CRLF) { |
||
| 83 | $sum = wani_strip_crlf($sum); |
||
| 84 | } |
||
| 85 | |||
| 86 | if ($FLAG_STRIP_STYLE) { |
||
| 87 | $sum = wani_strip_style_tag($sum); |
||
| 88 | } |
||
| 89 | |||
| 90 | if ($FLAG_ADD_SPACE) { |
||
| 91 | $sum = wani_add_space($sum); |
||
| 92 | } |
||
| 93 | |||
| 94 | $sum = strip_tags($sum); |
||
| 95 | |||
| 96 | if ($FLAG_STRIP_SPACE) { |
||
| 97 | $sum = wani_strip_space($sum); |
||
| 98 | } |
||
| 99 | |||
| 100 | $sum = (mb_strlen($sum) > $max) ? mb_strimwidth($sum, 0, $max, ' ...') : $sum; |
||
| 101 | |||
| 102 | // sanitize |
||
| 103 | $sum = wani_html_special_chars($sum); |
||
| 104 | |||
| 105 | return $sum; |
||
| 106 | } |
||
| 107 | |||
| 108 | ///////////// |
||
| 109 | // -------------------------------------------------------- |
||
| 110 | // strip return code |
||
| 111 | // -------------------------------------------------------- |
||
| 112 | /** |
||
| 113 | * @param $text |
||
| 114 | * @return mixed |
||
| 115 | */ |
||
| 116 | function wani_strip_crlf($text) |
||
| 117 | { |
||
| 118 | $text = preg_replace("/\r/", ' ', $text); |
||
| 119 | $text = preg_replace("/\n/", ' ', $text); |
||
| 120 | |||
| 121 | return $text; |
||
| 122 | } |
||
| 123 | |||
| 124 | // -------------------------------------------------------- |
||
| 125 | // strip style tag |
||
| 126 | // in strip_tags, cannot strip style tag area well |
||
| 127 | // -------------------------------------------------------- |
||
| 128 | /** |
||
| 129 | * @param $text |
||
| 130 | * @return mixed |
||
| 131 | */ |
||
| 132 | function wani_strip_style_tag($text) |
||
| 133 | { |
||
| 134 | return preg_replace('|<\s*style\s?.*?>(.*)<\s*/\s*style\s*>|is', '', $text); |
||
| 135 | } |
||
| 136 | |||
| 137 | // -------------------------------------------------------- |
||
| 138 | // strip space code |
||
| 139 | // -------------------------------------------------------- |
||
| 140 | /** |
||
| 141 | * @param $text |
||
| 142 | * @return mixed|string |
||
| 143 | */ |
||
| 144 | function wani_strip_space($text) |
||
| 145 | { |
||
| 146 | global $xoopsConfig; |
||
| 147 | |||
| 148 | if (($xoopsConfig['language'] == 'japanese') && function_exists('mb_convert_kana')) { |
||
| 149 | // zenkaku to hankaku |
||
| 150 | $text = mb_convert_kana($text, 's'); |
||
| 151 | } |
||
| 152 | |||
| 153 | // in MyTextSanitizer, replace " " to "&nbsp;" |
||
| 154 | $text = preg_replace('/&nbsp;/i', ' ', $text); |
||
| 155 | $text = preg_replace('/ /i', ' ', $text); |
||
| 156 | $text = preg_replace("/[\x20]+/", ' ', $text); |
||
| 157 | |||
| 158 | return $text; |
||
| 159 | } |
||
| 160 | |||
| 161 | // -------------------------------------------------------- |
||
| 162 | // add space code after end tag |
||
| 163 | // REQ 3509: put into spacing in a summary |
||
| 164 | // -------------------------------------------------------- |
||
| 165 | /** |
||
| 166 | * @param $text |
||
| 167 | * @return mixed |
||
| 168 | */ |
||
| 169 | function wani_add_space($text) |
||
| 170 | { |
||
| 171 | $text = preg_replace('/>/', '> ', $text); |
||
| 172 | |||
| 173 | return $text; |
||
| 174 | } |
||
| 175 | |||
| 176 | // -------------------------------------------------------- |
||
| 177 | // convert html_special_chars |
||
| 178 | // in MyTextSanitizer, replace " " to "&nbsp;" |
||
| 179 | // in this, not replace " " |
||
| 180 | // < -> < |
||
| 181 | // > -> > |
||
| 182 | // " -> " |
||
| 183 | // ' -> ' |
||
| 184 | // -------------------------------------------------------- |
||
| 185 | /** |
||
| 186 | * @param $text |
||
| 187 | * @return mixed|string |
||
| 188 | */ |
||
| 189 | View Code Duplication | function wani_html_special_chars($text) |
|
| 190 | { |
||
| 191 | $text = wani_strip_control_code($text); |
||
| 192 | $text = wani_conv_js($text); |
||
| 193 | $text = htmlspecialchars($text, ENT_QUOTES); |
||
| 194 | $text = preg_replace("/'/", ''', $text); |
||
| 195 | //$text = preg_replace("/&/i", '&', $text); |
||
| 196 | return $text; |
||
| 197 | } |
||
| 198 | |||
| 199 | //--------------------------------------------------------- |
||
| 200 | // convert html_special_chars for url |
||
| 201 | // < -> < |
||
| 202 | // > -> > |
||
| 203 | // " -> " |
||
| 204 | // ' -> ' |
||
| 205 | // & -> & |
||
| 206 | // & -> & |
||
| 207 | //--------------------------------------------------------- |
||
| 208 | // BUG 3169: need to sanitaize $_SERVER['PHP_SELF'] |
||
| 209 | /** |
||
| 210 | * @param $text |
||
| 211 | * @return mixed|string |
||
| 212 | */ |
||
| 213 | View Code Duplication | function wani_html_special_chars_url($text) |
|
| 214 | { |
||
| 215 | $text = wani_strip_control_code($text); |
||
| 216 | $text = wani_strip_crlf($text); |
||
| 217 | $text = wani_conv_js($text); |
||
| 218 | $text = preg_replace('/&/i', '&', $text); |
||
| 219 | $text = htmlspecialchars($text, ENT_QUOTES); |
||
| 220 | |||
| 221 | return $text; |
||
| 222 | } |
||
| 223 | |||
| 224 | // BUG 3169: need to sanitaize $_SERVER['PHP_SELF'] |
||
| 225 | /** |
||
| 226 | * @param $text |
||
| 227 | * @return mixed |
||
| 228 | */ |
||
| 229 | function wani_conv_js($text) |
||
| 230 | { |
||
| 231 | $text = preg_replace('/javascript:/si', 'java script:', $text); |
||
| 232 | $text = preg_replace('/about:/si', 'about :', $text); |
||
| 233 | |||
| 234 | return $text; |
||
| 235 | } |
||
| 236 | |||
| 237 | // -------------------------------------------------------- |
||
| 238 | // strip control code |
||
| 239 | // -------------------------------------------------------- |
||
| 240 | /** |
||
| 241 | * @param $text |
||
| 242 | * @return mixed |
||
| 243 | */ |
||
| 244 | function wani_strip_control_code($text) |
||
| 245 | { |
||
| 246 | $text = preg_replace('/[\x00-\x09]/', ' ', $text); |
||
| 247 | $text = preg_replace('/[\x0B-\x0C]/', ' ', $text); |
||
| 248 | $text = preg_replace('/[\x0E-\x1F]/', ' ', $text); |
||
| 249 | $text = preg_replace('/[\x7F]/', ' ', $text); |
||
| 250 | |||
| 251 | return $text; |
||
| 252 | } |
||
| 253 | |||
| 254 | //--------------------------------------------------------- |
||
| 255 | // http://www.w3.org/TR/NOTE-datetime |
||
| 256 | // 2003-12-13T18:30:02+09:00 |
||
| 257 | // |
||
| 258 | // http://www.php.net/manual/ja/function.date.php |
||
| 259 | // User Contributed Notes |
||
| 260 | //--------------------------------------------------------- |
||
| 261 | /** |
||
| 262 | * @param $time |
||
| 263 | * @return string |
||
| 264 | */ |
||
| 265 | function wani_iso8601_date($time) |
||
| 266 | { |
||
| 267 | $tzd = date('O', $time); |
||
| 268 | $tzd = substr(chunk_split($tzd, 3, ':'), 0, 6); |
||
| 269 | $date = date('Y-m-d\TH:i:s', $time) . $tzd; |
||
| 270 | |||
| 271 | return $date; |
||
| 272 | } |
||
| 273 | |||
| 274 | /** |
||
| 275 | * @param $text |
||
| 276 | * @return string |
||
| 277 | */ |
||
| 278 | function wani_utf8_encode($text) |
||
| 279 | { |
||
| 280 | if (1 == XOOPS_USE_MULTIBYTES) { |
||
| 281 | if (function_exists('mb_convert_encoding')) { |
||
| 282 | return mb_convert_encoding($text, 'UTF-8', _CHARSET); |
||
| 283 | } |
||
| 284 | |||
| 285 | return $text; |
||
| 286 | } |
||
| 287 | |||
| 288 | return utf8_encode($text); |
||
| 289 | } |
||
| 290 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.