XoopsModules25x /
mylinks
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | // $Id: submit.php 11819 2013-07-09 18:21:40Z zyspec $ |
||
| 3 | // ------------------------------------------------------------------------ // |
||
| 4 | // XOOPS - PHP Content Management System // |
||
| 5 | // Copyright (c) 2000 XOOPS.org // |
||
| 6 | // <http://www.xoops.org/> // |
||
| 7 | // ------------------------------------------------------------------------- // |
||
| 8 | // This program is free software; you can redistribute it and/or modify // |
||
| 9 | // it under the terms of the GNU General Public License as published by // |
||
| 10 | // the Free Software Foundation; either version 2 of the License, or // |
||
| 11 | // (at your option) any later version. // |
||
| 12 | // // |
||
| 13 | // You may not change or alter any portion of this comment or credits // |
||
| 14 | // of supporting developers from this source code or any supporting // |
||
| 15 | // source code which is considered copyrighted (c) material of the // |
||
| 16 | // original comment or credit authors. // |
||
| 17 | // // |
||
| 18 | // This program is distributed in the hope that it will be useful, // |
||
| 19 | // but WITHOUT ANY WARRANTY; without even the implied warranty of // |
||
| 20 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // |
||
| 21 | // GNU General Public License for more details. // |
||
| 22 | // // |
||
| 23 | // You should have received a copy of the GNU General Public License // |
||
| 24 | // along with this program; if not, write to the Free Software // |
||
| 25 | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA // |
||
| 26 | // ------------------------------------------------------------------------ // |
||
| 27 | include __DIR__ . '/header.php'; |
||
| 28 | $myts = MyTextSanitizer::getInstance();// MyTextSanitizer object |
||
| 29 | include_once XOOPS_ROOT_PATH . '/include/xoopscodes.php'; |
||
| 30 | |||
| 31 | include_once __DIR__ . '/class/utility.php'; |
||
| 32 | //xoops_load('utility', $xoopsModule->getVar('dirname')); |
||
| 33 | |||
| 34 | if (empty($xoopsUser) and !$xoopsModuleConfig['anonpost']) { |
||
| 35 | redirect_header(XOOPS_URL . '/user.php', 2, _MD_MYLINKS_MUSTREGFIRST); |
||
| 36 | exit(); |
||
| 37 | } |
||
| 38 | |||
| 39 | if (!empty($_POST['submit'])) { |
||
| 40 | |||
| 41 | // include_once XOOPS_ROOT_PATH . '/class/module.errorhandler.php'; |
||
| 42 | // $eh = new ErrorHandler; //ErrorHandler object |
||
| 43 | $submitter = !empty($xoopsUser) ? $xoopsUser->getVar('uid') : 0; |
||
| 44 | |||
| 45 | $msg = ''; |
||
| 46 | switch (true) { |
||
| 47 | case (empty($_POST['title'])): |
||
| 48 | $msg .= _MD_MYLINKS_ERRORTITLE; |
||
| 49 | case (empty($_POST['url'])): |
||
| 50 | $msg .= _MD_MYLINKS_ERRORURL; |
||
| 51 | case (empty($_POST['message'])): |
||
| 52 | $msg .= _MD_MYLINKS_ERRORDESC; |
||
| 53 | } |
||
| 54 | if ('' !== $msg) { |
||
| 55 | MylinksUtility::show_message($msg); |
||
| 56 | exit(); |
||
| 57 | } |
||
| 58 | |||
| 59 | $title = $myts->addSlashes($_POST['title']); |
||
| 60 | $url = $myts->addSlashes($_POST['url']); |
||
| 61 | $notify = !empty($_POST['notify']) ? 1 : 0; |
||
| 62 | $cid = MylinksUtility::mylinks_cleanVars($_POST, 'cid', 0, 'int', array('min' => 0)); |
||
|
0 ignored issues
–
show
|
|||
| 63 | $description = $myts->addSlashes($_POST['message']); |
||
| 64 | $date = time(); |
||
| 65 | $newid = $xoopsDB->genId($xoopsDB->prefix('mylinks_links') . '_lid_seq'); |
||
| 66 | $mylinksAdmin = (is_object($xoopsUser) && $xoopsUser->isAdmin($xoopsModule->mid())) ? true : false; |
||
| 67 | $status = ((1 == $xoopsModuleConfig['autoapprove']) || $mylinksAdmin) ? 1 : 0; |
||
| 68 | |||
| 69 | $sql = sprintf("INSERT INTO %s (lid, cid, title, url, logourl, submitter, status, date, hits, rating, votes, comments) VALUES (%u, %u, '%s', '%s', '%s', %u, %u, %u, %u, %u, %u, %u)", $xoopsDB->prefix('mylinks_links'), $newid, $cid, $title, $url, ' ', $submitter, $status, $date, 0, 0, 0, 0); |
||
| 70 | $result = $xoopsDB->query($sql); |
||
| 71 | if (!$result) { |
||
| 72 | MylinksUtility::show_message(_MD_MYLINKS_DBNOTUPDATED); |
||
| 73 | exit(); |
||
| 74 | } |
||
| 75 | if (0 == $newid) { |
||
| 76 | $newid = $xoopsDB->getInsertId(); |
||
| 77 | } |
||
| 78 | $sql = sprintf("INSERT INTO %s (lid, description) VALUES (%u, '%s')", $xoopsDB->prefix('mylinks_text'), $newid, $description); |
||
| 79 | $result = $xoopsDB->query($sql); |
||
| 80 | if (!$result) { |
||
| 81 | MylinksUtility::show_message(_MD_MYLINKS_DBNOTUPDATED); |
||
| 82 | exit(); |
||
| 83 | } |
||
| 84 | // Notify of new link (anywhere) and new link in category. |
||
| 85 | $notificationHandler = xoops_getHandler('notification'); |
||
| 86 | $tags = array(); |
||
| 87 | $tags['LINK_NAME'] = $title; |
||
| 88 | $tags['LINK_URL'] = XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/singlelink.php?cid={$cid}&lid={$newid}"; |
||
| 89 | $sql = 'SELECT title FROM ' . $xoopsDB->prefix('mylinks_cat') . " WHERE cid={$cid}"; |
||
| 90 | $result = $xoopsDB->query($sql); |
||
| 91 | $row = $xoopsDB->fetchArray($result); |
||
| 92 | $tags['CATEGORY_NAME'] = $row['title']; |
||
| 93 | $tags['CATEGORY_URL'] = XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . "/viewcat.php?cid={$cid}"; |
||
| 94 | if (1 == $xoopsModuleConfig['autoapprove']) { |
||
| 95 | $notificationHandler->triggerEvent('global', 0, 'new_link', $tags); |
||
| 96 | $notificationHandler->triggerEvent('category', $cid, 'new_link', $tags); |
||
| 97 | redirect_header('index.php', 2, _MD_MYLINKS_RECEIVED . '<br>' . _MD_MYLINKS_ISAPPROVED . ''); |
||
| 98 | } else { |
||
| 99 | $tags['WAITINGLINKS_URL'] = XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . '/admin/index.php?op=listNewLinks'; |
||
| 100 | $notificationHandler->triggerEvent('global', 0, 'link_submit', $tags); |
||
| 101 | $notificationHandler->triggerEvent('category', $cid, 'link_submit', $tags); |
||
| 102 | if ($notify) { |
||
| 103 | include_once XOOPS_ROOT_PATH . '/include/notification_constants.php'; |
||
| 104 | $notificationHandler->subscribe('link', $newid, 'approve', XOOPS_NOTIFICATION_MODE_SENDONCETHENDELETE); |
||
| 105 | } |
||
| 106 | redirect_header('index.php', 2, _MD_MYLINKS_RECEIVED); |
||
| 107 | } |
||
| 108 | exit(); |
||
| 109 | } else { |
||
| 110 | include_once XOOPS_ROOT_PATH . '/class/tree.php'; |
||
| 111 | $mylinksCatHandler = xoops_getModuleHandler('category', $xoopsModule->getVar('dirname')); |
||
| 112 | $catObjs = $mylinksCatHandler->getAll(); |
||
| 113 | $myCatTree = new XoopsObjectTree($catObjs, 'cid', 'pid'); |
||
| 114 | |||
| 115 | $xoopsOption['template_main'] = 'mylinks_submit.tpl'; |
||
| 116 | include XOOPS_ROOT_PATH . '/header.php'; |
||
| 117 | //wanikoo |
||
| 118 | $xoTheme->addStylesheet('browse.php?' . mylinksGetStylePath('mylinks.css', 'include')); |
||
| 119 | $xoTheme->addScript('browse.php?Frameworks/jquery/jquery.js'); |
||
| 120 | $xoTheme->addScript('browse.php?' . mylinksGetStylePath('mylinks.js', 'include')); |
||
| 121 | // |
||
| 122 | ob_start(); |
||
| 123 | xoopsCodeTarea('message', 37, 8); |
||
| 124 | $xoopsTpl->assign('xoops_codes', ob_get_contents()); |
||
| 125 | ob_end_clean(); |
||
| 126 | ob_start(); |
||
| 127 | xoopsSmilies('message'); |
||
| 128 | $xoopsTpl->assign('xoops_smilies', ob_get_contents()); |
||
| 129 | ob_end_clean(); |
||
| 130 | $notify_show = (!empty($xoopsUser) && !$xoopsModuleConfig['autoapprove']) ? 1 : 0; |
||
| 131 | $xoopsTpl->assign('notify_show', $notify_show); |
||
| 132 | $xoopsTpl->assign('lang_submitonce', _MD_MYLINKS_SUBMITONCE); |
||
| 133 | $xoopsTpl->assign('lang_submitlinkh', _MD_MYLINKS_SUBMITLINKHEAD); |
||
| 134 | $xoopsTpl->assign('lang_allpending', _MD_MYLINKS_ALLPENDING); |
||
| 135 | $xoopsTpl->assign('lang_dontabuse', _MD_MYLINKS_DONTABUSE); |
||
| 136 | $xoopsTpl->assign('lang_wetakeshot', _MD_MYLINKS_TAKESHOT); |
||
| 137 | $xoopsTpl->assign('lang_sitetitle', _MD_MYLINKS_SITETITLE); |
||
| 138 | $xoopsTpl->assign('lang_siteurl', _MD_MYLINKS_SITEURL); |
||
| 139 | $xoopsTpl->assign('lang_category', _MD_MYLINKS_CATEGORYC); |
||
| 140 | $xoopsTpl->assign('lang_options', _MD_MYLINKS_OPTIONS); |
||
| 141 | $xoopsTpl->assign('lang_notify', _MD_MYLINKS_NOTIFYAPPROVE); |
||
| 142 | $xoopsTpl->assign('lang_description', _MD_MYLINKS_DESCRIPTIONC); |
||
| 143 | $xoopsTpl->assign('lang_submit', _SUBMIT); |
||
| 144 | $xoopsTpl->assign('lang_cancel', _CANCEL); |
||
| 145 | $xoopsTpl->assign('category_selbox', $myCatTree->makeSelBox('cid', 'title', '-', 0, false)); |
||
| 146 | |||
| 147 | //wanikoo theme changer |
||
| 148 | $xoopsTpl->assign('lang_themechanger', _MD_MYLINKS_THEMECHANGER); |
||
| 149 | $mymylinkstheme_options = ''; |
||
| 150 | |||
| 151 | View Code Duplication | foreach ($GLOBALS['mylinks_allowed_theme'] as $mymylinkstheme) { |
|
| 152 | $mymylinkstheme_options .= "<option value='{$mymylinkstheme}'"; |
||
| 153 | if ($mymylinkstheme == $GLOBALS['mylinks_theme']) { |
||
| 154 | $mymylinkstheme_options .= " selected='selected'"; |
||
| 155 | } |
||
| 156 | $mymylinkstheme_options .= ">{$mymylinkstheme}</option>"; |
||
| 157 | } |
||
| 158 | |||
| 159 | $mylinkstheme_select = "<select name='mylinks_theme_select' onchange='submit();' size='1'>{$mymylinkstheme_options}</select>"; |
||
| 160 | |||
| 161 | $xoopsTpl->assign('mylinksthemeoption', $mylinkstheme_select); |
||
| 162 | |||
| 163 | //wanikoo search |
||
| 164 | View Code Duplication | if (file_exists(XOOPS_ROOT_PATH . '/language/' . $xoopsConfig['language'] . '/search.php')) { |
|
| 165 | include_once XOOPS_ROOT_PATH . '/language/' . $xoopsConfig['language'] . '/search.php'; |
||
| 166 | } else { |
||
| 167 | include_once XOOPS_ROOT_PATH . '/language/english/search.php'; |
||
| 168 | } |
||
| 169 | $xoopsTpl->assign('lang_all', _SR_ALL); |
||
| 170 | $xoopsTpl->assign('lang_any', _SR_ANY); |
||
| 171 | $xoopsTpl->assign('lang_exact', _SR_EXACT); |
||
| 172 | $xoopsTpl->assign('lang_search', _SR_SEARCH); |
||
| 173 | $xoopsTpl->assign('module_id', $xoopsModule->getVar('mid')); |
||
| 174 | //category head |
||
| 175 | $catarray = array(); |
||
| 176 | if ($mylinks_show_letters) { |
||
| 177 | $catarray['letters'] = ml_wfd_letters(); |
||
| 178 | } |
||
| 179 | if ($mylinks_show_toolbar) { |
||
| 180 | $catarray['toolbar'] = ml_wfd_toolbar(); |
||
| 181 | } |
||
| 182 | $xoopsTpl->assign('catarray', $catarray); |
||
| 183 | |||
| 184 | include_once XOOPSMYLINKPATH . '/footer.php'; |
||
| 185 | } |
||
| 186 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: