Issues (384)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/XoopsStory.php (15 issues)

1
<?php declare(strict_types=1);
2
3
namespace XoopsModules\News;
4
5
use MyTextSanitizer;
6
use XoopsDatabaseFactory;
7
use XoopsUser;
8
9
/**
10
 * XOOPS news story
11
 *
12
 * You may not change or alter any portion of this comment or credits
13
 * of supporting developers from this source code or any supporting source code
14
 * which is considered copyrighted (c) material of the original comment or credit authors.
15
 * This program is distributed in the hope that it will be useful,
16
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
18
 *
19
 * @copyright       XOOPS Project (https://xoops.org)
20
 * @license         GNU GPL 2 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
21
 * @since           2.0.0
22
 * @author          Kazumi Ono (AKA onokazu) http://www.myweb.ne.jp/, http://jp.xoops.org/
23
 * @deprecated
24
 */
25
26
//$GLOBALS['xoopsLogger']->addDeprecated("'/class/xoopsstory.php' is deprecated since XOOPS 2.5.4, please create your own class instead.");
27
// require_once XOOPS_ROOT_PATH . '/modules/news/class/xoopstopic.php';
28
require_once XOOPS_ROOT_PATH . '/kernel/user.php';
29
30
/**
31
 * Class XoopsStory
32
 */
33
class XoopsStory
34
{
35
    public $table;
36
    public $storyid;
37
    public $topicid;
38
    public $uid;
39
    public $title;
40
    public $hometext;
41
    public $bodytext  = '';
42
    public $counter;
43
    public $created;
44
    public $published;
45
    public $expired;
46
    public $hostname;
47
    public $nohtml    = 0;
48
    public $nosmiley  = 0;
49
    public $ihome     = 0;
50
    public $notifypub = 0;
51
    public $type;
52
    public $approved;
53
    public $topicdisplay;
54
    public $topicalign;
55
    public $db;
56
    public $topicstable;
57
    public $comments;
58
59
    public $img_name;
60
    public $menu;
61
    public $story_type;
62
    public $topic_color;
63
    public $topic_frontpage;
64
    public $topic_id;
65
    public $topic_pid;
66
    public $topic_rssurl;
67
68
69
    /**
70
     * @param $storyid
71
     */
72
    public function Story($storyid = -1): void
73
    {
74
        /** @var \XoopsMySQLDatabase $this ->db */
75
        $this->db          = XoopsDatabaseFactory::getDatabaseConnection();
0 ignored issues
show
The property db does not seem to exist on XoopsMySQLDatabase.
Loading history...
76
        $this->table       = '';
0 ignored issues
show
The property table does not seem to exist on XoopsMySQLDatabase.
Loading history...
77
        $this->topicstable = '';
0 ignored issues
show
The property topicstable does not seem to exist on XoopsMySQLDatabase.
Loading history...
78
        if (\is_array($storyid)) {
79
            $this->makeStory($storyid);
0 ignored issues
show
The method makeStory() does not exist on XoopsMySQLDatabase. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

79
            $this->/** @scrutinizer ignore-call */ 
80
                   makeStory($storyid);

This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.

This is most likely a typographical error or the method has been renamed.

Loading history...
80
        } elseif (-1 != $storyid) {
81
            $this->getStory((int)$storyid);
0 ignored issues
show
The method getStory() does not exist on XoopsMySQLDatabase. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

81
            $this->/** @scrutinizer ignore-call */ 
82
                   getStory((int)$storyid);

This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.

This is most likely a typographical error or the method has been renamed.

Loading history...
82
        }
83
    }
84
85
    /**
86
     * @param $value
87
     */
88
    public function setStoryId($value): void
89
    {
90
        $this->storyid = (int)$value;
91
    }
92
93
    /**
94
     * @param $value
95
     */
96
    public function setTopicId($value): void
97
    {
98
        $this->topicid = (int)$value;
99
    }
100
101
    /**
102
     * @param $value
103
     */
104
    public function setUid($value): void
105
    {
106
        $this->uid = (int)$value;
107
    }
108
109
    /**
110
     * @param $value
111
     */
112
    public function setTitle($value): void
113
    {
114
        $this->title = $value;
115
    }
116
117
    /**
118
     * @param $value
119
     */
120
    public function setHometext($value): void
121
    {
122
        $this->hometext = $value;
123
    }
124
125
    /**
126
     * @param $value
127
     */
128
    public function setBodytext($value): void
129
    {
130
        $this->bodytext = $value;
131
    }
132
133
    /**
134
     * @param $value
135
     */
136
    public function setPublished($value): void
137
    {
138
        $this->published = (int)$value;
139
    }
140
141
    /**
142
     * @param $value
143
     */
144
    public function setExpired($value): void
145
    {
146
        $this->expired = (int)$value;
147
    }
148
149
    /**
150
     * @param $value
151
     */
152
    public function setHostname($value): void
153
    {
154
        $this->hostname = $value;
155
    }
156
157
    /**
158
     * @param int $value
159
     */
160
    public function setNohtml($value = 0): void
161
    {
162
        $this->nohtml = $value;
163
    }
164
165
    /**
166
     * @param int $value
167
     */
168
    public function setNosmiley($value = 0): void
169
    {
170
        $this->nosmiley = $value;
171
    }
172
173
    /**
174
     * @param $value
175
     */
176
    public function setIhome($value): void
177
    {
178
        $this->ihome = $value;
179
    }
180
181
    /**
182
     * @param $value
183
     */
184
    public function setNotifyPub($value): void
185
    {
186
        $this->notifypub = $value;
187
    }
188
189
    /**
190
     * @param $value
191
     */
192
    public function setType($value): void
193
    {
194
        $this->type = $value;
195
    }
196
197
    /**
198
     * @param $value
199
     */
200
    public function setApproved($value): void
201
    {
202
        $this->approved = (int)$value;
203
    }
204
205
    /**
206
     * @param $value
207
     */
208
    public function setTopicdisplay($value): void
209
    {
210
        $this->topicdisplay = $value;
211
    }
212
213
    /**
214
     * @param $value
215
     */
216
    public function setTopicalign($value): void
217
    {
218
        $this->topicalign = $value;
219
    }
220
221
    /**
222
     * @param $value
223
     */
224
    public function setComments($value): void
225
    {
226
        $this->comments = (int)$value;
227
    }
228
229
    /**
230
     * @param bool $approved
231
     *
232
     * @return bool
233
     */
234
    public function store($approved = false)
0 ignored issues
show
The parameter $approved is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

234
    public function store(/** @scrutinizer ignore-unused */ $approved = false)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
235
    {
236
        //$newpost = 0;
237
        $myts     = MyTextSanitizer::getInstance();
238
        $title    = $myts->censorString($this->title);
239
        $hometext = $myts->censorString($this->hometext);
240
        $bodytext = $myts->censorString($this->bodytext);
241
        $title    = $GLOBALS['xoopsDB']->escape($title);
242
        $hometext = $GLOBALS['xoopsDB']->escape($hometext);
243
        $bodytext = $GLOBALS['xoopsDB']->escape($bodytext);
244
        if (!isset($this->nohtml) || 1 != $this->nohtml) {
245
            $this->nohtml = 0;
246
        }
247
        if (!isset($this->nosmiley) || 1 != $this->nosmiley) {
248
            $this->nosmiley = 0;
249
        }
250
        if (!isset($this->notifypub) || 1 != $this->notifypub) {
251
            $this->notifypub = 0;
252
        }
253
        if (!isset($this->topicdisplay) || 0 != $this->topicdisplay) {
254
            $this->topicdisplay = 1;
255
        }
256
        $expired = !empty($this->expired) ? $this->expired : 0;
257
        if (!isset($this->storyid)) {
258
            //$newpost = 1;
259
            $newstoryid = $this->db->genId($this->table . '_storyid_seq');
260
            $created    = \time();
261
            $published  = $this->approved ? $this->published : 0;
262
263
            $sql = \sprintf(
264
                "INSERT INTO `%s` (storyid, uid, title, created, published, expired, hostname, nohtml, nosmiley, hometext, bodytext, counter, topicid, ihome, notifypub, story_type, topicdisplay, topicalign, comments) VALUES (%u, %u, '%s', %u, %u, %u, '%s', %u, %u, '%s', '%s', %u, %u, %u, %u, '%s', %u, '%s', %u)",
265
                $this->table,
266
                $newstoryid,
267
                $this->uid,
268
                $title,
269
                $created,
270
                $published,
271
                $expired,
272
                $this->hostname,
273
                $this->nohtml,
274
                $this->nosmiley,
275
                $hometext,
276
                $bodytext,
277
                0,
278
                $this->topicid,
279
                $this->ihome,
280
                $this->notifypub,
281
                $this->type,
282
                $this->topicdisplay,
283
                $this->topicalign,
284
                $this->comments
285
            );
286
        } else {
287
            if ($this->approved) {
288
                $sql = \sprintf(
289
                    "UPDATE `%s` SET title = '%s', published = %u, expired = %u, nohtml = %u, nosmiley = %u, hometext = '%s', bodytext = '%s', topicid = %u, ihome = %u, topicdisplay = %u, topicalign = '%s', comments = %u WHERE storyid = %u",
290
                    $this->table,
291
                    $title,
292
                    $this->published,
293
                    $expired,
294
                    $this->nohtml,
295
                    $this->nosmiley,
296
                    $hometext,
297
                    $bodytext,
298
                    $this->topicid,
299
                    $this->ihome,
300
                    $this->topicdisplay,
301
                    $this->topicalign,
302
                    $this->comments,
303
                    $this->storyid
304
                );
305
            } else {
306
                $sql = \sprintf(
307
                    "UPDATE `%s` SET title = '%s', expired = %u, nohtml = %u, nosmiley = %u, hometext = '%s', bodytext = '%s', topicid = %u, ihome = %u, topicdisplay = %u, topicalign = '%s', comments = %u WHERE storyid = %u",
308
                    $this->table,
309
                    $title,
310
                    $expired,
311
                    $this->nohtml,
312
                    $this->nosmiley,
313
                    $hometext,
314
                    $bodytext,
315
                    $this->topicid,
316
                    $this->ihome,
317
                    $this->topicdisplay,
318
                    $this->topicalign,
319
                    $this->comments,
320
                    $this->storyid
321
                );
322
            }
323
            $newstoryid = $this->storyid;
324
        }
325
        if (!$result = $this->db->query($sql)) {
0 ignored issues
show
The assignment to $result is dead and can be removed.
Loading history...
326
            return false;
327
        }
328
        if (empty($newstoryid)) {
329
            $newstoryid    = $this->db->getInsertId();
330
            $this->storyid = $newstoryid;
331
        }
332
333
        return $newstoryid;
334
    }
335
336
    /**
337
     * @param $storyid
338
     */
339
    public function getStory($storyid): void
340
    {
341
        $storyid = (int)$storyid;
342
        $sql     = 'SELECT * FROM ' . $this->table . ' WHERE storyid=' . $storyid;
343
        $array   = $this->db->fetchArray($this->db->query($sql));
344
        $this->makeStory($array);
345
    }
346
347
    /**
348
     * @param $array
349
     */
350
    public function makeStory($array): void
351
    {
352
        foreach ($array as $key => $value) {
353
            $this->$key = $value;
354
        }
355
    }
356
357
    /**
358
     * @return bool
359
     */
360
    public function delete()
361
    {
362
        $sql = \sprintf('DELETE FROM `%s` WHERE storyid = %u', $this->table, $this->storyid);
363
        if (!$result = $this->db->query($sql)) {
0 ignored issues
show
The assignment to $result is dead and can be removed.
Loading history...
364
            return false;
365
        }
366
367
        return true;
368
    }
369
370
    /**
371
     * @return bool
372
     */
373
    public function updateCounter()
374
    {
375
        $sql = \sprintf('UPDATE `%s` SET counter = counter+1 WHERE storyid = %u', $this->table, $this->storyid);
376
        if (!$result = $this->db->queryF($sql)) {
0 ignored issues
show
The assignment to $result is dead and can be removed.
Loading history...
377
            return false;
378
        }
379
380
        return true;
381
    }
382
383
    /**
384
     * @param $total
385
     *
386
     * @return bool
387
     */
388
    public function updateComments($total)
389
    {
390
        $sql = \sprintf('UPDATE `%s` SET comments = %u WHERE storyid = %u', $this->table, $total, $this->storyid);
391
        if (!$result = $this->db->queryF($sql)) {
0 ignored issues
show
The assignment to $result is dead and can be removed.
Loading history...
392
            return false;
393
        }
394
395
        return true;
396
    }
397
398
    public function topicid()
399
    {
400
        return $this->topicid;
401
    }
402
403
    /**
404
     * @return \XoopsModules\News\XoopsTopic
405
     */
406
    public function topic()
407
    {
408
        return new XoopsTopic($this->topicstable, $this->topicid);
409
    }
410
411
    public function uid()
412
    {
413
        return $this->uid;
414
    }
415
416
    /**
417
     * @return string
418
     */
419
    public function uname()
420
    {
421
        return XoopsUser::getUnameFromId($this->uid);
422
    }
423
424
    /**
425
     * @param string $format
426
     *
427
     * @return mixed
428
     */
429
    public function title($format = 'Show')
430
    {
431
        $myts   = MyTextSanitizer::getInstance();
0 ignored issues
show
The assignment to $myts is dead and can be removed.
Loading history...
432
        $smiley = 1;
0 ignored issues
show
The assignment to $smiley is dead and can be removed.
Loading history...
433
        if ($this->nosmiley()) {
434
            $smiley = 0;
435
        }
436
        switch ($format) {
437
            case 'Show':
438
            case 'Edit':
439
                $title = \htmlspecialchars($this->title, \ENT_QUOTES | \ENT_HTML5);
440
                break;
441
            case 'Preview':
442
            case 'InForm':
443
                $title = \htmlspecialchars($this->title, \ENT_QUOTES | \ENT_HTML5);
444
                break;
445
        }
446
447
        return $title;
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $title does not seem to be defined for all execution paths leading up to this point.
Loading history...
448
    }
449
450
    /**
451
     * @param string $format
452
     *
453
     * @return string
454
     */
455
    public function hometext($format = 'Show')
456
    {
457
        $myts   = MyTextSanitizer::getInstance();
458
        $html   = 1;
459
        $smiley = 1;
460
        $xcodes = 1;
461
        if ($this->nohtml()) {
462
            $html = 0;
463
        }
464
        if ($this->nosmiley()) {
465
            $smiley = 0;
466
        }
467
        switch ($format) {
468
            case 'Show':
469
                $hometext = $myts->displayTarea($this->hometext, $html, $smiley, $xcodes);
470
                break;
471
            case 'Edit':
472
                $hometext = \htmlspecialchars($this->hometext, \ENT_QUOTES);
473
                break;
474
            case 'Preview':
475
                $hometext = $myts->previewTarea($this->hometext, $html, $smiley, $xcodes);
476
                break;
477
            case 'InForm':
478
                $hometext = \htmlspecialchars($this->hometext, \ENT_QUOTES);
479
                break;
480
        }
481
482
        return $hometext;
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $hometext does not seem to be defined for all execution paths leading up to this point.
Loading history...
483
    }
484
485
    /**
486
     * @param string $format
487
     *
488
     * @return string
489
     */
490
    public function bodytext($format = 'Show')
491
    {
492
        $myts   = MyTextSanitizer::getInstance();
493
        $html   = 1;
494
        $smiley = 1;
495
        $xcodes = 1;
496
        if ($this->nohtml()) {
497
            $html = 0;
498
        }
499
        if ($this->nosmiley()) {
500
            $smiley = 0;
501
        }
502
        switch ($format) {
503
            case 'Show':
504
                $bodytext = $myts->displayTarea($this->bodytext, $html, $smiley, $xcodes);
505
                break;
506
            case 'Edit':
507
                $bodytext = \htmlspecialchars($this->bodytext, \ENT_QUOTES);
508
                break;
509
            case 'Preview':
510
                $bodytext = $myts->previewTarea($this->bodytext, $html, $smiley, $xcodes);
511
                break;
512
            case 'InForm':
513
                $bodytext = \htmlspecialchars($this->bodytext, \ENT_QUOTES);
514
                break;
515
        }
516
517
        return $bodytext;
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $bodytext does not seem to be defined for all execution paths leading up to this point.
Loading history...
518
    }
519
520
    public function counter()
521
    {
522
        return $this->counter;
523
    }
524
525
    public function created()
526
    {
527
        return $this->created;
528
    }
529
530
    public function published()
531
    {
532
        return $this->published;
533
    }
534
535
    public function expired()
536
    {
537
        return $this->expired;
538
    }
539
540
    public function hostname()
541
    {
542
        return $this->hostname;
543
    }
544
545
    public function storyid()
546
    {
547
        return $this->storyid;
548
    }
549
550
    /**
551
     * @return int
552
     */
553
    public function nohtml()
554
    {
555
        return $this->nohtml;
556
    }
557
558
    /**
559
     * @return int
560
     */
561
    public function nosmiley()
562
    {
563
        return $this->nosmiley;
564
    }
565
566
    /**
567
     * @return int
568
     */
569
    public function notifypub()
570
    {
571
        return $this->notifypub;
572
    }
573
574
    public function type()
575
    {
576
        return $this->type;
577
    }
578
579
    /**
580
     * @return int
581
     */
582
    public function ihome()
583
    {
584
        return $this->ihome;
585
    }
586
587
    public function topicdisplay()
588
    {
589
        return $this->topicdisplay;
590
    }
591
592
    /**
593
     * @param bool $astext
594
     *
595
     * @return string
596
     */
597
    public function topicalign($astext = true)
598
    {
599
        if ($astext) {
600
            if ('R' === $this->topicalign) {
601
                $ret = 'right';
602
            } else {
603
                $ret = 'left';
604
            }
605
606
            return $ret;
607
        }
608
609
        return $this->topicalign;
610
    }
611
612
    public function comments()
613
    {
614
        return $this->comments;
615
    }
616
}
617