Issues (384)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

index.php (3 issues)

1
<?php declare(strict_types=1);
2
/*
3
 * You may not change or alter any portion of this comment or credits
4
 * of supporting developers from this source code or any supporting source code
5
 * which is considered copyrighted (c) material of the original comment or credit authors.
6
 *
7
 * This program is distributed in the hope that it will be useful,
8
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
10
 */
11
12
/**
13
 * @copyright      {@link https://xoops.org/ XOOPS Project}
14
 * @license        {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later}
15
 * @author         XOOPS Development Team
16
 */
17
18
/**
19
 * Module's index
20
 *
21
 * This page displays a list of the published articles and can also display the
22
 * stories of a particular topic.
23
 *
24
 * @author                Xoops Modules Dev Team
25
 * @copyright (c)         XOOPS Project (https://xoops.org)
26
 *
27
 * Parameters received by this page :
28
 * @page_param            int        storytopic                    Topic's ID
29
 * @page_param            int        topic_id                    Topic's ID
30
 * @page_param            int        storynum                    Number of news per page
31
 * @page_param            int        start                        First news to display
32
 *
33
 * @page_title            Topic's title - Story's title - Module's name
34
 *
35
 * @template_name         news_index.html or news_by_topic.html
36
 *
37
 * Template's variables :
38
 * For each article
39
 * @template_var          int        id            story's ID
40
 * @template_var          string    poster        Complete link to the author's profile
41
 * @template_var          string    author_name    Author's name according to the module's option called displayname
42
 * @template_var          int        author_uid    Author's ID
43
 * @template_var          float    rating        New's rating
44
 * @template_var          int        votes        number of votes
45
 * @template_var          int        posttimestamp Timestamp representing the published date
46
 * @template_var          string    posttime        Formated published date
47
 * @template_var          string    text        The introduction's text
48
 * @template_var          string    morelink    The link to read the full article (points to article.php)
49
 * @template_var          string    adminlink    Link reserved to the admin to edit and delete the news
50
 * @template_var          string    mail_link    Link used to send the story's url by email
51
 * @template_var          string    title        Story's title presented on the form of a link
52
 * @template_var          string    news_title    Just the news title
53
 * @template_var          string    topic_title    Just the topic's title
54
 * @template_var          int        hits        Number of times the article was read
55
 * @template_var          int        files_attached    Number of files attached to this news
56
 * @template_var          string    attached_link    An URL pointing to the attached files
57
 * @template_var          string    topic_color    The topic's color
58
 * @template_var          int        columnwidth    column's width
59
 * @template_var          int        displaynav    To know if we must display the navigation's box
60
 * @template_var          string    lang_go        fixed text : Go!
61
 * @template_var          string    lang_morereleases    fixed text : More releases in
62
 * @template_var          string    lang_on        fixed text : on
63
 * @template_var          string    lang_postedby    fixed text : Posted by
64
 * @template_var          string    lang_printerpage    fixed text : Printer Friendly Page
65
 * @template_var          string    lang_ratethisnews    fixed text : Rate this News
66
 * @template_var          string    lang_ratingc    fixed text : Rating:
67
 * @template_var          string    lang_reads        fixed text : reads
68
 * @template_var          string    lang_sendstory    fixed text : Send this Story to a Friend
69
 * @template_var          string     topic_select    contains the topics selector
70
 */
71
72
use Xmf\Module\Admin;
73
use Xmf\Request;
0 ignored issues
show
This use statement conflicts with another class in this namespace, Request. Consider defining an alias.

Let?s assume that you have a directory layout like this:

.
|-- OtherDir
|   |-- Bar.php
|   `-- Foo.php
`-- SomeDir
    `-- Foo.php

and let?s assume the following content of Bar.php:

// Bar.php
namespace OtherDir;

use SomeDir\Foo; // This now conflicts the class OtherDir\Foo

If both files OtherDir/Foo.php and SomeDir/Foo.php are loaded in the same runtime, you will see a PHP error such as the following:

PHP Fatal error:  Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php

However, as OtherDir/Foo.php does not necessarily have to be loaded and the error is only triggered if it is loaded before OtherDir/Bar.php, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias:

// Bar.php
namespace OtherDir;

use SomeDir\Foo as SomeDirFoo; // There is no conflict anymore.
Loading history...
74
use XoopsModules\News\{
75
    Files,
76
    Helper,
77
    NewsStory,
78
    NewsTopic,
79
    ObjectTree,
80
    PageNav,
81
    Utility,
82
    XoopsTree
83
};
84
85
require \dirname(__DIR__, 2) . '/mainfile.php';
86
87
/** @var Helper $helper */
88
$helper = Helper::getInstance();
89
90
//$XOOPS_URL = XOOPS_URL;
91
//$u=$XOOPS_URL.'/uploads/news_xml.php';
92
//  $x = file_get_contents($u);
93
94
//require_once XOOPS_ROOT_PATH . '/modules/news/class/class.newsstory.php';
95
//require_once XOOPS_ROOT_PATH . '/modules/news/class/class.sfiles.php';
96
//require_once XOOPS_ROOT_PATH . '/modules/news/class/class.newstopic.php';
97
//;
98
//require_once XOOPS_ROOT_PATH . '/modules/news/class/tree.php';
99
100
$moduleDirName = basename(__DIR__);
101
xoops_load('utility', $moduleDirName);
102
$module = \XoopsModule::getByDirname($moduleDirName);
103
104
$storytopic = 0;
105
if (Request::hasVar('storytopic', 'GET')) {
106
    $storytopic = Request::getInt('storytopic', 0, 'GET');
107
} elseif (Request::hasVar('topic_id', 'GET')) {
108
    $storytopic = Request::getInt('topic_id', 0, 'GET');
109
}
110
111
if ($storytopic) {
112
    $groups = is_object($xoopsUser) ? $xoopsUser->getGroups() : XOOPS_GROUP_ANONYMOUS;
113
    /** @var \XoopsGroupPermHandler $grouppermHandler */
114
    $grouppermHandler = xoops_getHandler('groupperm');
115
    if (!$grouppermHandler->checkRight('news_view', $storytopic, $groups, $xoopsModule->getVar('mid'))) {
116
        redirect_header(XOOPS_URL . '/modules/news/index.php', 3, _NOPERM);
117
    }
118
    $xoopsOption['storytopic'] = $storytopic;
119
} else {
120
    $xoopsOption['storytopic'] = 0;
121
}
122
if (Request::hasVar('storynum', 'GET')) {
123
    $xoopsOption['storynum'] = Request::getInt('storynum', 0, 'GET');
124
    if ($xoopsOption['storynum'] > 30) {
125
        $xoopsOption['storynum'] = $helper->getConfig('storyhome');
126
    }
127
} else {
128
    $xoopsOption['storynum'] = $helper->getConfig('storyhome');
129
}
130
131
if (Request::hasVar('start', 'GET')) {
132
    $start = Request::getInt('start', 0, 'GET');
133
} else {
134
    $start = 0;
135
}
136
137
if (empty($helper->getConfig('newsdisplay')) || 'Classic' === $helper->getConfig('newsdisplay')
138
    || $xoopsOption['storytopic'] > 0) {
139
    $showclassic = 1;
140
} else {
141
    $showclassic = 0;
142
}
143
$firsttitle = '';
144
$topictitle = '';
145
$myts       = \MyTextSanitizer::getInstance();
146
$sfiles     = new Files();
147
148
$column_count = $helper->getConfig('columnmode');
149
150
if ($showclassic) {
151
    $GLOBALS['xoopsOption']['template_main'] = 'news_index.tpl';
152
    require_once XOOPS_ROOT_PATH . '/header.php';
153
    $xt = new NewsTopic();
154
155
    $xoopsTpl->assign('columnwidth', (int)(1 / $column_count * 100));
156
    if ($helper->getConfig('ratenews')) {
157
        $xoopsTpl->assign('rates', true);
158
        $xoopsTpl->assign('lang_ratingc', _NW_RATINGC);
159
        $xoopsTpl->assign('lang_ratethisnews', _NW_RATETHISNEWS);
160
    } else {
161
        $xoopsTpl->assign('rates', false);
162
    }
163
164
    if ($xoopsOption['storytopic']) {
165
        $xt->getTopic($xoopsOption['storytopic']);
166
        $xoopsTpl->assign('topic_description', $xt->topic_description('S'));
167
        $xoopsTpl->assign('topic_color', '#' . $xt->topic_color('S'));
168
        $topictitle = $xt->topic_title();
169
    }
170
171
    if (1 == $helper->getConfig('displaynav')) {
172
        $xoopsTpl->assign('displaynav', true);
173
174
        $allTopics  = $xt->getAllTopics($helper->getConfig('restrictindex'));
175
        $topic_tree = new ObjectTree($allTopics, 'topic_id', 'topic_pid');
176
177
        if (Utility::checkVerXoops($GLOBALS['xoopsModule'], '2.5.9')) {
178
            $topic_select = $topic_tree->makeSelectElement('storytopic', 'topic_title', '--', $xoopsOption['storytopic'], true, 0, '', '');
179
            $xoopsTpl->assign('topic_select', $topic_select->render());
180
        } else {
181
            $topic_select = $topic_tree->makeSelBox('storytopic', 'topic_title', '-- ', $xoopsOption['storytopic'], true);
0 ignored issues
show
Deprecated Code introduced by
The function XoopsModules\News\ObjectTree::makeSelBox() has been deprecated: since 2.5.9, please use makeSelectElement() ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-deprecated  annotation

181
            $topic_select = /** @scrutinizer ignore-deprecated */ $topic_tree->makeSelBox('storytopic', 'topic_title', '-- ', $xoopsOption['storytopic'], true);

This function has been deprecated. The supplier of the function has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.

Loading history...
182
            $xoopsTpl->assign('topic_select', $topic_select);
183
        }
184
185
        $storynum_options = '';
186
        for ($i = 5; $i <= 30; $i += 5) {
187
            $sel = '';
188
            if ($i == $xoopsOption['storynum']) {
189
                $sel = ' selected';
190
            }
191
            $storynum_options .= '<option value="' . $i . '"' . $sel . '>' . $i . '</option>';
192
        }
193
        $xoopsTpl->assign('storynum_options', $storynum_options);
194
    } else {
195
        $xoopsTpl->assign('displaynav', false);
196
    }
197
    if (0 == $xoopsOption['storytopic']) {
198
        $topic_frontpage = true;
199
    } else {
200
        $topic_frontpage = false;
201
    }
202
    $sarray = NewsStory::getAllPublished($xoopsOption['storynum'], $start, $helper->getConfig('restrictindex'), $xoopsOption['storytopic'], 0, true, 'published', $topic_frontpage);
203
204
    $scount = count($sarray);
0 ignored issues
show
It seems like $sarray can also be of type null; however, parameter $value of count() does only seem to accept Countable|array, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

204
    $scount = count(/** @scrutinizer ignore-type */ $sarray);
Loading history...
205
    $xoopsTpl->assign('story_count', $scount);
206
    $k       = 0;
207
    $columns = [];
208
    if ($scount > 0) {
209
        $storieslist = [];
210
        foreach ($sarray as $storyid => $thisstory) {
211
            $storieslist[] = $thisstory->storyid();
212
        }
213
        $filesperstory = $sfiles->getCountbyStories($storieslist);
214
215
        if (!empty($sarray)) {
216
            foreach ($sarray as $storyid => $thisstory) {
217
                $filescount = array_key_exists($thisstory->storyid(), $filesperstory) ? $filesperstory[$thisstory->storyid()] : 0;
218
                $story      = $thisstory->prepare2show($filescount);
219
                // The line below can be used to display a Permanent Link image
220
                // $story['title'] .= "&nbsp;&nbsp;<a href='".XOOPS_URL."/modules/news/article.php?storyid=".$sarray[$i]->storyid()."'><img src='".XOOPS_URL."/modules/news/assets/images/x.gif' alt='Permanent Link'></a>";
221
                $story['news_title']  = $story['title'];
222
                $story['title']       = $thisstory->textlink() . '&nbsp;:&nbsp;' . $story['title'];
223
                $story['topic_title'] = $thisstory->textlink();
224
                $story['topic_img'] = $thisstory->imglink();
225
                $story['topic_color'] = '#' . $myts->displayTarea($thisstory->topic_color);
226
                if ('' === $firsttitle) {
227
                    $firsttitle = $thisstory->topic_title() . ' - ' . $thisstory->title();
228
                }
229
                $columns[$k][] = $story;
230
                ++$k;
231
                if ($k == $column_count) {
232
                    $k = 0;
233
                }
234
            }
235
        }
236
    }
237
    $xoopsTpl->assign('columns', $columns);
238
    unset($story);
239
240
    // orwah show topictitle in news_item.tpl
241
    if (1 == Utility::getModuleOption('displaytopictitle')) {
242
        $xoopsTpl->assign('displaytopictitle', true);
243
    } else {
244
        $xoopsTpl->assign('displaytopictitle', false);
245
    }
246
247
    $totalcount = NewsStory::countPublishedByTopic($xoopsOption['storytopic'], $helper->getConfig('restrictindex'));
248
    if ($totalcount > $scount) {
249
//        require_once XOOPS_ROOT_PATH . '/class/pagenav.php';
250
        $pagenav = new PageNav($totalcount, $xoopsOption['storynum'], $start, 'start', 'storytopic=' . $xoopsOption['storytopic']);
251
        if (Utility::isBot()) { // A bot is reading the news, we are going to show it all the links so that it can read everything
252
            $xoopsTpl->assign('pagenav', $pagenav->renderNav($totalcount));
253
        } else {
254
            $xoopsTpl->assign('pagenav', $pagenav->renderNav());
255
        }
256
    } else {
257
        $xoopsTpl->assign('pagenav', '');
258
    }
259
} else { // Affichage par sujets
260
    $GLOBALS['xoopsOption']['template_main'] = 'news_by_topic.tpl';
261
    require_once XOOPS_ROOT_PATH . '/header.php';
262
    $xoopsTpl->assign('columnwidth', (int)(1 / $column_count * 100));
263
    if ($helper->getConfig('ratenews')) {
264
        $xoopsTpl->assign('rates', true);
265
        $xoopsTpl->assign('lang_ratingc', _NW_RATINGC);
266
        $xoopsTpl->assign('lang_ratethisnews', _NW_RATETHISNEWS);
267
    } else {
268
        $xoopsTpl->assign('rates', false);
269
    }
270
271
    $xt            = new NewsTopic();
272
    $alltopics     = $xt->getTopicsList(true, $helper->getConfig('restrictindex'));
273
    $smarty_topics = [];
274
    $topicstories  = [];
275
276
    foreach ($alltopics as $topicid => $topic) {
277
        $allstories  = NewsStory::getAllPublished($helper->getConfig('storyhome'), 0, $helper->getConfig('restrictindex'), $topicid);
278
        $storieslist = [];
279
        foreach ($allstories as $thisstory) {
280
            $storieslist[] = $thisstory->storyid();
281
        }
282
        $filesperstory = $sfiles->getCountbyStories($storieslist);
283
        foreach ($allstories as $thisstory) {
284
            $filescount               = array_key_exists($thisstory->storyid(), $filesperstory) ? $filesperstory[$thisstory->storyid()] : 0;
285
            $story                    = $thisstory->prepare2show($filescount);
286
            $story['topic_title']     = $thisstory->textlink();
287
            $story['news_title']      = $story['title'];
288
            $topicstories[$topicid][] = $story;
289
        }
290
        if (isset($topicstories[$topicid])) {
291
            $smarty_topics[$topicstories[$topicid][0]['posttimestamp']] = [
292
                'title'       => $topic['title'],
293
                'stories'     => $topicstories[$topicid],
294
                'id'          => $topicid,
295
                'topic_color' => $topic['color'],
296
            ];
297
        }
298
    }
299
300
    krsort($smarty_topics);
301
    $columns = [];
302
    $i       = 0;
303
    foreach ($smarty_topics as $thistopictimestamp => $thistopic) {
304
        $columns[$i][] = $thistopic;
305
        ++$i;
306
        if ($i == $column_count) {
307
            $i = 0;
308
        }
309
    }
310
    //$xoopsTpl->assign('topics', $smarty_topics);
311
    $xoopsTpl->assign('columns', $columns);
312
}
313
314
$xoopsTpl->assign('advertisement', Utility::getModuleOption('advertisement'));
315
316
/**
317
 * Create the Meta Datas
318
 */
319
Utility::createMetaDatas();
320
321
/**
322
 * Create a clickable path from the root to the current topic (if we are viewing a topic)
323
 * Actually this is not used in the default templates but you can use it as you want
324
 * You can comment the code to optimize the requests count
325
 */
326
if ($xoopsOption['storytopic']) {
327
    // require_once XOOPS_ROOT_PATH . '/modules/news/class/xoopstree.php';
328
    $mytree    = new XoopsTree($xoopsDB->prefix('news_topics'), 'topic_id', 'topic_pid');
329
    $topicpath = $mytree->getNicePathFromId($xoopsOption['storytopic'], 'topic_title', 'index.php?op=1');
330
    $xoopsTpl->assign('topic_path', $topicpath);
331
    unset($mytree);
332
}
333
334
/**
335
 * Create a link for the RSS feed (if the module's option is activated)
336
 */
337
/** @var \XoopsModuleHandler $moduleHandler */
338
$moduleHandler = xoops_getHandler('module');
339
$moduleInfo    = $moduleHandler->get($GLOBALS['xoopsModule']->getVar('mid'));
340
if ($helper->getConfig('topicsrss') && $xoopsOption['storytopic']) {
341
    $link = sprintf("<a href='%s' title='%s'><img src='%s' border='0' alt='%s'></a>", XOOPS_URL . '/modules/news/backendt.php?topicid=' . $xoopsOption['storytopic'], _NW_RSSFEED, Admin::iconUrl('', '16') . '/rss.gif', _NW_RSSFEED);
342
    $xoopsTpl->assign('topic_rssfeed_link', $link);
343
}
344
345
/**
346
 * Assign page's title
347
 */
348
if ('' !== $firsttitle) {
349
    $xoopsTpl->assign('xoops_pagetitle', $firsttitle . ' - ' . $xoopsModule->name('s'));
350
} elseif ('' !== $topictitle) {
351
    $xoopsTpl->assign('xoops_pagetitle', $topictitle);
352
} else {
353
    $xoopsTpl->assign('xoops_pagetitle', $xoopsModule->name('s'));
354
}
355
356
$xoopsTpl->assign('lang_go', _GO);
357
$xoopsTpl->assign('lang_on', _ON);
358
$xoopsTpl->assign('lang_printerpage', _NW_PRINTERFRIENDLY);
359
$xoopsTpl->assign('lang_sendstory', _NW_SENDSTORY);
360
$xoopsTpl->assign('lang_postedby', _POSTEDBY);
361
$xoopsTpl->assign('lang_reads', _READS);
362
$xoopsTpl->assign('lang_morereleases', _NW_MORERELEASES);
363
require_once XOOPS_ROOT_PATH . '/footer.php';
364