This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | |||
3 | declare(strict_types=1); |
||
4 | /* |
||
5 | * You may not change or alter any portion of this comment or credits |
||
6 | * of supporting developers from this source code or any supporting source code |
||
7 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
8 | * |
||
9 | * This program is distributed in the hope that it will be useful, |
||
10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
12 | */ |
||
13 | |||
14 | /** |
||
15 | * @copyright XOOPS Project (https://xoops.org) |
||
16 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||
17 | * @package RSSFit - Extendable XML news feed generator |
||
18 | * @author NS Tai (aka tuff) <http://www.brandycoke.com> |
||
19 | * @author XOOPS Development Team |
||
20 | */ |
||
21 | |||
22 | use Xmf\Request; |
||
23 | use XoopsModules\Rssfit\{ |
||
24 | FeedHandler, |
||
25 | PluginHandler, |
||
26 | Utility |
||
27 | }; |
||
28 | |||
29 | /** @var FeedHandler $feedHandler */ |
||
30 | /** @var PluginHandler $pluginHandler */ |
||
31 | |||
32 | if (!preg_match('#/rssfit/admin/#', $_SERVER['SCRIPT_NAME'])) { |
||
33 | redirect_header('index.php'); |
||
34 | } |
||
35 | |||
36 | switch ($op) { |
||
37 | default: |
||
38 | $ret = ''; |
||
39 | $plugins = $pluginHandler->getObjects2(null, 'sublist'); |
||
40 | if ($plugins) { |
||
41 | $ret .= "<br>\n<table cellspacing='1' class='outer' width='100%'>\n" |
||
42 | . "<tr><th colspan='4'>" |
||
43 | . _AM_RSSFIT_SUB_LIST |
||
44 | . "</th></tr>\n" |
||
45 | . "<tr>\n<td class='head' align='center'>" |
||
46 | . _AM_RSSFIT_SUB_FILENAME_URL |
||
47 | . "</td>\n" |
||
48 | . "<td class='head' align='center'>" |
||
49 | . _AM_RSSFIT_PLUGIN_MODNAME |
||
50 | . "</td>\n" |
||
51 | . "<td class='head' align='center'>" |
||
52 | . _AM_RSSFIT_SUB_ACTIVATE |
||
53 | . "</td>\n" |
||
54 | . "<td class='head' align='center'> </td>\n" |
||
55 | . "</tr>\n"; |
||
56 | foreach ($plugins as $p) { |
||
57 | $id = $p->getVar('rssf_conf_id'); |
||
58 | if ($handler = $pluginHandler->checkPlugin($p)) { |
||
59 | $mod = $handler->modname; |
||
60 | $activate = new \XoopsFormCheckBox('', 'activate[' . $id . ']', $p->getVar('subfeed')); |
||
61 | $config = Utility::rssfGenAnchor(RSSFIT_ADMIN_URL . '?do=' . $do . '&op=edit&feed=' . $id, _AM_RSSFIT_SUB_CONFIGURE); |
||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||
62 | $urlLink = '<a href="' . $feedHandler->subFeedUrl($p->getVar('rssf_filename')) . '">' . $feedHandler->subFeedUrl($p->getVar('rssf_filename')) . '</a>'; |
||
63 | } else { |
||
64 | $pluginHandler->forceDeactivate($p); |
||
65 | $mod = implode('<br>', $p->getErrors()); |
||
66 | $activate = new \XoopsFormCheckBox('', 'activate[' . $id . ']', 0); |
||
67 | $activate->setExtra('disabled="disabled"'); |
||
68 | $config = ' '; |
||
69 | $urlLink = $feedHandler->subFeedUrl($p->getVar('rssf_filename')); |
||
70 | } |
||
71 | $activate->addOption('1', ' '); |
||
72 | $ret .= "<tr>\n" |
||
73 | . "<td class='even'>" |
||
74 | . $p->getVar('rssf_filename') |
||
75 | . '<br>' |
||
76 | . $urlLink |
||
77 | . "</td>\n" |
||
78 | . "<td class='even' align='center'>" |
||
79 | . $mod |
||
80 | . "</td>\n" |
||
81 | . "<td class='odd' align='center'>" |
||
82 | . $activate->render() |
||
83 | . "</td>\n" |
||
84 | . "<td class='even' align='center'>" |
||
85 | . $config |
||
86 | . "</td>\n"; |
||
87 | $ret .= "</tr>\n"; |
||
88 | } |
||
89 | $ret .= "</table>\n"; |
||
90 | $hidden = new \XoopsFormHidden('op', 'save'); |
||
91 | $ret = "<form action='" |
||
92 | . RSSFIT_ADMIN_URL |
||
93 | . "' method='post'>\n" |
||
94 | . $ret |
||
95 | . "<br><table cellspacing='1' class='outer' width='100%'><tr><td class='foot' align='center'>\n" |
||
96 | . $saveCancelTray->render() |
||
97 | . "\n" |
||
98 | . $hidden->render() |
||
99 | . "\n" |
||
100 | . $hiddenDo->render() |
||
101 | . "\n</td></tr></table></form>"; |
||
102 | echo $ret; |
||
103 | } else { |
||
104 | echo '<p><b>' . _AM_RSSFIT_PLUGIN_NONE . '</b></p>'; |
||
105 | } |
||
106 | break; |
||
107 | case 'save': |
||
108 | $activate = Request::getArray('activate', null, 'POST'); |
||
109 | |||
110 | $plugins = $pluginHandler->getObjects2(null, 'sublist'); |
||
111 | if ($plugins) { |
||
112 | $pluginHandler->modifyObjects(null, ['subfeed' => 0], false); |
||
113 | if (isset($activate) && is_array($activate) && count($activate) > 0) { |
||
114 | $keys = array_keys($activate); |
||
115 | $criteria = new \Criteria('rssf_conf_id', '(' . implode(',', $keys) . ')', 'IN'); |
||
116 | $pluginHandler->modifyObjects($criteria, ['subfeed' => 1], false); |
||
117 | } |
||
118 | redirect_header(RSSFIT_ADMIN_URL . '?do=' . $do, 0, _AM_RSSFIT_DBUPDATED); |
||
119 | } else { |
||
120 | redirect_header(RSSFIT_ADMIN_URL, 0, _AM_RSSFIT_PLUGIN_NONE); |
||
121 | } |
||
122 | break; |
||
123 | case 'edit': |
||
124 | $id = Request::getInt('feed', 0, 'GET'); |
||
125 | if (!empty($id)) { |
||
126 | $sub = $pluginHandler->get($id); |
||
127 | if (null !== $sub && !$handler = $pluginHandler->checkPlugin($sub)) { |
||
128 | $pluginHandler->forceDeactivate($sub); |
||
129 | } |
||
130 | } |
||
131 | if (empty($id) || !$sub) { |
||
132 | redirect_header(RSSFIT_ADMIN_URL, 0, _AM_RSSFIT_SUB_PLUGIN_NONE); |
||
133 | } |
||
134 | $form = new \XoopsThemeForm(sprintf(_AM_RSSFIT_SUB_EDIT, $handler->modname), 'editsub', RSSFIT_ADMIN_URL); |
||
135 | $form->addElement(new \XoopsFormRadioYN(_AM_RSSFIT_SUB_ACTIVATE, 'subfeed', $sub->getVar('subfeed'))); |
||
136 | $form->addElement(new \XoopsFormText(_AM_RSSFIT_PLUGIN_SHOWXENTRIES, 'sub_entries', 3, 2, $sub->getVar('sub_entries')), true); |
||
137 | |||
138 | $form->addElement(new \XoopsFormLabel('', '<b>' . _AM_RSSFIT_EDIT_CHANNEL_REQUIRED . '</b> ' . Utility::genSpecMoreInfo('req', $feedHandler))); |
||
139 | $form->addElement(new \XoopsFormText('title', 'sub_title', 50, 255, $sub->getVar('sub_title', 'e')), true); |
||
140 | $form->addElement(new \XoopsFormText('link', 'sub_link', 50, 255, $sub->getVar('sub_link', 'e')), true); |
||
141 | $form->addElement(new \XoopsFormTextArea('description', 'sub_desc', $sub->getVar('sub_desc', 'e')), true); |
||
142 | |||
143 | $form->addElement(new \XoopsFormLabel('', '<b>' . _AM_RSSFIT_EDIT_CHANNEL_IMAGE . '</b> ' . Utility::genSpecMoreInfo('img', $feedHandler))); |
||
144 | $form->addElement(new \XoopsFormText('url', 'img_url', 50, 255, $sub->getVar('img_url', 'e'))); |
||
145 | $form->addElement(new \XoopsFormText('link', 'img_link', 50, 255, $sub->getVar('img_link', 'e'))); |
||
146 | $form->addElement(new \XoopsFormText('title', 'img_title', 50, 255, $sub->getVar('img_title', 'e'))); |
||
147 | |||
148 | $form->addElement(new \XoopsFormHidden('feed', (string)$id)); |
||
149 | $form->addElement(new \XoopsFormHidden('op', 'savefeed')); |
||
150 | $form->addElement($hiddenDo); |
||
151 | $form->addElement($saveCancelTray); |
||
152 | $form->display(); |
||
153 | break; |
||
154 | case 'savefeed': |
||
155 | $id = Request::getInt('feed', 0, 'POST'); |
||
156 | if (!empty($id)) { |
||
157 | $sub = $pluginHandler->get($id); |
||
158 | if (null !== $sub && !$handler = $pluginHandler->checkPlugin($sub)) { |
||
159 | $pluginHandler->forceDeactivate($sub); |
||
160 | } |
||
161 | } |
||
162 | if (empty($id) || !$sub || !$handler) { |
||
163 | redirect_header(RSSFIT_ADMIN_URL, 0, _AM_RSSFIT_SUB_PLUGIN_NONE); |
||
164 | } |
||
165 | |||
166 | $subfeed = Request::getBool('subfeed', false, 'POST'); |
||
167 | $sub_entries = Request::getInt('sub_entries', 5, 'POST'); |
||
168 | $sub_title = Request::getString('sub_title', '', 'POST'); |
||
169 | $sub_link = Request::getUrl('sub_link', '', 'POST'); |
||
170 | $sub_desc = Request::getString('sub_desc', '', 'POST'); |
||
171 | $img_url = Request::getUrl('img_url', '', 'POST'); |
||
172 | $img_link = Request::getUrl('img_link', '', 'POST'); |
||
173 | $img_title = Request::getString('img_title', '', 'POST'); |
||
174 | |||
175 | $sub->setVar('subfeed', (int)$subfeed); |
||
176 | $sub->setVar('sub_entries', $sub_entries); |
||
177 | $sub->setVar('sub_title', $sub_title); |
||
178 | $sub->setVar('sub_link', $sub_link); |
||
179 | $sub->setVar('sub_desc', $sub_desc); |
||
180 | $sub->setVar('img_url', $img_url); |
||
181 | $sub->setVar('img_link', $img_link); |
||
182 | $sub->setVar('img_title', $img_title); |
||
183 | if (false !== $pluginHandler->insert($sub)) { |
||
184 | redirect_header(RSSFIT_ADMIN_URL . '?do=' . $do, 0, _AM_RSSFIT_DBUPDATED); |
||
185 | } else { |
||
186 | echo $sub->getHtmlErrors(); |
||
187 | } |
||
188 | break; |
||
189 | } |
||
190 |