Issues (278)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/article - Copy.php (10 issues)

1
<?php
2
/**
3
 * Module: Soapbox
4
 * Author: hsalazar
5
 * Licence: GNU
6
 */
7
8
use XoopsModules\Soapbox;
9
10
// -- General Stuff -- //
11
require_once __DIR__ . '/admin_header.php';
12
$adminObject = \Xmf\Module\Admin::getInstance();
13
14
/** @var Soapbox\Helper $helper */
15
$helper = Soapbox\Helper::getInstance();
16
17
$op = '';
18
if (\Xmf\Request::hasVar('op', 'GET')) {
19
    $op = trim(strip_tags($myts->stripSlashesGPC($_GET['op'])));
20
}
21
if (\Xmf\Request::hasVar('op', 'POST')) {
22
    $op = trim(strip_tags($myts->stripSlashesGPC($_POST['op'])));
23
}
24
25
/** @var \XoopsModules\Soapbox\EntrydataHandler $entrydataHandler */
26
$entrydataHandler = new \XoopsModules\Soapbox\EntrydataHandler();
27
$totalcats        = $entrydataHandler->getColumnCount();
28
if (0 === $totalcats) {
29
    redirect_header('index.php', 1, _AM_SOAPBOX_NEEDONECOLUMN);
30
}
31
32
// -- Edit function -- //
33
/**
34
 * @param int $articleID
35
 */
36
function editarticle($articleID = 0)
37
{
38
    global $xoopsGTicket, $indexAdmin;
39
    global $xoopsUser, $xoopsConfig, $xoopsModule, $xoopsLogger, $xoopsOption, $xoopsUserIsAdmin;
40
    /** @var Soapbox\Helper $helper */
41
    $helper = Soapbox\Helper::getInstance();
42
43
    $xoopsDB = \XoopsDatabaseFactory::getDatabaseConnection();
0 ignored issues
show
The assignment to $xoopsDB is dead and can be removed.
Loading history...
44
    $myts    = \MyTextSanitizer::getInstance();
45
46
    if (file_exists(XOOPS_ROOT_PATH . '/language/' . $xoopsConfig['language'] . '/calendar.php')) {
47
        require_once XOOPS_ROOT_PATH . '/language/' . $xoopsConfig['language'] . '/calendar.php';
48
    } else {
49
        require_once XOOPS_ROOT_PATH . '/language/english/calendar.php';
50
    }
51
    require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
52
53
    $articleID = (int)$articleID;
54
    /** @var \XoopsModules\Soapbox\EntrydataHandler $entrydataHandler */
55
    $entrydataHandler = new \XoopsModules\Soapbox\EntrydataHandler();
56
    if (0 !== $articleID) {
57
        //articleID check
58
        $_entryob = $entrydataHandler->getArticleOnePermcheck($articleID, false, false);
59
        if (!is_object($_entryob)) {
60
            redirect_header('index.php', 1, _AM_SOAPBOX_NOARTS);
61
        }
62
63
        //adminMenu(2, _AM_SOAPBOX_ARTS._AM_SOAPBOX_EDITING. $_entryob->getVar('headline') ."'");
64
        //echo "<h3 style='color: #2F5376; '>" . _AM_SOAPBOX_ADMINARTMNGMT . "</h3>";
65
        $sform = new \XoopsThemeForm(_AM_SOAPBOX_MODART . ': ' . $_entryob->getVar('headline'), 'op', $myts->htmlSpecialChars(xoops_getenv('PHP_SELF')), 'post', true);
66
    } else {
67
        //create new entry object
68
        $_entryob = $entrydataHandler->createArticle(true);
69
        $_entryob->cleanVars();
70
71
        /**
72
         *initial first variables before we start
73
         */
74
        $columnID = 1;
0 ignored issues
show
The assignment to $columnID is dead and can be removed.
Loading history...
75
        if (null !== $helper->getConfig('editorUser') && 'dhtml' !== $helper->getConfig('editorUser')) {
76
            $html   = 1;
0 ignored issues
show
The assignment to $html is dead and can be removed.
Loading history...
77
            $breaks = 0;
0 ignored issues
show
The assignment to $breaks is dead and can be removed.
Loading history...
78
        }
79
        //adminMenu(2, _AM_SOAPBOX_ARTS._AM_SOAPBOX_CREATINGART);
80
        //echo "<h3 style='color: #2F5376; '>" . _AM_SOAPBOX_ADMINARTMNGMT . "</h3>";
81
        $sform = new \XoopsThemeForm(_AM_SOAPBOX_NEWART, 'op', $myts->htmlSpecialChars(xoops_getenv('PHP_SELF')), 'post', true);
82
    }
83
84
    //get vars mode E
85
    $entry_vars = $_entryob->getVars();
86
    foreach ($entry_vars as $k => $v) {
87
        $e_articles[$k] = $_entryob->getVar($k, 'E');
88
    }
89
90
    $sform->setExtra('enctype="multipart/form-data"');
91
92
    // COLUMN
93
    /*
94
    * Get information for pulldown menu using XoopsTree.
95
    * First var is the database table
96
    * Second var is the unique field ID for the categories
97
    * Last one is not set as we do not have sub menus in WF-FAQ
98
    */
99
    $canEditCategoryobArray = $entrydataHandler->getColumns(null, true);
100
    $collist                = [];
101
    foreach ($canEditCategoryobArray as $key => $_can_edit_categoryob) {
102
        $collist[$key] = $_can_edit_categoryob->getVar('name');
103
    }
104
    $col_select = new \XoopsFormSelect('', 'columnID', (int)$e_articles['columnID']);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $e_articles seems to be defined by a foreach iteration on line 86. Are you sure the iterator is never empty, otherwise this variable is not defined?
Loading history...
105
    $col_select->addOptionArray($collist);
106
    $col_select_tray = new \XoopsFormElementTray(_AM_SOAPBOX_COLNAME, '<br>');
107
    $col_select_tray->addElement($col_select);
108
    $sform->addElement($col_select_tray);
109
110
    // HEADLINE, LEAD, BODYTEXT
111
    // This part is common to edit/add
112
    $sform->addElement(new \XoopsFormText(_AM_SOAPBOX_ARTHEADLINE, 'headline', 50, 50, $e_articles['headline']), true);
113
114
    // LEAD
115
    //    $sform -> addElement( new \XoopsFormTextArea( _AM_SOAPBOX_ARTLEAD, 'lead', $lead, 5, 60 ) );
116
    //    $editor_lead=soapbox_getWysiwygForm($helper->getConfig('editorUser') , _AM_SOAPBOX_ARTLEAD , 'lead' , $e_articles['lead'] , '100%', '200px');
117
    //    $sform->addElement($editor_lead,TRUE);
118
119
    $editor_lead = new \XoopsFormElementTray(_AM_SOAPBOX_ARTLEAD, '<br>');
120
    if (class_exists('XoopsFormEditor')) {
121
        $options['name']   = 'lead';
0 ignored issues
show
Comprehensibility Best Practice introduced by
$options was never initialized. Although not strictly required by PHP, it is generally a good practice to add $options = array(); before regardless.
Loading history...
122
        $options['value']  = $e_articles['lead'];
123
        $options['rows']   = 5;
124
        $options['cols']   = '100%';
125
        $options['width']  = '100%';
126
        $options['height'] = '200px';
127
        $formmnote         = new \XoopsFormEditor('', $helper->getConfig('editorUser'), $options, $nohtml = false, $onfailure = 'textarea');
128
        $editor_lead->addElement($formmnote);
129
    } else {
130
        $formmnote = new \XoopsFormDhtmlTextArea('', 'formmnote', $item->getVar('formmnote', 'e'), '100%', '100%');
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $item seems to be never defined.
Loading history...
'100%' of type string is incompatible with the type integer expected by parameter $rows of XoopsFormDhtmlTextArea::__construct(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

130
        $formmnote = new \XoopsFormDhtmlTextArea('', 'formmnote', $item->getVar('formmnote', 'e'), /** @scrutinizer ignore-type */ '100%', '100%');
Loading history...
'100%' of type string is incompatible with the type integer expected by parameter $cols of XoopsFormDhtmlTextArea::__construct(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

130
        $formmnote = new \XoopsFormDhtmlTextArea('', 'formmnote', $item->getVar('formmnote', 'e'), '100%', /** @scrutinizer ignore-type */ '100%');
Loading history...
131
        $editor_lead->addElement($formmnote);
132
    }
133
    $sform->addElement($editor_lead, false);
134
135
    // TEASER
136
    $sform->addElement(new \XoopsFormTextArea(_AM_SOAPBOX_ARTTEASER, 'teaser', $e_articles['teaser'], 10, 120));
137
    //    $editor_teaser=soapbox_getWysiwygForm($helper->getConfig('editorUser') , _AM_SOAPBOX_ARTTEASER ,'teaser', $teaser , '100%', '120px');
138
    //    $sform->addElement($editor_teaser,true);
139
    //
140
    // $autoteaser_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_AUTOTEASER, 'autoteaser', 0, ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
141
    // $sform->addElement($autoteaser_radio);
142
    // $sform->addElement(new \XoopsFormText(_AM_SOAPBOX_AUTOTEASERAMOUNT, 'teaseramount', 4, 4, 100));
143
144
    // BODY
145
    //HACK by domifara for Wysiwyg
146
    //    if  (null !== ($helper->getConfig('editorUser')) ) {
147
    //        $editor=soapbox_getWysiwygForm($helper->getConfig('editorUser') , _AM_SOAPBOX_ARTBODY, 'bodytext', $e_articles['bodytext'], '100%', '400px');
148
    //        $sform->addElement($editor,true);
149
    //    } else {
150
    //        $sform -> addElement( new \XoopsFormDhtmlTextArea( _AM_SOAPBOX_ARTBODY, 'bodytext', $e_articles['bodytext'], 20, 120 ) );
151
    //    }
152
153
    $optionsTrayNote = new \XoopsFormElementTray(_AM_SOAPBOX_ARTBODY, '<br>');
154
    if (class_exists('XoopsFormEditor')) {
155
        $options['name']   = 'bodytext';
156
        $options['value']  = $e_articles['bodytext'];
157
        $options['rows']   = 5;
158
        $options['cols']   = '100%';
159
        $options['width']  = '100%';
160
        $options['height'] = '400px';
161
        $bodynote          = new \XoopsFormEditor('', $helper->getConfig('editorUser'), $options, $nohtml = false, $onfailure = 'textarea');
162
        $optionsTrayNote->addElement($bodynote);
163
    } else {
164
        $bodynote = new \XoopsFormDhtmlTextArea('', 'formmnote', $item->getVar('formmnote', 'e'), '100%', '100%');
165
        $optionsTrayNote->addElement($bodynote);
166
    }
167
    $sform->addElement($optionsTrayNote, false);
168
169
    // IMAGE
170
    // The article CAN have its own image :)
171
    // First, if the article's image doesn't exist, set its value to the blank file
172
    if (empty($e_articles['artimage'])
173
        || !file_exists(XOOPS_ROOT_PATH . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')) . '/' . $e_articles['artimage'])) {
174
        $artimage = 'blank.png';
0 ignored issues
show
The assignment to $artimage is dead and can be removed.
Loading history...
175
    }
176
    // Code to create the image selector
177
    $graph_array     = \XoopsLists:: getImgListAsArray(XOOPS_ROOT_PATH . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')));
178
    $artimage_select = new \XoopsFormSelect('', 'artimage', $e_articles['artimage']);
179
    $artimage_select->addOptionArray($graph_array);
180
    $artimage_select->setExtra("onchange='showImgSelected(\"image5\", \"artimage\", \"" . $helper->getConfig('sbuploaddir') . '", "", "' . XOOPS_URL . "\")'");
181
    $artimage_tray = new \XoopsFormElementTray(_AM_SOAPBOX_SELECT_IMG, '&nbsp;');
182
    $artimage_tray->addElement($artimage_select);
183
    $artimage_tray->addElement(new \XoopsFormLabel('', "<br><br><img src='" . XOOPS_URL . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')) . '/' . $e_articles['artimage'] . "' name='image5' id='image5' alt='' />"));
184
    $sform->addElement($artimage_tray);
185
186
    // Code to call the file browser to select an image to upload
187
    $sform->addElement(new \XoopsFormFile(_AM_SOAPBOX_UPLOADIMAGE, 'cimage', (int)$helper->getConfig('maxfilesize')), false);
188
189
    // WEIGHT
190
    $sform->addElement(new \XoopsFormText(_AM_SOAPBOX_WEIGHT, 'weight', 4, 4, $e_articles['weight']));
191
    //----------
192
    // datesub
193
    //----------
194
    //$datesub_caption = $myts->htmlSpecialChars( formatTimestamp( $e_articles['datesub'] , $helper->getConfig('dateformat')) . "=>");
195
    //$datesub_tray = new \XoopsFormDateTime( _AM_SOAPBOX_POSTED.'<br>' . $datesub_caption ,'datesub' , 15, time()) ;
196
    $datesub_tray = new \XoopsFormDateTime(_AM_SOAPBOX_POSTED . '<br>', 'datesub', 15, $e_articles['datesub']);
197
198
    // you don't want to change datesub
199
    $datesubnochage_checkbox = new \XoopsFormCheckBox(_AM_SOAPBOX_DATESUBNOCHANGE, 'datesubnochage', 1);
200
    $datesubnochage_checkbox->addOption(1, _AM_SOAPBOX_YES);
201
    $datesub_tray->addElement($datesubnochage_checkbox);
202
    $sform->addElement($datesub_tray);
203
    //-----------
204
205
    // COMMENTS
206
    if (isset($GLOBALS['xoopsModuleConfig']['globaldisplaycomments'])
207
        && 1 === $GLOBALS['xoopsModuleConfig']['globaldisplaycomments']) {
208
        // COMMENTS
209
        // Code to allow comments
210
        $addcommentable_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_ALLOWCOMMENTS, 'commentable', $e_articles['commentable'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
211
        $sform->addElement($addcommentable_radio);
212
    }
213
214
    // OFFLINE
215
    // Code to take article offline, for maintenance purposes
216
    $offline_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_SWITCHOFFLINE, 'offline', $e_articles['offline'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
217
    $sform->addElement($offline_radio);
218
219
    // ARTICLE IN BLOCK
220
    // Code to put article in block
221
    $block_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_BLOCK, 'block', $e_articles['block'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
222
    $sform->addElement($block_radio);
223
224
    // notification public
225
    $notifypub_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_NOTIFY, 'notifypub', $e_articles['notifypub'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
226
    $sform->addElement($notifypub_radio);
227
228
    // VARIOUS OPTIONS
229
    //----------
230
    $options_tray = new \XoopsFormElementTray(_AM_SOAPBOX_OPTIONS, '<br>');
231
232
    $html_checkbox = new \XoopsFormCheckBox('', 'html', $e_articles['html']);
233
    $html_checkbox->addOption(1, _AM_SOAPBOX_DOHTML);
234
    $options_tray->addElement($html_checkbox);
235
236
    $smiley_checkbox = new \XoopsFormCheckBox('', 'smiley', $e_articles['smiley']);
237
    $smiley_checkbox->addOption(1, _AM_SOAPBOX_DOSMILEY);
238
    $options_tray->addElement($smiley_checkbox);
239
240
    $xcodes_checkbox = new \XoopsFormCheckBox('', 'xcodes', $e_articles['xcodes']);
241
    $xcodes_checkbox->addOption(1, _AM_SOAPBOX_DOXCODE);
242
    $options_tray->addElement($xcodes_checkbox);
243
244
    $breaks_checkbox = new \XoopsFormCheckBox('', 'breaks', $e_articles['breaks']);
245
    $breaks_checkbox->addOption(1, _AM_SOAPBOX_BREAKS);
246
    $options_tray->addElement($breaks_checkbox);
247
248
    $sform->addElement($options_tray);
249
    //----------
250
251
    $sform->addElement(new \XoopsFormHidden('articleID', $e_articles['articleID']));
252
253
    $buttonTray = new \XoopsFormElementTray('', '');
254
    $hidden     = new \XoopsFormHidden('op', 'addart');
255
    $buttonTray->addElement($hidden);
256
257
    if (!$e_articles['articleID']) { // there's no articleID? Then it's a new article
258
        $butt_create = new \XoopsFormButton('', '', _AM_SOAPBOX_CREATE, 'submit');
259
        $butt_create->setExtra('onclick="this.form.elements.op.value=\'addart\'"');
260
        $buttonTray->addElement($butt_create);
261
262
        $butt_clear = new \XoopsFormButton('', '', _AM_SOAPBOX_CLEAR, 'reset');
263
        $buttonTray->addElement($butt_clear);
264
265
        $butt_cancel = new \XoopsFormButton('', '', _AM_SOAPBOX_CANCEL, 'button');
266
        $butt_cancel->setExtra('onclick="history.go(-1)"');
267
        $buttonTray->addElement($butt_cancel);
268
    } else { // else, we're editing an existing article
269
        $butt_create = new \XoopsFormButton('', '', _AM_SOAPBOX_MODIFY, 'submit');
270
        $butt_create->setExtra('onclick="this.form.elements.op.value=\'addart\'"');
271
        $buttonTray->addElement($butt_create);
272
273
        $butt_cancel = new \XoopsFormButton('', '', _AM_SOAPBOX_CANCEL, 'button');
274
        $butt_cancel->setExtra('onclick="history.go(-1)"');
275
        $buttonTray->addElement($butt_cancel);
276
    }
277
278
    $sform->addElement($buttonTray);
279
    //-----------
280
    $xoopsGTicket->addTicketXoopsFormElement($sform, __LINE__);
281
    //-----------
282
    $sform->display();
283
    unset($hidden);
284
}
285
286
/* -- Available operations -- */
287
switch ($op) {
288
    case 'mod':
289
        xoops_cp_header();
290
        $adminObject->displayNavigation(basename(__FILE__));
291
        $articleID = \Xmf\Request::getInt('articleID', \Xmf\Request::getInt('articleID', 0, 'GET'), 'POST');
292
        editarticle($articleID);
293
        break;
294
    case 'addart':
295
        //-------------------------
296
        if (!$xoopsGTicket->check()) {
297
            redirect_header(XOOPS_URL . '/', 3, $xoopsGTicket->getErrors());
298
        }
299
        //-------------------------
300
301
        //articleID check
302
        if (!isset($_POST['articleID'])) {
303
            redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
304
        } else {
305
            $articleID = \Xmf\Request::getInt('articleID', 0, 'POST');
306
        }
307
        //articleID check
308
        if (!isset($_POST['columnID'])) {
309
            redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
310
        } else {
311
            $columnID = \Xmf\Request::getInt('columnID', 0, 'POST');
312
        }
313
314
        //get category object
315
        $_categoryob = $entrydataHandler->getColumn($columnID);
316
        if (!is_object($_categoryob)) {
317
            redirect_header('index.php', 1, _AM_SOAPBOX_NEEDONECOLUMN);
318
        }
319
320
        $_entryob = $entrydataHandler->getArticle($articleID);
321
        //new data or edit
322
        if (!is_object($_entryob)) {
323
            $_entryob = $entrydataHandler->createArticle(true);
324
            $_entryob->cleanVars();
325
        }
326
        //set
327
328
        // new data post uid
329
        if (is_object($xoopsUser)) {
330
            $_entryob->setVar('uid', $xoopsUser->getVar('uid'));
331
        } else {
332
            //trigger_error ("Why:uid no mach") ;
333
            redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
334
        }
335
336
        if (\Xmf\Request::hasVar('articleID', 'POST')) {
337
            $_entryob->setVar('articleID', $articleID);
338
        }
339
        if (\Xmf\Request::hasVar('columnID', 'POST')) {
340
            $_entryob->setVar('columnID', $columnID);
341
        }
342
343
        if (\Xmf\Request::hasVar('weight', 'POST')) {
344
            $_entryob->setVar('weight', \Xmf\Request::getInt('weight', 0, 'POST'));
345
        }
346
347
        if (\Xmf\Request::hasVar('commentable', 'POST')) {
348
            $_entryob->setVar('commentable', \Xmf\Request::getInt('commentable', 0, 'POST'));
349
        }
350
        if (\Xmf\Request::hasVar('block', 'POST')) {
351
            $_entryob->setVar('block', \Xmf\Request::getInt('block', 0, 'POST'));
352
        }
353
        if (\Xmf\Request::hasVar('offline', 'POST')) {
354
            $_entryob->setVar('offline', \Xmf\Request::getInt('offline', 0, 'POST'));
355
        }
356
        if (\Xmf\Request::hasVar('notifypub', 'POST')) {
357
            $_entryob->setVar('notifypub', \Xmf\Request::getInt('notifypub', 0, 'POST'));
358
        }
359
360
        if (\Xmf\Request::hasVar('breaks', 'POST')) {
361
            $_entryob->setVar('breaks', \Xmf\Request::getInt('breaks', 0, 'POST'));
362
        }
363
        if (\Xmf\Request::hasVar('html', 'POST')) {
364
            $_entryob->setVar('html', \Xmf\Request::getInt('html', 0, 'POST'));
365
        }
366
        if (\Xmf\Request::hasVar('smiley', 'POST')) {
367
            $_entryob->setVar('smiley', \Xmf\Request::getInt('smiley', 0, 'POST'));
368
        }
369
        if (\Xmf\Request::hasVar('xcodes', 'POST')) {
370
            $_entryob->setVar('xcodes', \Xmf\Request::getInt('xcodes', 0, 'POST'));
371
        }
372
373
        if (\Xmf\Request::hasVar('headline', 'POST')) {
374
            $_entryob->setVar('headline', $_POST['headline']);
375
        }
376
        if (\Xmf\Request::hasVar('lead', 'POST')) {
377
            $_entryob->setVar('lead', $_POST['lead']);
378
        }
379
        if (\Xmf\Request::hasVar('bodytext', 'POST')) {
380
            $_entryob->setVar('bodytext', $_POST['bodytext']);
381
        }
382
        if (\Xmf\Request::hasVar('votes', 'POST')) {
383
            $_entryob->setVar('votes', \Xmf\Request::getInt('votes', 0, 'POST'));
384
        }
385
        if (\Xmf\Request::hasVar('rating', 'POST')) {
386
            $_entryob->setVar('rating', \Xmf\Request::getInt('rating', 0, 'POST'));
387
        }
388
389
        if (\Xmf\Request::hasVar('teaser', 'POST')) {
390
            $_entryob->setVar('teaser', $_POST['teaser']);
391
        }
392
393
        $autoteaser = \Xmf\Request::getInt('autoteaser', 0, 'POST');
394
        $charlength = \Xmf\Request::getInt('teaseramount', 0, 'POST');
395
        if ($autoteaser && $charlength) {
396
            $_entryob->setVar('teaser', xoops_substr($_entryob->getVar('bodytext', 'none'), 0, $charlength));
397
        }
398
        //datesub
399
        $datesubnochage  = \Xmf\Request::getInt('datesubnochage', 0, 'POST');
400
        $datesub_date_sl = isset($_POST['datesub']) ? (int)strtotime($_POST['datesub']['date']) : 0;
401
        $datesub_time_sl = \Xmf\Request::getInt('datesub', 0, 'POST');
402
        $datesub         = isset($_POST['datesub']) ? $datesub_date_sl + $datesub_time_sl : 0;
403
        //if (!$datesub || $_entryob->_isNew) {
404
        if (!$datesub) {
405
            $_entryob->setVar('datesub', time());
406
        } else {
407
            if (!$datesubnochage) {
408
                $_entryob->setVar('datesub', $datesub);
409
            }
410
        }
411
412
        $_entryob->setVar('submit', 0);
413
414
        // ARTICLE IMAGE
415
        // Define variables
416
        $error  = 0;
417
        $word   = null;
418
        $uid    = $xoopsUser->uid();
419
        $submit = 1;
420
        $date   = time();
421
        //-----------------
422
        //artimage
423
        if (\Xmf\Request::hasVar('artimage', 'POST')) {
424
            $_entryob->setVar('artimage', $_POST['artimage']);
425
        }
426
        if (isset($_FILES['cimage']['name'])) {
427
            $artimage_name = trim(strip_tags($myts->stripSlashesGPC($_FILES['cimage']['name'])));
428
            if ('' !== $artimage_name) {
429
                require_once XOOPS_ROOT_PATH . '/class/uploader.php';
430
                if (file_exists(XOOPS_ROOT_PATH . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')) . '/' . $artimage_name)) {
431
                    redirect_header('index.php', 1, _AM_SOAPBOX_FILEEXISTS);
432
                }
433
                $allowed_mimetypes = ['image/gif', 'image/jpeg', 'image/pjpeg', 'image/png'];
434
435
                Soapbox\Utility::uploadFile($allowed_mimetypes, $artimage_name, 'index.php', 0, $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')));
436
437
                $_entryob->setVar('artimage', $artimage_name);
438
            }
439
        }
440
        if ('' === $_entryob->getVar('artimage')) {
441
            $_entryob->setVar('artimage', 'blank.png');
442
        }
443
        //-----------------
444
445
        // Save to database
446
        if ($_entryob->_isNew) {
447
            if (!$entrydataHandler->insertArticle($_entryob)) {
448
                xoops_cp_header();
449
                $adminObject->displayNavigation(basename(__FILE__));
450
                //                print_r($_entryob->getErrors());
451
                xoops_cp_footer();
452
                //                exit();
453
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
454
            } else {
455
                // Notify of to admin only for approve
456
                $entrydataHandler->newArticleTriggerEvent($_entryob, 'new_article');
457
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTCREATEDOK);
458
            }
459
        } else {
460
            if (!$entrydataHandler->insertArticle($_entryob)) {
461
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTUPDATED);
462
            } else {
463
                $entrydataHandler->newArticleTriggerEvent($_entryob, 'new_article');
464
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTMODIFIED);
465
            }
466
        }
467
        exit();
468
        break;
469
    case 'del':
470
471
        $confirm = \Xmf\Request::getInt('confirm', 0, 'POST');
472
473
        // confirmed, so delete
474
        if (1 === $confirm) {
475
            //-------------------------
476
            if (!$xoopsGTicket->check()) {
477
                redirect_header(XOOPS_URL . '/', 3, $xoopsGTicket->getErrors());
478
            }
479
            //-------------------------
480
            //articleID check
481
            if (!isset($_POST['articleID'])) {
482
                redirect_header('index.php', 1, _NOPERM);
483
            } else {
484
                $articleID = \Xmf\Request::getInt('articleID', 0, 'POST');
485
            }
486
487
            $_entryob = $entrydataHandler->getArticle($articleID);
488
            if (!is_object($_entryob)) {
489
                redirect_header('index.php', 1, _NOPERM);
490
            }
491
492
            if (!$entrydataHandler->deleteArticle($_entryob)) {
493
                trigger_error('ERROR:not deleted from database');
494
                exit();
495
            }
496
            $headline = $myts->htmlSpecialChars($_entryob->getVar('headline'));
497
            redirect_header('index.php', 1, sprintf(_AM_SOAPBOX_ARTISDELETED, $headline));
498
        } else {
499
            $articleID = \Xmf\Request::getInt('articleID', \Xmf\Request::getInt('articleID', 0, 'GET'), 'POST');
500
            $_entryob  = $entrydataHandler->getArticle($articleID);
501
            if (!is_object($_entryob)) {
502
                redirect_header('index.php', 1, _NOPERM);
503
            }
504
            $headline = $myts->htmlSpecialChars($_entryob->getVar('headline'));
505
            xoops_cp_header();
506
            $adminObject->displayNavigation(basename(__FILE__));
507
            xoops_confirm([
508
                              'op'        => 'del',
509
                              'articleID' => $articleID,
510
                              'confirm'   => 1,
511
                              'headline'  => $headline,
512
                          ] + $xoopsGTicket->getTicketArray(__LINE__), 'article.php', _AM_SOAPBOX_DELETETHISARTICLE . '<br><br>' . $headline, _AM_SOAPBOX_DELETE);
513
            xoops_cp_footer();
514
        }
515
        exit();
516
        break;
517
    case 'reorder':
518
        //-------------------------
519
        if (!$xoopsGTicket->check()) {
520
            redirect_header(XOOPS_URL . '/', 3, $xoopsGTicket->getErrors());
521
        }
522
        $entrydataHandler->reorderArticlesUpdate($_POST['articleweight']);
523
        redirect_header('index.php', 1, _AM_SOAPBOX_ORDERUPDATED);
524
        break;
525
    case 'default':
526
    default:
527
        xoops_cp_header();
528
        $adminObject->displayNavigation(basename(__FILE__));
529
        editarticle(0);
530
        //showArticles (0);
531
        break;
532
}
533
require_once __DIR__ . '/admin_footer.php';
534