Issues (278)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/article.php (6 issues)

1
<?php
2
/**
3
 * Module: Soapbox
4
 * Author: hsalazar
5
 * Licence: GNU
6
 */
7
8
use XoopsModules\Soapbox;
9
10
// -- General Stuff -- //
11
require_once __DIR__ . '/admin_header.php';
12
$adminObject = \Xmf\Module\Admin::getInstance();
13
14
/** @var Soapbox\Helper $helper */
15
$helper = Soapbox\Helper::getInstance();
16
17
$op = '';
18
if (\Xmf\Request::hasVar('op', 'GET')) {
19
    $op = trim(strip_tags($myts->stripSlashesGPC($_GET['op'])));
20
}
21
if (\Xmf\Request::hasVar('op', 'POST')) {
22
    $op = trim(strip_tags($myts->stripSlashesGPC($_POST['op'])));
23
}
24
25
/** @var \XoopsModules\Soapbox\EntrydataHandler $entrydataHandler */
26
$entrydataHandler = new \XoopsModules\Soapbox\EntrydataHandler();
27
$totalcats        = $entrydataHandler->getColumnCount();
28
if (0 === $totalcats) {
29
    redirect_header('index.php', 1, _AM_SOAPBOX_NEEDONECOLUMN);
30
}
31
32
// -- Edit function -- //
33
/**
34
 * @param int $articleID
35
 */
36
function editarticle($articleID = 0)
37
{
38
    global $indexAdmin;
39
    global $xoopsUser, $xoopsConfig, $xoopsModule, $xoopsLogger, $xoopsOption, $xoopsUserIsAdmin;
40
    /** @var Soapbox\Helper $helper */
41
    $helper = Soapbox\Helper::getInstance();
42
43
    $xoopsDB = \XoopsDatabaseFactory::getDatabaseConnection();
0 ignored issues
show
The assignment to $xoopsDB is dead and can be removed.
Loading history...
44
    $myts    = \MyTextSanitizer::getInstance();
45
46
    if (file_exists(XOOPS_ROOT_PATH . '/language/' . $xoopsConfig['language'] . '/calendar.php')) {
47
        require_once XOOPS_ROOT_PATH . '/language/' . $xoopsConfig['language'] . '/calendar.php';
48
    } else {
49
        require_once XOOPS_ROOT_PATH . '/language/english/calendar.php';
50
    }
51
    require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
52
53
    $articleID = (int)$articleID;
54
    /** @var \XoopsModules\Soapbox\EntrydataHandler $entrydataHandler */
55
    $entrydataHandler = new \XoopsModules\Soapbox\EntrydataHandler();
56
    if (0 !== $articleID) {
57
        //articleID check
58
        $_entryob = $entrydataHandler->getArticleOnePermcheck($articleID, false, false);
59
        if (!is_object($_entryob)) {
60
            redirect_header('index.php', 1, _AM_SOAPBOX_NOARTS);
61
        }
62
63
        //adminMenu(2, _AM_SOAPBOX_ARTS._AM_SOAPBOX_EDITING. $_entryob->getVar('headline') ."'");
64
        //echo "<h3 style='color: #2F5376; '>" . _AM_SOAPBOX_ADMINARTMNGMT . "</h3>";
65
        $sform = new \XoopsThemeForm(_AM_SOAPBOX_MODART . ': ' . $_entryob->getVar('headline'), 'op', $myts->htmlSpecialChars(xoops_getenv('PHP_SELF')), 'post', true);
66
    } else {
67
        //create new entry object
68
        $_entryob = $entrydataHandler->createArticle(true);
69
        //        $_entryob->cleanVars();
70
71
        /**
72
         *initial first variables before we start
73
         */
74
        $columnID = 1;
0 ignored issues
show
The assignment to $columnID is dead and can be removed.
Loading history...
75
        if (null !== $helper->getConfig('editorUser') && 'dhtml' !== $helper->getConfig('editorUser')) {
76
            $html   = 1;
0 ignored issues
show
The assignment to $html is dead and can be removed.
Loading history...
77
            $breaks = 0;
0 ignored issues
show
The assignment to $breaks is dead and can be removed.
Loading history...
78
        }
79
        //adminMenu(2, _AM_SOAPBOX_ARTS._AM_SOAPBOX_CREATINGART);
80
        //echo "<h3 style='color: #2F5376; '>" . _AM_SOAPBOX_ADMINARTMNGMT . "</h3>";
81
        $sform = new \XoopsThemeForm(_AM_SOAPBOX_NEWART, 'op', $myts->htmlSpecialChars(xoops_getenv('PHP_SELF')), 'post', true);
82
    }
83
84
    //get vars mode E
85
    $entry_vars = $_entryob->getVars();
86
    foreach ($entry_vars as $k => $v) {
87
        $e_articles[$k] = $_entryob->getVar($k, 'E');
88
    }
89
90
    $sform->setExtra('enctype="multipart/form-data"');
91
92
    // COLUMN
93
    /*
94
    * Get information for pulldown menu using XoopsTree.
95
    * First var is the database table
96
    * Second var is the unique field ID for the categories
97
    * Last one is not set as we do not have sub menus in WF-FAQ
98
    */
99
    $canEditCategoryobArray = $entrydataHandler->getColumns(null, true);
100
    $collist                = [];
101
    foreach ($canEditCategoryobArray as $key => $_can_edit_categoryob) {
102
        $collist[$key] = $_can_edit_categoryob->getVar('name');
103
    }
104
    $col_select = new \XoopsFormSelect('', 'columnID', (int)$e_articles['columnID']);
105
    $col_select->addOptionArray($collist);
106
    $col_select_tray = new \XoopsFormElementTray(_AM_SOAPBOX_COLNAME, '<br>');
107
    $col_select_tray->addElement($col_select);
108
    $sform->addElement($col_select_tray);
109
110
    // HEADLINE, LEAD, BODYTEXT
111
    // This part is common to edit/add
112
    $sform->addElement(new \XoopsFormText(_AM_SOAPBOX_ARTHEADLINE, 'headline', 50, 50, $e_articles['headline']), true);
113
114
    // LEAD
115
    //    $sform -> addElement( new \XoopsFormTextArea( _AM_SOAPBOX_ARTLEAD, 'lead', $lead, 5, 60 ) );
116
    //    $editor_lead=soapbox_getWysiwygForm($helper->getConfig('editorUser') , _AM_SOAPBOX_ARTLEAD , 'lead' , $e_articles['lead'] , '100%', '200px');
117
    //    $sform->addElement($editor_lead,TRUE);
118
119
    $editor_lead = new \XoopsFormElementTray(_AM_SOAPBOX_ARTLEAD, '<br>');
120
    if (class_exists('XoopsFormEditor')) {
121
        $options['name']   = 'lead';
122
        $options['value']  = $e_articles['lead'];
123
        $options['rows']   = 5;
124
        $options['cols']   = '100%';
125
        $options['width']  = '100%';
126
        $options['height'] = '200px';
127
        $formmnote         = new \XoopsFormEditor('', $helper->getConfig('editorUser'), $options, $nohtml = false, $onfailure = 'textarea');
128
        $editor_lead->addElement($formmnote);
129
    } else {
130
        $formmnote = new \XoopsFormDhtmlTextArea('', 'formmnote', $item->getVar('formmnote', 'e'), '100%', '100%');
131
        $editor_lead->addElement($formmnote);
132
    }
133
    $sform->addElement($editor_lead, false);
134
135
    // TEASER
136
    $sform->addElement(new \XoopsFormTextArea(_AM_SOAPBOX_ARTTEASER, 'teaser', $e_articles['teaser'], 10, 120));
137
    //    $editor_teaser=soapbox_getWysiwygForm($helper->getConfig('editorUser') , _AM_SOAPBOX_ARTTEASER ,'teaser', $teaser , '100%', '120px');
138
    //    $sform->addElement($editor_teaser,true);
139
    //
140
    $autoteaser_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_AUTOTEASER, 'autoteaser', 0, ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
141
    $sform->addElement($autoteaser_radio);
142
    $sform->addElement(new \XoopsFormText(_AM_SOAPBOX_AUTOTEASERAMOUNT, 'teaseramount', 4, 4, 100));
143
144
    // BODY
145
    //HACK by domifara for Wysiwyg
146
    //    if  (null !== ($helper->getConfig('editorUser')) ) {
147
    //        $editor=soapbox_getWysiwygForm($helper->getConfig('editorUser') , _AM_SOAPBOX_ARTBODY, 'bodytext', $e_articles['bodytext'], '100%', '400px');
148
    //        $sform->addElement($editor,true);
149
    //    } else {
150
    //        $sform -> addElement( new \XoopsFormDhtmlTextArea( _AM_SOAPBOX_ARTBODY, 'bodytext', $e_articles['bodytext'], 20, 120 ) );
151
    //    }
152
153
    $optionsTrayNote = new \XoopsFormElementTray(_AM_SOAPBOX_ARTBODY, '<br>');
154
    if (class_exists('XoopsFormEditor')) {
155
        $options['name']   = 'bodytext';
156
        $options['value']  = $e_articles['bodytext'];
157
        $options['rows']   = 5;
158
        $options['cols']   = '100%';
159
        $options['width']  = '100%';
160
        $options['height'] = '400px';
161
        $bodynote          = new \XoopsFormEditor('', $helper->getConfig('editorUser'), $options, $nohtml = false, $onfailure = 'textarea');
162
        $optionsTrayNote->addElement($bodynote);
163
    } else {
164
        $bodynote = new \XoopsFormDhtmlTextArea('', 'formmnote', $item->getVar('formmnote', 'e'), '100%', '100%');
165
        $optionsTrayNote->addElement($bodynote);
166
    }
167
    $sform->addElement($optionsTrayNote, false);
168
169
    // IMAGE
170
    // The article CAN have its own image :)
171
    // First, if the article's image doesn't exist, set its value to the blank file
172
    if (empty($e_articles['artimage'])
173
        || !file_exists(XOOPS_ROOT_PATH . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')) . '/' . $e_articles['artimage'])) {
174
        $artimage = 'blank.png';
0 ignored issues
show
The assignment to $artimage is dead and can be removed.
Loading history...
175
    }
176
    // Code to create the image selector
177
    $graph_array     = \XoopsLists:: getImgListAsArray(XOOPS_ROOT_PATH . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')));
178
    $artimage_select = new \XoopsFormSelect('', 'artimage', $e_articles['artimage']);
179
    $artimage_select->addOptionArray($graph_array);
180
    $artimage_select->setExtra("onchange='showImgSelected(\"image5\", \"artimage\", \"" . $helper->getConfig('sbuploaddir') . '", "", "' . XOOPS_URL . "\")'");
181
    $artimage_tray = new \XoopsFormElementTray(_AM_SOAPBOX_SELECT_IMG, '&nbsp;');
182
    $artimage_tray->addElement($artimage_select);
183
    $artimage_tray->addElement(new \XoopsFormLabel('', "<br><br><img src='" . XOOPS_URL . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')) . '/' . $e_articles['artimage'] . "' name='image5' id='image5' alt=''>"));
184
    $sform->addElement($artimage_tray);
185
186
    // Code to call the file browser to select an image to upload
187
    $sform->addElement(new \XoopsFormFile(_AM_SOAPBOX_UPLOADIMAGE, 'cimage', (int)$helper->getConfig('maxfilesize')), false);
188
189
    // WEIGHT
190
    $sform->addElement(new \XoopsFormText(_AM_SOAPBOX_WEIGHT, 'weight', 4, 4, $e_articles['weight']));
191
    //----------
192
    // datesub
193
    //----------
194
    //$datesub_caption = $myts->htmlSpecialChars( formatTimestamp( $e_articles['datesub'] , $helper->getConfig('dateformat')) . "=>");
195
    //$datesub_tray = new \XoopsFormDateTime( _AM_SOAPBOX_POSTED.'<br>' . $datesub_caption ,'datesub' , 15, time()) ;
196
    $datesub_tray = new \XoopsFormDateTime(_AM_SOAPBOX_POSTED . '<br>', 'datesub', 15, $e_articles['datesub']);
197
198
    // you don't want to change datesub
199
    //    $datesubnochage_checkbox = new \XoopsFormCheckBox( _AM_SOAPBOX_DATESUBNOCHANGE, 'datesubnochage', 0 );
200
    //    $datesubnochage_checkbox->addOption(1, _AM_SOAPBOX_YES);
201
    //    $datesub_tray -> addElement( $datesubnochage_checkbox );
202
    $sform->addElement($datesub_tray);
203
    //-----------
204
    // Тэги
205
    if (xoops_getModuleOption('usetag', 'soapbox')) {
206
        $moduleHandler = xoops_getHandler('module');
207
        $tagsModule    = $moduleHandler->getByDirname('tag');
208
        if (is_object($tagsModule)) {
209
            require_once XOOPS_ROOT_PATH . '/modules/tag/include/formtag.php';
210
            $itemid = \Xmf\Request::getInt('articleID', 0, 'GET');
211
            $catid  = 0;
0 ignored issues
show
The assignment to $catid is dead and can be removed.
Loading history...
212
            $sform->addElement(new \XoopsModules\Tag\FormTag('item_tag', 60, 255, $itemid, $catid = 0));
213
        }
214
    }
215
    // COMMENTS
216
    if (isset($GLOBALS['xoopsModuleConfig']['globaldisplaycomments'])
217
        && 1 === $GLOBALS['xoopsModuleConfig']['globaldisplaycomments']) {
218
        // COMMENTS
219
        // Code to allow comments
220
        $addcommentable_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_ALLOWCOMMENTS, 'commentable', $e_articles['commentable'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
221
        $sform->addElement($addcommentable_radio);
222
    }
223
224
    // OFFLINE
225
    // Code to take article offline, for maintenance purposes
226
    $offline_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_SWITCHOFFLINE, 'offline', $e_articles['offline'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
227
    $sform->addElement($offline_radio);
228
229
    // ARTICLE IN BLOCK
230
    // Code to put article in block
231
    $block_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_BLOCK, 'block', $e_articles['block'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
232
    $sform->addElement($block_radio);
233
234
    // notification public
235
    $notifypub_radio = new \XoopsFormRadioYN(_AM_SOAPBOX_NOTIFY, 'notifypub', $e_articles['notifypub'], ' ' . _AM_SOAPBOX_YES . '', ' ' . _AM_SOAPBOX_NO . '');
236
    $sform->addElement($notifypub_radio);
237
238
    // VARIOUS OPTIONS
239
    //----------
240
    $options_tray = new \XoopsFormElementTray(_AM_SOAPBOX_OPTIONS, '<br>');
241
242
    $html_checkbox = new \XoopsFormCheckBox('', 'html', $e_articles['html']);
243
    $html_checkbox->addOption(1, _AM_SOAPBOX_DOHTML);
244
    $options_tray->addElement($html_checkbox);
245
246
    $smiley_checkbox = new \XoopsFormCheckBox('', 'smiley', $e_articles['smiley']);
247
    $smiley_checkbox->addOption(1, _AM_SOAPBOX_DOSMILEY);
248
    $options_tray->addElement($smiley_checkbox);
249
250
    $xcodes_checkbox = new \XoopsFormCheckBox('', 'xcodes', $e_articles['xcodes']);
251
    $xcodes_checkbox->addOption(1, _AM_SOAPBOX_DOXCODE);
252
    $options_tray->addElement($xcodes_checkbox);
253
254
    $breaks_checkbox = new \XoopsFormCheckBox('', 'breaks', $e_articles['breaks']);
255
    $breaks_checkbox->addOption(1, _AM_SOAPBOX_BREAKS);
256
    $options_tray->addElement($breaks_checkbox);
257
258
    $sform->addElement($options_tray);
259
    //----------
260
261
    $sform->addElement(new \XoopsFormHidden('articleID', $e_articles['articleID']));
262
263
    $buttonTray = new \XoopsFormElementTray('', '');
264
    $hidden     = new \XoopsFormHidden('op', 'addart');
265
    $buttonTray->addElement($hidden);
266
267
    if (!$e_articles['articleID']) { // there's no articleID? Then it's a new article
268
        $butt_create = new \XoopsFormButton('', '', _AM_SOAPBOX_CREATE, 'submit');
269
        $butt_create->setExtra('onclick="this.form.elements.op.value=\'addart\'"');
270
        $buttonTray->addElement($butt_create);
271
272
        $butt_clear = new \XoopsFormButton('', '', _AM_SOAPBOX_CLEAR, 'reset');
273
        $buttonTray->addElement($butt_clear);
274
275
        $butt_cancel = new \XoopsFormButton('', '', _AM_SOAPBOX_CANCEL, 'button');
276
        $butt_cancel->setExtra('onclick="history.go(-1)"');
277
        $buttonTray->addElement($butt_cancel);
278
    } else { // else, we're editing an existing article
279
        $butt_create = new \XoopsFormButton('', '', _AM_SOAPBOX_MODIFY, 'submit');
280
        $butt_create->setExtra('onclick="this.form.elements.op.value=\'addart\'"');
281
        $buttonTray->addElement($butt_create);
282
283
        $butt_cancel = new \XoopsFormButton('', '', _AM_SOAPBOX_CANCEL, 'button');
284
        $butt_cancel->setExtra('onclick="history.go(-1)"');
285
        $buttonTray->addElement($butt_cancel);
286
    }
287
288
    $sform->addElement($buttonTray);
289
    //-----------
290
    //    $xoopsGTicket->addTicketXoopsFormElement($sform, __LINE__);
291
    //-----------
292
    $sform->display();
293
    unset($hidden);
294
}
295
296
/* -- Available operations -- */
297
switch ($op) {
298
    case 'mod':
299
        xoops_cp_header();
300
        $adminObject->displayNavigation(basename(__FILE__));
301
        $articleID = \Xmf\Request::getInt('articleID', \Xmf\Request::getInt('articleID', 0, 'GET'), 'POST');
302
        editarticle($articleID);
303
        break;
304
    case 'addart':
305
        //-------------------------
306
        if (!$GLOBALS['xoopsSecurity']->check()) {
307
            redirect_header(XOOPS_URL . '/', 3, $GLOBALS['xoopsSecurity']->getErrors());
308
        }
309
        //-------------------------
310
311
        //articleID check
312
        if (!isset($_POST['articleID'])) {
313
            redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
314
        } else {
315
            $articleID = \Xmf\Request::getInt('articleID', 0, 'POST');
316
        }
317
        //articleID check
318
        if (!isset($_POST['columnID'])) {
319
            redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
320
        } else {
321
            $columnID = \Xmf\Request::getInt('columnID', 0, 'POST');
322
        }
323
324
        //get category object
325
        $_categoryob = $entrydataHandler->getColumn($columnID);
326
        if (!is_object($_categoryob)) {
327
            redirect_header('index.php', 1, _AM_SOAPBOX_NEEDONECOLUMN);
328
        }
329
330
        $_entryob = $entrydataHandler->getArticle($articleID);
331
        //new data or edit
332
        if (!is_object($_entryob)) {
333
            $_entryob = $entrydataHandler->createArticle(true);
334
            //            $_entryob->cleanVars();
335
        }
336
        //set
337
338
        // new data post uid
339
        if (is_object($xoopsUser)) {
340
            $_entryob->setVar('uid', $xoopsUser->getVar('uid'));
341
        } else {
342
            //trigger_error ("Why:uid no mach") ;
343
            redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
344
        }
345
346
        if (\Xmf\Request::hasVar('articleID', 'POST')) {
347
            $_entryob->setVar('articleID', $articleID);
348
        }
349
        if (\Xmf\Request::hasVar('columnID', 'POST')) {
350
            $_entryob->setVar('columnID', $columnID);
351
        }
352
353
        if (\Xmf\Request::hasVar('weight', 'POST')) {
354
            $_entryob->setVar('weight', \Xmf\Request::getInt('weight', 0, 'POST'));
355
        }
356
357
        if (\Xmf\Request::hasVar('commentable', 'POST')) {
358
            $_entryob->setVar('commentable', \Xmf\Request::getInt('commentable', 0, 'POST'));
359
        }
360
        if (\Xmf\Request::hasVar('block', 'POST')) {
361
            $_entryob->setVar('block', \Xmf\Request::getInt('block', 0, 'POST'));
362
        }
363
        if (\Xmf\Request::hasVar('offline', 'POST')) {
364
            $_entryob->setVar('offline', \Xmf\Request::getInt('offline', 0, 'POST'));
365
        }
366
        if (\Xmf\Request::hasVar('notifypub', 'POST')) {
367
            $_entryob->setVar('notifypub', \Xmf\Request::getInt('notifypub', 0, 'POST'));
368
        }
369
370
        if (\Xmf\Request::hasVar('breaks', 'POST')) {
371
            $_entryob->setVar('breaks', \Xmf\Request::getInt('breaks', 0, 'POST'));
372
        }
373
        if (\Xmf\Request::hasVar('html', 'POST')) {
374
            $_entryob->setVar('html', \Xmf\Request::getInt('html', 0, 'POST'));
375
        }
376
        if (\Xmf\Request::hasVar('smiley', 'POST')) {
377
            $_entryob->setVar('smiley', \Xmf\Request::getInt('smiley', 0, 'POST'));
378
        }
379
        if (\Xmf\Request::hasVar('xcodes', 'POST')) {
380
            $_entryob->setVar('xcodes', \Xmf\Request::getInt('xcodes', 0, 'POST'));
381
        }
382
383
        if (\Xmf\Request::hasVar('headline', 'POST')) {
384
            $_entryob->setVar('headline', $_POST['headline']);
385
        }
386
        if (\Xmf\Request::hasVar('lead', 'POST')) {
387
            $_entryob->setVar('lead', $_POST['lead']);
388
        }
389
        if (\Xmf\Request::hasVar('bodytext', 'POST')) {
390
            $_entryob->setVar('bodytext', $_POST['bodytext']);
391
        }
392
        if (\Xmf\Request::hasVar('votes', 'POST')) {
393
            $_entryob->setVar('votes', \Xmf\Request::getInt('votes', 0, 'POST'));
394
        }
395
        if (\Xmf\Request::hasVar('rating', 'POST')) {
396
            $_entryob->setVar('rating', \Xmf\Request::getInt('rating', 0, 'POST'));
397
        }
398
399
        if (\Xmf\Request::hasVar('teaser', 'POST')) {
400
            $_entryob->setVar('teaser', $_POST['teaser']);
401
        }
402
403
        $autoteaser = \Xmf\Request::getInt('autoteaser', 0, 'POST');
404
        $charlength = \Xmf\Request::getInt('teaseramount', 0, 'POST');
405
        if ($autoteaser && $charlength) {
406
            $_entryob->setVar('teaser', xoops_substr($_entryob->getVar('bodytext', 'none'), 0, $charlength));
407
        }
408
        //datesub
409
        $datesubnochage  = \Xmf\Request::getInt('datesubnochage', 0, 'POST');
410
        $datesub_date_sl = isset($_POST['datesub']) ? (int)strtotime($_POST['datesub']['date']) : 0;
411
        $datesub_time_sl = \Xmf\Request::getInt('datesub', 0, 'POST');
412
        $datesub         = isset($_POST['datesub']) ? $datesub_date_sl + $datesub_time_sl : 0;
413
        //if (!$datesub || $_entryob->_isNew) {
414
        if (!$datesub) {
415
            $_entryob->setVar('datesub', time());
416
        } else {
417
            if (!$datesubnochage) {
418
                $_entryob->setVar('datesub', $datesub);
419
            }
420
        }
421
422
        $_entryob->setVar('submit', 0);
423
424
        // ARTICLE IMAGE
425
        // Define variables
426
        $error  = 0;
427
        $word   = null;
428
        $uid    = $xoopsUser->uid();
429
        $submit = 1;
430
        $date   = time();
431
        //-----------------
432
        //artimage
433
        if (\Xmf\Request::hasVar('artimage', 'POST')) {
434
            $_entryob->setVar('artimage', $_POST['artimage']);
435
        }
436
        if (isset($_FILES['cimage']['name'])) {
437
            $artimage_name = trim(strip_tags($myts->stripSlashesGPC($_FILES['cimage']['name'])));
438
            if ('' !== $artimage_name) {
439
                require_once XOOPS_ROOT_PATH . '/class/uploader.php';
440
                if (file_exists(XOOPS_ROOT_PATH . '/' . $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')) . '/' . $artimage_name)) {
441
                    redirect_header('index.php', 1, _AM_SOAPBOX_FILEEXISTS);
442
                }
443
                $allowed_mimetypes = ['image/gif', 'image/jpeg', 'image/pjpeg', 'image/png'];
444
445
                Soapbox\Utility::uploadFile($allowed_mimetypes, $artimage_name, 'index.php', 0, $myts->htmlSpecialChars($helper->getConfig('sbuploaddir')));
446
447
                $_entryob->setVar('artimage', $artimage_name);
448
            }
449
        }
450
        if ('' === $_entryob->getVar('artimage')) {
451
            $_entryob->setVar('artimage', 'blank.png');
452
        }
453
        //-----------------
454
        //-- module Tag
455
        $moduleHandler = xoops_getHandler('module');
456
        $tagsModule    = $moduleHandler->getByDirname('tag');
457
        if (is_object($tagsModule)) {
458
            $tagHandler = \XoopsModules\Tag\Helper::getInstance()->getHandler('Tag'); // $helper->getHandler('tag', 'tag');
459
            $tagHandler->updateByItem($_POST['item_tag'], $articleID, $xoopsModule->getVar('dirname'), $catid = 0);
460
        }
461
        // Save to database
462
        if ($_entryob->_isNew) {
463
            if (!$entrydataHandler->insertArticle($_entryob)) {
464
                xoops_cp_header();
465
                $adminObject->displayNavigation(basename(__FILE__));
466
                // print_r($_entryob->getErrors());
467
                xoops_cp_footer();
468
                // exit();
469
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTCREATED);
470
            } else {
471
                // Notify of to admin only for approve
472
                $entrydataHandler->newArticleTriggerEvent($_entryob, 'new_article');
473
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTCREATEDOK);
474
            }
475
        } else {
476
            if (!$entrydataHandler->insertArticle($_entryob)) {
477
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTNOTUPDATED);
478
            } else {
479
                $entrydataHandler->newArticleTriggerEvent($_entryob, 'new_article');
480
                redirect_header('index.php', 1, _AM_SOAPBOX_ARTMODIFIED);
481
            }
482
        }
483
        exit();
484
        break;
485
    case 'del':
486
487
        $confirm = \Xmf\Request::getInt('confirm', 0, 'POST');
488
489
        // confirmed, so delete
490
        if (1 === $confirm) {
491
            //-------------------------
492
            if (!$GLOBALS['xoopsSecurity']->check()) {
493
                redirect_header(XOOPS_URL . '/', 3, $GLOBALS['xoopsSecurity']->getErrors());
494
            }
495
            //-------------------------
496
            //articleID check
497
            if (!isset($_POST['articleID'])) {
498
                redirect_header('index.php', 1, _NOPERM);
499
            } else {
500
                $articleID = \Xmf\Request::getInt('articleID', 0, 'POST');
501
            }
502
503
            $_entryob = $entrydataHandler->getArticle($articleID);
504
            if (!is_object($_entryob)) {
505
                redirect_header('index.php', 1, _NOPERM);
506
            }
507
508
            if (!$entrydataHandler->deleteArticle($_entryob)) {
509
                trigger_error('ERROR:not deleted from database');
510
                exit();
511
            }
512
            $headline = $myts->htmlSpecialChars($_entryob->getVar('headline'));
513
            redirect_header('index.php', 1, sprintf(_AM_SOAPBOX_ARTISDELETED, $headline));
514
        } else {
515
            $articleID = \Xmf\Request::getInt('articleID', \Xmf\Request::getInt('articleID', 0, 'GET'), 'POST');
516
            $_entryob  = $entrydataHandler->getArticle($articleID);
517
            if (!is_object($_entryob)) {
518
                redirect_header('index.php', 1, _NOPERM);
519
            }
520
            $headline = $myts->htmlSpecialChars($_entryob->getVar('headline'));
521
            xoops_cp_header();
522
            $adminObject->displayNavigation(basename(__FILE__));
523
            xoops_confirm([
524
                              'op'        => 'del',
525
                              'articleID' => $articleID,
526
                              'confirm'   => 1,
527
                              'headline'  => $headline,
528
                          ], 'article.php', _AM_SOAPBOX_DELETETHISARTICLE . '<br><br>' . $headline, _AM_SOAPBOX_DELETE);
529
            xoops_cp_footer();
530
        }
531
        exit();
532
        break;
533
    case 'reorder':
534
        //-------------------------
535
        if (!$GLOBALS['xoopsSecurity']->check()) {
536
            redirect_header(XOOPS_URL . '/', 3, $GLOBALS['xoopsSecurity']->getErrors());
537
        }
538
        $entrydataHandler->reorderArticlesUpdate($_POST['articleweight']);
539
        redirect_header('index.php', 1, _AM_SOAPBOX_ORDERUPDATED);
540
        break;
541
    case 'default':
542
    default:
543
        xoops_cp_header();
544
        $adminObject->displayNavigation(basename(__FILE__));
545
        editarticle(0);
546
        //showArticles (0);
547
        break;
548
}
549
require_once __DIR__ . '/admin_footer.php';
550