XoopsModules25x /
soapbox
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||
| 2 | |||||
| 3 | namespace XoopsModules\Soapbox; |
||||
| 4 | |||||
| 5 | /* |
||||
| 6 | * You may not change or alter any portion of this comment or credits |
||||
| 7 | * of supporting developers from this source code or any supporting source code |
||||
| 8 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||
| 9 | * |
||||
| 10 | * This program is distributed in the hope that it will be useful, |
||||
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
| 13 | */ |
||||
| 14 | |||||
| 15 | /** |
||||
| 16 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||
| 17 | * @license {@link http://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||||
| 18 | * @package |
||||
| 19 | * @since |
||||
| 20 | * @author XOOPS Development Team |
||||
| 21 | */ |
||||
| 22 | |||||
| 23 | use XoopsModules\Soapbox; |
||||
| 24 | |||||
| 25 | // defined('XOOPS_ROOT_PATH') || die('Restricted access'); |
||||
| 26 | //require_once XOOPS_ROOT_PATH . '/modules/soapbox/include/cleantags.php'; |
||||
| 27 | if (!defined('XOBJ_SOAPBOX_DTYPE_FLOAT')) { |
||||
| 28 | define('XOBJ_SOAPBOX_DTYPE_FLOAT', 21); |
||||
| 29 | } |
||||
| 30 | |||||
| 31 | /** |
||||
| 32 | * Class ArticlesHandler |
||||
| 33 | */ |
||||
| 34 | class ArticlesHandler extends \XoopsPersistableObjectHandler |
||||
| 35 | { |
||||
| 36 | public $totalarts_AllPermcheck; |
||||
| 37 | |||||
| 38 | /** |
||||
| 39 | * create a new entry |
||||
| 40 | * |
||||
| 41 | * @param bool $isNew flag the new objects as "new"? |
||||
| 42 | * @return Articles Articles |
||||
| 43 | */ |
||||
| 44 | public function create($isNew = true) |
||||
| 45 | { |
||||
| 46 | $sbarticle = new Articles(); |
||||
| 47 | if ($isNew) { |
||||
| 48 | $sbarticle->setNew(); |
||||
| 49 | } |
||||
| 50 | |||||
| 51 | return $sbarticle; |
||||
| 52 | } |
||||
| 53 | |||||
| 54 | /** |
||||
| 55 | * retrieve a entry |
||||
| 56 | * |
||||
| 57 | * @param mixed|null $id |
||||
| 58 | * @param null $fields |
||||
|
0 ignored issues
–
show
Documentation
Bug
introduced
by
Loading history...
|
|||||
| 59 | * @return mixed reference to the <a href='psi_element://soapboxEntry'>soapboxEntry</a> object, FALSE if failed |
||||
| 60 | * object, FALSE if failed |
||||
| 61 | * object, FALSE if failed |
||||
| 62 | * @internal param int $articleID articleID of the entry |
||||
| 63 | */ |
||||
| 64 | public function get($id = null, $fields = null) //&get($id) |
||||
| 65 | { |
||||
| 66 | $ret = false; |
||||
| 67 | if ((int)$id > 0) { |
||||
| 68 | $sql = 'SELECT * FROM ' . $this->db->prefix('sbarticles') . " WHERE articleID = '$id'"; |
||||
| 69 | if (!$result = $this->db->query($sql)) { |
||||
| 70 | return $ret; |
||||
| 71 | } |
||||
| 72 | $numrows = $this->db->getRowsNum($result); |
||||
| 73 | if (1 === $numrows) { |
||||
| 74 | $sbarticle = new Articles(); |
||||
| 75 | $sbarticle->assignVars($this->db->fetchArray($result)); |
||||
| 76 | //pre_offline value buckup |
||||
| 77 | if ($sbarticle->getVar('offline') || $sbarticle->getVar('submit')) { |
||||
| 78 | $sbarticle->pre_offline = 1; |
||||
| 79 | } |
||||
| 80 | |||||
| 81 | return $sbarticle; |
||||
| 82 | } |
||||
| 83 | } |
||||
| 84 | |||||
| 85 | return $ret; |
||||
| 86 | } |
||||
| 87 | |||||
| 88 | /** |
||||
| 89 | * retrieve entrys from the database |
||||
| 90 | * |
||||
| 91 | * @param \CriteriaElement $criteria {@link CriteriaElement} conditions to be match |
||||
| 92 | * @param bool $id_as_key use the articleID as key for the array? |
||||
| 93 | * @param bool $as_object |
||||
| 94 | * @return array array of <a href='psi_element://Articles'>Articles</a> objects |
||||
| 95 | * objects |
||||
| 96 | */ |
||||
| 97 | public function &getObjects(\CriteriaElement $criteria = null, $id_as_key = false, $as_object = true) |
||||
| 98 | { |
||||
| 99 | $ret = []; |
||||
| 100 | $limit = $start = 0; |
||||
| 101 | $sql = 'SELECT * FROM ' . $this->db->prefix('sbarticles'); |
||||
| 102 | if (null !== $criteria && $criteria instanceof \CriteriaElement) { |
||||
| 103 | $sql .= ' ' . $criteria->renderWhere(); |
||||
|
0 ignored issues
–
show
The method
renderWhere() does not exist on CriteriaElement. Did you maybe mean render()?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces. This is most likely a typographical error or the method has been renamed. Loading history...
|
|||||
| 104 | if ('' !== $criteria->getSort()) { |
||||
| 105 | $sql .= ' ORDER BY ' . $criteria->getSort() . ' ' . $criteria->getOrder(); |
||||
| 106 | } |
||||
| 107 | $limit = $criteria->getLimit(); |
||||
| 108 | $start = $criteria->getStart(); |
||||
| 109 | } |
||||
| 110 | $result = $this->db->query($sql, $limit, $start); |
||||
| 111 | if (!$result) { |
||||
| 112 | return $ret; |
||||
| 113 | } |
||||
| 114 | while (false !== ($myrow = $this->db->fetchArray($result))) { |
||||
| 115 | $sbarticle = new Articles(); |
||||
| 116 | $sbarticle->assignVars($myrow); |
||||
| 117 | if (!$id_as_key) { |
||||
| 118 | $ret[] = $sbarticle; |
||||
| 119 | } else { |
||||
| 120 | $ret[$myrow['articleID']] = $sbarticle; |
||||
| 121 | } |
||||
| 122 | unset($sbarticle); |
||||
| 123 | } |
||||
| 124 | $this->db->freeRecordSet($result); |
||||
| 125 | |||||
| 126 | return $ret; |
||||
| 127 | } |
||||
| 128 | |||||
| 129 | /** |
||||
| 130 | * insert a new entry in the database |
||||
| 131 | * |
||||
| 132 | * @param \XoopsObject $sbarticle reference to the {@link Articles} |
||||
| 133 | * object |
||||
| 134 | * @param bool $force |
||||
| 135 | * @return bool FALSE if failed, TRUE if already present and unchanged or successful |
||||
| 136 | */ |
||||
| 137 | public function insert(\XoopsObject $sbarticle, $force = false) |
||||
| 138 | { |
||||
| 139 | // if ('soapboxsbarticles' !== mb_strtolower(get_class($sbarticle))) { |
||||
| 140 | if (mb_strtolower(get_class($sbarticle)) !== mb_strtolower(Articles::class)) { |
||||
| 141 | return false; |
||||
| 142 | } |
||||
| 143 | if (!$sbarticle->isDirty()) { |
||||
| 144 | return true; |
||||
| 145 | } |
||||
| 146 | if (!$sbarticle->cleanVars()) { |
||||
| 147 | return false; |
||||
| 148 | } |
||||
| 149 | foreach ($sbarticle->cleanVars as $k => $v) { |
||||
| 150 | ${$k} = $v; |
||||
| 151 | } |
||||
| 152 | // RMV-NOTIFY |
||||
| 153 | if ($sbarticle->isNew()) { |
||||
| 154 | $articleID = $this->db->genId($this->db->prefix('sbarticles') . '_articleID_seq'); |
||||
| 155 | $sql = sprintf('INSERT INTO `%s` (articleID, columnID, headline, lead, bodytext, teaser, uid, submit, datesub, counter, weight, html, smiley, xcodes, breaks, BLOCK, artimage, votes, rating, commentable, offline, notifypub) VALUES (%u, %u, %s, %s, %s, %s, %u, %u, %u, %u, %u, %u, %u, %u, %u, %u, %s, %u, %f, %u, %u, %u )', |
||||
| 156 | $this->db->prefix('sbarticles'), $articleID, $columnID, $this->db->quoteString($headline), $this->db->quoteString($lead), $this->db->quoteString($bodytext), $this->db->quoteString($teaser), $uid, $submit, $datesub, $counter, $weight, $html, $smiley, $xcodes, $breaks, |
||||
| 157 | $block, $this->db->quoteString($artimage), $votes, $rating, $commentable, $offline, $notifypub); |
||||
| 158 | } else { |
||||
| 159 | $sql = sprintf('UPDATE `%s` SET columnID = %u , headline = %s , lead = %s , bodytext = %s , teaser = %s , uid = %u , submit = %u , datesub = %u , counter = %u , weight = %u , html = %u , smiley = %u , xcodes = %u , breaks = %u , BLOCK = %u , artimage = %s , votes = %u , rating = %f , commentable = %u , offline = %u , notifypub = %u WHERE articleID = %u', |
||||
| 160 | $this->db->prefix('sbarticles'), $columnID, $this->db->quoteString($headline), $this->db->quoteString($lead), $this->db->quoteString($bodytext), $this->db->quoteString($teaser), $uid, $submit, $datesub, $counter, $weight, $html, $smiley, $xcodes, $breaks, $block, |
||||
| 161 | $this->db->quoteString($artimage), $votes, $rating, $commentable, $offline, $notifypub, $articleID); |
||||
| 162 | } |
||||
| 163 | if ($force) { |
||||
| 164 | $result = $this->db->queryF($sql); |
||||
| 165 | } else { |
||||
| 166 | $result = $this->db->query($sql); |
||||
| 167 | } |
||||
| 168 | if (!$result) { |
||||
| 169 | return false; |
||||
| 170 | } |
||||
| 171 | if (empty($articleID)) { |
||||
| 172 | $articleID = $this->db->getInsertId(); |
||||
| 173 | } |
||||
| 174 | $sbarticle->assignVar('articleID', $articleID); |
||||
| 175 | |||||
| 176 | return true; |
||||
| 177 | } |
||||
| 178 | |||||
| 179 | /** |
||||
| 180 | * delete a entry from the database |
||||
| 181 | * |
||||
| 182 | * @param \XoopsObject $sbarticle reference to the entry to delete |
||||
| 183 | * @param bool $force |
||||
| 184 | * @return bool FALSE if failed. |
||||
| 185 | */ |
||||
| 186 | public function delete(\XoopsObject $sbarticle, $force = false) |
||||
| 187 | { |
||||
| 188 | global $xoopsModule; |
||||
| 189 | if (mb_strtolower(get_class($sbarticle)) !== mb_strtolower(Articles::class)) { |
||||
| 190 | return false; |
||||
| 191 | } |
||||
| 192 | $sql = sprintf('DELETE FROM `%s` WHERE articleID = %u', $this->db->prefix('sbarticles'), $sbarticle->getVar('articleID')); |
||||
|
0 ignored issues
–
show
It seems like
$sbarticle->getVar('articleID') can also be of type array and array; however, parameter $args of sprintf() does only seem to accept string, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 193 | if ($force) { |
||||
| 194 | $result = $this->db->queryF($sql); |
||||
| 195 | } else { |
||||
| 196 | $result = $this->db->query($sql); |
||||
| 197 | } |
||||
| 198 | if (!$result) { |
||||
| 199 | return false; |
||||
| 200 | } |
||||
| 201 | |||||
| 202 | return true; |
||||
| 203 | } |
||||
| 204 | |||||
| 205 | /** |
||||
| 206 | * count entrys matching a condition |
||||
| 207 | * |
||||
| 208 | * @param \CriteriaElement $criteria {@link CriteriaElement} to match |
||||
| 209 | * @return int count of entrys |
||||
| 210 | */ |
||||
| 211 | public function getCount(\CriteriaElement $criteria = null) |
||||
| 212 | { |
||||
| 213 | $sql = 'SELECT COUNT(*) FROM ' . $this->db->prefix('sbarticles'); |
||||
| 214 | |||||
| 215 | if (null !== $criteria && $criteria instanceof \CriteriaElement) { |
||||
| 216 | $sql .= ' ' . $criteria->renderWhere(); |
||||
| 217 | } |
||||
| 218 | $result = $this->db->query($sql); |
||||
| 219 | if (!$result) { |
||||
| 220 | return 0; |
||||
| 221 | } |
||||
| 222 | list($count) = $this->db->fetchRow($result); |
||||
| 223 | |||||
| 224 | return $count; |
||||
| 225 | } |
||||
| 226 | |||||
| 227 | /** |
||||
| 228 | * updates a single field in a Article record |
||||
| 229 | * |
||||
| 230 | * @param Articles $entry reference to the {@link Articles} object |
||||
| 231 | * @param string $fieldName name of the field to update |
||||
| 232 | * @param string $fieldValue updated value for the field |
||||
| 233 | * @param bool $force |
||||
| 234 | * @return bool TRUE if success or unchanged, FALSE on failure |
||||
| 235 | */ |
||||
| 236 | public function updateByField($entry, $fieldName, $fieldValue, $force = false) |
||||
| 237 | { |
||||
| 238 | // if (mb_strtolower(get_class($entry)) !== mb_strtolower('Articles')) { |
||||
| 239 | if (mb_strtolower(get_class($entry)) !== mb_strtolower(Articles::class)) { |
||||
| 240 | return false; |
||||
| 241 | } |
||||
| 242 | $entry->setVar($fieldName, $fieldValue); |
||||
| 243 | |||||
| 244 | return $this->insert($entry, $force); |
||||
| 245 | } |
||||
| 246 | } |
||||
| 247 |