Issues (278)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Utility.php (17 issues)

1
<?php
2
3
namespace XoopsModules\Soapbox;
4
5
use XoopsModules\Soapbox;
6
7
/**
8
 * Class Utility
9
 */
10
class Utility extends \XoopsObject
11
{
12
    use Common\VersionChecks; //checkVerXoops, checkVerPhp Traits
13
14
    use Common\ServerStats; // getServerStats Trait
15
16
    use Common\FilesManagement; // Files Management Trait
17
18
    /**
19
     * getLinkedUnameFromId()
20
     *
21
     * @param  int $userid Userid of author etc
22
     * @param  int $name   :  0 Use Usenamer 1 Use realname
23
     * @return string
24
     */
25
    public static function getLinkedUnameFromId($userid = 0, $name = 0)
26
    {
27
        if (!is_numeric($userid)) {
28
            return $userid;
29
        }
30
        $myts   = \MyTextSanitizer::getInstance();
31
        $userid = (int)$userid;
32
        if ($userid > 0) {
33
            $memberHandler = xoops_getHandler('member');
34
            $user          = $memberHandler->getUser($userid);
35
36
            if (is_object($user)) {
37
                $username  = $user->getVar('uname');
38
                $usernameu = $user->getVar('name');
39
40
                if ($name && !empty($usernameu)) {
41
                    $username = $user->getVar('name');
42
                }
43
                if (!empty($usernameu)) {
44
                    $linkeduser = $myts->htmlSpecialChars($usernameu) . " [<a href='" . XOOPS_URL . '/userinfo.php?uid=' . $userid . "'>" . $myts->htmlSpecialChars($username) . '</a>]';
45
                } else {
46
                    //                    $linkeduser = "<a href='".XOOPS_URL."/userinfo.php?uid=".$userid."'>". ucfirst($ts->htmlSpecialChars($username)) .'</a>';
47
                    $linkeduser = "<a href='" . XOOPS_URL . '/userinfo.php?uid=' . $userid . "'>" . $myts->htmlSpecialChars($username) . '</a>';
48
                }
49
50
                return $linkeduser;
51
            }
52
        }
53
54
        return $myts->htmlSpecialChars($GLOBALS['xoopsConfig']['anonymous']);
55
    }
56
57
    /*
58
    public static function displayimage($image = 'blank.gif', $path = '', $imgsource = '', $alttext = '')
59
    {
60
        global $xoopsConfig, $xoopsUser, $xoopsModule;
61
        $myts = \MyTextSanitizer::getInstance();
62
        $showimage = '';
63
64
        if ($path) {
65
            $showimage = "<a href='" . $myts->htmlSpecialChars(strip_tags($path)) . "'>";
66
        }
67
68
        if (!is_dir(XOOPS_ROOT_PATH."/".$imgsource."/".$image) && file_exists(XOOPS_ROOT_PATH."/".$imgsource."/".$image)) {
69
            $showimage .= "<img src='".XOOPS_URL."/".$myts->htmlSpecialChars(strip_tags($imgsource))."/".$myts->htmlSpecialChars(strip_tags($image))."' border='0' alt=".$myts->htmlSpecialChars(strip_tags($alttext))."></a>";
70
        } else {
71
            if ($xoopsUser && $xoopsUser->isAdmin($xoopsModule->mid())) {
72
                $showimage .= "<img src='".XOOPS_URL.'/modules/'.$xoopsModule->dirname()."/assets/images/brokenimg.png' border='0' alt='"._AM_SOAPBOX_ISADMINNOTICE."'></a>";
73
            } else {
74
                $showimage .= "<img src='".XOOPS_URL.'/modules/'.$xoopsModule->dirname()."/assets/images/blank.png' border='0' alt=".$myts->htmlSpecialChars(strip_tags($alttext))."></a>";
75
            }
76
        }
77
        // clearstatcache();
78
        return $showimage;
79
    }
80
    */
81
82
    /**
83
     * @param        $allowed_mimetypes
84
     * @param        $httppostfiles
85
     * @param string $redirecturl
86
     * @param int    $num
87
     * @param string $dir
88
     * @param int    $redirect
89
     */
90
    public static function uploadFile(
91
        $allowed_mimetypes,
92
        $httppostfiles,
0 ignored issues
show
The parameter $httppostfiles is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

92
        /** @scrutinizer ignore-unused */ $httppostfiles,

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
93
        $redirecturl = 'index.php',
94
        $num = 0,
95
        $dir = 'uploads',
96
        $redirect = 0)
97
    {
98
        require_once XOOPS_ROOT_PATH . '/class/uploader.php';
99
        $myts = \MyTextSanitizer::getInstance();
100
101
        global $xoopsConfig, $_POST;
102
        /** @var Soapbox\Helper $helper */
103
        $helper = Soapbox\Helper::getInstance();
104
105
        $maxfilesize   = (int)$helper->getConfig('maxfilesize');
106
        $maxfilewidth  = (int)$helper->getConfig('maximgwidth');
107
        $maxfileheight = (int)$helper->getConfig('maximgheight');
108
        $uploaddir     = XOOPS_ROOT_PATH . '/' . $myts->htmlSpecialChars(strip_tags($dir)) . '/';
109
110
        $uploader = new \XoopsMediaUploader($uploaddir, $allowed_mimetypes, $maxfilesize, $maxfilewidth, $maxfileheight);
111
112
        if ($uploader->fetchMedia($myts->htmlSpecialChars(strip_tags($_POST['xoops_upload_file'][$num])))) {
113
            if (!$uploader->upload()) {
114
                $errors = $uploader->getErrors();
115
                redirect_header($redirecturl, 1, $errors);
116
            } else {
117
                if ($redirect) {
118
                    redirect_header($redirecturl, '1', 'Image Uploaded');
119
                }
120
            }
121
        } else {
122
            $errors = $uploader->getErrors();
123
            redirect_header($redirecturl, 1, $errors);
124
        }
125
    }
126
127
    /*
128
    public static function htmlarray($thishtmlpage, $thepath)
129
    {
130
        global $xoopsConfig, $wfsConfig;
131
132
        $file_array = filesarray( $thepath );
133
134
        echo "<select size='1' name='htmlpage'>";
135
        echo "<option value='-1'>------</option>";
136
        foreach ($file_array as $htmlpage) {
137
            if ($htmlpage == $thishtmlpage) {
138
                $opt_selected = "selected";
139
            } else {
140
                $opt_selected = "";
141
            }
142
            echo "<option value='" . $htmlpage . "' $opt_selected>" . $htmlpage . "</option>";
143
        }
144
        echo "</select>";
145
146
        return $htmlpage;
147
    }
148
    */
149
    /*
150
    public static function filesarray($filearray)
151
    {
152
        $files = array();
153
        $dir = opendir( $filearray );
154
155
        while ( ( $file = readdir( $dir ) ) !== false ) {
156
            if ( ( !preg_match( "/^[.]{1,2}$/", $file ) && preg_match( "/[.htm|.html|.xhtml]$/i", $file ) && !is_dir( $file ) ) ) {
157
                if ( strtolower( $file ) != 'cvs' && !is_dir( $file ) ) {
158
                    $files[$file] = $file;
159
                }
160
            }
161
        }
162
        closedir( $dir );
163
        asort( $files );
164
        reset( $files );
165
166
        return $files;
167
    }
168
    */
169
    /*
170
    public static function getuserForm($user)
171
    {
172
        global $xoopsDB, $xoopsConfig;
173
        $myts = \MyTextSanitizer::getInstance();
174
175
        echo "<select name='author'>";
176
        echo "<option value='-1'>------</option>";
177
        $result = $xoopsDB->query("SELECT uid, uname FROM ".$xoopsDB->prefix("users")." ORDER BY uname");
178
179
        while (false !== (list($uid, $uname) = $xoopsDB->fetchRow($result))) {
180
            if ($uid == $user) {
181
                $opt_selected = "selected";
182
            } else {
183
                $opt_selected = "";
184
            }
185
            echo "<option value='".(int)($uid)."' $opt_selected>".$myts->htmlSpecialChars($uname)."</option>";
186
        }
187
        echo "</select>";
188
    }
189
    */
190
191
    /**
192
     * @param $author
193
     * @return string
194
     */
195
    public static function getAuthorName($author)
196
    {
197
        $ret = '';
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
198
        //get author
199
        $_authoruserHandler = xoops_getHandler('user');
200
        $_authoruser        = $_authoruserHandler->get($author);
201
        if (!is_object($_authoruser)) {
202
            $name3      = '';
0 ignored issues
show
The assignment to $name3 is dead and can be removed.
Loading history...
203
            $uname3     = '';
204
            $authorname = '';
205
        } else {
206
            $name3      = $_authoruser->getVar('name');
207
            $uname3     = $_authoruser->getVar('uname');
208
            $authorname = $name3;
209
        }
210
        //-------------------------------------
211
        $ret = $authorname;
212
        if (empty($authorname) || '' === $authorname) {
213
            $ret = $uname3;
214
        }
215
216
        return $ret;
217
        //-------------------------------------
218
    }
219
220
    /**
221
     * @param int $showCreate
222
     */
223
    public static function showColumns($showCreate = 0)
0 ignored issues
show
The parameter $showCreate is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

223
    public static function showColumns(/** @scrutinizer ignore-unused */ $showCreate = 0)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
224
    {
225
        global $xoopsModule;
226
        /** @var Soapbox\Helper $helper */
227
        $helper = Soapbox\Helper::getInstance();
228
229
        $pathIcon16 = \Xmf\Module\Admin::iconUrl('', 16);
230
        $myts       = \MyTextSanitizer::getInstance();
0 ignored issues
show
The assignment to $myts is dead and can be removed.
Loading history...
231
        require_once XOOPS_ROOT_PATH . '/class/pagenav.php';
232
        require_once XOOPS_ROOT_PATH . '/class/xoopsform/grouppermform.php';
233
        //        require_once XOOPS_ROOT_PATH . '/modules/' . $xoopsModule->dirname() . '/include/cleantags.php';
234
        $module_id = $xoopsModule->getVar('mid');
0 ignored issues
show
The assignment to $module_id is dead and can be removed.
Loading history...
235
        $startcol  = \Xmf\Request::getInt('startcol', 0, 'GET');
236
237
        /* Code to show existing columns */
238
        echo "<h3 style='color: #2F5376; margin: 0 0 4px 0;'>" . _AM_SOAPBOX_SHOWCOLS . '</h3>';
239
        echo '<span style="color: #567; margin: 3px 0 12px 0; font-size: small; display: block; ">' . _AM_SOAPBOX_COLSTEXT . '</span>';
240
241
        //    if ($showCreate == 1) {
242
        //        echo
243
        //            "<a style='border: 1px solid #5E5D63; color: #000000; font-family: verdana, tahoma, arial, helvetica, sans-serif; font-size: 1em; padding: 4px 8px; text-align:center;' href='column.php'>"
244
        //            . _AM_SOAPBOX_CREATECOL . "</a><br><br>";
245
        //    }
246
        // To create existing columns table
247
        //----------------------------
248
        //get category object
249
        /** @var \XoopsModules\Soapbox\EntrydataHandler $entrydataHandler */
250
        $entrydataHandler = new \XoopsModules\Soapbox\EntrydataHandler();
251
        $numrows          = $entrydataHandler->getColumnCount();
252
        $criteria         = new \CriteriaCompo();
253
        $criteria->setSort('weight');
254
        $criteria->setLimit((int)$helper->getConfig('perpage'));
255
        $criteria->setStart($startcol);
256
        $categoryobArray = $entrydataHandler->getColumns($criteria);
257
        unset($criteria);
258
        if ($numrows > 0) {
259
            echo '<form action="column.php" method="post" name="reordercols">';
260
        }
261
        echo "<table width='100%' cellspacing='1' cellpadding='3' border='0' class='outer'>";
262
        echo '<tr>';
263
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ID . '</b></td>';
264
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_WEIGHT . '</b></td>';
265
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_AUTHOR . '</b></td>';
266
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ARTCOLNAME . '</b></td>';
267
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_DESCRIP . '</b></td>';
268
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ACTION . '</b></td>';
269
        echo '</tr>';
270
271
        if ($numrows > 0) { // That is, if there ARE columns in the system
272
            //----------------------------
273
            $cont = 0;
274
            foreach ($categoryobArray as $_categoryob) {
275
                //----------------------------
276
                //get vars
277
                ++$cont;
278
                $category      = $_categoryob->toArray(); //all assign
279
                $category_vars = $_categoryob->getVars();
280
                foreach ($category_vars as $k => $v) {
281
                    ${$k} = $_categoryob->getVar($k);
282
                }
283
                //----------------------------
284
285
                $author = self::getLinkedUnameFromId($author, 0);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $author does not seem to be defined for all execution paths leading up to this point.
Loading history...
286
                $modify = "<a href='column.php?op=mod&columnID=" . $category['columnID'] . "'><img src='" . $pathIcon16 . "/edit.png' ALT='" . _AM_SOAPBOX_EDITCOL . "'></a>";
287
                $delete = "<a href='column.php?op=del&columnID=" . $category['columnID'] . "'><img src='" . $pathIcon16 . "/delete.png' ALT='" . _AM_SOAPBOX_DELETECOL . "'></a>";
288
                $style  = (0 === ($cont % 2)) ? 'even' : 'odd';
289
                echo '<tr class="' . $style . '">';
290
                echo '<td class="txtcenter">' . $category['columnID'] . '</td>';
291
                echo '<td class="txtcenter"><input type="text" name="columnweight[' . $category['columnID'] . ']" value="' . $weight . '" size="3" maxlength="3" style="text-align: center;"></td>';
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $weight seems to be never defined.
Loading history...
292
                echo '<td class="txtcenter">' . $category['author'] . '</td>';
293
                echo '<td class="txtcenter">' . $category['name'] . '</td>';
294
                echo '<td class="txtcenter">' . $category['description'] . '</td>';
295
                echo '<td class="txtcenter">' . $modify . ' ' . $delete . '</td>';
296
                echo '</tr>';
297
            }
298
        } else { // that is, $numrows = 0, there's no columns yet
299
            echo '<tr>';
300
            echo "<td class='head' align='center' colspan= '7'>" . _AM_SOAPBOX_NOCOLS . '</td>';
301
            echo '</tr>';
302
            $category['columnID'] = '0';
0 ignored issues
show
Comprehensibility Best Practice introduced by
$category was never initialized. Although not strictly required by PHP, it is generally a good practice to add $category = array(); before regardless.
Loading history...
303
        }
304
        echo "</table>\n";
305
        $pagenav = new \XoopsPageNav($numrows, (int)$helper->getConfig('perpage'), $startcol, 'startcol', 'columnID=' . $category['columnID']);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $category does not seem to be defined for all execution paths leading up to this point.
Loading history...
306
        echo '<div style="text-align:right;">' . $pagenav->renderNav() . '</div>';
307
        echo "<br>\n";
308
309
        if ($numrows > 0) {
310
            echo "<input type='hidden' name='op' value='reorder'>";
311
            //--------------------
312
            echo $GLOBALS['xoopsSecurity']->getTokenHTML();
313
            //--------------------
314
            echo '<div style="margin-bottom: 18px;"><input type="submit" name="submit" class="formButton" value="' . _AM_SOAPBOX_REORDERCOL . '"></div>';
315
            echo '</form>';
316
        }
317
    }
318
319
    /**
320
     * @param int $showCreate
321
     */
322
    public static function showArticles($showCreate = 0)
0 ignored issues
show
The parameter $showCreate is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

322
    public static function showArticles(/** @scrutinizer ignore-unused */ $showCreate = 0)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
323
    {
324
        global $xoopsModule;
325
        $myts = \MyTextSanitizer::getInstance();
326
        /** @var Soapbox\Helper $helper */
327
        $helper = Soapbox\Helper::getInstance();
328
329
        $pathIcon16 = \Xmf\Module\Admin::iconUrl('', 16);
330
        require_once XOOPS_ROOT_PATH . '/class/xoopslists.php';
331
        require_once XOOPS_ROOT_PATH . '/class/pagenav.php';
332
        require_once XOOPS_ROOT_PATH . '/class/xoopsform/grouppermform.php';
333
        //        require_once XOOPS_ROOT_PATH . '/modules/' . $xoopsModule->dirname() . '/include/cleantags.php';
334
335
        $module_id = $xoopsModule->getVar('mid');
0 ignored issues
show
The assignment to $module_id is dead and can be removed.
Loading history...
336
        $startart  = \Xmf\Request::getInt('startart', 0, 'GET');
337
        if (\Xmf\Request::hasVar('entries', 'POST')) {
338
            $entries = \Xmf\Request::getInt('entries', 0, 'POST');
339
        } else {
340
            $entries = \Xmf\Request::getInt('entries', 0, 'GET');
341
        }
342
        //---GET view sort --
343
        $sortname = isset($_GET['sortname']) ? mb_strtolower(trim(strip_tags($myts->stripSlashesGPC($_GET['sortname'])))) : 'datesub';
344
        if (!in_array($sortname, ['datesub', 'weight', 'counter', 'rating', 'headline'], true)) {
345
            $sortname = 'datesub';
346
        }
347
        $sortorder = isset($_GET['sortorder']) ? mb_strtoupper(trim(strip_tags($myts->stripSlashesGPC($_GET['sortorder'])))) : 'DESC';
348
        if (!in_array($sortorder, ['ASC', 'DESC'], true)) {
349
            $sortorder = 'DESC';
350
        }
351
        //---------------
352
        /* Code to show existing articles */
353
        echo "<h3 style='color: #2F5376; margin: 0 0 4px 0;'>" . _AM_SOAPBOX_SHOWARTS . '</h3>';
354
        echo '<span style="color: #567; margin: 3px 0 12px 0; font-size: small; display: block; ">' . _AM_SOAPBOX_ARTSTEXT . '</span>';
355
356
        //    if ($showCreate == 1) {
357
        //        echo
358
        //            "<a style='border: 1px solid #5E5D63; color: #000000; font-family: verdana, tahoma, arial, helvetica, sans-serif; font-size: 1em; padding: 4px 8px; text-align:center;' href='article.php'>"
359
        //            . _AM_SOAPBOX_CREATEART . "</a><br><br>";
360
        //    }
361
        // Articles count
362
        /** @var \XoopsModules\Soapbox\EntrydataHandler $entrydataHandler */
363
        $entrydataHandler = new \XoopsModules\Soapbox\EntrydataHandler();
364
        //----------------------------
365
        $criteria = new \CriteriaCompo();
366
        $criteria->add(new \Criteria('submit', 0));
367
        $criteria->add(new \Criteria('offline', 0));
368
        $tot_published = $entrydataHandler->getArticleCount($criteria);
369
        unset($criteria);
370
        //----------------------------
371
        $criteria = new \CriteriaCompo();
372
        $criteria->add(new \Criteria('submit', 0));
373
        $criteria->add(new \Criteria('offline', 1));
374
        $tot_offline = $entrydataHandler->getArticleCount($criteria);
375
        unset($criteria);
376
        //----------------------------
377
        $criteria = new \CriteriaCompo();
378
        $criteria->add(new \Criteria('submit', 1));
379
        $tot_submitted = $entrydataHandler->getArticleCount($criteria);
380
        unset($criteria);
381
        //----------------------------
382
        $tot_all = $entrydataHandler->getArticleCount();
383
        //----------------------------
384
        $criteria = new \CriteriaCompo();
385
        $criteria->add(new \Criteria('submit', 0));
386
        $tot_ok = $entrydataHandler->getArticleCount($criteria);
387
        unset($criteria);
388
        //----------------------------
389
390
        // Prepare string for table head
391
        if (0 === $entries) {
392
            $string = _AM_SOAPBOX_SHWALL;
393
        }
394
        if (1 === $entries) {
395
            $string = _AM_SOAPBOX_SHWONL;
396
        }
397
        if (2 === $entries) {
398
            $string = _AM_SOAPBOX_SHWOFF;
399
        }
400
        if (3 === $entries) {
401
            $string = _AM_SOAPBOX_SHWSUB;
402
        }
403
        if (4 === $entries) {
404
            $string = _AM_SOAPBOX_SHWAPV;
405
        }
406
407
        /* Code to show selected articles */
408
        echo "<form name='pick' id='pick' action='" . $myts->htmlSpecialChars(xoops_getenv('PHP_SELF')) . "' method='POST' style='margin: 0;'>"; ?>
409
        <table width='100%' cellspacing='1' cellpadding='2' border='0'
410
               style='border-left: 1px solid #c0c0c0; border-top: 1px solid #c0c0c0; border-right: 1px solid #c0c0c0;'>
411
            <tr>
412
                <td class='odd'><span style='font-weight: bold; font-variant: small-caps;'><?php echo $string ?></span></td>
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $string does not seem to be defined for all execution paths leading up to this point.
Loading history...
413
                <td class='odd' width='40%' align='right'><?php echo _AM_SOAPBOX_SELECTSTATUS; ?>
414
                    <select name='entries' onchange='submit()'>
415
                        <option value='0'
416
                            <?php
417
                            if (0 === $entries) {
418
                                echo 'selected';
419
                            } ?>>
420
                            <?php echo _AM_SOAPBOX_SELALL; ?>
421
                            [<?php echo $tot_all; ?>]
422
                        </option>
423
                        <option value='1' <?php if (1 === $entries) {
424
                            echo 'selected';
425
                        } ?>><?php echo _AM_SOAPBOX_SELONL; ?>
426
                            [<?php echo $tot_published; ?>]
427
                        </option>
428
                        <option value='2' <?php if (2 === $entries) {
429
                            echo 'selected';
430
                        } ?>>
431
                            <?php echo _AM_SOAPBOX_SELOFF; ?>
432
                            [<?php echo $tot_offline; ?>]
433
                        </option>
434
                        <option value='3' <?php if (3 === $entries) {
435
                            echo 'selected';
436
                        } ?>>
437
                            <?php echo _AM_SOAPBOX_SELSUB; ?>
438
                            [<?php echo $tot_submitted; ?>]
439
                        </option>
440
                        <option value='4' <?php if (4 === $entries) {
441
                            echo 'selected';
442
                        } ?>><?php echo _AM_SOAPBOX_SELAPV; ?>
443
                            [<?php echo $tot_ok; ?>]
444
                        </option>
445
                    </select>
446
                </td>
447
            </tr>
448
        </table>
449
        </form>
450
        <?php
451
452
        //----------------------------
453
        // Put column names in an array, to avoid a query in the while loop further ahead
454
        switch ($entries) {
455
            case 1:
456
                $submit  = 0;
457
                $offline = 0;
458
                break;
459
            case 2:
460
                //----------------------------
461
                $submit  = 0;
462
                $offline = 1;
463
                break;
464
            case 3:
465
                //----------------------------
466
                $submit  = 1;
467
                $offline = null;
468
                break;
469
            case 4:
470
                //----------------------------
471
                $submit = 0;
472
                break;
473
            case 0:
474
            default:
475
                $submit  = null;
476
                $offline = null;
477
                break;
478
        }
479
        //    function getArticlesAllPermcheck(
480
        //         $limit=0, $start=0,
481
        //         $checkRight = true, $published = true, $submit = 0, $offline = 0, $block = null ,
482
        //         $sortname = 'datesub', $sortorder = 'DESC',
483
        //         $select_sbcolumns = null , $NOTarticleIDs = null ,
484
        //         $approve_submit = false ,
485
        //         $id_as_key = false )
486
        //-------------------------------------
487
        $entryobArray = $entrydataHandler->getArticlesAllPermcheck((int)$helper->getConfig('perpage'), $startart, false, false, $submit, $offline, null, $sortname, $sortorder, null, null, false, true);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $offline does not seem to be defined for all execution paths leading up to this point.
Loading history...
488
        // Get number of articles in the selected condition ($cond)
489
        $numrows = $entrydataHandler->total_getArticlesAllPermcheck;
490
        if ($numrows > 0) {
491
            echo '<form action="article.php" method="post" name="reorderarticles\">';
492
        }
493
        echo "<table width='100%' cellspacing='1' cellpadding='3' border='0' class='outer'>";
494
        echo '<tr>';
495
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ARTID . '</b></td>';
496
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_WEIGHT . '</b></td>';
497
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ARTCOLNAME . '</b></td>';
498
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ARTHEADLINE . '</b></td>';
499
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ARTCREATED . '</b></td>';
500
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_STATUS . '</b></td>';
501
        echo '<th class="txtcenter"><b>' . _AM_SOAPBOX_ACTION . '</b></td>';
502
        echo '</tr>';
503
504
        if ($numrows > 0) { // That is, if there ARE articles in the said condition
505
            // Retrieve rows for those items
506
507
            $colarray = [];
0 ignored issues
show
The assignment to $colarray is dead and can be removed.
Loading history...
508
            $cont     = 0;
509
510
            foreach ($entryobArray as $key => $_entryob) {
511
                //get vars
512
                ++$cont;
513
                //-------------------------------------
514
                $articles = $_entryob->toArray();
515
                //--------------------
516
                $colname = !empty($_entryob->_sbcolumns) ? $_entryob->_sbcolumns->getVar('name') : '';
517
                //--------------------
518
                $created = $myts->htmlSpecialChars(formatTimestamp($articles['datesub'], $helper->getConfig('dateformat')));
519
                $modify  = "<a href='article.php?op=mod&articleID=" . $articles['articleID'] . "'><img src='" . $pathIcon16 . "/edit.png' ALT='" . _AM_SOAPBOX_EDITART . "'></a>";
520
                $delete  = "<a href='article.php?op=del&articleID=" . $articles['articleID'] . "'><img src='" . $pathIcon16 . "/delete.png' ALT='" . _AM_SOAPBOX_DELETEART . "'></a>";
521
522
                //if ($offline == 0) {
523
                if (0 === $articles['offline']) {
524
                    $status = "<img src='" . $pathIcon16 . "/1.png' alt='" . _AM_SOAPBOX_ARTISON . "'>";
525
                } else {
526
                    //if ($offline == 1 && $submit == 0) {
527
                    if (0 === $submit && 1 === $articles['offline']) {
528
                        $status = "<img src='" . $pathIcon16 . "/0.png' alt='" . _AM_SOAPBOX_ARTISOFF . "'>";
529
                    } else {
530
                        if (1 === $submit) {
531
                            $status = '<img src=' . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . "/assets/images/icon/sub.gif alt='" . _AM_SOAPBOX_ARTISSUB . "'>";
532
                        }
533
                    }
534
                }
535
536
                //mb ----------------------------
537
                //echo $cont.' - '.$offline.': '.$status.'</br>';
538
539
                $style = (0 === ($cont % 2)) ? 'even' : 'odd';
540
                echo '<tr class="' . $style . '">';
541
                echo '<td align="center"><a href="' . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . '/article.php?articleID=' . $articles['articleID'] . '" title="' . $articles['headline'] . '" target="_blank">' . $articles['articleID'] . '</a></td>';
542
                echo '<td class="txtcenter"><input type="text" name="articleweight[' . $articles['articleID'] . ']" value="' . $articles['weight'] . '" size="3" maxlength="3" style="text-align: center;"></td>';
543
                echo '<td class="txtcenter">' . $colname . '</td>';
544
                echo '<td>' . $articles['headline'] . '</td>';
545
                echo '<td class="txtcenter">' . $created . '</td>';
546
                echo '<td class="txtcenter">' . $status . '</td>';
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $status does not seem to be defined for all execution paths leading up to this point.
Loading history...
547
                echo '<td class="txtcenter">' . $modify . $delete . '</td>';
548
                echo '</tr>';
549
            }
550
        } else { // that is, $numrows = 0, there's no columns yet
551
            echo '<tr>';
552
            echo "<td class='head' align='center' colspan= '7'>" . _AM_SOAPBOX_NOARTS . '</td>';
553
            echo '</tr>';
554
        }
555
        echo "</table>\n";
556
        $pagenav = new \XoopsPageNav($numrows, (int)$helper->getConfig('perpage'), $startart, 'startart', 'entries=' . $entries . '&sortname=' . $sortname . '&sortorder=' . $sortorder);
557
        echo '<div style="text-align:right;">' . $pagenav->renderNav() . '</div>';
558
559
        if ($numrows > 0) {
560
            echo "<input type='hidden' name='op' value='reorder'>";
561
            //--------------------
562
            echo $GLOBALS['xoopsSecurity']->getTokenHTML();
563
            //--------------------
564
            echo '<div style="margin-bottom: 18px;"><input type="submit" name="submit" class="formButton" value="' . _AM_SOAPBOX_REORDERART . '"></div>';
565
            echo '</form>';
566
        }
567
        echo "<br>\n";
568
    }
569
570
    public static function showSubmissions()
571
    {
572
        global $xoopsModule;
573
        /** @var Soapbox\Helper $helper */
574
        $helper = Soapbox\Helper::getInstance();
575
576
        $pathIcon16 = \Xmf\Module\Admin::iconUrl('', 16);
577
        $myts       = \MyTextSanitizer::getInstance();
578
        require_once XOOPS_ROOT_PATH . '/class/xoopslists.php';
579
        require_once XOOPS_ROOT_PATH . '/class/pagenav.php';
580
        require_once XOOPS_ROOT_PATH . '/class/xoopsform/grouppermform.php';
581
        //        require_once XOOPS_ROOT_PATH . '/modules/' . $xoopsModule->dirname() . '/include/cleantags.php';
582
        $module_id = $xoopsModule->getVar('mid');
0 ignored issues
show
The assignment to $module_id is dead and can be removed.
Loading history...
583
        $startsub  = \Xmf\Request::getInt('startsub', 0, 'GET');
584
        $datesub   = \Xmf\Request::getInt('datesub', 0, 'GET');
585
586
        //---GET view sort --
587
        $sortname = isset($_GET['sortname']) ? mb_strtolower(trim(strip_tags($myts->stripSlashesGPC($_GET['sortname'])))) : 'datesub';
588
        if (!in_array($sortname, ['datesub', 'weight', 'counter', 'rating', 'headline'], true)) {
589
            $sortname = 'datesub';
590
        }
591
        $sortorder = isset($_GET['sortorder']) ? mb_strtoupper(trim(strip_tags($myts->stripSlashesGPC($_GET['sortorder'])))) : 'DESC';
592
        if (!in_array($sortorder, ['ASC', 'DESC'], true)) {
593
            $sortorder = 'DESC';
594
        }
595
        //---------------
596
        /* Code to show submitted articles */
597
        echo "<h3 style='color: #2F5376; margin: 0 0 4px 0;'>" . _AM_SOAPBOX_SHOWSUBMISSIONS . '</h3>';
598
        echo '<span style="color: #567; margin: 3px 0 12px 0; font-size: small; display: block; ">' . _AM_SOAPBOX_SUBTEXT . '</span>';
599
        echo "<table width='100%' cellspacing=1 cellpadding=3 border=0 class = outer>";
600
        echo '<tr>';
601
        echo "<td width='40' class='bg3' align='center'><b>" . _AM_SOAPBOX_ARTID . '</b></td>';
602
        echo "<td width='20%' class='bg3' align='center'><b>" . _AM_SOAPBOX_ARTCOLNAME . '</b></td>';
603
        echo "<td width='45%' class='bg3' align='center'><b>" . _AM_SOAPBOX_ARTHEADLINE . '</b></td>';
604
        echo "<td width='90' class='bg3' align='center'><b>" . _AM_SOAPBOX_ARTCREATED . '</b></td>';
605
        echo "<td width='60' class='bg3' align='center'><b>" . _AM_SOAPBOX_ACTION . '</b></td>';
606
        echo '</tr>';
607
608
        // Put column names in an array, to avoid a query in the while loop farther ahead
609
        /* Code to show submitted articles */
610
        // Articles count
611
        //    function getArticlesAllPermcheck(
612
        //         $limit=0, $start=0,
613
        //         $checkRight = true, $published = true, $submit = 0, $offline = 0, $block = null ,
614
        //         $sortname = 'datesub', $sortorder = 'DESC',
615
        //         $select_sbcolumns = null , $NOTarticleIDs = null ,
616
        //         $approve_submit = false ,
617
        //         $id_as_key = false )
618
        // Articles count
619
        /** @var \XoopsModules\Soapbox\EntrydataHandler $entrydataHandler */
620
        $entrydataHandler = new \XoopsModules\Soapbox\EntrydataHandler();
621
        //-------------------------------------
622
        $entryobArray = $entrydataHandler->getArticlesAllPermcheck((int)$helper->getConfig('perpage'), $startsub, false, false, 1, null, null, $sortname, $sortorder, null, null, false);
623
        // Get number of articles in the selected condition ($cond)
624
        $numrows = $entrydataHandler->total_getArticlesAllPermcheck;
625
626
        if ($numrows > 0) { // That is, if there ARE unauthorized articles in the system
627
            foreach ($entryobArray as $_entryob) {
628
                //get vars
629
                //-------------------------------------
630
                $articles = $_entryob->toArray();
631
                //--------------------
632
                $colname = !empty($_entryob->_sbcolumns) ? $_entryob->_sbcolumns->getVar('name') : '';
633
                $created = $myts->htmlSpecialChars(formatTimestamp($datesub, $helper->getConfig('dateformat')));
634
                $modify  = "<a href='submissions.php?op=mod&articleID=" . $articles['articleID'] . "'><img src='" . $pathIcon16 . "/edit.png' ALT='" . _AM_SOAPBOX_EDITSUBM . "'></a>";
635
                $delete  = "<a href='submissions.php?op=del&articleID=" . $articles['articleID'] . "'><img src='" . $pathIcon16 . "/delete.png' ALT='" . _AM_SOAPBOX_DELETESUBM . "'></a>";
636
637
                echo '<tr>';
638
                echo "<td class='head' align='center'>" . $articles['articleID'] . '</td>';
639
                echo "<td class='even' align='left'>" . $colname . '</td>';
640
                echo "<td class='even' align='left'>" . $articles['headline'] . '</td>';
641
                echo "<td class='even' align='center'>" . $created . '</td>';
642
                echo "<td class='even' align='center'>" . $modify . $delete . '</td>';
643
                echo '</tr>';
644
            }
645
        } else { // that is, $numrows = 0, there's no columns yet
646
            echo '<tr>';
647
            echo "<td class='head' align='center' colspan= '7'>" . _AM_SOAPBOX_NOSUBMISSYET . '</td>';
648
            echo '</tr>';
649
        }
650
        echo "</table>\n";
651
        $pagenav = new \XoopsPageNav($numrows, $helper->getConfig('perpage'), $startsub, 'startsub', '&sortname=' . $sortname . '&sortorder=' . $sortorder);
652
        echo '<div style="text-align:right;">' . $pagenav->renderNav() . '</div>';
653
        echo "<br>\n";
654
    }
655
656
    //HACK bydomifara for add method
657
658
    /**
659
     * @return string
660
     */
661
    public static function getAcceptLang()
662
    {
663
        //---access language
664
        $al = 'en';
665
        if (\Xmf\Request::hasVar('HTTP_ACCEPT_LANGUAGE', 'SERVER')) {
666
            $accept_langs = explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE']);
667
            foreach ($accept_langs as $al) {
668
                $al     = mb_strtolower($al);
669
                $al_len = mb_strlen($al);
670
                if ($al_len > 2) {
671
                    if (preg_match('/([a-z]{2});q=[0-9.]+$/', $al, $al_match)) {
672
                        $al = $al_match[1];
673
                        break;
674
                    }
675
                    continue;
676
                }
677
            }
678
        }
679
680
        return $al;
681
    }
682
}
683