This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||
2 | |||||
3 | namespace XoopsModules\Songlist; |
||||
4 | |||||
5 | use XoopsDatabase; |
||||
6 | use XoopsObject; |
||||
7 | use XoopsPersistableObjectHandler; |
||||
8 | |||||
9 | /** |
||||
10 | * @copyright copyright © 2000 XOOPS.org |
||||
11 | */ |
||||
12 | class ExtrasHandler extends XoopsPersistableObjectHandler |
||||
13 | { |
||||
14 | /** |
||||
15 | * holds reference to {@link ObjectsFieldHandler} object |
||||
16 | */ |
||||
17 | public $_fHandler; |
||||
18 | /** |
||||
19 | * Array of {@link XoopsObjectsField} objects |
||||
20 | * @var array |
||||
21 | */ |
||||
22 | public $_fields = []; |
||||
23 | |||||
24 | /** |
||||
25 | * ExtrasHandler constructor. |
||||
26 | * @param \XoopsDatabase $db |
||||
27 | */ |
||||
28 | public function __construct(XoopsDatabase $db) |
||||
29 | { |
||||
30 | parent::__construct($db, 'songlist_extra', Extras::class, 'sid'); |
||||
31 | $this->_fHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Field'); |
||||
32 | } |
||||
33 | |||||
34 | /** |
||||
35 | * create a new {@link Extras} |
||||
36 | * |
||||
37 | * @param bool $isNew Flag the new objects as "new"? |
||||
38 | * |
||||
39 | * @return object {@link Extras} |
||||
40 | */ |
||||
41 | public function &create($isNew = true): object |
||||
42 | { |
||||
43 | $obj = new $this->className($this->loadFields()); |
||||
44 | $obj->handler = $this; |
||||
45 | $obj->setNew(); |
||||
46 | |||||
47 | return $obj; |
||||
48 | } |
||||
49 | |||||
50 | /** |
||||
51 | * Get a {@link Extras} |
||||
52 | * |
||||
53 | * @param null $id |
||||
0 ignored issues
–
show
Documentation
Bug
introduced
by
![]() |
|||||
54 | * @param null $fields |
||||
0 ignored issues
–
show
|
|||||
55 | * @return object <a href='psi_element://Extras'>Extras</a> |
||||
56 | */ |
||||
57 | public function get($id = null, $fields = null): object //get($uid, $createOnFailure = true) |
||||
58 | { |
||||
59 | if (null === $fields) { |
||||
0 ignored issues
–
show
|
|||||
60 | $fields = true; |
||||
61 | } |
||||
62 | $obj = parent::get($id); |
||||
63 | if (!\is_object($obj) && $fields) { |
||||
64 | $obj = $this->create(); |
||||
65 | } |
||||
66 | |||||
67 | return $obj; |
||||
68 | } |
||||
69 | |||||
70 | /** |
||||
71 | * Create new {@link ObjectsField} object |
||||
72 | * |
||||
73 | * @param bool $isNew |
||||
74 | * |
||||
75 | * @return object |
||||
76 | */ |
||||
77 | public function &createField($isNew = true): object |
||||
78 | { |
||||
79 | $return = $this->_fHandler->create($isNew); |
||||
80 | |||||
81 | return $return; |
||||
82 | } |
||||
83 | |||||
84 | /** |
||||
85 | * Load field information |
||||
86 | * |
||||
87 | * @return array|false |
||||
88 | */ |
||||
89 | public function loadFields() |
||||
90 | { |
||||
91 | if (0 == \count($this->_fields)) { |
||||
92 | $this->_fields = $this->_fHandler->loadFields(); |
||||
0 ignored issues
–
show
It seems like
$this->_fHandler->loadFields() can also be of type false . However, the property $_fields is declared as type array . Maybe add an additional type check?
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly. For example, imagine you have a variable Either this assignment is in error or a type check should be added for that assignment. class Id
{
public $id;
public function __construct($id)
{
$this->id = $id;
}
}
class Account
{
/** @var Id $id */
public $id;
}
$account_id = false;
if (starsAreRight()) {
$account_id = new Id(42);
}
$account = new Account();
if ($account instanceof Id)
{
$account->id = $account_id;
}
![]() |
|||||
93 | } |
||||
94 | |||||
95 | return (0 == $this->_fields || empty($this->_fields) ? false : $this->_fields); |
||||
96 | } |
||||
97 | |||||
98 | /** |
||||
99 | * @return array |
||||
100 | */ |
||||
101 | public function getPostVars(): array |
||||
102 | { |
||||
103 | return ['sid', 'cid', 'gid', 'aids', 'abid', 'songid', 'title', 'lyrics', 'hits', 'rank', 'votes', 'tags', 'created', 'updated']; |
||||
104 | } |
||||
105 | |||||
106 | /** |
||||
107 | * @param $criteria |
||||
108 | * @param bool $id_as_key |
||||
109 | * @param bool $as_object |
||||
110 | * @return array |
||||
111 | */ |
||||
112 | public function getFields($criteria, $id_as_key = true, $as_object = true): array |
||||
113 | { |
||||
114 | return $this->_fHandler->getObjects($criteria, $id_as_key, $as_object); |
||||
115 | } |
||||
116 | |||||
117 | /** |
||||
118 | * Insert a field in the database |
||||
119 | * |
||||
120 | * @param XoopsObject $field |
||||
121 | * @param bool $force |
||||
122 | * @return mixed|void |
||||
123 | */ |
||||
124 | public function insertField($field, $force = false) |
||||
125 | { |
||||
126 | return $this->_fHandler->insert($field, $force); |
||||
127 | } |
||||
128 | |||||
129 | /** |
||||
130 | * Delete a field from the database |
||||
131 | * |
||||
132 | * @param XoopsObject $field |
||||
133 | * @param bool $force |
||||
134 | * @return bool |
||||
135 | */ |
||||
136 | public function deleteField($field, $force = false) |
||||
137 | { |
||||
138 | return $this->_fHandler->delete($field, $force); |
||||
139 | } |
||||
140 | |||||
141 | /** |
||||
142 | * Save a new field in the database |
||||
143 | * |
||||
144 | * @param array $vars array of variables, taken from $module->loadInfo('Extras')['field'] |
||||
145 | * @param int $weight |
||||
146 | * @return string |
||||
147 | * @internal param int $categoryid ID of the category to add it to |
||||
148 | * @internal param int $type valuetype of the field |
||||
149 | * @internal param int $moduleid ID of the module, this field belongs to |
||||
150 | */ |
||||
151 | public function saveField($vars, $weight = 0): string |
||||
152 | { |
||||
153 | $field = $this->createField(); |
||||
154 | $field->setVar('field_name', $vars['name']); |
||||
155 | $field->setVar('field_valuetype', $vars['valuetype']); |
||||
156 | $field->setVar('field_type', $vars['type']); |
||||
157 | $field->setVar('field_weight', $weight); |
||||
158 | if (isset($vars['title'])) { |
||||
159 | $field->setVar('field_title', $vars['title']); |
||||
160 | } |
||||
161 | if (isset($vars['description'])) { |
||||
162 | $field->setVar('field_description', $vars['description']); |
||||
163 | } |
||||
164 | if (isset($vars['required'])) { |
||||
165 | $field->setVar('field_required', $vars['required']); //0 = no, 1 = yes |
||||
166 | } |
||||
167 | if (isset($vars['maxlength'])) { |
||||
168 | $field->setVar('field_maxlength', $vars['maxlength']); |
||||
169 | } |
||||
170 | if (isset($vars['default'])) { |
||||
171 | $field->setVar('field_default', $vars['default']); |
||||
172 | } |
||||
173 | if (isset($vars['notnull'])) { |
||||
174 | $field->setVar('field_notnull', $vars['notnull']); |
||||
175 | } |
||||
176 | if (isset($vars['show'])) { |
||||
177 | $field->setVar('field_show', $vars['show']); |
||||
178 | } |
||||
179 | if (isset($vars['edit'])) { |
||||
180 | $field->setVar('field_edit', $vars['edit']); |
||||
181 | } |
||||
182 | if (isset($vars['config'])) { |
||||
183 | $field->setVar('field_config', $vars['config']); |
||||
184 | } |
||||
185 | if (isset($vars['options'])) { |
||||
186 | $field->setVar('field_options', $vars['options']); |
||||
187 | } else { |
||||
188 | $field->setVar('field_options', []); |
||||
189 | } |
||||
190 | if ($this->insertField($field)) { |
||||
191 | $msg = ' Field <b>' . $vars['name'] . '</b> added to the database'; |
||||
192 | } else { |
||||
193 | $msg = ' <span style="color:#ff0000;">ERROR: Could not insert field <b>' . $vars['name'] . '</b> into the database. ' . \implode(' ', $field->getErrors()) . $this->db->error() . '</span>'; |
||||
194 | } |
||||
195 | unset($field); |
||||
196 | |||||
197 | return $msg; |
||||
198 | } |
||||
199 | |||||
200 | /** |
||||
201 | * insert a new object in the database |
||||
202 | * |
||||
203 | * @param \XoopsObject $obj reference to the object |
||||
204 | * @param bool $force whether to force the query execution despite security settings |
||||
205 | * @param bool $checkObject check if the object is dirty and clean the attributes |
||||
206 | * |
||||
207 | * @return bool FALSE if failed, TRUE if already present and unchanged or successful |
||||
208 | */ |
||||
209 | public function insert(XoopsObject $obj, $force = false, $checkObject = true): bool |
||||
210 | { |
||||
211 | $uservars = $this->getPostVars(); |
||||
212 | foreach ($uservars as $var) { |
||||
213 | if ('sid' != $var) { |
||||
214 | unset($obj->vars[$var]); |
||||
215 | } |
||||
216 | } |
||||
217 | if (0 == \count($obj->vars)) { |
||||
218 | return true; |
||||
219 | } |
||||
220 | |||||
221 | return (bool)parent::insert($obj, $force, $checkObject); |
||||
0 ignored issues
–
show
The call to
XoopsPersistableObjectHandler::insert() has too many arguments starting with $checkObject .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above. ![]() |
|||||
222 | } |
||||
223 | } |
||||
224 |