This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||
2 | |||||
3 | namespace XoopsModules\Songlist; |
||||
4 | |||||
5 | require_once \dirname(__DIR__) . '/include/songlist.object.php'; |
||||
6 | // require_once \dirname(__DIR__) . '/include/songlist.form.php'; |
||||
7 | use XoopsModules\Songlist\Form\FormController; |
||||
8 | |||||
9 | /** |
||||
10 | * Class RequestsHandler |
||||
11 | */ |
||||
12 | class RequestsHandler extends \XoopsPersistableObjectHandler |
||||
13 | { |
||||
14 | /** |
||||
15 | * RequestsHandler constructor. |
||||
16 | * @param \XoopsDatabase $db |
||||
17 | */ |
||||
18 | public function __construct(\XoopsDatabase $db) |
||||
19 | { |
||||
20 | parent::__construct($db, 'songlist_requests', Requests::class, 'rid', 'name'); |
||||
21 | } |
||||
22 | |||||
23 | /** |
||||
24 | * @return array |
||||
25 | */ |
||||
26 | public function filterFields(): array |
||||
27 | { |
||||
28 | return ['rid', 'artist', 'album', 'title', 'lyrics', 'uid', 'name', 'email', 'songid', 'sid', 'created', 'updated']; |
||||
29 | } |
||||
30 | |||||
31 | /** |
||||
32 | * @param $filter |
||||
33 | * @return \CriteriaCompo |
||||
34 | */ |
||||
35 | public function getFilterCriteria($filter): \CriteriaCompo |
||||
36 | { |
||||
37 | $parts = \explode('|', $filter); |
||||
38 | $criteria = new \CriteriaCompo(); |
||||
39 | foreach ($parts as $part) { |
||||
40 | $var = \explode(',', $part); |
||||
41 | if (!empty($var[1]) && !\is_numeric($var[0])) { |
||||
42 | $object = $this->create(); |
||||
43 | if (\XOBJ_DTYPE_TXTBOX == $object->vars[$var[0]]['data_type'] |
||||
44 | || \XOBJ_DTYPE_TXTAREA == $object->vars[$var[0]]['data_type']) { |
||||
45 | $criteria->add(new \Criteria('`' . $var[0] . '`', '%' . $var[1] . '%', ($var[2] ?? 'LIKE'))); |
||||
46 | } elseif (in_array($object->vars[$var[0]]['data_type'], [XOBJ_DTYPE_INT, XOBJ_DTYPE_DECIMAL, XOBJ_DTYPE_FLOAT])) { |
||||
47 | $criteria->add(new \Criteria('`' . $var[0] . '`', $var[1], ($var[2] ?? '='))); |
||||
48 | } elseif (\XOBJ_DTYPE_ENUM == $object->vars[$var[0]]['data_type']) { |
||||
49 | $criteria->add(new \Criteria('`' . $var[0] . '`', $var[1], ($var[2] ?? '='))); |
||||
50 | } elseif (\XOBJ_DTYPE_ARRAY == $object->vars[$var[0]]['data_type']) { |
||||
51 | $criteria->add(new \Criteria('`' . $var[0] . '`', '%"' . $var[1] . '";%', ($var[2] ?? 'LIKE'))); |
||||
52 | } |
||||
53 | } elseif (!empty($var[1]) && \is_numeric($var[0])) { |
||||
54 | $criteria->add(new \Criteria($var[0], $var[1])); |
||||
55 | } |
||||
56 | } |
||||
57 | |||||
58 | return $criteria; |
||||
59 | } |
||||
60 | |||||
61 | /** |
||||
62 | * @param $filter |
||||
63 | * @param $field |
||||
64 | * @param string $sort |
||||
65 | * @param string $op |
||||
66 | * @param string $fct |
||||
67 | * @return string |
||||
68 | */ |
||||
69 | public function getFilterForm($filter, $field, $sort = 'created', $op = 'dashboard', $fct = 'list'): string |
||||
70 | { |
||||
71 | $ele = Utility::getFilterElement($filter, $field, $sort, $op, $fct); |
||||
72 | if (\is_object($ele)) { |
||||
73 | return $ele->render(); |
||||
74 | } |
||||
75 | |||||
76 | return ' '; |
||||
77 | } |
||||
78 | |||||
79 | /** |
||||
80 | * @param bool $force |
||||
81 | * @return mixed |
||||
82 | */ |
||||
83 | public function insert(\XoopsObject $obj, $force = true) |
||||
84 | { |
||||
85 | if ($obj->isNew()) { |
||||
86 | $obj->setVar('created', \time()); |
||||
87 | $new = true; |
||||
88 | $sendmail = true; |
||||
89 | } else { |
||||
90 | $obj->setVar('updated', \time()); |
||||
91 | $new = false; |
||||
92 | if (true === $obj->vars['songid']['changed']) { |
||||
93 | $songsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Songs'); |
||||
94 | $criteria = new \Criteria('songid', $obj->getVar('songid')); |
||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||
95 | $songs = $songsHandler->getObjects($criteria, false); |
||||
96 | if (\is_object($songs[0])) { |
||||
97 | foreach ($songs[0]->getVar('aids') as $aid) { |
||||
98 | $ad[] = $aid; |
||||
99 | } |
||||
100 | $obj->setVar('sid', $songs[0]->getVar('sid')); |
||||
101 | $obj->setVar('aid', $ad[0]); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
102 | $sendmail = true; |
||||
103 | } |
||||
104 | } |
||||
105 | } |
||||
106 | $rid = parent::insert($obj, $force); |
||||
107 | if ($rid) { |
||||
108 | if ($sendmail) { |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
109 | if ($new) { |
||||
110 | \xoops_loadLanguage('email', 'songlist'); |
||||
111 | $xoopsMailer = \xoops_getMailer(); |
||||
112 | $xoopsMailer->setHTML(true); |
||||
113 | $xoopsMailer->setTemplateDir($GLOBALS['xoops']->path('/modules/songlist/language/' . $GLOBALS['xoopsConfig']['language'] . '/mail_templates/')); |
||||
114 | $xoopsMailer->setTemplate('songlist_request_created.tpl'); |
||||
115 | $xoopsMailer->setSubject(\sprintf(\_MD_SONGLIST_SUBJECT_REQUESTMADE, $rid)); |
||||
116 | |||||
117 | foreach (\explode('|', $GLOBALS['songlistModuleConfig']['email']) as $email) { |
||||
118 | $xoopsMailer->setToEmails($email); |
||||
119 | } |
||||
120 | |||||
121 | $xoopsMailer->setToEmails($obj->getVar('email')); |
||||
122 | |||||
123 | $xoopsMailer->assign('SITEURL', XOOPS_URL); |
||||
124 | $xoopsMailer->assign('SITENAME', $GLOBALS['xoopsConfig']['sitename']); |
||||
125 | $xoopsMailer->assign('RID', $rid); |
||||
126 | $xoopsMailer->assign('TITLE', $obj->getVar('title')); |
||||
127 | $xoopsMailer->assign('ALBUM', $obj->getVar('album')); |
||||
128 | $xoopsMailer->assign('ARTIST', $obj->getVar('artist')); |
||||
129 | $xoopsMailer->assign('EMAIL', $obj->getVar('email')); |
||||
130 | $xoopsMailer->assign('NAME', $obj->getVar('name')); |
||||
131 | |||||
132 | $debug = true; |
||||
133 | |||||
134 | if (!$xoopsMailer->send($debug)) { |
||||
135 | \xoops_error($xoopsMailer->getErrors(true), 'Email Send Error'); |
||||
136 | } |
||||
137 | } else { |
||||
138 | \xoops_loadLanguage('email', 'songlist'); |
||||
139 | $songsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Songs'); |
||||
140 | $artistsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Artists'); |
||||
141 | $albumsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Albums'); |
||||
0 ignored issues
–
show
|
|||||
142 | $genreHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Genre'); |
||||
143 | |||||
144 | $song = $songsHandler->get($obj->getVar('sid')); |
||||
145 | if (\is_object($song)) { |
||||
146 | $sng = $genre->getVar('title'); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
147 | } |
||||
148 | $album = $albumHandler->get($song->getVar('abid')); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
149 | if (\is_object($album)) { |
||||
150 | $alb = $genre->getVar('title'); |
||||
151 | $alb_img = $genre->getImage(); |
||||
0 ignored issues
–
show
|
|||||
152 | } |
||||
153 | $genre = $genreHandler->get($song->getVar('abid')); |
||||
154 | if (\is_object($genre)) { |
||||
155 | $gen = $genre->getVar('name'); |
||||
156 | } |
||||
157 | $artists = $artistsHandler->getObjects(new \Criteria('aid', '(' . \implode(',', $song->getVar('aid')) . ')', 'IN'), false); |
||||
0 ignored issues
–
show
It seems like
$song->getVar('aid') can also be of type boolean and null and string ; however, parameter $pieces of implode() does only seem to accept array , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
158 | $art = ''; |
||||
159 | foreach ($artists as $id => $artist) { |
||||
160 | $art .= $artist->getVar('name') . ($id < \count($artists) - 1 ? ', ' : ''); |
||||
161 | } |
||||
162 | $xoopsMailer = \getMailer(); |
||||
163 | $xoopsMailer->setHTML(true); |
||||
164 | $xoopsMailer->setTemplateDir($GLOBALS['xoops']->path('/modules/songlist/language/' . $GLOBALS['xoopsConfig']['language'] . '/mail_templates/')); |
||||
165 | $xoopsMailer->setTemplate('songlist_request_updated.tpl'); |
||||
166 | $xoopsMailer->setSubject(\sprintf(\_MD_SONGLIST_SUBJECT_REQUESTFOUND, $rid)); |
||||
167 | |||||
168 | $xoopsMailer->setToEmails($obj->getVar('email')); |
||||
169 | |||||
170 | $xoopsMailer->assign('SITEURL', XOOPS_URL); |
||||
171 | $xoopsMailer->assign('SITENAME', $GLOBALS['xoopsConfig']['sitename']); |
||||
172 | $xoopsMailer->assign('RID', $rid); |
||||
173 | $xoopsMailer->assign('TITLE', $obj->getVar('title')); |
||||
174 | $xoopsMailer->assign('ALBUM', $obj->getVar('album')); |
||||
175 | $xoopsMailer->assign('ARTIST', $obj->getVar('artist')); |
||||
176 | $xoopsMailer->assign('EMAIL', $obj->getVar('email')); |
||||
177 | $xoopsMailer->assign('NAME', $obj->getVar('name')); |
||||
178 | $xoopsMailer->assign('SONGID', $song->getVar('songid')); |
||||
179 | $xoopsMailer->assign('SONGURL', $song->getURL()); |
||||
0 ignored issues
–
show
The method
getURL() does not exist on XoopsObject . It seems like you code against a sub-type of XoopsObject such as XoopsModules\Songlist\Genre or XoopsModules\Songlist\Voice or XoopsModules\Songlist\Category or XoopsModules\Songlist\Songs or XoopsModules\Songlist\Albums or XoopsModules\Songlist\Artists .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
180 | $xoopsMailer->assign('FOUNDTITLE', $sng); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
181 | $xoopsMailer->assign('FOUNDALBUM', $alb); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
182 | $xoopsMailer->assign('FOUNDARTIST', $art); |
||||
183 | $xoopsMailer->assign('FOUNDGENRE', $gen); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
184 | $xoopsMailer->assign('EMAIL', $obj->getVar('email')); |
||||
185 | $xoopsMailer->assign('NAME', $obj->getVar('name')); |
||||
186 | |||||
187 | if (!$xoopsMailer->send()) { |
||||
188 | \xoops_error($xoopsMailer->getErrors(true), 'Email Send Error'); |
||||
189 | } |
||||
190 | } |
||||
191 | } |
||||
192 | } |
||||
193 | |||||
194 | return $rid; |
||||
195 | } |
||||
196 | |||||
197 | /** |
||||
198 | * @return string |
||||
199 | */ |
||||
200 | public function getURL(): string |
||||
201 | { |
||||
202 | global $file, $op, $fct, $id, $value, $gid, $cid, $start, $limit; |
||||
203 | if ($GLOBALS['songlistModuleConfig']['htaccess']) { |
||||
204 | return XOOPS_URL . '/' . $GLOBALS['songlistModuleConfig']['baseofurl'] . '/' . $file . '/' . $op . '-' . $fct . $GLOBALS['songlistModuleConfig']['endofurl']; |
||||
205 | } |
||||
206 | |||||
207 | return XOOPS_URL . '/modules/songlist/' . $file . '.php?op=' . $op . '&fct=' . $fct; |
||||
208 | } |
||||
209 | } |
||||
210 |