XoopsModules25x /
songlist
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php declare(strict_types=1); |
||||
| 2 | |||||
| 3 | namespace XoopsModules\Songlist; |
||||
| 4 | |||||
| 5 | require_once \dirname(__DIR__) . '/include/songlist.object.php'; |
||||
| 6 | // require_once \dirname(__DIR__) . '/include/songlist.form.php'; |
||||
| 7 | use XoopsModules\Songlist\Form\FormController; |
||||
| 8 | |||||
| 9 | /** |
||||
| 10 | * Class RequestsHandler |
||||
| 11 | */ |
||||
| 12 | class RequestsHandler extends \XoopsPersistableObjectHandler |
||||
| 13 | { |
||||
| 14 | /** |
||||
| 15 | * RequestsHandler constructor. |
||||
| 16 | * @param \XoopsDatabase $db |
||||
| 17 | */ |
||||
| 18 | public function __construct(\XoopsDatabase $db) |
||||
| 19 | { |
||||
| 20 | parent::__construct($db, 'songlist_requests', Requests::class, 'rid', 'name'); |
||||
| 21 | } |
||||
| 22 | |||||
| 23 | /** |
||||
| 24 | * @return array |
||||
| 25 | */ |
||||
| 26 | public function filterFields(): array |
||||
| 27 | { |
||||
| 28 | return ['rid', 'artist', 'album', 'title', 'lyrics', 'uid', 'name', 'email', 'songid', 'sid', 'created', 'updated']; |
||||
| 29 | } |
||||
| 30 | |||||
| 31 | /** |
||||
| 32 | * @param $filter |
||||
| 33 | * @return \CriteriaCompo |
||||
| 34 | */ |
||||
| 35 | public function getFilterCriteria($filter): \CriteriaCompo |
||||
| 36 | { |
||||
| 37 | $parts = \explode('|', $filter); |
||||
| 38 | $criteria = new \CriteriaCompo(); |
||||
| 39 | foreach ($parts as $part) { |
||||
| 40 | $var = \explode(',', $part); |
||||
| 41 | if (!empty($var[1]) && !\is_numeric($var[0])) { |
||||
| 42 | $object = $this->create(); |
||||
| 43 | if (\XOBJ_DTYPE_TXTBOX == $object->vars[$var[0]]['data_type'] |
||||
| 44 | || \XOBJ_DTYPE_TXTAREA == $object->vars[$var[0]]['data_type']) { |
||||
| 45 | $criteria->add(new \Criteria('`' . $var[0] . '`', '%' . $var[1] . '%', ($var[2] ?? 'LIKE'))); |
||||
| 46 | } elseif (in_array($object->vars[$var[0]]['data_type'], [XOBJ_DTYPE_INT, XOBJ_DTYPE_DECIMAL, XOBJ_DTYPE_FLOAT])) { |
||||
| 47 | $criteria->add(new \Criteria('`' . $var[0] . '`', $var[1], ($var[2] ?? '='))); |
||||
| 48 | } elseif (\XOBJ_DTYPE_ENUM == $object->vars[$var[0]]['data_type']) { |
||||
| 49 | $criteria->add(new \Criteria('`' . $var[0] . '`', $var[1], ($var[2] ?? '='))); |
||||
| 50 | } elseif (\XOBJ_DTYPE_ARRAY == $object->vars[$var[0]]['data_type']) { |
||||
| 51 | $criteria->add(new \Criteria('`' . $var[0] . '`', '%"' . $var[1] . '";%', ($var[2] ?? 'LIKE'))); |
||||
| 52 | } |
||||
| 53 | } elseif (!empty($var[1]) && \is_numeric($var[0])) { |
||||
| 54 | $criteria->add(new \Criteria($var[0], $var[1])); |
||||
| 55 | } |
||||
| 56 | } |
||||
| 57 | |||||
| 58 | return $criteria; |
||||
| 59 | } |
||||
| 60 | |||||
| 61 | /** |
||||
| 62 | * @param $filter |
||||
| 63 | * @param $field |
||||
| 64 | * @param string $sort |
||||
| 65 | * @param string $op |
||||
| 66 | * @param string $fct |
||||
| 67 | * @return string |
||||
| 68 | */ |
||||
| 69 | public function getFilterForm($filter, $field, $sort = 'created', $op = 'dashboard', $fct = 'list'): string |
||||
| 70 | { |
||||
| 71 | $ele = Utility::getFilterElement($filter, $field, $sort, $op, $fct); |
||||
| 72 | if (\is_object($ele)) { |
||||
| 73 | return $ele->render(); |
||||
| 74 | } |
||||
| 75 | |||||
| 76 | return ' '; |
||||
| 77 | } |
||||
| 78 | |||||
| 79 | /** |
||||
| 80 | * @param bool $force |
||||
| 81 | * @return mixed |
||||
| 82 | */ |
||||
| 83 | public function insert(\XoopsObject $obj, $force = true) |
||||
| 84 | { |
||||
| 85 | if ($obj->isNew()) { |
||||
| 86 | $obj->setVar('created', \time()); |
||||
| 87 | $new = true; |
||||
| 88 | $sendmail = true; |
||||
| 89 | } else { |
||||
| 90 | $obj->setVar('updated', \time()); |
||||
| 91 | $new = false; |
||||
| 92 | if (true === $obj->vars['songid']['changed']) { |
||||
| 93 | $songsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Songs'); |
||||
| 94 | $criteria = new \Criteria('songid', $obj->getVar('songid')); |
||||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||||
| 95 | $songs = $songsHandler->getObjects($criteria, false); |
||||
| 96 | if (\is_object($songs[0])) { |
||||
| 97 | foreach ($songs[0]->getVar('aids') as $aid) { |
||||
| 98 | $ad[] = $aid; |
||||
| 99 | } |
||||
| 100 | $obj->setVar('sid', $songs[0]->getVar('sid')); |
||||
| 101 | $obj->setVar('aid', $ad[0]); |
||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
| 102 | $sendmail = true; |
||||
| 103 | } |
||||
| 104 | } |
||||
| 105 | } |
||||
| 106 | $rid = parent::insert($obj, $force); |
||||
| 107 | if ($rid) { |
||||
| 108 | if ($sendmail) { |
||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
| 109 | if ($new) { |
||||
| 110 | \xoops_loadLanguage('email', 'songlist'); |
||||
| 111 | $xoopsMailer = \xoops_getMailer(); |
||||
| 112 | $xoopsMailer->setHTML(true); |
||||
| 113 | $xoopsMailer->setTemplateDir($GLOBALS['xoops']->path('/modules/songlist/language/' . $GLOBALS['xoopsConfig']['language'] . '/mail_templates/')); |
||||
| 114 | $xoopsMailer->setTemplate('songlist_request_created.tpl'); |
||||
| 115 | $xoopsMailer->setSubject(\sprintf(\_MD_SONGLIST_SUBJECT_REQUESTMADE, $rid)); |
||||
| 116 | |||||
| 117 | foreach (\explode('|', $GLOBALS['songlistModuleConfig']['email']) as $email) { |
||||
| 118 | $xoopsMailer->setToEmails($email); |
||||
| 119 | } |
||||
| 120 | |||||
| 121 | $xoopsMailer->setToEmails($obj->getVar('email')); |
||||
| 122 | |||||
| 123 | $xoopsMailer->assign('SITEURL', XOOPS_URL); |
||||
| 124 | $xoopsMailer->assign('SITENAME', $GLOBALS['xoopsConfig']['sitename']); |
||||
| 125 | $xoopsMailer->assign('RID', $rid); |
||||
| 126 | $xoopsMailer->assign('TITLE', $obj->getVar('title')); |
||||
| 127 | $xoopsMailer->assign('ALBUM', $obj->getVar('album')); |
||||
| 128 | $xoopsMailer->assign('ARTIST', $obj->getVar('artist')); |
||||
| 129 | $xoopsMailer->assign('EMAIL', $obj->getVar('email')); |
||||
| 130 | $xoopsMailer->assign('NAME', $obj->getVar('name')); |
||||
| 131 | |||||
| 132 | $debug = true; |
||||
| 133 | |||||
| 134 | if (!$xoopsMailer->send($debug)) { |
||||
| 135 | \xoops_error($xoopsMailer->getErrors(true), 'Email Send Error'); |
||||
| 136 | } |
||||
| 137 | } else { |
||||
| 138 | \xoops_loadLanguage('email', 'songlist'); |
||||
| 139 | $songsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Songs'); |
||||
| 140 | $artistsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Artists'); |
||||
| 141 | $albumsHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Albums'); |
||||
|
0 ignored issues
–
show
|
|||||
| 142 | $genreHandler = \XoopsModules\Songlist\Helper::getInstance()->getHandler('Genre'); |
||||
| 143 | |||||
| 144 | $song = $songsHandler->get($obj->getVar('sid')); |
||||
| 145 | if (\is_object($song)) { |
||||
| 146 | $sng = $genre->getVar('title'); |
||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
| 147 | } |
||||
| 148 | $album = $albumHandler->get($song->getVar('abid')); |
||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
| 149 | if (\is_object($album)) { |
||||
| 150 | $alb = $genre->getVar('title'); |
||||
| 151 | $alb_img = $genre->getImage(); |
||||
|
0 ignored issues
–
show
|
|||||
| 152 | } |
||||
| 153 | $genre = $genreHandler->get($song->getVar('abid')); |
||||
| 154 | if (\is_object($genre)) { |
||||
| 155 | $gen = $genre->getVar('name'); |
||||
| 156 | } |
||||
| 157 | $artists = $artistsHandler->getObjects(new \Criteria('aid', '(' . \implode(',', $song->getVar('aid')) . ')', 'IN'), false); |
||||
|
0 ignored issues
–
show
It seems like
$song->getVar('aid') can also be of type boolean and null and string; however, parameter $pieces of implode() does only seem to accept array, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 158 | $art = ''; |
||||
| 159 | foreach ($artists as $id => $artist) { |
||||
| 160 | $art .= $artist->getVar('name') . ($id < \count($artists) - 1 ? ', ' : ''); |
||||
| 161 | } |
||||
| 162 | $xoopsMailer = \getMailer(); |
||||
| 163 | $xoopsMailer->setHTML(true); |
||||
| 164 | $xoopsMailer->setTemplateDir($GLOBALS['xoops']->path('/modules/songlist/language/' . $GLOBALS['xoopsConfig']['language'] . '/mail_templates/')); |
||||
| 165 | $xoopsMailer->setTemplate('songlist_request_updated.tpl'); |
||||
| 166 | $xoopsMailer->setSubject(\sprintf(\_MD_SONGLIST_SUBJECT_REQUESTFOUND, $rid)); |
||||
| 167 | |||||
| 168 | $xoopsMailer->setToEmails($obj->getVar('email')); |
||||
| 169 | |||||
| 170 | $xoopsMailer->assign('SITEURL', XOOPS_URL); |
||||
| 171 | $xoopsMailer->assign('SITENAME', $GLOBALS['xoopsConfig']['sitename']); |
||||
| 172 | $xoopsMailer->assign('RID', $rid); |
||||
| 173 | $xoopsMailer->assign('TITLE', $obj->getVar('title')); |
||||
| 174 | $xoopsMailer->assign('ALBUM', $obj->getVar('album')); |
||||
| 175 | $xoopsMailer->assign('ARTIST', $obj->getVar('artist')); |
||||
| 176 | $xoopsMailer->assign('EMAIL', $obj->getVar('email')); |
||||
| 177 | $xoopsMailer->assign('NAME', $obj->getVar('name')); |
||||
| 178 | $xoopsMailer->assign('SONGID', $song->getVar('songid')); |
||||
| 179 | $xoopsMailer->assign('SONGURL', $song->getURL()); |
||||
|
0 ignored issues
–
show
The method
getURL() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as XoopsModules\Songlist\Genre or XoopsModules\Songlist\Voice or XoopsModules\Songlist\Category or XoopsModules\Songlist\Songs or XoopsModules\Songlist\Albums or XoopsModules\Songlist\Artists.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 180 | $xoopsMailer->assign('FOUNDTITLE', $sng); |
||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
| 181 | $xoopsMailer->assign('FOUNDALBUM', $alb); |
||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
| 182 | $xoopsMailer->assign('FOUNDARTIST', $art); |
||||
| 183 | $xoopsMailer->assign('FOUNDGENRE', $gen); |
||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
| 184 | $xoopsMailer->assign('EMAIL', $obj->getVar('email')); |
||||
| 185 | $xoopsMailer->assign('NAME', $obj->getVar('name')); |
||||
| 186 | |||||
| 187 | if (!$xoopsMailer->send()) { |
||||
| 188 | \xoops_error($xoopsMailer->getErrors(true), 'Email Send Error'); |
||||
| 189 | } |
||||
| 190 | } |
||||
| 191 | } |
||||
| 192 | } |
||||
| 193 | |||||
| 194 | return $rid; |
||||
| 195 | } |
||||
| 196 | |||||
| 197 | /** |
||||
| 198 | * @return string |
||||
| 199 | */ |
||||
| 200 | public function getURL(): string |
||||
| 201 | { |
||||
| 202 | global $file, $op, $fct, $id, $value, $gid, $cid, $start, $limit; |
||||
| 203 | if ($GLOBALS['songlistModuleConfig']['htaccess']) { |
||||
| 204 | return XOOPS_URL . '/' . $GLOBALS['songlistModuleConfig']['baseofurl'] . '/' . $file . '/' . $op . '-' . $fct . $GLOBALS['songlistModuleConfig']['endofurl']; |
||||
| 205 | } |
||||
| 206 | |||||
| 207 | return XOOPS_URL . '/modules/songlist/' . $file . '.php?op=' . $op . '&fct=' . $fct; |
||||
| 208 | } |
||||
| 209 | } |
||||
| 210 |