Issues (432)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/FieldHandler.php (1 issue)

1
<?php declare(strict_types=1);
2
3
namespace XoopsModules\Suico;
4
5
/**
6
 * Extended User Profile
7
 *
8
 * You may not change or alter any portion of this comment or credits
9
 * of supporting developers from this source code or any supporting source code
10
 * which is considered copyrighted (c) material of the original comment or credit authors.
11
 * This program is distributed in the hope that it will be useful,
12
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14
 *
15
 * @copyright       (c) 2000-2016 XOOPS Project (www.xoops.org)
16
 * @license             GNU GPL 2 (https://www.gnu.org/licenses/gpl-2.0.html)
17
 * @since               2.3.0
18
 * @author              Jan Pedersen
19
 * @author              Taiwen Jiang <[email protected]>
20
 */
21
22
/**
23
 * @copyright       (c) 2000-2016 XOOPS Project (www.xoops.org)
24
 */
25
26
use XoopsModules\Suico;
27
28
/**
29
 * Class FieldHandler
30
 */
31
class FieldHandler extends \XoopsPersistableObjectHandler
32
{
33
    /**
34
     * @param \XoopsDatabase $db
35
     */
36
    public function __construct(\XoopsDatabase $db)
37
    {
38
        parent::__construct($db, 'suico_profile_field', Field::class, 'field_id', 'field_title');
39
    }
40
41
    /**
42
     * Read field information from cached storage
43
     *
44
     * @param bool $force_update read fields from database and not cached storage
45
     *
46
     * @return array
47
     */
48
    public function loadFields($force_update = false)
49
    {
50
        static $fields = [];
51
        if (!empty($force_update) || 0 == \count($fields)) {
52
            $this->table_link = $this->db->prefix('suico_profile_category');
53
            $criteria         = new \Criteria('o.field_id', 0, '!=');
54
            $criteria->setSort('l.cat_weight ASC, o.field_weight');
55
            $field_objs = &$this->getByLink($criteria, ['o.*'], true, 'cat_id', 'cat_id');
56
            foreach (\array_keys($field_objs) as $i) {
57
                $fields[$field_objs[$i]->getVar('field_name')] = $field_objs[$i];
58
            }
59
        }
60
61
        return $fields;
62
    }
63
64
    /**
65
     * save a profile field in the database
66
     *
67
     * @param \XoopsObject $object   reference to the object
68
     * @param bool         $force whether to force the query execution despite security settings
69
     *
70
     * @return bool|int FALSE if failed, TRUE if already present and unchanged or successful
71
     * @internal param bool $checkObject check if the object is dirty and clean the attributes
72
     */
73
    public function insert(\XoopsObject $object, $force = false)
74
    {
75
        if (!($object instanceof $this->className)) {
76
            return false;
77
        }
78
        /** @var Suico\ProfileHandler $profileHandler */
79
        $profileHandler = Helper::getInstance()->getHandler('Profile');
80
        $object->setVar('field_name', \str_replace(' ', '_', $object->getVar('field_name')));
81
        $object->cleanVars();
82
        $defaultstring = '';
0 ignored issues
show
The assignment to $defaultstring is dead and can be removed.
Loading history...
83
        switch ($object->getVar('field_type')) {
84
            case 'datetime':
85
            case 'date':
86
                $object->setVar('field_valuetype', \XOBJ_DTYPE_INT);
87
                $object->setVar('field_maxlength', 10);
88
                break;
89
            case 'longdate':
90
                $object->setVar('field_valuetype', \XOBJ_DTYPE_MTIME);
91
                break;
92
            case 'yesno':
93
                $object->setVar('field_valuetype', \XOBJ_DTYPE_INT);
94
                $object->setVar('field_maxlength', 1);
95
                break;
96
            case 'textbox':
97
                if (\XOBJ_DTYPE_INT != $object->getVar('field_valuetype')) {
98
                    $object->setVar('field_valuetype', \XOBJ_DTYPE_TXTBOX);
99
                }
100
                break;
101
            case 'autotext':
102
                if (\XOBJ_DTYPE_INT != $object->getVar('field_valuetype')) {
103
                    $object->setVar('field_valuetype', \XOBJ_DTYPE_TXTAREA);
104
                }
105
                break;
106
            case 'group_multi':
107
            case 'select_multi':
108
            case 'checkbox':
109
                $object->setVar('field_valuetype', \XOBJ_DTYPE_ARRAY);
110
                break;
111
            case 'language':
112
            case 'timezone':
113
            case 'theme':
114
                $object->setVar('field_valuetype', \XOBJ_DTYPE_TXTBOX);
115
                break;
116
            case 'dhtml':
117
            case 'textarea':
118
                $object->setVar('field_valuetype', \XOBJ_DTYPE_TXTAREA);
119
                break;
120
        }
121
        if ('' === $object->getVar('field_valuetype')) {
122
            $object->setVar('field_valuetype', \XOBJ_DTYPE_TXTBOX);
123
        }
124
        if ((!\in_array($object->getVar('field_name'), $this->getUserVars(), true)) && isset($_REQUEST['field_required'])) {
125
            if ($object->isNew()) {
126
                //add column to table
127
                $changetype = 'ADD';
128
            } else {
129
                //update column information
130
                $changetype = 'MODIFY COLUMN';
131
            }
132
            $maxlengthstring = $object->getVar('field_maxlength') > 0 ? '(' . $object->getVar('field_maxlength') . ')' : '';
133
            //set type
134
            switch ($object->getVar('field_valuetype')) {
135
                default:
136
                case \XOBJ_DTYPE_ARRAY:
137
                case \XOBJ_DTYPE_UNICODE_ARRAY:
138
                    $type            = 'mediumtext';
139
                    $maxlengthstring = '';
140
                    break;
141
                case \XOBJ_DTYPE_UNICODE_EMAIL:
142
                case \XOBJ_DTYPE_UNICODE_TXTBOX:
143
                case \XOBJ_DTYPE_UNICODE_URL:
144
                case \XOBJ_DTYPE_EMAIL:
145
                case \XOBJ_DTYPE_TXTBOX:
146
                case \XOBJ_DTYPE_URL:
147
                    $type = 'varchar';
148
                    // varchars must have a maxlength
149
                    if (!$maxlengthstring) {
150
                        //so set it to max if maxlength is not set - or should it fail?
151
                        $maxlengthstring = '(255)';
152
                        $object->setVar('field_maxlength', 255);
153
                    }
154
                    break;
155
                case \XOBJ_DTYPE_INT:
156
                    $type = 'int';
157
                    break;
158
                case \XOBJ_DTYPE_DECIMAL:
159
                    $type = 'decimal(14,6)';
160
                    break;
161
                case \XOBJ_DTYPE_FLOAT:
162
                    $type = 'float(15,9)';
163
                    break;
164
                case \XOBJ_DTYPE_OTHER:
165
                case \XOBJ_DTYPE_UNICODE_TXTAREA:
166
                case \XOBJ_DTYPE_TXTAREA:
167
                    $type            = 'text';
168
                    $maxlengthstring = '';
169
                    break;
170
                case \XOBJ_DTYPE_MTIME:
171
                    $type            = 'date';
172
                    $maxlengthstring = '';
173
                    break;
174
            }
175
            $sql    = 'ALTER TABLE `' . $profileHandler->table . '` ' . $changetype . ' `' . $object->cleanVars['field_name'] . '` ' . $type . $maxlengthstring . ' NULL';
176
            $result = $force ? $this->db->queryF($sql) : $this->db->query($sql);
177
            if (!$result) {
178
                $object->setErrors($this->db->error());
179
180
                return false;
181
            }
182
        }
183
        //change this to also update the cached field information storage
184
        $object->setDirty();
185
        if (!parent::insert($object, $force)) {
186
            return false;
187
        }
188
189
        return $object->getVar('field_id');
190
    }
191
192
    /**
193
     * delete a profile field from the database
194
     *
195
     * @param \XoopsObject $object reference to the object to delete
196
     * @param bool         $force
197
     * @return bool FALSE if failed.
198
     */
199
    public function delete(\XoopsObject $object, $force = false)
200
    {
201
        if (!($object instanceof $this->className)) {
202
            return false;
203
        }
204
        /** @var ProfileHandler $profileHandler */
205
        $profileHandler = Helper::getInstance()->getHandler('Profile');
206
        // remove column from table
207
        $sql = 'ALTER TABLE ' . $profileHandler->table . ' DROP `' . $object->getVar('field_name', 'n') . '`';
208
        if ($this->db->query($sql)) {
209
            //change this to update the cached field information storage
210
            if (!parent::delete($object, $force)) {
211
                return false;
212
            }
213
            if ($object->getVar('field_show') || $object->getVar('field_edit')) {
214
                $moduleSuico = Helper::getInstance()->getModule();
215
                if (\is_object($moduleSuico)) {
216
                    // Remove group permissions
217
                    /** @var \XoopsGroupPermHandler $grouppermHandler */
218
                    $grouppermHandler = \xoops_getHandler('groupperm');
219
                    $criteria         = new \CriteriaCompo(new \Criteria('gperm_modid', $moduleSuico->getVar('mid')));
220
                    $criteria->add(new \Criteria('gperm_itemid', $object->getVar('field_id')));
221
222
                    return $grouppermHandler->deleteAll($criteria);
223
                }
224
            }
225
        }
226
227
        return false;
228
    }
229
230
    /**
231
     * Get array of standard variable names (user table)
232
     *
233
     * @return array
234
     */
235
    public function getUserVars()
236
    {
237
        return [
238
            'uid',
239
            'uname',
240
            'name',
241
            'email',
242
            'url',
243
            'user_avatar',
244
            'user_regdate',
245
            'user_from',
246
            'user_sig',
247
            'user_viewemail',
248
            'actkey',
249
            'pass',
250
            'posts',
251
            'attachsig',
252
            'rank',
253
            'level',
254
            'theme',
255
            'timezone_offset',
256
            'last_login',
257
            'umode',
258
            'uorder',
259
            'notify_method',
260
            'notify_mode',
261
            'user_occ',
262
            'bio',
263
            'user_intrest',
264
            'user_mailok',
265
        ];
266
    }
267
}
268