Issues (432)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/ImageHandler.php (18 issues)

1
<?php declare(strict_types=1);
2
3
namespace XoopsModules\Suico;
4
5
/*
6
 You may not change or alter any portion of this comment or credits
7
 of supporting developers from this source code or any supporting source code
8
 which is considered copyrighted (c) material of the original comment or credit authors.
9
10
 This program is distributed in the hope that it will be useful,
11
 but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
*/
14
15
use CriteriaElement;
16
use Xmf\Request;
17
use XoopsDatabase;
18
use XoopsFormButton;
19
use XoopsFormFile;
20
use XoopsFormHidden;
21
use XoopsFormLabel;
22
use XoopsFormText;
23
use XoopsMediaUploader;
24
use XoopsObject;
25
use XoopsPersistableObjectHandler;
26
use XoopsThemeForm;
27
28
/**
29
 * @category        Module
30
 * @copyright       {@link https://xoops.org/ XOOPS Project}
31
 * @license         GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html)
32
 * @author          Marcello Brandão aka  Suico, Mamba, LioMJ  <https://xoops.org>
33
 */
34
35
/**
36
 * Includes of form objects and uploader
37
 */
38
require_once XOOPS_ROOT_PATH . '/class/uploader.php';
39
require_once XOOPS_ROOT_PATH . '/kernel/object.php';
40
require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
41
42
/**
43
 * suico_imageshandler class.
44
 * This class provides simple mechanism for Image object and generate forms for inclusion etc
45
 */
46
class ImageHandler extends XoopsPersistableObjectHandler
47
{
48
    public Helper $helper;
49
    public        $isAdmin;
50
51
    /**
52
     * Constructor
53
     * @param \XoopsDatabase|null             $xoopsDatabase
54
     * @param \XoopsModules\Suico\Helper|null $helper
55
     */
56
    public function __construct(
57
        ?XoopsDatabase $xoopsDatabase = null,
58
        $helper = null
59
    ) {
60
        /** @var \XoopsModules\Suico\Helper $this- >helper */
61
        if (null === $helper) {
62
            $this->helper = Helper::getInstance();
63
        } else {
64
            $this->helper = $helper;
65
        }
66
        $this->isAdmin = $this->helper->isUserAdmin();
67
        parent::__construct($xoopsDatabase, 'suico_images', Image::class, 'image_id', 'title', 'caption');
68
    }
69
70
    /**
71
     * create a new Groups
72
     *
73
     * @param bool $isNew flag the new objects as "new"?
74
     * @return \XoopsObject Groups
75
     */
76
    public function create(
77
        $isNew = true
78
    ) {
79
        $obj = parent::create($isNew);
80
        //        if ($isNew) {
81
        //            $obj->setDefaultPermissions();
82
        //        }
83
        if ($isNew) {
84
            $obj->setNew();
85
        } else {
86
            $obj->unsetNew();
87
        }
88
        $obj->helper = $this->helper;
89
90
        return $obj;
91
    }
92
93
    /**
94
     * retrieve a Image
95
     *
96
     * @param int|null $id of the Image
97
     * @param null     $fields
0 ignored issues
show
Documentation Bug introduced by
Are you sure the doc-type for parameter $fields is correct as it would always require null to be passed?
Loading history...
98
     * @return false|\XoopsModules\Suico\Image reference to the {@link Image} object, FALSE if failed
99
     */
100
    public function get2(
101
        $id = null,
102
        $fields = null
0 ignored issues
show
The parameter $fields is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

102
        /** @scrutinizer ignore-unused */ $fields = null

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
103
    ) {
104
        $sql = 'SELECT * FROM ' . $this->db->prefix('suico_images') . ' WHERE image_id=' . $id;
105
        if (!$result = $this->db->query($sql)) {
106
            return false;
107
        }
108
        $numrows = $this->db->getRowsNum($result);
109
        if (1 === $numrows) {
110
            $image = new Image();
111
            $image->assignVars($this->db->fetchArray($result));
112
113
            return $image;
114
        }
115
116
        return false;
117
    }
118
119
    /**
120
     * insert a new Image in the database
121
     *
122
     * @param \XoopsObject $object reference to the {@link Image} object
123
     * @param bool         $force
124
     * @return bool FALSE if failed, TRUE if already present and unchanged or successful
125
     */
126
    public function insert2(
127
        XoopsObject $object,
128
        $force = false
129
    ) {
130
        global $xoopsConfig;
131
        if (!$object instanceof Image) {
132
            return false;
133
        }
134
        if (!$object->isDirty()) {
135
            return true;
136
        }
137
        if (!$object->cleanVars()) {
138
            return false;
139
        }
140
        $image_id = '';
141
        foreach ($object->cleanVars as $k => $v) {
142
            ${$k} = $v;
143
        }
144
        //        $now = 'date_add(now(), interval ' . $xoopsConfig['server_TZ'] . ' hour)';
145
        if ($object->isNew()) {
146
            // ajout/modification d'un Image
147
            $object = new Image();
148
            $format      = 'INSERT INTO %s (image_id, title, caption, date_created, date_updated, uid_owner, filename, private)';
149
            $format      .= 'VALUES (%u, %s, %s, %s, %s, %s, %s, 0)';
150
            $sql         = \sprintf(
151
                $format,
152
                $this->db->prefix('suico_images'),
153
                $image_id,
154
                $this->db->quoteString($title),
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $title seems to be never defined.
Loading history...
155
                $this->db->quoteString($caption),
156
                \time(), //$now,
157
                \time(), //$now,
158
                $this->db->quoteString($uid_owner),
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $uid_owner seems to be never defined.
Loading history...
159
                $this->db->quoteString($filename)
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $filename seems to be never defined.
Loading history...
160
            );
161
            $force       = true;
162
        } else {
163
            $format = 'UPDATE %s SET ';
164
            $format .= 'image_id=%u, title=%s, caption=%s, date_created=%s, date_updated=%s, uid_owner=%s, filename=%s, private=%s';
165
            $format .= ' WHERE image_id = %u';
166
            $sql    = \sprintf(
167
                $format,
168
                $this->db->prefix('suico_images'),
169
                $image_id,
170
                $this->db->quoteString($title),
171
                $this->db->quoteString($caption),
172
                $object->getVar('date_created'), // $now,
0 ignored issues
show
It seems like $object->getVar('date_created') can also be of type array and array; however, parameter $values of sprintf() does only seem to accept double|integer|string, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

172
                /** @scrutinizer ignore-type */ $object->getVar('date_created'), // $now,
Loading history...
173
                $object->getVar('date_updated'), // $now,
174
                $this->db->quoteString($uid_owner),
175
                $this->db->quoteString($filename),
176
                $this->db->quoteString($private),
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $private seems to be never defined.
Loading history...
177
                $image_id
178
            );
179
        }
180
        if ($force) {
181
            $result = $this->db->queryF($sql);
182
        } else {
183
            $result = $this->db->query($sql);
184
        }
185
        if (!$result) {
186
            return false;
187
        }
188
        if (empty($image_id)) {
189
            $image_id = $this->db->getInsertId();
190
        }
191
        $object->assignVar('image_id', $image_id);
192
193
        return true;
194
    }
195
196
    /**
197
     * delete a Image from the database
198
     *
199
     * @param \XoopsObject $object reference to the Image to delete
200
     * @param bool         $force
201
     * @return bool FALSE if failed.
202
     */
203
    public function delete(
204
        XoopsObject $object,
205
        $force = false
206
    ) {
207
        if (!$object instanceof Image) {
208
            return false;
209
        }
210
        $sql = \sprintf(
211
            'DELETE FROM %s WHERE image_id = %u',
212
            $this->db->prefix('suico_images'),
213
            (int)$object->getVar('image_id')
214
        );
215
        if ($force) {
216
            $result = $this->db->queryF($sql);
217
        } else {
218
            $result = $this->db->query($sql);
219
        }
220
        if (!$result) {
221
            return false;
222
        }
223
224
        return true;
225
    }
226
227
    /**
228
     * retrieve suico_imagess from the database
229
     *
230
     * @param \CriteriaElement|\CriteriaCompo|null $criteria {@link \CriteriaElement} conditions to be met
231
     * @param bool                                 $id_as_key       use the UID as key for the array?
232
     * @param bool                                 $as_object
233
     * @return array array of {@link Image} objects
234
     */
235
    public function &getObjects(
236
        ?CriteriaElement $criteria = null,
237
        $id_as_key = false,
238
        $as_object = true
239
    ) {
240
        $ret   = [];
241
        $start = 0;
242
        $limit = 0;
243
        $sql   = 'SELECT * FROM ' . $this->db->prefix('suico_images');
244
        if (isset($criteria) && is_subclass_of($criteria, 'CriteriaElement')) {
245
            $sql .= ' ' . $criteria->renderWhere();
0 ignored issues
show
The method renderWhere() does not exist on CriteriaElement. Did you maybe mean render()? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

245
            $sql .= ' ' . $criteria->/** @scrutinizer ignore-call */ renderWhere();

This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.

This is most likely a typographical error or the method has been renamed.

Loading history...
246
            if ('' !== $criteria->getSort()) {
247
                $sql .= ' ORDER BY ' . $criteria->getSort() . ' ' . $criteria->getOrder();
248
            }
249
            $limit = $criteria->getLimit();
250
            $start = $criteria->getStart();
251
        }
252
        $result = $this->db->query($sql, $limit, $start);
253
        if (!$result) {
254
            return $ret;
255
        }
256
        while (false !== ($myrow = $this->db->fetchArray($result))) {
257
            $image = new Image();
258
            $image->assignVars($myrow);
259
            if ($id_as_key) {
260
                $ret[$myrow['image_id']] = &$image;
261
            } else {
262
                $ret[] = &$image;
263
            }
264
            unset($image);
265
        }
266
267
        return $ret;
268
    }
269
270
    /**
271
     * count suico_imagess matching a condition
272
     *
273
     * @param \CriteriaElement|\CriteriaCompo|null $criteria {@link \CriteriaElement} to match
274
     * @return int count of suico_imagess
275
     */
276
    public function getCount(
277
        ?CriteriaElement $criteria = null
278
    ) {
279
        $sql = 'SELECT COUNT(*) FROM ' . $this->db->prefix('suico_images');
280
        if (isset($criteria) && is_subclass_of($criteria, 'CriteriaElement')) {
281
            $sql .= ' ' . $criteria->renderWhere();
282
        }
283
        $result = $this->db->query($sql);
284
        if (!$result) {
285
            return 0;
286
        }
287
        [$count] = $this->db->fetchRow($result);
288
289
        return (int)$count;
290
    }
291
292
    /**
293
     * delete suico_imagess matching a set of conditions
294
     *
295
     * @param \CriteriaElement|\CriteriaCompo|null $criteria {@link \CriteriaElement}
296
     * @param bool                                 $force
297
     * @param bool                                 $asObject
298
     * @return bool FALSE if deletion failed
299
     */
300
    public function deleteAll(
301
        ?CriteriaElement $criteria = null,
302
        $force = true,
303
        $asObject = false
304
    ) {
305
        $sql = 'DELETE FROM ' . $this->db->prefix('suico_images');
306
        if (isset($criteria) && is_subclass_of($criteria, 'CriteriaElement')) {
307
            $sql .= ' ' . $criteria->renderWhere();
308
        }
309
        if (!$result = $this->db->query($sql)) {
0 ignored issues
show
The assignment to $result is dead and can be removed.
Loading history...
310
            return false;
311
        }
312
313
        return true;
314
    }
315
316
    /**
317
     * Render a form to send pictures
318
     *
319
     * @param int       $maxbytes the maximum size of a picture
320
     * @param \XoopsTpl $xoopsTpl the one in which the form will be rendered
321
     * @return bool TRUE
322
     *
323
     * obs: Some functions wont work on php 4 so edit lines down under acording to your version
324
     */
325
    public function renderFormSubmit(
326
        $maxbytes,
327
        $xoopsTpl
328
    ) {
329
        $form          = new XoopsThemeForm(\_MD_SUICO_SUBMIT_PIC_TITLE, 'form_picture', 'submitImage.php', 'post', true);
330
        $field_url     = new XoopsFormFile(\_MD_SUICO_SELECT_PHOTO, 'sel_photo', 2000000);
331
        $field_title   = new XoopsFormText(\_MD_SUICO_PHOTOTITLE, 'title', 35, 55);
332
        $field_caption = new XoopsFormText(\_MD_SUICO_CAPTION, 'caption', 35, 55);
333
        $form->setExtra('enctype="multipart/form-data"');
334
        $buttonSend    = new XoopsFormButton('', 'submit_button', \_MD_SUICO_UPLOADPICTURE, 'submit');
335
        $field_warning = new XoopsFormLabel(\sprintf(\_MD_SUICO_YOU_CAN_UPLOAD, $maxbytes / 1024));
336
        $form->addElement($field_warning);
337
        $form->addElement($field_url, true);
338
        $form->addElement($field_title);
339
        $form->addElement($field_caption);
340
        $form->addElement($buttonSend);
341
        $form->assign($xoopsTpl); //If your server is php 5
342
343
        return true;
344
    }
345
346
    /**
347
     * Render a form to edit the description of the pictures
348
     *
349
     * @param        $title
350
     * @param string $caption  The description of the picture
351
     * @param int    $image_id the id of the image in database
352
     * @param string $filename the url to the thumb of the image so it can be displayed
353
     * @return bool TRUE
354
     */
355
    public function renderFormEdit(
356
        $title,
357
        $caption,
358
        $image_id,
359
        $filename
360
    ) {
361
        $form          = new XoopsThemeForm(\_MD_SUICO_EDIT_PICTURE, 'form_picture', 'editpicture.php', 'post', true);
362
        $field_title   = new XoopsFormText($title, 'title', 35, 55);
363
        $field_caption = new XoopsFormText($caption, 'caption', 35, 55);
364
        $form->setExtra('enctype="multipart/form-data"');
365
        $buttonSend     = new XoopsFormButton('', 'submit_button', \_MD_SUICO_SUBMIT, 'submit');
366
        $field_warning  = new XoopsFormLabel("<img src='" . $filename . "' alt='thumb'>");
367
        $field_image_id = new XoopsFormHidden('image_id', $image_id);
368
        $field_marker   = new XoopsFormHidden('marker', 1);
369
        $form->addElement($field_warning);
370
        $form->addElement($field_title);
371
        $form->addElement($field_caption);
372
        $form->addElement($field_image_id);
373
        $form->addElement($field_marker);
374
        $form->addElement($buttonSend);
375
        $form->display();
376
377
        return true;
378
    }
379
380
    /**
381
     * Upload the file and Save into database
382
     *
383
     * @param string $title         A litle title of the file
384
     * @param string $caption       A litle description of the file
385
     * @param string $pathUpload    The path to where the file should be uploaded
386
     * @param int    $thumbwidth    the width in pixels that the thumbnail will have
387
     * @param int    $thumbheight   the height in pixels that the thumbnail will have
388
     * @param int    $pictwidth     the width in pixels that the pic will have
389
     * @param int    $pictheight    the height in pixels that the pic will have
390
     * @param int    $maxfilebytes  the maximum size a file can have to be uploaded in bytes
391
     * @param int    $maxfilewidth  the maximum width in pixels that a pic can have
392
     * @param int    $maxfileheight the maximum height in pixels that a pic can have
393
     * @return bool FALSE if upload fails or database fails
394
     */
395
    public function receivePicture(
396
        $title,
397
        $caption,
398
        $pathUpload,
399
        $thumbwidth,
400
        $thumbheight,
401
        $pictwidth,
402
        $pictheight,
403
        $maxfilebytes,
404
        $maxfilewidth,
405
        $maxfileheight
406
    ) {
407
        global $xoopsUser, $xoopsDB;
408
        //search logged user id
409
        $uid = $xoopsUser->getVar('uid');
410
        //create a hash so it does not erase another file
411
        //$hash1 = date();
412
        //$hash = substr($hash1,0,4);
413
        // mimetypes and settings put this in admin part later
414
        $allowed_mimetypes = Helper::getInstance()->getConfig(
415
            'mimetypes'
416
        );
417
        $maxfilesize       = $maxfilebytes;
418
        //        $uploadDir = \XOOPS_UPLOAD_PATH . '/suico/images/';
419
        // create the object to upload
420
        $uploader = new XoopsMediaUploader(
421
            $pathUpload,
422
            $allowed_mimetypes,
423
            $maxfilesize,
424
            $maxfilewidth,
425
            $maxfileheight
426
        );
427
        // fetch the media
428
        if ($uploader->fetchMedia(Request::getArray('xoops_upload_file', '', 'POST')[0])) {
429
            //lets create a name for it
430
            $uploader->setPrefix('pic_' . $uid . '_');
431
            //now let s upload the file
432
            if (!$uploader->upload()) {
433
                // if there are errors lets return them
434
                echo '<div style="color:#FF0000; background-color:#FFEAF4; border-color:#FF0000; border-width:thick; border-style:solid; text-align:center"><p>' . $uploader->getErrors() . '</p></div>';
435
436
                return false;
437
            }
438
            // now let s create a new object picture and set its variables
439
            $picture  = $this->create();
440
            $filename = $uploader->getSavedFileName();
441
            $picture->setVar('filename', $filename);
442
            $picture->setVar('title', $title);
443
            $picture->setVar('caption', $caption);
444
            $picture->setVar('date_created', \time());
445
            $picture->setVar('date_updated', \time());
446
            $picture->setVar('private', 0);
447
            $uid = $xoopsUser->getVar('uid');
448
            $picture->setVar('uid_owner', $uid);
449
            $this->insert($picture);
450
            $saved_destination = $uploader->getSavedDestination();
451
            //print_r($_FILES);
452
            //$this->resizeImage($saved_destination,false, $thumbwidth, $thumbheight, $pictwidth, $pictheight,$pathUpload);
453
            //$this->resizeImage($saved_destination,true, $thumbwidth, $thumbheight, $pictwidth, $pictheight,$pathUpload);
454
            $this->resizeImage(
455
                $saved_destination,
456
                $thumbwidth,
457
                $thumbheight,
458
                $pictwidth,
459
                $pictheight,
460
                $pathUpload
461
            );
462
        } else {
463
            echo '<div style="color:#FF0000; background-color:#FFEAF4; border-color:#FF0000; border-width:thick; border-style:solid; text-align:center"><p>' . $uploader->getErrors() . '</p></div>';
464
465
            return false;
466
        }
467
468
        return true;
469
    }
470
471
    /**
472
     * Resize a picture and save it to $pathUpload
473
     *
474
     * @param string $img         the path to the file
475
     * @param int    $thumbwidth  the width in pixels that the thumbnail will have
476
     * @param int    $thumbheight the height in pixels that the thumbnail will have
477
     * @param int    $pictwidth   the width in pixels that the pic will have
478
     * @param int    $pictheight  the height in pixels that the pic will have
479
     * @param string $pathUpload  The path to where the files should be saved after resizing
480
     */
481
    public function resizeImage(
482
        $img,
483
        $thumbwidth,
484
        $thumbheight,
485
        $pictwidth,
486
        $pictheight,
487
        $pathUpload
488
    ): void {
489
        $img2   = $img;
490
        $path   = \pathinfo($img);
491
        $img    = \imagecreatefromjpeg($img);
492
        $xratio = $thumbwidth / \imagesx($img);
493
        $yratio = $thumbheight / \imagesy($img);
494
        if ($xratio < 1 || $yratio < 1) {
495
            if ($xratio < $yratio) {
496
                $resized = \imagecreatetruecolor($thumbwidth, (int)\floor(\imagesy($img) * $xratio));
497
            } else {
498
                $resized = \imagecreatetruecolor((int)\floor(\imagesx($img) * $yratio), $thumbheight);
499
            }
500
            \imagecopyresampled(
501
                $resized,
502
                $img,
503
                0,
504
                0,
505
                0,
506
                0,
507
                \imagesx($resized) + 1,
508
                \imagesy($resized) + 1,
509
                \imagesx($img),
510
                \imagesy($img)
511
            );
512
            \imagejpeg($resized, $pathUpload . '/thumb_' . $path['basename']);
513
            \imagedestroy($resized);
514
        } else {
515
            \imagejpeg($img, $pathUpload . '/thumb_' . $path['basename']);
516
        }
517
        \imagedestroy($img);
518
        $path2   = \pathinfo($img2);
519
        $img2    = \imagecreatefromjpeg($img2);
520
        $xratio2 = $pictwidth / \imagesx($img2);
521
        $yratio2 = $pictheight / \imagesy($img2);
522
        if ($xratio2 < 1 || $yratio2 < 1) {
523
            if ($xratio2 < $yratio2) {
524
                $resized2 = \imagecreatetruecolor($pictwidth, (int)\floor(\imagesy($img2) * $xratio2));
525
            } else {
526
                $resized2 = \imagecreatetruecolor((int)\floor(\imagesx($img2) * $yratio2), $pictheight);
527
            }
528
            \imagecopyresampled(
529
                $resized2,
530
                $img2,
531
                0,
532
                0,
533
                0,
534
                0,
535
                \imagesx($resized2) + 1,
536
                \imagesy($resized2) + 1,
537
                \imagesx($img2),
538
                \imagesy($img2)
539
            );
540
            \imagejpeg($resized2, $pathUpload . '/resized_' . $path2['basename']);
541
            \imagedestroy($resized2);
542
        } else {
543
            \imagejpeg($img2, $pathUpload . '/resized_' . $path2['basename']);
544
        }
545
        \imagedestroy($img2);
546
    }
547
548
    /**
549
     * @param $limit
550
     * @return array
551
     */
552
    public function getLastPictures($limit)
553
    {
554
        $ret    = [];
0 ignored issues
show
The assignment to $ret is dead and can be removed.
Loading history...
555
        $sql    = 'SELECT uname, t.uid_owner, t.filename FROM ' . $this->db->prefix(
556
                'suico_images'
557
            ) . ' AS t, ' . $this->db->prefix(
558
                'users'
559
            );
560
        $sql    .= ' WHERE uid_owner = uid AND private=0 ORDER BY image_id DESC';
561
        $result = $this->db->query($sql, $limit, 0);
562
        $vetor  = [];
563
        $i      = 0;
564
        while (false !== ($myrow = $this->db->fetchArray($result))) {
565
            $vetor[$i]['uid_owner']    = $myrow['uid_owner'];
566
            $vetor[$i]['uname']        = $myrow['uname'];
567
            $vetor[$i]['img_filename'] = $myrow['filename'];
568
            $i++;
569
        }
570
571
        return $vetor;
572
    }
573
574
    /**
575
     * @param $limit
576
     * @return array
577
     */
578
    public function getLastPicturesForBlock($limit)
579
    {
580
        global $xoopsUser, $xoopsDB;
581
        if (\is_object($xoopsUser)) {
582
            $uid = $xoopsUser->getVar('uid');
583
        }
584
585
        $controller = new PhotosController($xoopsDB, $xoopsUser);
586
587
        $isUser      = $controller->isUser;
588
        $isAnonymous = $controller->isAnonym;
589
590
        if (1 == $isAnonymous) {
591
            $sql = 'SELECT uname, t.uid_owner, t.filename, t.title, t.caption, t.date_created, t.date_updated  FROM ' . $this->db->prefix('suico_images') . ' AS t';
592
            $sql .= ' INNER JOIN ' . $this->db->prefix('users') . ' u ON t.uid_owner=u.uid';
593
            $sql .= ' INNER JOIN ' . $this->db->prefix('suico_configs') . ' c on t.uid_owner=c.config_uid';
594
            $sql .= ' WHERE private=0 AND c.pictures < 2 ';
595
            $sql .= ' ORDER BY image_id DESC';
596
        }
597
        if (1 == $isUser) {
598
            $sql0 = 'SELECT f.friend2_uid FROM ' . $this->db->prefix('suico_friendships') . ' AS f';
599
            $sql0 .= ' WHERE f.friend1_uid = ' . $uid;
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $uid does not seem to be defined for all execution paths leading up to this point.
Loading history...
600
            $sql  = 'SELECT uname, t.uid_owner, t.filename, t.title, t.caption, t.date_created, t.date_updated  FROM ' . $this->db->prefix('suico_images') . ' AS t';
601
            $sql  .= ' INNER JOIN ' . $this->db->prefix('users') . ' u ON t.uid_owner=u.uid';
602
            $sql  .= ' INNER JOIN ' . $this->db->prefix('suico_configs') . ' c on t.uid_owner=c.config_uid';
603
            $sql  .= ' WHERE (private=0 AND c.pictures < 3 )'; //all pictures visible to members
604
            $sql  .= ' OR ( private=0 AND c.pictures = 3 AND c.config_uid IN ( ' . $sql0 . ')) '; //pictures visible to friends
605
            $sql  .= ' OR ( c.config_uid = ' . $uid . ' ) '; //my private pictures
606
            $sql  .= ' ORDER BY image_id DESC';
607
        }
608
609
        $result = $this->db->query($sql, $limit, 0);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $sql does not seem to be defined for all execution paths leading up to this point.
Loading history...
610
611
        $vetor = [];
612
        $i     = 0;
613
        while (false !== ($myrow = $this->db->fetchArray($result))) {
614
            $vetor[$i]['uid_owner']    = $myrow['uid_owner'];
615
            $vetor[$i]['uname']        = $myrow['uname'];
616
            $vetor[$i]['img_filename'] = $myrow['filename'];
617
            $vetor[$i]['title']        = $myrow['title'];
618
            $vetor[$i]['caption']      = $myrow['caption'];
619
            $vetor[$i]['date_created'] = \formatTimestamp($myrow['date_created']);
620
            $vetor[$i]['date_updated'] = \formatTimestamp($myrow['date_updated']);
621
            $i++;
622
        }
623
624
        return $vetor;
625
    }
626
627
    /**
628
     * Resize a picture and save it to $pathUpload
629
     *
630
     * @param string $img        the path to the file
631
     * @param        $width
632
     * @param        $height
633
     * @param string $pathUpload The path to where the files should be saved after resizing
634
     */
635
    public function makeAvatar(
636
        $img,
637
        $width,
0 ignored issues
show
The parameter $width is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

637
        /** @scrutinizer ignore-unused */ $width,

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
638
        $height,
0 ignored issues
show
The parameter $height is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

638
        /** @scrutinizer ignore-unused */ $height,

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
639
        $pathUpload
640
    ): void {
641
        $img2   = $img;
642
        $path   = \pathinfo($img);
643
        $img    = \imagecreatefromjpeg($img);
644
        $xratio = $thumbwidth / \imagesx($img);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $thumbwidth seems to be never defined.
Loading history...
645
        $yratio = $thumbheight / \imagesy($img);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $thumbheight does not exist. Did you maybe mean $height?
Loading history...
646
        if ($xratio < 1 || $yratio < 1) {
647
            if ($xratio < $yratio) {
648
                $resized = \imagecreatetruecolor($thumbwidth, (int)\floor(\imagesy($img) * $xratio));
649
            } else {
650
                $resized = \imagecreatetruecolor((int)\floor(\imagesx($img) * $yratio), $thumbheight);
651
            }
652
            \imagecopyresampled(
653
                $resized,
654
                $img,
655
                0,
656
                0,
657
                0,
658
                0,
659
                \imagesx($resized) + 1,
660
                \imagesy($resized) + 1,
661
                \imagesx($img),
662
                \imagesy($img)
663
            );
664
            \imagejpeg($resized, $pathUpload . '/thumb_' . $path['basename']);
665
            \imagedestroy($resized);
666
        } else {
667
            \imagejpeg($img, $pathUpload . '/thumb_' . $path['basename']);
668
        }
669
        \imagedestroy($img);
670
        $path2   = \pathinfo($img2);
671
        $img2    = \imagecreatefromjpeg($img2);
672
        $xratio2 = $pictwidth / \imagesx($img2);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $pictwidth seems to be never defined.
Loading history...
673
        $yratio2 = $pictheight / \imagesy($img2);
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $pictheight does not exist. Did you maybe mean $height?
Loading history...
674
        if ($xratio2 < 1 || $yratio2 < 1) {
675
            if ($xratio2 < $yratio2) {
676
                $resized2 = \imagecreatetruecolor($pictwidth, (int)\floor(\imagesy($img2) * $xratio2));
677
            } else {
678
                $resized2 = \imagecreatetruecolor((int)\floor(\imagesx($img2) * $yratio2), $pictheight);
679
            }
680
            \imagecopyresampled(
681
                $resized2,
682
                $img2,
683
                0,
684
                0,
685
                0,
686
                0,
687
                \imagesx($resized2) + 1,
688
                \imagesy($resized2) + 1,
689
                \imagesx($img2),
690
                \imagesy($img2)
691
            );
692
            \imagejpeg($resized2, $pathUpload . '/resized_' . $path2['basename']);
693
            \imagedestroy($resized2);
694
        } else {
695
            \imagejpeg($img2, $pathUpload . '/resized_' . $path2['basename']);
696
        }
697
        \imagedestroy($img2);
698
    }
699
}
700