XoopsModules25x /
suico
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php declare(strict_types=1); |
||
| 2 | |||
| 3 | namespace XoopsModules\Suico; |
||
| 4 | |||
| 5 | /** |
||
| 6 | * Extended User Profile |
||
| 7 | * |
||
| 8 | * You may not change or alter any portion of this comment or credits |
||
| 9 | * of supporting developers from this source code or any supporting source code |
||
| 10 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
| 11 | * This program is distributed in the hope that it will be useful, |
||
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
| 14 | * |
||
| 15 | * @copyright (c) 2000-2016 XOOPS Project (www.xoops.org) |
||
| 16 | * @license GNU GPL 2 (https://www.gnu.org/licenses/gpl-2.0.html) |
||
| 17 | * @since 2.3.0 |
||
| 18 | * @author Jan Pedersen |
||
| 19 | * @author Taiwen Jiang <[email protected]> |
||
| 20 | */ |
||
| 21 | |||
| 22 | /** |
||
| 23 | * @copyright (c) 2000-2016 XOOPS Project (www.xoops.org) |
||
| 24 | */ |
||
| 25 | |||
| 26 | use XoopsModules\Suico; |
||
| 27 | |||
| 28 | /** |
||
| 29 | * Class ProfileHandler |
||
| 30 | */ |
||
| 31 | class ProfileHandler extends \XoopsPersistableObjectHandler |
||
| 32 | { |
||
| 33 | /** |
||
| 34 | * holds reference to {@link ProfileFieldHandler} object |
||
| 35 | */ |
||
| 36 | public $fieldHandler; |
||
| 37 | /** |
||
| 38 | * Array of {@link Suico\Field} objects |
||
| 39 | * @var array |
||
| 40 | */ |
||
| 41 | public array $_fields = []; |
||
| 42 | |||
| 43 | /** |
||
| 44 | * @param \XoopsDatabase $db |
||
| 45 | */ |
||
| 46 | public function __construct(\XoopsDatabase $db) |
||
| 47 | { |
||
| 48 | parent::__construct($db, 'suico_profile', Profile::class, 'profile_id'); |
||
| 49 | $this->fieldHandler = Helper::getInstance()->getHandler('Field'); |
||
| 50 | } |
||
| 51 | |||
| 52 | /** |
||
| 53 | * create a new {@link ProfileProfile} |
||
| 54 | * |
||
| 55 | * @param bool $isNew Flag the new objects as "new"? |
||
| 56 | * |
||
| 57 | * @return object {@link ProfileProfile} |
||
| 58 | */ |
||
| 59 | public function create($isNew = true) |
||
| 60 | { |
||
| 61 | $obj = new $this->className($this->loadFields()); |
||
| 62 | $obj->handler = $this; |
||
| 63 | if ($isNew) { |
||
| 64 | $obj->setNew(); |
||
| 65 | } |
||
| 66 | |||
| 67 | return $obj; |
||
| 68 | } |
||
| 69 | |||
| 70 | /** |
||
| 71 | * Get a ProfileProfile object for a user id. |
||
| 72 | * |
||
| 73 | * We will create an empty profile if none exists. This behavior allows user objects |
||
| 74 | * created outside of profile to be edited correctly in the profile module. |
||
| 75 | * |
||
| 76 | * @param int|null $id User ID |
||
| 77 | * @param string[]|null $fields array of field names to fetch, null for all |
||
| 78 | * |
||
| 79 | * @return object {@link ProfileProfile} |
||
| 80 | * |
||
| 81 | * @internal This was get($id, $createOnFailure = true). No callers found using the extra parameter. |
||
| 82 | * @internal Modified to match parent signature. |
||
| 83 | */ |
||
| 84 | public function get($id = null, $fields = null) |
||
| 85 | { |
||
| 86 | $obj = parent::get($id, $fields); |
||
| 87 | if (!\is_object($obj)) { |
||
| 88 | $obj = $this->create(); |
||
| 89 | } |
||
| 90 | |||
| 91 | return $obj; |
||
| 92 | } |
||
| 93 | |||
| 94 | /** |
||
| 95 | * Create new {@link Suico\Field} object |
||
| 96 | * |
||
| 97 | * @param bool $isNew |
||
| 98 | * |
||
| 99 | * @return \XoopsModules\Suico\Field|\XoopsObject |
||
| 100 | */ |
||
| 101 | public function createField($isNew = true) |
||
| 102 | { |
||
| 103 | $return = $this->fieldHandler->create($isNew); |
||
| 104 | |||
| 105 | return $return; |
||
| 106 | } |
||
| 107 | |||
| 108 | /** |
||
| 109 | * Load field information |
||
| 110 | * |
||
| 111 | * @return array |
||
| 112 | */ |
||
| 113 | public function loadFields() |
||
| 114 | { |
||
| 115 | if (0 == \count($this->_fields)) { |
||
| 116 | $this->_fields = $this->fieldHandler->loadFields(); |
||
| 117 | } |
||
| 118 | |||
| 119 | return $this->_fields; |
||
| 120 | } |
||
| 121 | |||
| 122 | /** |
||
| 123 | * Fetch fields |
||
| 124 | * |
||
| 125 | * @param \CriteriaElement $criteria {@link CriteriaElement} object |
||
| 126 | * @param bool $id_as_key return array with field IDs as key? |
||
| 127 | * @param bool $as_object return array of objects? |
||
| 128 | * |
||
| 129 | * @return array |
||
| 130 | */ |
||
| 131 | public function getFields(\CriteriaElement $criteria, $id_as_key = true, $as_object = true) |
||
| 132 | { |
||
| 133 | return $this->fieldHandler->getObjects($criteria, $id_as_key, $as_object); |
||
| 134 | } |
||
| 135 | |||
| 136 | /** |
||
| 137 | * Insert a field in the database |
||
| 138 | * |
||
| 139 | * @param \XoopsModules\Suico\Field $field |
||
| 140 | * @param bool $force |
||
| 141 | * |
||
| 142 | * @return bool |
||
| 143 | */ |
||
| 144 | public function insertField(Suico\Field $field, $force = false) |
||
| 145 | { |
||
| 146 | return $this->fieldHandler->insert($field, $force); |
||
| 147 | } |
||
| 148 | |||
| 149 | /** |
||
| 150 | * Delete a field from the database |
||
| 151 | * |
||
| 152 | * @param \XoopsModules\Suico\Field $field |
||
| 153 | * @param bool $force |
||
| 154 | * |
||
| 155 | * @return bool |
||
| 156 | */ |
||
| 157 | public function deleteField(Suico\Field $field, $force = false) |
||
| 158 | { |
||
| 159 | return $this->fieldHandler->delete($field, $force); |
||
| 160 | } |
||
| 161 | |||
| 162 | /** |
||
| 163 | * Save a new field in the database |
||
| 164 | * |
||
| 165 | * @param array $vars array of variables, taken from $module->loadInfo('profile')['field'] |
||
| 166 | * @param int $weight |
||
| 167 | * |
||
| 168 | * @return string |
||
| 169 | * @internal param int $type valuetype of the field |
||
| 170 | * @internal param int $moduleid ID of the module, this field belongs to |
||
| 171 | * @internal param int $categoryid ID of the category to add it to |
||
| 172 | */ |
||
| 173 | public function saveField($vars, $weight = 0) |
||
| 174 | { |
||
| 175 | $field = $this->createField(); |
||
| 176 | $field->setVar('field_name', $vars['name']); |
||
| 177 | $field->setVar('field_valuetype', $vars['valuetype']); |
||
| 178 | $field->setVar('field_type', $vars['type']); |
||
| 179 | $field->setVar('field_weight', $weight); |
||
| 180 | if (isset($vars['title'])) { |
||
| 181 | $field->setVar('field_title', $vars['title']); |
||
| 182 | } |
||
| 183 | if (isset($vars['description'])) { |
||
| 184 | $field->setVar('field_description', $vars['description']); |
||
| 185 | } |
||
| 186 | if (isset($vars['required'])) { |
||
| 187 | $field->setVar('field_required', $vars['required']); //0 = no, 1 = yes |
||
| 188 | } |
||
| 189 | if (isset($vars['maxlength'])) { |
||
| 190 | $field->setVar('field_maxlength', $vars['maxlength']); |
||
| 191 | } |
||
| 192 | if (isset($vars['default'])) { |
||
| 193 | $field->setVar('field_default', $vars['default']); |
||
| 194 | } |
||
| 195 | if (isset($vars['notnull'])) { |
||
| 196 | $field->setVar('field_notnull', $vars['notnull']); |
||
| 197 | } |
||
| 198 | if (isset($vars['show'])) { |
||
| 199 | $field->setVar('field_show', $vars['show']); |
||
| 200 | } |
||
| 201 | if (isset($vars['edit'])) { |
||
| 202 | $field->setVar('field_edit', $vars['edit']); |
||
| 203 | } |
||
| 204 | if (isset($vars['config'])) { |
||
| 205 | $field->setVar('field_config', $vars['config']); |
||
| 206 | } |
||
| 207 | if (isset($vars['options'])) { |
||
| 208 | $field->setVar('field_options', $vars['options']); |
||
| 209 | } else { |
||
| 210 | $field->setVar('field_options', []); |
||
| 211 | } |
||
| 212 | if ($this->insertField($field)) { |
||
| 213 | $msg = ' Field <strong>' . $vars['name'] . '</strong> added to the database'; |
||
| 214 | } else { |
||
| 215 | $msg = ' <span class="red">ERROR: Could not insert field <strong>' . $vars['name'] . '</strong> into the database. ' . \implode(' ', $field->getErrors()) . $this->db->error() . '</span>'; |
||
| 216 | } |
||
| 217 | unset($field); |
||
| 218 | |||
| 219 | return $msg; |
||
| 220 | } |
||
| 221 | |||
| 222 | /** |
||
| 223 | * insert a new object in the database |
||
| 224 | * |
||
| 225 | * @param \XoopsObject $object reference to the object |
||
| 226 | * @param bool $force whether to force the query execution despite security settings |
||
| 227 | * |
||
| 228 | * @return bool FALSE if failed, TRUE if already present and unchanged or successful |
||
| 229 | */ |
||
| 230 | public function insert(\XoopsObject $object, $force = false) |
||
| 231 | { |
||
| 232 | if (!($object instanceof $this->className)) { |
||
| 233 | return false; |
||
| 234 | } |
||
| 235 | $uservars = $this->getUserVars(); |
||
| 236 | foreach ($uservars as $var) { |
||
| 237 | unset($object->vars[$var]); |
||
| 238 | } |
||
| 239 | if (0 == \count($object->vars)) { |
||
| 240 | return true; |
||
| 241 | } |
||
| 242 | |||
| 243 | return parent::insert($object, $force); |
||
| 244 | } |
||
| 245 | |||
| 246 | /** |
||
| 247 | * Get array of standard variable names (user table) |
||
| 248 | * |
||
| 249 | * @return array |
||
| 250 | */ |
||
| 251 | public function getUserVars() |
||
| 252 | { |
||
| 253 | return $this->fieldHandler->getUserVars(); |
||
| 254 | } |
||
| 255 | |||
| 256 | /** |
||
| 257 | * Search profiles and users |
||
| 258 | * |
||
| 259 | * @param \CriteriaElement $criteria CriteriaElement |
||
| 260 | * @param array $searchvars Fields to be fetched |
||
| 261 | * @param array|null $groups for Usergroups is selected (only admin!) |
||
| 262 | * |
||
| 263 | * @return array |
||
| 264 | */ |
||
| 265 | public function search(\CriteriaElement $criteria, $searchvars = [], $groups = null) |
||
| 266 | { |
||
| 267 | $uservars = $this->getUserVars(); |
||
| 268 | $searchvars_user = \array_intersect($searchvars, $uservars); |
||
| 269 | $searchvars_profile = \array_diff($searchvars, $uservars); |
||
| 270 | $sv = ['u.uid, u.uname, u.email, u.user_viewemail']; |
||
| 271 | if (!empty($searchvars_user)) { |
||
| 272 | $sv[0] .= ',u.' . \implode(', u.', $searchvars_user); |
||
| 273 | } |
||
| 274 | if (!empty($searchvars_profile)) { |
||
| 275 | $sv[] = 'p.' . \implode(', p.', $searchvars_profile); |
||
| 276 | } |
||
| 277 | $sql_select = 'SELECT ' . (empty($searchvars) ? 'u.*, p.*' : \implode(', ', $sv)); |
||
| 278 | $sql_from = ' FROM ' . $this->db->prefix('users') . ' AS u LEFT JOIN ' . $this->table . ' AS p ON u.uid=p.profile_id' . (empty($groups) ? '' : ' LEFT JOIN ' . $this->db->prefix('groups_users_link') . ' AS g ON u.uid=g.uid'); |
||
| 279 | $sql_clause = ' WHERE 1=1'; |
||
| 280 | $sql_order = ''; |
||
| 281 | $start = 0; |
||
| 282 | $limit = 0; |
||
| 283 | if (($criteria instanceof \CriteriaCompo) || ($criteria instanceof \Criteria)) { |
||
| 284 | $sql_clause .= ' AND ' . $criteria->render(); |
||
| 285 | if ('' !== $criteria->getSort()) { |
||
| 286 | $sql_order = ' ORDER BY ' . $criteria->getSort() . ' ' . $criteria->getOrder(); |
||
| 287 | } |
||
| 288 | $limit = $criteria->getLimit(); |
||
| 289 | $start = $criteria->getStart(); |
||
| 290 | } |
||
| 291 | if (!empty($groups)) { |
||
| 292 | $sql_clause .= ' AND g.groupid IN (' . \implode(', ', $groups) . ')'; |
||
| 293 | } |
||
| 294 | $sql_users = $sql_select . $sql_from . $sql_clause . $sql_order; |
||
| 295 | $result = $this->db->query($sql_users, $limit, $start); |
||
| 296 | if (!$result) { |
||
| 297 | return [[], [], 0]; |
||
| 298 | } |
||
| 299 | $userHandler = \xoops_getHandler('user'); |
||
| 300 | $uservars = $this->getUserVars(); |
||
| 301 | $users = []; |
||
| 302 | $profiles = []; |
||
| 303 | while (false !== ($myrow = $this->db->fetchArray($result))) { |
||
| 304 | $profile = $this->create(false); |
||
| 305 | $user = $userHandler->create(false); |
||
|
0 ignored issues
–
show
|
|||
| 306 | foreach ($myrow as $name => $value) { |
||
| 307 | if (\in_array($name, $uservars, true)) { |
||
| 308 | $user->assignVar($name, $value); |
||
| 309 | } else { |
||
| 310 | $profile->assignVar($name, $value); |
||
| 311 | } |
||
| 312 | } |
||
| 313 | $profiles[$myrow['uid']] = $profile; |
||
| 314 | $users[$myrow['uid']] = $user; |
||
| 315 | } |
||
| 316 | $count = \count($users); |
||
| 317 | if ((!empty($limit) && $count >= $limit) || !empty($start)) { |
||
| 318 | $sql_count = 'SELECT COUNT(*)' . $sql_from . $sql_clause; |
||
| 319 | $result = $this->db->query($sql_count); |
||
| 320 | [$count] = $this->db->fetchRow($result); |
||
| 321 | } |
||
| 322 | |||
| 323 | return [$users, $profiles, (int)$count]; |
||
| 324 | } |
||
| 325 | } |
||
| 326 |
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.
If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.