This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||
2 | /* |
||||
3 | You may not change or alter any portion of this comment or credits |
||||
4 | of supporting developers from this source code or any supporting source code |
||||
5 | which is considered copyrighted (c) material of the original comment or credit authors. |
||||
6 | |||||
7 | This program is distributed in the hope that it will be useful, |
||||
8 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
9 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
10 | */ |
||||
11 | |||||
12 | /** |
||||
13 | * @category Module |
||||
14 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||
15 | * @license GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||
16 | * @author Marcello Brandão aka Suico, Mamba, LioMJ <https://xoops.org> |
||||
17 | */ |
||||
18 | |||||
19 | use Xmf\Database\TableLoad; |
||||
20 | use Xmf\Request; |
||||
0 ignored issues
–
show
|
|||||
21 | use Xmf\Yaml; |
||||
22 | use XoopsModules\Suico\{ |
||||
23 | Common\Configurator, |
||||
24 | Common\Migrate, |
||||
25 | Helper, |
||||
26 | Utility |
||||
27 | }; |
||||
28 | |||||
29 | require \dirname(__DIR__, 3) . '/include/cp_header.php'; |
||||
30 | require \dirname(__DIR__) . '/preloads/autoloader.php'; |
||||
31 | $op = Request::getCmd('op', ''); |
||||
32 | $moduleDirName = \basename(\dirname(__DIR__)); |
||||
33 | $moduleDirNameUpper = \mb_strtoupper($moduleDirName); |
||||
34 | $helper = Helper::getInstance(); |
||||
35 | // Load language files |
||||
36 | $helper->loadLanguage('common'); |
||||
37 | switch ($op) { |
||||
38 | case 'load': |
||||
39 | if (Request::hasVar('ok', 'REQUEST') && 1 === Request::getInt('ok', 0, 'REQUEST')) { |
||||
40 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||
41 | redirect_header('../admin/index.php', 3, implode(',', $GLOBALS['xoopsSecurity']->getErrors())); |
||||
42 | } |
||||
43 | loadSampleData(); |
||||
44 | } else { |
||||
45 | xoops_cp_header(); |
||||
46 | xoops_confirm( |
||||
47 | [ |
||||
48 | 'ok' => 1, |
||||
49 | 'op' => 'load', |
||||
50 | ], |
||||
51 | 'index.php', |
||||
52 | constant('CO_' . $moduleDirNameUpper . '_' . 'LOAD_SAMPLEDATA_CONFIRM'), |
||||
53 | constant( |
||||
54 | 'CO_' . $moduleDirNameUpper . '_' . 'CONFIRM' |
||||
55 | ), |
||||
56 | true |
||||
57 | ); |
||||
58 | xoops_cp_footer(); |
||||
59 | } |
||||
60 | break; |
||||
61 | case 'save': |
||||
62 | saveSampleData(); |
||||
63 | break; |
||||
64 | case 'clear': |
||||
65 | if (Request::hasVar('ok', 'REQUEST') && 1 === Request::getInt('ok', 0)) { |
||||
66 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||
67 | redirect_header($helper->url('admin/index.php'), 3, implode(',', $GLOBALS['xoopsSecurity']->getErrors())); |
||||
68 | } |
||||
69 | clearSampleData(); |
||||
70 | } else { |
||||
71 | xoops_cp_header(); |
||||
72 | xoops_confirm(['ok' => 1, 'op' => 'clear'], 'index.php', sprintf(constant('CO_' . $moduleDirNameUpper . '_' . 'CLEAR_SAMPLEDATA')), constant('CO_' . $moduleDirNameUpper . '_' . 'CONFIRM'), true); |
||||
73 | xoops_cp_footer(); |
||||
74 | } |
||||
75 | break; |
||||
76 | } |
||||
77 | |||||
78 | // XMF TableLoad for SAMPLE data |
||||
79 | |||||
80 | /** |
||||
81 | * @return void |
||||
82 | */ |
||||
83 | function loadSampleData(): void |
||||
84 | { |
||||
85 | global $xoopsConfig; |
||||
86 | $moduleDirName = \basename(\dirname(__DIR__)); |
||||
87 | $moduleDirNameUpper = \mb_strtoupper($moduleDirName); |
||||
88 | |||||
89 | $utility = new Utility(); |
||||
90 | $configurator = new Configurator(); |
||||
91 | |||||
92 | $tables = \Xmf\Module\Helper::getHelper($moduleDirName)->getModule()->getInfo('tables'); |
||||
93 | |||||
94 | $language = 'english/'; |
||||
95 | if (is_dir(__DIR__ . '/' . $xoopsConfig['language'])) { |
||||
96 | $language = $xoopsConfig['language'] . '/'; |
||||
97 | } |
||||
98 | |||||
99 | // load module tables |
||||
100 | foreach ($tables as $table) { |
||||
101 | $tabledata = Yaml::readWrapped($language . $table . '.yml'); |
||||
102 | TableLoad::truncateTable($table); |
||||
103 | TableLoad::loadTableFromArray($table, $tabledata); |
||||
104 | } |
||||
105 | |||||
106 | // load permissions |
||||
107 | $table = 'group_permission'; |
||||
108 | $tabledata = Yaml::readWrapped($language . $table . '.yml'); |
||||
109 | $mid = \Xmf\Module\Helper::getHelper($moduleDirName)->getModule()->getVar('mid'); |
||||
110 | loadTableFromArrayWithReplace($table, $tabledata, 'gperm_modid', $mid); |
||||
111 | |||||
112 | // --- COPY test folder files --------------- |
||||
113 | if (is_array($configurator->copyTestFolders) && count($configurator->copyTestFolders) > 0) { |
||||
114 | // $file = \dirname(__DIR__) . '/testdata/images/'; |
||||
115 | foreach (array_keys($configurator->copyTestFolders) as $i) { |
||||
116 | $src = $configurator->copyTestFolders[$i][0]; |
||||
117 | $dest = $configurator->copyTestFolders[$i][1]; |
||||
118 | $utility::rcopy($src, $dest); |
||||
119 | } |
||||
120 | } |
||||
121 | \redirect_header('../admin/index.php', 1, \constant('CO_' . $moduleDirNameUpper . '_' . 'LOAD_SAMPLEDATA_SUCCESS')); |
||||
122 | } |
||||
123 | |||||
124 | /** |
||||
125 | * @return void |
||||
126 | */ |
||||
127 | function saveSampleData(): void |
||||
128 | { |
||||
129 | global $xoopsConfig; |
||||
130 | $moduleDirName = \basename(\dirname(__DIR__)); |
||||
131 | $moduleDirNameUpper = \mb_strtoupper($moduleDirName); |
||||
132 | $helper = Helper::getInstance(); |
||||
133 | $tables = $helper->getModule()->getInfo('tables'); |
||||
134 | |||||
135 | $languageFolder = __DIR__ . '/' . $xoopsConfig['language']; |
||||
136 | if (!file_exists($languageFolder . '/')) { |
||||
137 | Utility::createFolder($languageFolder . '/'); |
||||
138 | } |
||||
139 | $exportFolder = $languageFolder . '/Exports-' . date('Y-m-d-H-i-s') . '/'; |
||||
140 | Utility::createFolder($exportFolder); |
||||
141 | |||||
142 | // save module tables |
||||
143 | foreach ($tables as $table) { |
||||
144 | TableLoad::saveTableToYamlFile($table, $exportFolder . $table . '.yml'); |
||||
145 | } |
||||
146 | |||||
147 | // save permissions |
||||
148 | $criteria = new \CriteriaCompo(); |
||||
149 | $criteria->add(new \Criteria('gperm_modid', $helper->getModule()->getVar('mid'))); |
||||
0 ignored issues
–
show
It seems like
$helper->getModule()->getVar('mid') can also be of type array and array ; however, parameter $value of Criteria::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
150 | $skipColumns[] = 'gperm_id'; |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
151 | TableLoad::saveTableToYamlFile('group_permission', $exportFolder . 'group_permission.yml', $criteria, $skipColumns); |
||||
152 | unset($criteria); |
||||
153 | |||||
154 | \redirect_header('../admin/index.php', 1, \constant('CO_' . $moduleDirNameUpper . '_' . 'SAVE_SAMPLEDATA_SUCCESS')); |
||||
155 | } |
||||
156 | |||||
157 | /** |
||||
158 | * @return void |
||||
159 | */ |
||||
160 | function exportSchema(): void |
||||
161 | { |
||||
162 | $moduleDirName = \basename(\dirname(__DIR__)); |
||||
163 | $moduleDirNameUpper = \mb_strtoupper($moduleDirName); |
||||
0 ignored issues
–
show
|
|||||
164 | |||||
165 | try { |
||||
166 | // TODO set exportSchema |
||||
167 | // $migrate = new Migrate($moduleDirName); |
||||
168 | // $migrate->saveCurrentSchema(); |
||||
169 | // |
||||
170 | // redirect_header('../admin/index.php', 1, constant('CO_' . $moduleDirNameUpper . '_' . 'EXPORT_SCHEMA_SUCCESS')); |
||||
171 | } catch (\Throwable $e) { |
||||
0 ignored issues
–
show
catch (\Throwable $e) is not reachable.
This check looks for unreachable code. It uses sophisticated control flow analysis techniques to find statements which will never be executed. Unreachable code is most often the result of function fx() {
try {
doSomething();
return true;
}
catch (\Exception $e) {
return false;
}
return false;
}
In the above example, the last ![]() |
|||||
172 | exit(constant('CO_' . $moduleDirNameUpper . '_' . 'EXPORT_SCHEMA_ERROR')); |
||||
0 ignored issues
–
show
|
|||||
173 | } |
||||
174 | } |
||||
175 | |||||
176 | /** |
||||
177 | * loadTableFromArrayWithReplace |
||||
178 | * |
||||
179 | * @param string $table value with should be used insead of original value of $search |
||||
180 | * |
||||
181 | * @param array $data array of rows to insert |
||||
182 | * Each element of the outer array represents a single table row. |
||||
183 | * Each row is an associative array in 'column' => 'value' format. |
||||
184 | * @param string $search name of column for which the value should be replaced |
||||
185 | * @param $replace |
||||
186 | * @return int number of rows inserted |
||||
187 | */ |
||||
188 | function loadTableFromArrayWithReplace($table, $data, $search, $replace) |
||||
189 | { |
||||
190 | /** @var \XoopsMySQLDatabase $db */ |
||||
191 | $db = \XoopsDatabaseFactory::getDatabaseConnection(); |
||||
192 | |||||
193 | $prefixedTable = $db->prefix($table); |
||||
194 | $count = 0; |
||||
195 | |||||
196 | $sql = 'DELETE FROM ' . $prefixedTable . ' WHERE `' . $search . '`=' . $db->quote($replace); |
||||
197 | |||||
198 | $result = $db->queryF($sql); |
||||
0 ignored issues
–
show
|
|||||
199 | |||||
200 | foreach ($data as $row) { |
||||
201 | $insertInto = 'INSERT INTO ' . $prefixedTable . ' ('; |
||||
202 | $valueClause = ' VALUES ('; |
||||
203 | $first = true; |
||||
204 | foreach ($row as $column => $value) { |
||||
205 | if ($first) { |
||||
206 | $first = false; |
||||
207 | } else { |
||||
208 | $insertInto .= ', '; |
||||
209 | $valueClause .= ', '; |
||||
210 | } |
||||
211 | |||||
212 | $insertInto .= $column; |
||||
213 | if ($search === $column) { |
||||
214 | $valueClause .= $db->quote($replace); |
||||
215 | } else { |
||||
216 | $valueClause .= $db->quote($value); |
||||
217 | } |
||||
218 | } |
||||
219 | |||||
220 | $sql = $insertInto . ') ' . $valueClause . ')'; |
||||
221 | |||||
222 | $result = $db->queryF($sql); |
||||
223 | if (false !== $result) { |
||||
224 | ++$count; |
||||
225 | } |
||||
226 | } |
||||
227 | |||||
228 | return $count; |
||||
229 | } |
||||
230 | |||||
231 | /** |
||||
232 | * @return void |
||||
233 | */ |
||||
234 | function clearSampleData(): void |
||||
235 | { |
||||
236 | $moduleDirName = \basename(\dirname(__DIR__)); |
||||
237 | $moduleDirNameUpper = \mb_strtoupper($moduleDirName); |
||||
238 | $helper = Helper::getInstance(); |
||||
239 | // Load language files |
||||
240 | $helper->loadLanguage('common'); |
||||
241 | $tables = $helper->getModule()->getInfo('tables'); |
||||
242 | // truncate module tables |
||||
243 | foreach ($tables as $table) { |
||||
244 | \Xmf\Database\TableLoad::truncateTable($table); |
||||
245 | } |
||||
246 | redirect_header($helper->url('admin/index.php'), 1, constant('CO_' . $moduleDirNameUpper . '_' . 'CLEAR_SAMPLEDATA_OK')); |
||||
247 | } |
||||
248 |
Let?s assume that you have a directory layout like this:
and let?s assume the following content of
Bar.php
:If both files
OtherDir/Foo.php
andSomeDir/Foo.php
are loaded in the same runtime, you will see a PHP error such as the following:PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php
However, as
OtherDir/Foo.php
does not necessarily have to be loaded and the error is only triggered if it is loaded beforeOtherDir/Bar.php
, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: