This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* |
||
3 | You may not change or alter any portion of this comment or credits |
||
4 | of supporting developers from this source code or any supporting source code |
||
5 | which is considered copyrighted (c) material of the original comment or credit authors. |
||
6 | |||
7 | This program is distributed in the hope that it will be useful, |
||
8 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
9 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
10 | */ |
||
11 | |||
12 | /** |
||
13 | * userlog module |
||
14 | * |
||
15 | * @copyright XOOPS Project (https://xoops.org) |
||
16 | * @license GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html) |
||
17 | * @package userlog admin |
||
18 | * @since 1 |
||
19 | * @author irmtfan ([email protected]) |
||
20 | * @author XOOPS Project <www.xoops.org> <www.xoops.ir> |
||
21 | */ |
||
22 | |||
23 | use Xmf\Request; |
||
24 | |||
25 | require_once __DIR__ . '/admin_header.php'; |
||
26 | require_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||
27 | xoops_cp_header(); |
||
28 | $userlog = Userlog::getInstance(); |
||
29 | $queryObj = UserlogQuery::getInstance(); |
||
30 | |||
31 | // Where do we start ? |
||
32 | $startentry = Request::getInt('startentry', 0); |
||
33 | $limitentry = Request::getInt('limitentry', 10); |
||
34 | $sortentry = Request::getString('sortentry', 'count'); |
||
35 | $orderentry = Request::getString('orderentry', 'DESC'); |
||
36 | $modules = Request::getArray('modules'); |
||
37 | $moduleScriptItem = Request::getArray('moduleScriptItem'); |
||
38 | $log_timeGT = Request::getInt('log_timeGT', 1); |
||
39 | $users = Request::getArray('users', -1); |
||
40 | $groups = Request::getArray('groups', 0); |
||
41 | |||
42 | // update all time stats |
||
43 | $statsObj = UserlogStats::getInstance(); |
||
44 | $statsObj->updateAll('log', 100); // prob = 100 |
||
45 | $statsObj->updateAll('set', 100); // prob = 100 |
||
46 | $statsObj->updateAll('file', 100); // prob = 100 |
||
47 | $statsObj->updateAll('referral', $userlog->getConfig('probstats')); |
||
48 | $statsObj->updateAll('browser', $userlog->getConfig('probstats')); // or $statsObj->updateAll("OS", $userlog->getConfig("probstats")); |
||
49 | |||
50 | $stats = $statsObj->getAll(['log', 'logdel', 'set', 'file']); |
||
51 | $adminObject = \Xmf\Module\Admin::getInstance(); |
||
52 | $adminObject->addInfoBox(_AM_USERLOG_STATS_ABSTRACT); |
||
53 | $periods = array_flip($statsObj->period); |
||
54 | $types = $statsObj->type; |
||
55 | View Code Duplication | foreach ($stats as $type => $arr) { |
|
0 ignored issues
–
show
|
|||
56 | if (strlen($type) > 10) { |
||
57 | continue; |
||
58 | } |
||
59 | foreach ($arr as $period => $arr2) { |
||
60 | // use sprintf in moduleadmin: sprintf($text, "<span style='color : " . $color . "; font-weight : bold;'>" . $value . "</span>") |
||
61 | $adminObject->addInfoBoxLine(sprintf( |
||
62 | _AM_USERLOG_STATS_TYPE_PERIOD, |
||
63 | '%1$s', |
||
64 | $types[$type], |
||
65 | constant('_AM_USERLOG_' . strtoupper($periods[$period])) . ' ' . _AM_USERLOG_STATS_TIME_UPDATE . ' ' . $arr2['time_update'], |
||
66 | $arr2['value'] |
||
67 | ), '', $arr2['value'] ? 'GREEN' : 'RED'); |
||
68 | } |
||
69 | } |
||
70 | $criteria = new CriteriaCompo(); |
||
71 | $criteria->setGroupBy('module'); |
||
72 | $moduleViews = $userlog->getHandler('log')->getCounts($criteria); |
||
73 | $dirNames = $userlog->getModules(); |
||
74 | if (!empty($moduleViews)) { |
||
75 | $adminObject->addInfoBox(_AM_USERLOG_VIEW_MODULE); |
||
76 | foreach ($moduleViews as $mDir => $views) { |
||
77 | $adminObject->addInfoBoxLine(sprintf($dirNames[$mDir] . ': %s', $views), '', $views ? 'GREEN' : 'RED'); |
||
78 | } |
||
79 | } |
||
80 | $criteria = new CriteriaCompo(); |
||
81 | $criteria->setGroupBy('uid'); |
||
82 | $criteria->setLimit(10); |
||
83 | $userViews = $userlog->getHandler('log')->getCounts($criteria); |
||
84 | if (!empty($userViews)) { |
||
85 | $adminObject->addInfoBox(_AM_USERLOG_VIEW_USER); |
||
86 | foreach ($userViews as $uid => $views) { |
||
87 | $adminObject->addInfoBoxLine(sprintf(($uid ? '<a href="' . XOOPS_URL . '/userinfo.php?uid=' . $uid . '">' . XoopsUserUtility::getUnameFromId($uid) . '</a>' : XoopsUserUtility::getUnameFromId(0)) . ': %s', $views), '', $views ? 'GREEN' : 'RED'); |
||
88 | } |
||
89 | } |
||
90 | $criteria = new CriteriaCompo(); |
||
91 | $criteria->add(new Criteria('groups', '%g%', 'LIKE')); // Why cannot use this?: $criteria->add(new Criteria("groups", "", "!=")) |
||
92 | $criteria->setGroupBy('groups'); |
||
93 | $criteria->setLimit(10); |
||
94 | $groupViews = $userlog->getHandler('log')->getCounts($criteria); |
||
95 | if (!empty($groupViews)) { |
||
96 | $adminObject->addInfoBox(_AM_USERLOG_VIEW_GROUP); |
||
97 | foreach ($groupViews as $gids => $views) { |
||
98 | $groupArr = explode('g', substr($gids, 1)); // remove the first "g" from string |
||
99 | $groupArr = array_unique($groupArr); |
||
100 | foreach ($groupArr as $group) { |
||
101 | if (isset($gidViews[$group])) { |
||
102 | $gidViews[$group] += $views; |
||
103 | } else { |
||
104 | $gidViews[$group] = $views; |
||
105 | } |
||
106 | } |
||
107 | } |
||
108 | $groupNames = $userlog->getGroupList(); |
||
109 | foreach ($gidViews as $gid => $views) { |
||
110 | $adminObject->addInfoBoxLine(sprintf($groupNames[$gid] . ': %s', $views), '', $views ? 'GREEN' : 'RED'); |
||
111 | } |
||
112 | } |
||
113 | // START add stats_type |
||
114 | // options[0] - number of items to show in block. the default is 10 |
||
115 | // options[1] - stats_type - referral (default), browser, OS |
||
116 | // options[2] - Sort - stats_link, stats_value (default), time_update |
||
117 | // options[3] - Order - DESC, ASC default: DESC |
||
118 | $refViews = $queryObj->stats_typeShow([10, 'referral', 'stats_value', 'DESC']); |
||
119 | $GLOBALS['xoopsTpl']->assign('refViews', $refViews); |
||
120 | |||
121 | $browserViews = $queryObj->stats_typeShow([10, 'browser', 'stats_value', 'DESC']); |
||
122 | $GLOBALS['xoopsTpl']->assign('browserViews', $browserViews); |
||
123 | |||
124 | $OSViews = $queryObj->stats_typeShow([10, 'OS', 'stats_value', 'DESC']); |
||
125 | $GLOBALS['xoopsTpl']->assign('OSViews', $OSViews); |
||
126 | // END add stats_type |
||
127 | |||
128 | // START Login / Register Patch |
||
129 | $patchLoginFilePatch = USERLOG_ROOT_PATH . '/class/patch/patch_login_history.php'; |
||
130 | if (file_exists($patchLoginFilePatch)) { |
||
131 | include $patchLoginFilePatch; |
||
132 | } |
||
133 | // END Login / Register Patch |
||
134 | |||
135 | // START add login/register history - TODO: in block |
||
136 | // options[0] - number of items to show in block. the default is 10 |
||
137 | // options[1] - login or register or both radio select |
||
138 | // options[2] - failed or successful or both radio select |
||
139 | // options[3] - inactive or active or both |
||
140 | // options[4] - never login before or login before or both |
||
141 | // options[5] - Order - DESC, ASC default: DESC |
||
142 | |||
143 | $loginsHistory = $queryObj->loginregHistoryShow([10, 0, 0, 0, 0, 'DESC']); |
||
144 | $GLOBALS['xoopsTpl']->assign('loginsHistory', $loginsHistory); |
||
145 | // END add login/register history - TODO: in block |
||
146 | |||
147 | // START add module admin history |
||
148 | // args[0] - number of items to show in block. the default is 10 |
||
149 | // args[1] - module dirname - 0 or empty = all modules |
||
150 | $moduleAdmin = $queryObj->modulesadminShow([10]); |
||
151 | $GLOBALS['xoopsTpl']->assign('moduleAdmin', $moduleAdmin); |
||
152 | |||
153 | // END add module admin history |
||
154 | |||
155 | // START module - script - item |
||
156 | $module = []; |
||
157 | // items |
||
158 | View Code Duplication | foreach ($moduleScriptItem as $key => $item) { |
|
159 | $module_script_item = explode('-', $item); // news:article.php-storyid news:index.php-storytopic => $module["news"]=array("storyid","storytopic"); |
||
160 | $module_script = explode(':', $module_script_item[0]); // news:article.php => $module_script = array(news,article.php); |
||
161 | if (!isset($module[$module_script[0]])) { |
||
162 | $module[$module_script[0]]['item_name'] = []; |
||
163 | $module[$module_script[0]]['script'] = array_slice($module_script, 1); |
||
164 | } |
||
165 | $module[$module_script[0]]['script'] = array_unique(array_merge($module[$module_script[0]]['script'], array_slice($module_script, 1))); |
||
166 | $module[$module_script[0]]['item_name'][] = $module_script_item[1]; |
||
167 | } |
||
168 | // add modules dont have item_name |
||
169 | foreach ($modules as $dir) { |
||
170 | if (!isset($module[$dir])) { |
||
171 | $module[$dir] = null; |
||
172 | } |
||
173 | } |
||
174 | // END module - script - item |
||
175 | $loglogObj = UserlogLog::getInstance(); |
||
176 | |||
177 | // get items views |
||
178 | $items = $loglogObj->getViews($limitentry, $startentry, $sortentry, $orderentry, $module, $log_timeGT, ($users[0] != -1) ? $users : [], (0 != $groups[0]) ? $groups : []); |
||
179 | $GLOBALS['xoopsTpl']->assign('sortentry', $sortentry); |
||
180 | $GLOBALS['xoopsTpl']->assign('items', $items); |
||
181 | // SRART form |
||
182 | $form = new XoopsThemeForm(_AM_USERLOG_VIEW, 'views', 'stats.php', 'post', true); |
||
183 | // number of items to display element |
||
184 | $limitEl = new XoopsFormText(_AM_USERLOG_ITEMS_NUM, 'limitentry', 10, 255, $limitentry); |
||
185 | $sortEl = new XoopsFormSelect(_AM_USERLOG_SORT, 'sortentry', $sortentry); |
||
186 | $sortEl->addOptionArray([ |
||
187 | 'count' => _AM_USERLOG_VIEW, |
||
188 | 'module' => _AM_USERLOG_MODULE, |
||
189 | 'module_name' => _AM_USERLOG_MODULE_NAME, |
||
190 | 'module_count' => _AM_USERLOG_VIEW_MODULE |
||
191 | ]); |
||
192 | $sortEl->setDescription(_AM_USERLOG_SORT_DSC); |
||
193 | $orderEl = new XoopsFormSelect(_AM_USERLOG_ORDER, 'orderentry', $orderentry); |
||
194 | $orderEl->addOption('DESC', _DESCENDING); |
||
195 | $orderEl->addOption('ASC', _ASCENDING); |
||
196 | $orderEl->setDescription(_AM_USERLOG_ORDER_DSC); |
||
197 | // modules, items elements |
||
198 | $moduleObjs = $userlog->getModules([], null, true); |
||
199 | $itemLinks = []; |
||
200 | foreach ($moduleObjs as $mObj) { |
||
201 | $dirNames[$mObj->dirname()] = $mObj->name(); |
||
202 | $not_config = $mObj->getInfo('notification'); |
||
203 | if (!empty($not_config['category'])) { |
||
204 | View Code Duplication | foreach ($not_config['category'] as $category) { |
|
205 | if (!empty($category['item_name'])) { |
||
206 | $script = is_array($category['subscribe_from']) ? implode(':', $category['subscribe_from']) : $category['subscribe_from']; |
||
207 | $itemLinks[$mObj->dirname() . ':' . $script . '-' . $category['item_name']] = $mObj->dirname() . '/' . $script . '?' . $category['item_name'] . '=ITEM_ID'; |
||
208 | } |
||
209 | } |
||
210 | } |
||
211 | } |
||
212 | $moduleEl = new XoopsFormSelect(_AM_USERLOG_MODULES, 'modules', $modules, 5, true); |
||
213 | $moduleEl->addOptionArray($dirNames); |
||
214 | $itemsEl = new XoopsFormSelect(_AM_USERLOG_ITEMS, 'moduleScriptItem', $moduleScriptItem, 5, true); |
||
215 | $itemsEl->addOptionArray($itemLinks); |
||
216 | $itemsEl->setDescription(_AM_USERLOG_ITEMS_DSC); |
||
217 | |||
218 | $timeEl = new XoopsFormText(_AM_USERLOG_LOG_TIMEGT, 'log_timeGT', 10, 255, $log_timeGT); |
||
219 | $timeEl->setDescription(_AM_USERLOG_LOG_TIMEGT_FORM); |
||
220 | |||
221 | $userRadioEl = new XoopsFormRadio(_AM_USERLOG_UID, 'users', $users[0]); |
||
222 | $userRadioEl->addOption(-1, _ALL); |
||
223 | $userRadioEl->addOption(($users[0] != -1) ? $users[0] : 0, _SELECT); // if no user in selection box it select uid=0 anon users |
||
224 | $userRadioEl->setExtra("onchange=\"var el=document.getElementById('users'); el.disabled=(this.id == 'users1'); if (!el.value) {el.value= this.value}\""); // if user dont select any option it select "all" |
||
225 | $userSelectEl = new XoopsFormSelectUser(_AM_USERLOG_UID, 'users', true, $users, 3, true); |
||
226 | $userEl = new XoopsFormLabel(_AM_USERLOG_UID, $userRadioEl->render() . $userSelectEl->render()); |
||
227 | |||
228 | $groupRadioEl = new XoopsFormRadio(_AM_USERLOG_GROUPS, 'groups', $groups[0]); |
||
229 | $groupRadioEl->addOption(0, _ALL); |
||
230 | $groupRadioEl->addOption((0 != $groups[0]) ? $groups[0] : 2, _SELECT); // if no group in selection box it select gid=2 registered users |
||
231 | $groupRadioEl->setExtra("onchange=\"var el=document.getElementById('groups'); el.disabled=(this.id == 'groups1'); if (!el.value) {el.value= this.value}\""); // if group dont select any option it select "all" |
||
232 | $groupSelectEl = new XoopsFormSelectGroup(_AM_USERLOG_GROUPS, 'groups', true, $groups, 3, true); |
||
233 | $groupEl = new XoopsFormLabel(_AM_USERLOG_GROUPS, $groupRadioEl->render() . $groupSelectEl->render()); |
||
234 | |||
235 | $submitEl = new XoopsFormButton(_SUBMIT, 'submitlogs', _SUBMIT, 'submit'); |
||
236 | // add all elements to form |
||
237 | $form->addElement($limitEl); |
||
238 | $form->addElement($moduleEl); |
||
239 | $form->addElement($itemsEl); |
||
240 | $form->addElement($timeEl); |
||
241 | $form->addElement($userEl); |
||
242 | $form->addElement($groupEl); |
||
243 | $form->addElement($sortEl); |
||
244 | $form->addElement($orderEl); |
||
245 | $form->addElement($submitEl); |
||
246 | $GLOBALS['xoopsTpl']->assign('form', $form->render()); |
||
247 | $GLOBALS['xoopsTpl']->assign('stats_abstract', $adminObject->renderInfoBox()); |
||
248 | $GLOBALS['xoopsTpl']->assign('logo', $adminObject->displayNavigation(basename(__FILE__))); |
||
249 | // template |
||
250 | $template_main = USERLOG_DIRNAME . '_admin_stats.tpl'; |
||
251 | if (!empty($template_main)) { |
||
252 | $GLOBALS['xoopsTpl']->display("db:{$template_main}"); |
||
253 | } |
||
254 | xoops_cp_footer(); |
||
255 |
There are different options of fixing this problem.
If you want to be on the safe side, you can add an additional type-check:
If you are sure that the expression is traversable, you might want to add a doc comment cast to improve IDE auto-completion and static analysis:
Mark the issue as a false-positive: Just hover the remove button, in the top-right corner of this issue for more options.