XoopsModules25x /
wfdownloads
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||||||
| 2 | /* |
||||||||
| 3 | You may not change or alter any portion of this comment or credits |
||||||||
| 4 | of supporting developers from this source code or any supporting source code |
||||||||
| 5 | which is considered copyrighted (c) material of the original comment or credit authors. |
||||||||
| 6 | |||||||||
| 7 | This program is distributed in the hope that it will be useful, |
||||||||
| 8 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||||
| 9 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||||
| 10 | */ |
||||||||
| 11 | |||||||||
| 12 | /** |
||||||||
| 13 | * Wfdownloads module |
||||||||
| 14 | * |
||||||||
| 15 | * @copyright XOOPS Project (https://xoops.org) |
||||||||
| 16 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||||||
| 17 | * @package wfdownload |
||||||||
| 18 | * @since 3.23 |
||||||||
| 19 | * @author Xoops Development Team |
||||||||
| 20 | */ |
||||||||
| 21 | |||||||||
| 22 | use XoopsModules\Wfdownloads; |
||||||||
| 23 | use XoopsModules\Wfdownloads\{ |
||||||||
| 24 | Helper, |
||||||||
| 25 | Utility |
||||||||
| 26 | }; |
||||||||
| 27 | /** @var Helper $helper */ |
||||||||
| 28 | /** @var Utility $utility */ |
||||||||
| 29 | |||||||||
| 30 | defined('XOOPS_ROOT_PATH') || exit('XOOPS root path not defined'); |
||||||||
| 31 | require_once __DIR__ . '/common.php'; |
||||||||
| 32 | /** |
||||||||
| 33 | * @param $queryArray |
||||||||
| 34 | * @param $andor |
||||||||
| 35 | * @param $limit |
||||||||
| 36 | * @param $offset |
||||||||
| 37 | * @param int $userId |
||||||||
| 38 | * @param array $categories |
||||||||
| 39 | * @param int $sortBy |
||||||||
| 40 | * @param string $searchIn |
||||||||
| 41 | * @param string $extra |
||||||||
| 42 | * |
||||||||
| 43 | * @return array |
||||||||
| 44 | */ |
||||||||
| 45 | function wfdownloads_search($queryArray, $andor, $limit, $offset, $userId = 0, $categories = [], $sortBy = 0, $searchIn = '', $extra = '') |
||||||||
|
0 ignored issues
–
show
The parameter
$extra is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. Loading history...
The parameter
$sortBy is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. Loading history...
The parameter
$categories is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. Loading history...
|
|||||||||
| 46 | { |
||||||||
| 47 | $helper = Helper::getInstance(); |
||||||||
| 48 | |||||||||
| 49 | $userGroups = is_object($GLOBALS['xoopsUser']) ? $GLOBALS['xoopsUser']->getGroups() : [0 => XOOPS_GROUP_ANONYMOUS]; |
||||||||
| 50 | |||||||||
| 51 | /** @var \XoopsGroupPermHandler $grouppermHandler */ |
||||||||
| 52 | $grouppermHandler = xoops_getHandler('groupperm'); |
||||||||
| 53 | $allowedDownCategoriesIds = $grouppermHandler->getItemIds('WFDownCatPerm', $userGroups, $helper->getModule()->mid()); |
||||||||
| 54 | $downloads_lids = $downloads_intersect = []; |
||||||||
| 55 | $criteria = new CriteriaCompo(new Criteria('cid', '(' . implode(',', $allowedDownCategoriesIds) . ')', 'IN')); |
||||||||
| 56 | if (0 != $userId) { |
||||||||
| 57 | $criteria->add(new Criteria('submitter', (int)$userId)); |
||||||||
| 58 | } |
||||||||
| 59 | |||||||||
| 60 | // changed and added - start - April 23, 2006 - jwe |
||||||||
| 61 | // moved these up here since we need to complete the $criteria object a little sooner now |
||||||||
| 62 | $criteria->setSort('published'); |
||||||||
| 63 | $criteria->setOrder('DESC'); |
||||||||
| 64 | |||||||||
| 65 | // because count() returns 1 even if a supplied variable |
||||||||
| 66 | // is not an array, we must check if $querryarray is really an array |
||||||||
| 67 | $queryArray_count = 0; |
||||||||
| 68 | if ((is_array($queryArray) && $queryArray_count = count($queryArray)) || 0 != $userId) { |
||||||||
| 69 | // $userId != 0 added August 13 2007 -- ACCOUNTS FOR CASES WHERE THERE ARE NO QUERY TERMS BUT A USER ID IS PASSED -- FREEFORM SOLUTIONS |
||||||||
| 70 | if (0 == $queryArray_count) { |
||||||||
| 71 | $queryArray_count = 1; // AUGUST 13 2007 -- MAKE COUNT EQUAL 1 SINCE WE HAVE TO DO AT LEAST ONE SEARCH (BASED ON USER ID) EVEN IF THERE ARE NO QUERY TERMS -- FREEFORM SOLUTIONS |
||||||||
|
0 ignored issues
–
show
|
|||||||||
| 72 | $queryArray = []; |
||||||||
| 73 | } |
||||||||
| 74 | |||||||||
| 75 | // Formulize module support - jpc - start |
||||||||
| 76 | /* |
||||||||
| 77 | // queryarray[0] now handled inside loop -- perhaps this "0 out of loop, 1 and up inside loop" approach was an unsuccessful attempt to fix the "unset" bug. Interesting that subcrit was unset prior to the FOR loop. |
||||||||
| 78 | $subCriteria = new \CriteriaCompo(new \Criteria("title", "%".$queryArray[0]."%", 'LIKE'), 'OR'); |
||||||||
| 79 | $subCriteria->add(new \Criteria("description", "%".$queryArray[0]."%", 'LIKE'), 'OR'); |
||||||||
| 80 | $criteria->add($subCriteria); |
||||||||
| 81 | unset($subCriteria); |
||||||||
| 82 | |||||||||
| 83 | $allSubCriterias = new \CriteriaCompo(); // added to fix bug related to nesting of ( ) |
||||||||
| 84 | for ($i = 0;$i < $queryArray_count;++$i) { // 1 changed to 0 so everything happens in one loop now |
||||||||
| 85 | $subCriteria = new \CriteriaCompo(new \Criteria("title", "%".$queryArray[$i]."%", 'LIKE'), 'OR'); |
||||||||
| 86 | $subCriteria->add(new \Criteria("description", "%".$queryArray[$i]."%", 'LIKE'), 'OR'); |
||||||||
| 87 | $allSubCriterias->add($subCriteria, $andor); // $criteria changed to $allSubCriterias to fix bug |
||||||||
| 88 | unset($subCriteria); // added to fix bug |
||||||||
| 89 | } |
||||||||
| 90 | $criteria->add($allSubCriterias); // added to fix bug |
||||||||
| 91 | |||||||||
| 92 | There are two bugs in the above code: all subcrits need to be added to the main |
||||||||
| 93 | criteria as a group, so it was a bug to have them added one at a time as they |
||||||||
| 94 | were, since the nesting of the () in the rendered where clause is incorrect also |
||||||||
| 95 | there was a bug which caused only the first and last items in the query array to |
||||||||
| 96 | be processed, and the last item would be processed multiple times. ie: terms |
||||||||
| 97 | "green, orange, black" resulted in a search for "green, black, black" -- this |
||||||||
| 98 | "bug" was introduced with php 4.4.0 (and some version of 5 as well) after a |
||||||||
| 99 | change in how objects are managed in memory or something like that. |
||||||||
| 100 | The fix is to specifically unset the $subCriteria object at the end of each |
||||||||
| 101 | iteration of the loop. The same bug hit Liase, Formulaire and Formulize. |
||||||||
| 102 | You can see the structure of the query by printing the output of $criteria's |
||||||||
| 103 | render or renderWhere method ( ie: print $criteria->renderWhere(); ) |
||||||||
| 104 | However, the whole approach to handling queries has been changed, so the above |
||||||||
| 105 | code is unused. It is included here for reference with regard to the bugs |
||||||||
| 106 | mentioned above. |
||||||||
| 107 | With custom forms, because a multi term query using AND could have some terms |
||||||||
| 108 | match only custom form fields and other terms match only native Wfdownloads |
||||||||
| 109 | fields, each term must be evaluated independently, |
||||||||
| 110 | across both modules, and then if an AND operator is in effect, the intersection |
||||||||
| 111 | of the results is returned. If OR is in effect, then all results are returned. |
||||||||
| 112 | */ |
||||||||
| 113 | // Determine what the custom forms are that need searching, if any |
||||||||
| 114 | if (Utility::checkModule('formulize')) { |
||||||||
| 115 | $fids = []; |
||||||||
| 116 | foreach ($allowedDownCategoriesIds as $cid) { |
||||||||
| 117 | $categoryObj = $helper->getHandler('Category')->get($cid); |
||||||||
| 118 | if (null !== $categoryObj && $fid = $categoryObj->getVar('formulize_fid')) { |
||||||||
| 119 | $fids[] = $fid; |
||||||||
| 120 | } |
||||||||
| 121 | } |
||||||||
| 122 | |||||||||
| 123 | // Set criteria for the captions that the user can see if necessary |
||||||||
| 124 | if ($fids && is_array($fids)) { |
||||||||
| 125 | $formulizeElementCriteria = new CriteriaCompo(); |
||||||||
| 126 | $formulizeElementCriteria->add(new Criteria('ele_display', 1), 'OR'); |
||||||||
| 127 | foreach ($userGroups as $group) { |
||||||||
| 128 | $formulizeElementCriteria->add(new Criteria('ele_display', '%,' . $group . ',%', 'LIKE'), 'OR'); |
||||||||
| 129 | } |
||||||||
| 130 | $formulizeElementCriteria->setSort('ele_order'); |
||||||||
| 131 | $formulizeElementCriteria->setOrder('ASC'); |
||||||||
| 132 | } |
||||||||
| 133 | } |
||||||||
| 134 | |||||||||
| 135 | $downloadObjs = []; |
||||||||
| 136 | // Loop through all query terms |
||||||||
| 137 | foreach ($queryArray as $i => $iValue) { |
||||||||
| 138 | // Make a copy of the $criteria for use with this term only |
||||||||
| 139 | $queryCriteria = clone $criteria; |
||||||||
| 140 | |||||||||
| 141 | // Setup criteria for searching the title and description fields of Wfdownloads for the current term |
||||||||
| 142 | $allSubCriterias = new CriteriaCompo(); |
||||||||
| 143 | $thisSearchTerm = count($queryArray) > 0 ? $queryArray[$i] : ''; |
||||||||
| 144 | $subCriteria = new CriteriaCompo(); |
||||||||
| 145 | $subCriteria->add(new Criteria('title', '%' . $thisSearchTerm . '%', 'LIKE'), 'OR'); // search in title field |
||||||||
| 146 | $subCriteria->add(new Criteria('description', '%' . $thisSearchTerm . '%', 'LIKE'), 'OR'); // search in description fiels |
||||||||
| 147 | $allSubCriterias->add($subCriteria, $andor); |
||||||||
| 148 | unset($subCriteria); |
||||||||
| 149 | |||||||||
| 150 | $saved_ids = []; |
||||||||
| 151 | |||||||||
| 152 | // Find all IDs of entries in all custom forms which match the current term |
||||||||
| 153 | if (Utility::checkModule('formulize')) { |
||||||||
| 154 | foreach ($fids as $fid) { |
||||||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||||||
| 155 | if (null === $formulizeElementsHandler) { |
||||||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||||||
| 156 | $formulizeElementsHandler = $helper->getHandler('Elements', 'formulize'); |
||||||||
|
0 ignored issues
–
show
The call to
XoopsModules\Wfdownloads\Helper::getHandler() has too many arguments starting with 'formulize'.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above. Loading history...
|
|||||||||
| 157 | } |
||||||||
| 158 | require_once XOOPS_ROOT_PATH . '/modules/formulize/include/extract.php'; |
||||||||
| 159 | // Setup the filter string based on the elements in the form and the current query term |
||||||||
| 160 | $formulizeElements = $formulizeElementsHandler->getObjects2($formulizeElementCriteria, $fid); |
||||||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||||||
| 161 | $filter_string = ''; |
||||||||
| 162 | $indexer = 0; |
||||||||
|
0 ignored issues
–
show
|
|||||||||
| 163 | $start = 1; |
||||||||
| 164 | foreach ($formulizeElements as $formulizeElement) { |
||||||||
| 165 | if ($start) { |
||||||||
| 166 | $filter_string = $formulizeElement->getVar('ele_id') . '/**/' . $iValue; |
||||||||
| 167 | $start = 0; |
||||||||
| 168 | } else { |
||||||||
| 169 | $filter_string .= '][' . $formulizeElement->getVar('ele_id') . '/**/' . $iValue; |
||||||||
| 170 | } |
||||||||
| 171 | } |
||||||||
| 172 | unset($formulizeElements); |
||||||||
| 173 | |||||||||
| 174 | // Query for the ids of the records in the form that match the queryarray |
||||||||
| 175 | $data = getData('', $fid, $filter_string, 'OR'); // is a 'formulize' function |
||||||||
|
0 ignored issues
–
show
The function
getData was not found. Maybe you did not declare it correctly or list all dependencies?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||||
| 176 | $formHandle = getFormHandleFromEntry($data[0], 'uid'); // is a 'formulize' function |
||||||||
|
0 ignored issues
–
show
The function
getFormHandleFromEntry was not found. Maybe you did not declare it correctly or list all dependencies?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||||
| 177 | $temp_saved_ids = []; |
||||||||
| 178 | foreach ($data as $entry) { |
||||||||
| 179 | // Gather all IDs for this $fid |
||||||||
| 180 | $found_ids = internalRecordIds($entry, $formHandle); // is a 'formulize' function |
||||||||
|
0 ignored issues
–
show
The function
internalRecordIds was not found. Maybe you did not declare it correctly or list all dependencies?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||||
| 181 | $temp_saved_ids = array_merge($temp_saved_ids, $found_ids); |
||||||||
| 182 | unset($found_ids); |
||||||||
| 183 | } |
||||||||
| 184 | $saved_ids = array_merge($saved_ids, $temp_saved_ids); // merge this $fid's IDs with IDs from all previous $fids |
||||||||
| 185 | unset($temp_saved_ids, $data); |
||||||||
| 186 | } // end of foreach $fids |
||||||||
| 187 | } |
||||||||
| 188 | // Formulize module support - jpc - end |
||||||||
| 189 | // Make a criteria object that includes the custom form ids that were found, if any |
||||||||
| 190 | if (count($saved_ids) > 0 && is_array($saved_ids)) { |
||||||||
| 191 | $subs_plus_custom = new CriteriaCompo(new Criteria('formulize_idreq', '(' . implode(',', $saved_ids) . ')', 'IN')); |
||||||||
| 192 | $subs_plus_custom->add($allSubCriterias, 'OR'); |
||||||||
| 193 | $queryCriteria->add($subs_plus_custom); |
||||||||
| 194 | unset($allSubCriterias, $subs_plus_custom, $saved_ids); |
||||||||
| 195 | } else { |
||||||||
| 196 | $queryCriteria->add($allSubCriterias); |
||||||||
| 197 | unset($allSubCriterias); |
||||||||
| 198 | } |
||||||||
| 199 | |||||||||
| 200 | // Check to see if this term matches any files |
||||||||
| 201 | $tempDownloadObjs = $helper->getHandler('Download')->getActiveDownloads($queryCriteria); |
||||||||
| 202 | unset($queryCriteria); |
||||||||
| 203 | |||||||||
| 204 | // Make an array of the downloads based on the lid, and a separate list of all the lids found (the separate list is used in the case of an AND operator to derive an intersection of the hits across all search terms -- and it is used to determine the start and limit points of the main results array for an OR query) |
||||||||
| 205 | foreach ($tempDownloadObjs as $tempDownloadObj) { |
||||||||
| 206 | $downloadObjs[(int)$tempDownloadObj->getVar('lid')] = $tempDownloadObj; |
||||||||
| 207 | $downloads_lids[] = (int)$tempDownloadObj->getVar('lid'); |
||||||||
| 208 | } |
||||||||
| 209 | |||||||||
| 210 | // Do an intersection of the found lids if the operator is AND |
||||||||
| 211 | if ('AND' === $andor) { |
||||||||
| 212 | if (null === $downloads_lids) { |
||||||||
| 213 | $downloads_lids[] = ''; |
||||||||
| 214 | } |
||||||||
| 215 | if (null === $downloads_intersect) { |
||||||||
| 216 | $downloads_intersect = $downloads_lids; |
||||||||
| 217 | } // first time through initialize the array with all the found files |
||||||||
| 218 | $downloads_intersect = array_intersect($downloads_intersect, $downloads_lids); |
||||||||
| 219 | unset($downloads_lids); |
||||||||
| 220 | } |
||||||||
| 221 | unset($tempDownloadObjs); |
||||||||
| 222 | } // end of for loop through query terms |
||||||||
| 223 | } // end of if there are query terms |
||||||||
| 224 | |||||||||
| 225 | // If an AND operator was used, cull the $downloadObjs array based on the intersection found |
||||||||
| 226 | if ('AND' === $andor) { |
||||||||
| 227 | foreach ($downloadObjs as $lid => $downloadObj) { |
||||||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||||||
| 228 | if (!in_array($lid, $downloads_intersect)) { |
||||||||
| 229 | unset($downloadObjs[$lid]); |
||||||||
| 230 | } |
||||||||
| 231 | } |
||||||||
| 232 | $limitOffsetIndex = $downloads_intersect; |
||||||||
| 233 | } else { |
||||||||
| 234 | $limitOffsetIndex = $downloads_lids; |
||||||||
| 235 | } |
||||||||
| 236 | |||||||||
| 237 | $ret = []; |
||||||||
| 238 | $i = 0; |
||||||||
| 239 | $storedLids = []; |
||||||||
| 240 | |||||||||
| 241 | // foreach (array_keys($downloadObjs) as $i) |
||||||||
| 242 | if (is_array($limitOffsetIndex)) { |
||||||||
|
0 ignored issues
–
show
|
|||||||||
| 243 | $counter = count($limitOffsetIndex); |
||||||||
| 244 | for ($x = $offset; $i < $limit && $x < $counter; ++$x) { |
||||||||
| 245 | $lid = $limitOffsetIndex[$x]; |
||||||||
| 246 | $obj = $downloadObjs[$lid]; |
||||||||
| 247 | if (is_object($obj) && !isset($storedLids[$lid])) { |
||||||||
| 248 | $storedLids[$lid] = true; |
||||||||
| 249 | $ret[$i]['image'] = 'assets/images/size2.gif'; |
||||||||
| 250 | $ret[$i]['link'] = "singlefile.php?cid={$obj->getVar('cid')}&lid={$lid}"; |
||||||||
| 251 | $ret[$i]['title'] = $obj->getVar('title'); |
||||||||
| 252 | $ret[$i]['time'] = $obj->getVar('published'); |
||||||||
| 253 | $ret[$i]['uid'] = $obj->getVar('submitter'); |
||||||||
| 254 | ++$i; |
||||||||
| 255 | } |
||||||||
| 256 | } |
||||||||
| 257 | } |
||||||||
| 258 | |||||||||
| 259 | /* |
||||||||
| 260 | // Swish-e support EXPERIMENTAL |
||||||||
| 261 | if (($helper->getConfig('enable_swishe') === true) && Utility::checkSwishe() === true) { |
||||||||
| 262 | // IN PROGRESS |
||||||||
| 263 | $swisheCriteria = new \CriteriaCompo(new \Criteria('cid', '(' . implode(',', $allowedDownCategoriesIds) . ')', 'IN')); |
||||||||
| 264 | if ($userId != 0) { |
||||||||
| 265 | $swisheCriteria->add(new \Criteria('submitter', (int) $userId)); |
||||||||
| 266 | } |
||||||||
| 267 | if ($andor = 'AND') { |
||||||||
| 268 | $swisheQueryWords = implode (' AND ', $queryArray); |
||||||||
| 269 | } elseif ($andor = 'OR') { |
||||||||
| 270 | $swisheQueryWords = implode (' OR ', $queryArray); |
||||||||
| 271 | } else { |
||||||||
| 272 | $swisheQueryWords = ''; |
||||||||
| 273 | } |
||||||||
| 274 | if (strlen($swisheQueryWords) > 0) { |
||||||||
| 275 | $swisheSearchResults = Utility::searchSwishe($swisheQueryWords); |
||||||||
| 276 | foreach ($swisheSearchResults as $swisheSearchResult) { |
||||||||
| 277 | $tempSwisheCriteria = clone($swisheCriteria); |
||||||||
| 278 | $tempSwisheCriteria->add(new \Criteria('filename', $swisheSearchResult['file_path'])); |
||||||||
| 279 | $tempDownloadObjs = $helper->getHandler('Download')->getActiveDownloads($tempSwisheCriteria); |
||||||||
| 280 | $tempDownloadObj = $tempDownloadObjs[0]; |
||||||||
| 281 | if (is_object($tempDownloadObj)) { |
||||||||
| 282 | $tempRet['image'] = "assets/images/size2.gif"; |
||||||||
| 283 | $tempRet['link'] = "singlefile.php?cid={$tempDownloadObj->getVar('cid')}&lid={$tempDownloadObj->getVar('lid')}"; |
||||||||
| 284 | $tempRet['title'] = $tempDownloadObj->getVar('title'); |
||||||||
| 285 | $tempRet['time'] = $tempDownloadObj->getVar('published'); |
||||||||
| 286 | $tempRet['uid'] = $tempDownloadObj->getVar('submitter'); |
||||||||
| 287 | // IN PROGRESS |
||||||||
| 288 | } |
||||||||
| 289 | } |
||||||||
| 290 | } |
||||||||
| 291 | } |
||||||||
| 292 | // Swish-e support EXPERIMENTAL |
||||||||
| 293 | */ |
||||||||
| 294 | |||||||||
| 295 | return $ret; |
||||||||
| 296 | } |
||||||||
| 297 |
This check looks for parameters that have been defined for a function or method, but which are not used in the method body.