XoopsModules25x /
wfdownloads
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||
| 2 | /* |
||||
| 3 | You may not change or alter any portion of this comment or credits |
||||
| 4 | of supporting developers from this source code or any supporting source code |
||||
| 5 | which is considered copyrighted (c) material of the original comment or credit authors. |
||||
| 6 | |||||
| 7 | This program is distributed in the hope that it will be useful, |
||||
| 8 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
| 9 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
| 10 | */ |
||||
| 11 | |||||
| 12 | /** |
||||
| 13 | * Wfdownloads module |
||||
| 14 | * |
||||
| 15 | * @copyright XOOPS Project (https://xoops.org) |
||||
| 16 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||
| 17 | * @package wfdownload |
||||
| 18 | * @since 3.23 |
||||
| 19 | * @author Xoops Development Team |
||||
| 20 | */ |
||||
| 21 | |||||
| 22 | use Xmf\Request; |
||||
| 23 | |||||
| 24 | $currentFile = basename(__FILE__); |
||||
| 25 | require_once __DIR__ . '/header.php'; |
||||
| 26 | |||||
| 27 | if (function_exists('mb_http_output')) { |
||||
| 28 | mb_http_output('pass'); |
||||
| 29 | } |
||||
| 30 | |||||
| 31 | $feed_type = 'rss'; |
||||
| 32 | $contents = ob_get_clean(); |
||||
| 33 | header('Content-Type:text/xml; charset=utf-8'); |
||||
| 34 | $GLOBALS['xoopsOption']['template_main'] = 'system_' . $feed_type . '.tpl'; |
||||
| 35 | error_reporting(0); |
||||
| 36 | |||||
| 37 | require_once XOOPS_ROOT_PATH . '/class/template.php'; |
||||
| 38 | $xoopsTpl = new XoopsTpl(); |
||||
| 39 | |||||
| 40 | // Find case |
||||
| 41 | $case = 'all'; |
||||
| 42 | $categoryObj = $helper->getHandler('Category')->get(Request::getInt('cid', 0, 'REQUEST')); |
||||
| 43 | |||||
| 44 | $groups = is_object($GLOBALS['xoopsUser']) ? $GLOBALS['xoopsUser']->getGroups() : [0 => XOOPS_GROUP_ANONYMOUS]; |
||||
| 45 | |||||
| 46 | // Get download permissions |
||||
| 47 | $allowedDownCategoriesIds = $grouppermHandler->getItemIds('WFDownCatPerm', $groups, $helper->getModule()->mid()); |
||||
| 48 | |||||
| 49 | if (!$categoryObj->isNew()) { |
||||
| 50 | if (!in_array($categoryObj->getVar('cid'), $allowedDownCategoriesIds)) { |
||||
| 51 | exit(); |
||||
| 52 | } |
||||
| 53 | $case = 'category'; |
||||
| 54 | } |
||||
| 55 | |||||
| 56 | switch ($case) { |
||||
| 57 | // Set cache_prefix |
||||
| 58 | default: |
||||
| 59 | case 'all': |
||||
| 60 | $cache_prefix = 'wfd|feed|' . $feed_type; |
||||
| 61 | break; |
||||
| 62 | case 'category': |
||||
| 63 | $cache_prefix = 'wfd|catfeed|' . $feed_type . '|' . (int)$categoryObj->getVar('cid'); |
||||
| 64 | break; |
||||
| 65 | } |
||||
| 66 | |||||
| 67 | $xoopsTpl->caching = true; |
||||
|
0 ignored issues
–
show
|
|||||
| 68 | $xoopsTpl->cache_lifetime = $GLOBALS['xoopsConfig']['module_cache'][(int)$helper->getModule()->mid()]; |
||||
| 69 | if (!$xoopsTpl->is_cached('db:' . $xoopsOption['template_main'], $cache_prefix)) { |
||||
| 70 | // Get content |
||||
| 71 | $limit = 30; |
||||
| 72 | |||||
| 73 | $criteria = new CriteriaCompo(new Criteria('offline', false)); |
||||
|
0 ignored issues
–
show
false of type false is incompatible with the type string expected by parameter $value of Criteria::__construct().
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 74 | $criteria->setSort('published'); |
||||
| 75 | $criteria->setOrder('DESC'); |
||||
| 76 | $criteria->setLimit($limit); |
||||
| 77 | |||||
| 78 | switch ($case) { |
||||
| 79 | default: |
||||
| 80 | case 'all': |
||||
| 81 | $shorthand = 'all'; |
||||
| 82 | $title = $GLOBALS['xoopsConfig']['sitename'] . ' - ' . htmlspecialchars($helper->getModule()->getVar('name'), ENT_QUOTES); |
||||
| 83 | $desc = $GLOBALS['xoopsConfig']['slogan']; |
||||
| 84 | $channel_url = XOOPS_URL . '/modules/' . $helper->getModule()->getVat('dirname') . '/rss.php'; |
||||
| 85 | |||||
| 86 | $criteria->add(new Criteria('cid', '(' . implode(',', $allowedDownCategoriesIds) . ')', 'IN')); |
||||
| 87 | $downloadObjs = $helper->getHandler('Download')->getObjects($criteria); |
||||
| 88 | $id = 0; |
||||
| 89 | break; |
||||
| 90 | case 'category': |
||||
| 91 | $shorthand = 'cat'; |
||||
| 92 | $title = $GLOBALS['xoopsConfig']['sitename'] . ' - ' . htmlspecialchars($categoryObj->getVar('title'), ENT_QUOTES); |
||||
| 93 | $desc = $GLOBALS['xoopsConfig']['slogan'] . ' - ' . htmlspecialchars($categoryObj->getVar('title'), ENT_QUOTES); |
||||
| 94 | $channel_url = XOOPS_URL . '/modules/' . $helper->getModule()->getVat('dirname') . '/rss.php?cid=' . (int)$categoryObj->getVar('cid'); |
||||
| 95 | |||||
| 96 | $criteria->add(new Criteria('cid', (int)$categoryObj->getVar('cid'))); |
||||
| 97 | $downloadObjs = $helper->getHandler('Download')->getObjects($criteria); |
||||
| 98 | $id = $categoryObj->getVar('categoryid'); |
||||
| 99 | break; |
||||
| 100 | } |
||||
| 101 | |||||
| 102 | // Assign feed-specific vars |
||||
| 103 | $xoopsTpl->assign('channel_title', xoops_utf8_encode($title, 'n')); |
||||
|
0 ignored issues
–
show
The call to
xoops_utf8_encode() has too many arguments starting with 'n'.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above. Loading history...
|
|||||
| 104 | $xoopsTpl->assign('channel_desc', xoops_utf8_encode($desc, 'n')); |
||||
| 105 | $xoopsTpl->assign('channel_link', $channel_url); |
||||
| 106 | $xoopsTpl->assign('channel_lastbuild', formatTimestamp(time(), $feed_type)); |
||||
| 107 | $xoopsTpl->assign('channel_webmaster', $GLOBALS['xoopsConfig']['adminmail']); |
||||
| 108 | $xoopsTpl->assign('channel_editor', $GLOBALS['xoopsConfig']['adminmail']); |
||||
| 109 | $xoopsTpl->assign('channel_editor_name', $GLOBALS['xoopsConfig']['sitename']); |
||||
| 110 | $xoopsTpl->assign('channel_category', $helper->getModule()->getVar('name', 'e')); |
||||
| 111 | $xoopsTpl->assign('channel_generator', 'PHP'); |
||||
| 112 | $xoopsTpl->assign('channel_language', _LANGCODE); |
||||
| 113 | |||||
| 114 | // Assign items to template style array |
||||
| 115 | $url = XOOPS_URL . '/modules/' . $helper->getModule()->getVat('dirname') . '/'; |
||||
| 116 | if (count($downloadObjs) > 0) { |
||||
| 117 | // Get users for downloads |
||||
| 118 | $uids = []; |
||||
| 119 | foreach ($downloadObjs as $downloadObj) { |
||||
| 120 | $uids[] = $downloadObj->getVar('submitter'); |
||||
| 121 | } |
||||
| 122 | if (count($uids) > 0) { |
||||
| 123 | $users = $memberHandler->getUserList(new Criteria('uid', '(' . implode(',', array_unique($uids)) . ')', 'IN')); |
||||
| 124 | } |
||||
| 125 | |||||
| 126 | // Assign items to template |
||||
| 127 | foreach ($downloadObjs as $downloadObj) { |
||||
| 128 | $item = $downloadObj; |
||||
| 129 | $link = $url . 'singlefile.php?lid=' . (int)$item->getVar('lid'); |
||||
| 130 | $title = htmlspecialchars($item->getVar('title', 'n'), ENT_QUOTES | ENT_HTML5); |
||||
| 131 | $teaser = htmlspecialchars($item->getVar('summary', 'n'), ENT_QUOTES | ENT_HTML5); |
||||
| 132 | $author = isset($users[$item->getVar('submitter')]) ?: $GLOBALS['xoopsConfig']['anonymous']; |
||||
| 133 | |||||
| 134 | $xoopsTpl->append( |
||||
| 135 | 'items', |
||||
| 136 | [ |
||||
| 137 | 'title' => xoops_utf8_encode($title), |
||||
| 138 | 'author' => xoops_utf8_encode($author), |
||||
| 139 | 'link' => $link, |
||||
| 140 | 'guid' => $link, |
||||
| 141 | 'is_permalink' => false, |
||||
| 142 | 'pubdate' => formatTimestamp($item->getVar('published'), $feed_type), |
||||
| 143 | 'dc_date' => formatTimestamp($item->getVar('published'), 'd/m H:i'), |
||||
| 144 | 'description' => xoops_utf8_encode($teaser), |
||||
| 145 | ] |
||||
| 146 | ); |
||||
| 147 | } |
||||
| 148 | } else { |
||||
| 149 | $excuse_title = 'No items!'; |
||||
| 150 | $excuse = 'There are no items for this feed!'; |
||||
| 151 | $art_title = htmlspecialchars($excuse_title, ENT_QUOTES); |
||||
| 152 | $art_teaser = htmlspecialchars($excuse, ENT_QUOTES); |
||||
| 153 | $xoopsTpl->append( |
||||
| 154 | 'items', |
||||
| 155 | [ |
||||
| 156 | 'title' => xoops_utf8_encode($art_title), |
||||
| 157 | 'link' => $url, |
||||
| 158 | 'guid' => $url, |
||||
| 159 | 'pubdate' => formatTimestamp(time(), $feed_type), |
||||
| 160 | 'dc_date' => formatTimestamp(time(), 'd/m H:i'), |
||||
| 161 | 'description' => xoops_utf8_encode($art_teaser), |
||||
| 162 | ] |
||||
| 163 | ); |
||||
| 164 | } |
||||
| 165 | } |
||||
| 166 | |||||
| 167 | $xoopsTpl->display('db:' . $xoopsOption['template_main'], $cache_prefix); |
||||
| 168 |
This check looks for assignments to scalar types that may be of the wrong type.
To ensure the code behaves as expected, it may be a good idea to add an explicit type cast.