This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||||
2 | |||||||
3 | namespace XoopsModules\Xhelp; |
||||||
4 | |||||||
5 | /* |
||||||
6 | * You may not change or alter any portion of this comment or credits |
||||||
7 | * of supporting developers from this source code or any supporting source code |
||||||
8 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||||
9 | * |
||||||
10 | * This program is distributed in the hope that it will be useful, |
||||||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||
13 | */ |
||||||
14 | |||||||
15 | /** |
||||||
16 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||||
17 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||||||
18 | * @author Eric Juden <[email protected]> |
||||||
19 | * @author XOOPS Development Team |
||||||
20 | */ |
||||||
21 | |||||||
22 | /** |
||||||
23 | * class EmailStore |
||||||
24 | */ |
||||||
25 | class EmailStore |
||||||
26 | { |
||||||
27 | public $responseHandler; |
||||||
28 | public $ticketHandler; |
||||||
29 | public $mailEventHandler; |
||||||
30 | public $_errors; |
||||||
31 | |||||||
32 | /** |
||||||
33 | * EmailStore constructor. |
||||||
34 | */ |
||||||
35 | public function __construct() |
||||||
36 | { |
||||||
37 | $helper = Helper::getInstance(); |
||||||
38 | $this->responseHandler = $helper->getHandler('Response'); |
||||||
39 | /** @var TicketHandler $this- >ticketHandler */ |
||||||
40 | $this->ticketHandler = $helper->getHandler('Ticket'); |
||||||
41 | /** @var MailEventHandler $this- >mailEventHandler */ |
||||||
42 | $this->mailEventHandler = $helper->getHandler('MailEvent'); |
||||||
43 | $this->_errors = []; |
||||||
44 | } |
||||||
45 | |||||||
46 | /** |
||||||
47 | * @param string|array $desc |
||||||
48 | */ |
||||||
49 | public function _setError($desc): void |
||||||
50 | { |
||||||
51 | if (\is_array($desc)) { |
||||||
52 | foreach ($desc as $d) { |
||||||
53 | $this->_errors[] = $d; |
||||||
54 | } |
||||||
55 | } |
||||||
56 | $this->_errors[] = $desc; |
||||||
57 | } |
||||||
58 | |||||||
59 | /** |
||||||
60 | * @return array|int |
||||||
61 | */ |
||||||
62 | public function _getErrors() |
||||||
63 | { |
||||||
64 | if (\count($this->_errors) > 0) { |
||||||
65 | return $this->_errors; |
||||||
66 | } |
||||||
67 | |||||||
68 | return 0; |
||||||
69 | } |
||||||
70 | |||||||
71 | /** |
||||||
72 | * |
||||||
73 | */ |
||||||
74 | public function clearErrors(): void |
||||||
75 | { |
||||||
76 | $this->_errors = []; |
||||||
77 | } |
||||||
78 | |||||||
79 | /** |
||||||
80 | * |
||||||
81 | */ |
||||||
82 | public function renderErrors(): void |
||||||
83 | { |
||||||
84 | } |
||||||
85 | |||||||
86 | /** |
||||||
87 | * Store the parsed message in database |
||||||
88 | * @param ParsedMessage $msg {@link ParsedMessage} object Message to add |
||||||
89 | * @param \XoopsUser $user {@link xoopsUser} object User that submitted message |
||||||
90 | * @param DepartmentMailBox $mbox {@link DepartmentMailBox} object. Originating Mailbox for message |
||||||
91 | * @param mixed $errors |
||||||
92 | * @return array|false Returns <a href='psi_element://Ticket'>Ticket</a> object if new ticket, <a href='psi_element://Response'>Response</a> object if a response, and false if unable to save. |
||||||
93 | */ |
||||||
94 | public function storeMsg(ParsedMessage $msg, \XoopsUser $user, DepartmentMailBox $mbox, &$errors) |
||||||
95 | { |
||||||
96 | //Remove any previous error messages |
||||||
97 | $this->clearErrors(); |
||||||
98 | |||||||
99 | $type = $msg->getMsgType(); |
||||||
100 | switch ($type) { |
||||||
101 | case _XHELP_MSGTYPE_TICKET: |
||||||
102 | $obj = $this->ticketHandler->create(); |
||||||
103 | $obj->setVar('uid', $user->getVar('uid')); |
||||||
104 | $obj->setVar('subject', $msg->getSubject()); |
||||||
105 | $obj->setVar('description', $msg->getMsg()); |
||||||
106 | $obj->setVar('department', $mbox->getVar('departmentid')); |
||||||
107 | $obj->setVar('priority', $mbox->getVar('priority')); |
||||||
108 | $obj->setVar('posted', \time()); |
||||||
109 | $obj->setVar('serverid', $mbox->getVar('id')); |
||||||
110 | $obj->setVar('userIP', 'via Email'); |
||||||
111 | $obj->setVar('email', $user->getVar('email')); |
||||||
112 | if (!$status = Utility::getMeta('default_status')) { |
||||||
113 | Utility::setMeta('default_status', '1'); |
||||||
114 | $status = 1; |
||||||
115 | } |
||||||
116 | $obj->setVar('status', $status); |
||||||
117 | $obj->createEmailHash($msg->getEmail()); |
||||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||||
118 | if ($this->ticketHandler->insert($obj)) { |
||||||
119 | $obj->addSubmitter($user->getVar('email'), $user->getVar('uid')); |
||||||
0 ignored issues
–
show
The method
addSubmitter() does not exist on XoopsObject . It seems like you code against a sub-type of XoopsObject such as XoopsModules\Xhelp\Ticket .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
120 | $this->saveAttachments($msg, $obj->getVar('id')); |
||||||
121 | |||||||
122 | $errors = $this->_getErrors(); |
||||||
123 | |||||||
124 | return [$obj]; |
||||||
125 | } |
||||||
126 | break; |
||||||
127 | case _XHELP_MSGTYPE_RESPONSE: |
||||||
128 | if (!$ticket = $this->ticketHandler->getTicketByHash($msg->getHash())) { |
||||||
129 | $this->_setError(\_XHELP_RESPONSE_NO_TICKET); |
||||||
130 | |||||||
131 | return false; |
||||||
132 | } |
||||||
133 | |||||||
134 | if ($msg->getEmail() != $ticket->getVar('email')) { |
||||||
135 | $this->_setError(\sprintf(\_XHELP_MISMATCH_EMAIL, $msg->getEmail(), $ticket->getVar('email'))); |
||||||
0 ignored issues
–
show
It seems like
$ticket->getVar('email') can also be of type array and array ; however, parameter $values of sprintf() does only seem to accept double|integer|string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
136 | |||||||
137 | return false; |
||||||
138 | } |
||||||
139 | |||||||
140 | $obj = $this->responseHandler->create(); |
||||||
141 | $obj->setVar('ticketid', $ticket->getVar('id')); |
||||||
142 | $obj->setVar('uid', $user->getVar('uid')); |
||||||
143 | $obj->setVar('message', $msg->getMsg()); |
||||||
144 | $obj->setVar('updateTime', \time()); |
||||||
145 | $obj->setVar('userIP', 'via Email'); |
||||||
146 | |||||||
147 | if ($this->responseHandler->insert($obj)) { |
||||||
148 | $this->saveAttachments($msg, $ticket->getVar('id'), $obj->getVar('id')); |
||||||
149 | $ticket->setVar('lastUpdated', \time()); |
||||||
150 | $this->ticketHandler->insert($ticket); |
||||||
151 | |||||||
152 | $errors = $this->_getErrors(); |
||||||
153 | |||||||
154 | return [$ticket, $obj]; |
||||||
155 | } |
||||||
156 | break; |
||||||
157 | default: |
||||||
158 | //Sanity Check, should never get here |
||||||
159 | } |
||||||
160 | |||||||
161 | return false; |
||||||
162 | } |
||||||
163 | |||||||
164 | /** |
||||||
165 | * @param ParsedMessage $msg |
||||||
166 | * @param int $ticketid |
||||||
167 | * @param int $responseid |
||||||
168 | */ |
||||||
169 | public function saveAttachments(ParsedMessage $msg, int $ticketid, int $responseid = 0): void |
||||||
170 | { |
||||||
171 | $helper = Helper::getInstance(); |
||||||
172 | |||||||
173 | $attachments = $msg->getAttachments(); |
||||||
174 | $dir = XOOPS_UPLOAD_PATH . '/xhelp'; |
||||||
175 | $prefix = (0 != $responseid ? $ticketid . '_' . $responseid . '_' : $ticketid . '_'); |
||||||
176 | /** @var \XoopsModules\Xhelp\MimetypeHandler $mimetypeHandler */ |
||||||
177 | $mimetypeHandler = $helper->getHandler('Mimetype'); |
||||||
178 | $allowed_mimetypes = $mimetypeHandler->getArray(); |
||||||
179 | |||||||
180 | if (!\is_dir($dir)) { |
||||||
181 | if (!\mkdir($dir, 0757) && !\is_dir($dir)) { |
||||||
182 | throw new \RuntimeException(\sprintf('Directory "%s" was not created', $dir)); |
||||||
183 | } |
||||||
184 | } |
||||||
185 | |||||||
186 | $dir .= '/'; |
||||||
187 | |||||||
188 | if ($helper->getConfig('xhelp_allowUpload')) { |
||||||
189 | /** @var \XoopsModules\Xhelp\FileHandler $fileHandler */ |
||||||
190 | $fileHandler = $helper->getHandler('File'); |
||||||
191 | foreach ($attachments as $attach) { |
||||||
192 | $validators = []; |
||||||
193 | |||||||
194 | //Create Temporary File |
||||||
195 | $fname = $prefix . $attach['filename']; |
||||||
196 | $fp = \fopen($dir . $fname, 'wb'); |
||||||
197 | \fwrite($fp, $attach['content']); |
||||||
198 | \fclose($fp); |
||||||
199 | |||||||
200 | $validators[] = new Validation\ValidateMimeType($dir . $fname, $attach['content-type'], $allowed_mimetypes); |
||||||
201 | $validators[] = new Validation\ValidateFileSize($dir . $fname, $helper->getConfig('xhelp_uploadSize')); |
||||||
0 ignored issues
–
show
It seems like
$helper->getConfig('xhelp_uploadSize') can also be of type null ; however, parameter $maxsize of XoopsModules\Xhelp\Valid...FileSize::__construct() does only seem to accept integer , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
202 | $validators[] = new Validation\ValidateImageSize($dir . $fname, $helper->getConfig('xhelp_uploadWidth'), $helper->getConfig('xhelp_uploadHeight')); |
||||||
0 ignored issues
–
show
It seems like
$helper->getConfig('xhelp_uploadHeight') can also be of type null ; however, parameter $maxheight of XoopsModules\Xhelp\Valid...mageSize::__construct() does only seem to accept integer , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() It seems like
$helper->getConfig('xhelp_uploadWidth') can also be of type null ; however, parameter $maxwidth of XoopsModules\Xhelp\Valid...mageSize::__construct() does only seem to accept integer , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
203 | |||||||
204 | if (Utility::checkRules($validators, $errors)) { |
||||||
205 | //Add attachment to ticket |
||||||
206 | |||||||
207 | /** @var \XoopsModules\Xhelp\File $file */ |
||||||
208 | $file = $fileHandler->create(); |
||||||
209 | $file->setVar('filename', $fname); |
||||||
210 | $file->setVar('ticketid', $ticketid); |
||||||
211 | $file->setVar('mimetype', $attach['content-type']); |
||||||
212 | $file->setVar('responseid', $responseid); |
||||||
213 | $fileHandler->insert($file, true); |
||||||
214 | } else { |
||||||
215 | //Remove the file |
||||||
216 | $this->addAttachmentError($errors, $msg, $fname); |
||||||
217 | \unlink($dir . $fname); |
||||||
218 | } |
||||||
219 | } |
||||||
220 | } else { |
||||||
221 | $this->_setError(\_XHELP_MESSAGE_UPLOAD_ALLOWED_ERR); // Error: file uploading is disabled |
||||||
222 | } |
||||||
223 | } |
||||||
224 | |||||||
225 | /** |
||||||
226 | * @param array $errors |
||||||
227 | * @param ParsedMessage $msg |
||||||
228 | * @param string $fname |
||||||
229 | */ |
||||||
230 | public function addAttachmentError(array $errors, ParsedMessage $msg, string $fname): void |
||||||
231 | { |
||||||
232 | if (0 != $errors) { |
||||||
0 ignored issues
–
show
|
|||||||
233 | $aErrors = []; |
||||||
234 | foreach ($errors as $err) { |
||||||
235 | if (\in_array($err, $aErrors)) { |
||||||
236 | continue; |
||||||
237 | } |
||||||
238 | $aErrors[] = $err; |
||||||
239 | } |
||||||
240 | $error = \implode(', ', $aErrors); |
||||||
241 | $this->_setError(\sprintf(\_XHELP_MESSAGE_UPLOAD_ERR, $fname, $msg->getEmail(), $error)); |
||||||
242 | } |
||||||
243 | } |
||||||
244 | } |
||||||
245 |