This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||||
2 | |||||||
3 | namespace XoopsModules\Xhelp; |
||||||
4 | |||||||
5 | /* |
||||||
6 | * You may not change or alter any portion of this comment or credits |
||||||
7 | * of supporting developers from this source code or any supporting source code |
||||||
8 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||||
9 | * |
||||||
10 | * This program is distributed in the hope that it will be useful, |
||||||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||
13 | */ |
||||||
14 | |||||||
15 | /** |
||||||
16 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||||
17 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||||||
18 | * @author Brian Wahoff <[email protected]> |
||||||
19 | * @author Eric Juden <[email protected]> |
||||||
20 | * @author XOOPS Development Team |
||||||
21 | */ |
||||||
22 | |||||||
23 | if (!\defined('XHELP_CLASS_PATH')) { |
||||||
24 | exit(); |
||||||
25 | } |
||||||
26 | |||||||
27 | /** |
||||||
28 | * class FaqAdapterFactory |
||||||
29 | */ |
||||||
30 | class FaqAdapterFactory |
||||||
31 | { |
||||||
32 | /** |
||||||
33 | * Retrieve an array of filenames for all installed adapters |
||||||
34 | * |
||||||
35 | * @return array FaqAdapterAbstract filenames |
||||||
36 | */ |
||||||
37 | public static function &installedAdapters(): array |
||||||
38 | { |
||||||
39 | $aAdapters = []; |
||||||
40 | |||||||
41 | // Step 1 - directory listing of all files in class/faq/ directory |
||||||
42 | $adapters_dir = @\dir(\XHELP_FAQ_ADAPTER_PATH); |
||||||
43 | if ($adapters_dir) { |
||||||
44 | while (false !== ($file = $adapters_dir->read())) { |
||||||
45 | if (\preg_match('|^\.+$|', $file)) { |
||||||
46 | continue; |
||||||
47 | } |
||||||
48 | if (\preg_match('|\.php$|', $file)) { |
||||||
49 | $modname = \basename($file, '.php'); // Get name without file extension |
||||||
50 | |||||||
51 | // Step 2 - Check that class exists |
||||||
52 | // $adapter_data = implode('', file(XHELP_FAQ_ADAPTER_PATH . '/' . $file)); |
||||||
53 | // $adapter_data = file_get_contents(\XHELP_FAQ_ADAPTER_PATH . '/' . $file); |
||||||
54 | // $classname = 'xhelp' . \ucfirst($modname) . 'Adapter'; |
||||||
55 | |||||||
56 | $class = __NAMESPACE__ . '\Faq\\' . \ucfirst($modname); |
||||||
57 | if (\class_exists($class)) { |
||||||
58 | $adapter = new $class(); |
||||||
59 | if ($adapter instanceof FaqAdapterAbstract) { |
||||||
60 | // $dirname = $adapter->dirname; |
||||||
61 | $aAdapters[$modname] = $adapter; |
||||||
62 | // if (!empty($dirname) && \is_dir(XOOPS_ROOT_PATH . '/modules/' . $dirname)) { |
||||||
63 | // if ($adapter->loadModule()) { |
||||||
64 | // $ret = $adapter; |
||||||
65 | // } else { |
||||||
66 | // $object->setErrors(\_AM_RSSFIT_PLUGIN_MODNOTFOUND); |
||||||
67 | // } |
||||||
68 | // } else { |
||||||
69 | // $object->setErrors(\_AM_RSSFIT_PLUGIN_MODNOTFOUND); |
||||||
70 | // } |
||||||
71 | } |
||||||
72 | // } else { |
||||||
73 | // $object->setErrors(\_AM_RSSFIT_PLUGIN_CLASSNOTFOUND . ' ' . $class); |
||||||
74 | // } |
||||||
75 | |||||||
76 | // if (\preg_match("|class $classname(.*)|i", $adapter_data) > 0) { |
||||||
77 | // require_once \XHELP_FAQ_ADAPTER_PATH . "/$file"; |
||||||
78 | // $aAdapters[$modname] = new $classname(); |
||||||
79 | // } |
||||||
80 | // unset($adapter_data); |
||||||
81 | } |
||||||
82 | } |
||||||
83 | } |
||||||
84 | } |
||||||
85 | |||||||
86 | // Step 3 - return array of accepted filenames |
||||||
87 | return $aAdapters; |
||||||
88 | } |
||||||
89 | |||||||
90 | /** |
||||||
91 | * Retrieve an FaqAdapterAbstract class |
||||||
92 | * @param string $name |
||||||
93 | * @return FaqAdapterAbstract|null |
||||||
94 | */ |
||||||
95 | public static function getFaqAdapter(string $name = ''): ?FaqAdapterAbstract |
||||||
96 | { |
||||||
97 | // Step 1 - Retrieve configured faq application |
||||||
98 | $ret = null; |
||||||
99 | if ('' === $name) { |
||||||
100 | $name = Utility::getMeta('faq_adapter'); |
||||||
101 | if ('' === $name || false === $name) { |
||||||
102 | return $ret; |
||||||
103 | } |
||||||
104 | } |
||||||
105 | |||||||
106 | // Check adapterValid function |
||||||
107 | $isValid = self::isAdapterValid($name); |
||||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||||
108 | |||||||
109 | if ($isValid) { |
||||||
110 | // Step 2 - include script with faq adapter class |
||||||
111 | // require_once \XHELP_FAQ_ADAPTER_PATH . '/' . $name . '.php'; |
||||||
112 | |||||||
113 | // Step 3 - create instance of adapter class |
||||||
114 | // $classname = 'xhelp' . $name . 'Adapter'; |
||||||
115 | $classname = __NAMESPACE__ . '\Faq\\' . \ucfirst($name); |
||||||
0 ignored issues
–
show
It seems like
$name can also be of type true ; however, parameter $string of ucfirst() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
116 | if (!\class_exists($classname)) { |
||||||
117 | throw new \RuntimeException("Class '$classname' not found"); |
||||||
118 | } |
||||||
119 | $ret = new $classname(); |
||||||
120 | |||||||
121 | // Step 4 - return adapter class |
||||||
122 | |||||||
123 | return $ret; |
||||||
124 | } |
||||||
125 | |||||||
126 | return $ret; |
||||||
127 | } |
||||||
128 | |||||||
129 | /** |
||||||
130 | * Set an FaqAdapterAbstract class |
||||||
131 | * |
||||||
132 | * @param string $name |
||||||
133 | * @return bool true (success) / false (failure) |
||||||
134 | */ |
||||||
135 | public static function setFaqAdapter(string $name): bool |
||||||
136 | { |
||||||
137 | // Step 1 - check that $name is a valid adapter |
||||||
138 | $isValid = self::isAdapterValid($name); |
||||||
139 | |||||||
140 | // Step 2 - store in xhelp_meta table |
||||||
141 | $ret = false; |
||||||
142 | if ($isValid) { |
||||||
143 | $ret = Utility::setMeta('faq_adapter', $name); |
||||||
144 | } |
||||||
145 | |||||||
146 | // Step 3 - return true/false |
||||||
147 | return $ret; |
||||||
148 | } |
||||||
149 | |||||||
150 | /** |
||||||
151 | * Check if an adapter exists |
||||||
152 | * |
||||||
153 | * @param string $name |
||||||
154 | * @return bool true (success) / false (failure) |
||||||
155 | */ |
||||||
156 | public static function isAdapterValid(string $name): bool |
||||||
157 | { |
||||||
158 | $ret = false; |
||||||
159 | // Step 0 - Make sure this is a valid file |
||||||
160 | if (\is_file(\XHELP_FAQ_ADAPTER_PATH . '/' . $name . '.php')) { |
||||||
161 | // Step 1 - create instance of faq adapter class |
||||||
162 | // if (require_once \XHELP_FAQ_ADAPTER_PATH . '/' . $name . '.php') { |
||||||
163 | // $classname = 'xhelp' . $name . 'Adapter'; |
||||||
164 | // $oAdapter = new $classname(); |
||||||
165 | // |
||||||
166 | // // Step 2 - run isActive inside of adapter class |
||||||
167 | // $ret = $oAdapter->isActive($oAdapter->meta['module_dir']); |
||||||
168 | // } |
||||||
169 | |||||||
170 | $class = __NAMESPACE__ . '\Faq\\' . \ucfirst($name); |
||||||
171 | if (\class_exists($class)) { |
||||||
172 | $oAdapter = new $class(); |
||||||
173 | if ($oAdapter instanceof FaqAdapterAbstract) { |
||||||
174 | // Step 2 - run isActive inside of adapter class //TODO MB: are we checking if it's Valid or if it's Active? |
||||||
175 | $ret = $oAdapter->isActive($oAdapter->meta['module_dir']); |
||||||
0 ignored issues
–
show
The call to
XoopsModules\Xhelp\FaqAdapterAbstract::isActive() has too many arguments starting with $oAdapter->meta['module_dir'] .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above. ![]() |
|||||||
176 | } |
||||||
177 | } |
||||||
178 | } |
||||||
179 | |||||||
180 | // Step 3 - return value |
||||||
181 | return $ret; |
||||||
182 | } |
||||||
183 | } |
||||||
184 |