This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||
2 | |||||
3 | namespace XoopsModules\Xhelp; |
||||
4 | |||||
5 | /* |
||||
6 | * You may not change or alter any portion of this comment or credits |
||||
7 | * of supporting developers from this source code or any supporting source code |
||||
8 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||
9 | * |
||||
10 | * This program is distributed in the hope that it will be useful, |
||||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
13 | */ |
||||
14 | |||||
15 | /** |
||||
16 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||
17 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||||
18 | * @author Brian Wahoff <[email protected]> |
||||
19 | * @author Eric Juden <[email protected]> |
||||
20 | * @author XOOPS Development Team |
||||
21 | */ |
||||
22 | |||||
23 | if (!\defined('XHELP_CLASS_PATH')) { |
||||
24 | exit(); |
||||
25 | } |
||||
26 | // require_once XHELP_CLASS_PATH . '/BaseObjectHandler.php'; |
||||
27 | |||||
28 | /** |
||||
29 | * class RoleHandler |
||||
30 | */ |
||||
31 | class RoleHandler extends BaseObjectHandler |
||||
32 | { |
||||
33 | /** |
||||
34 | * Name of child class |
||||
35 | * |
||||
36 | * @var string |
||||
37 | */ |
||||
38 | public $classname = Role::class; |
||||
39 | /** |
||||
40 | * DB Table Name |
||||
41 | * |
||||
42 | * @var string |
||||
43 | */ |
||||
44 | public $dbtable = 'xhelp_roles'; |
||||
45 | |||||
46 | private const TABLE = 'xhelp_roles'; |
||||
47 | private const ENTITY = Role::class; |
||||
48 | private const ENTITYNAME = 'Role'; |
||||
49 | private const KEYNAME = 'id'; |
||||
50 | private const IDENTIFIER = 'name'; |
||||
51 | |||||
52 | /** |
||||
53 | * Constructor |
||||
54 | * |
||||
55 | * @param \XoopsMySQLDatabase|null $db reference to a xoopsDB object |
||||
56 | */ |
||||
57 | public function __construct(\XoopsMySQLDatabase $db = null) |
||||
58 | { |
||||
59 | $this->init($db); |
||||
60 | $this->helper = Helper::getInstance(); |
||||
61 | parent::__construct($db, static::TABLE, static::ENTITY, static::KEYNAME, static::IDENTIFIER); |
||||
62 | } |
||||
63 | |||||
64 | /** |
||||
65 | * @param \XoopsObject $object |
||||
66 | * @return string |
||||
67 | */ |
||||
68 | public function insertQuery(\XoopsObject $object): string |
||||
69 | { |
||||
70 | //TODO mb replace with individual variables |
||||
71 | // Copy all object vars into local variables |
||||
72 | foreach ($object->cleanVars as $k => $v) { |
||||
73 | ${$k} = $v; |
||||
74 | } |
||||
75 | |||||
76 | $sql = \sprintf('INSERT INTO `%s` (id, NAME, description, tasks) VALUES (%u, %s, %s, %u)', $this->db->prefix($this->dbtable), $id, $this->db->quoteString($name), $this->db->quoteString($description), $tasks); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
![]() Comprehensibility
Best Practice
introduced
by
Comprehensibility
Best Practice
introduced
by
Comprehensibility
Best Practice
introduced
by
|
|||||
77 | |||||
78 | return $sql; |
||||
79 | } |
||||
80 | |||||
81 | /** |
||||
82 | * @param \XoopsObject $object |
||||
83 | * @return string |
||||
84 | */ |
||||
85 | public function updateQuery(\XoopsObject $object): string |
||||
86 | { |
||||
87 | //TODO mb replace with individual variables |
||||
88 | // Copy all object vars into local variables |
||||
89 | foreach ($object->cleanVars as $k => $v) { |
||||
90 | ${$k} = $v; |
||||
91 | } |
||||
92 | |||||
93 | $sql = \sprintf('UPDATE `%s` SET NAME = %s, description = %s, tasks = %u WHERE id = %u', $this->db->prefix($this->dbtable), $this->db->quoteString($name), $this->db->quoteString($description), $tasks, $id); |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
Comprehensibility
Best Practice
introduced
by
Comprehensibility
Best Practice
introduced
by
Comprehensibility
Best Practice
introduced
by
|
|||||
94 | |||||
95 | return $sql; |
||||
96 | } |
||||
97 | |||||
98 | /** |
||||
99 | * @param \XoopsObject $object |
||||
100 | * @return string |
||||
101 | */ |
||||
102 | public function deleteQuery(\XoopsObject $object): string |
||||
103 | { |
||||
104 | $sql = \sprintf('DELETE FROM `%s` WHERE id = %u', $this->db->prefix($this->dbtable), $object->getVar('id')); |
||||
0 ignored issues
–
show
It seems like
$object->getVar('id') can also be of type array and array ; however, parameter $values of sprintf() does only seem to accept double|integer|string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
105 | |||||
106 | return $sql; |
||||
107 | } |
||||
108 | |||||
109 | /** |
||||
110 | * delete a role from the database |
||||
111 | * |
||||
112 | * @param \XoopsObject $object reference to the {@link Role} |
||||
113 | * obj to delete |
||||
114 | * @param bool $force |
||||
115 | * @return bool FALSE if failed. |
||||
116 | */ |
||||
117 | public function delete(\XoopsObject $object, $force = false): bool |
||||
118 | { |
||||
119 | // Remove staff roles from db first |
||||
120 | $staffRoleHandler = $this->helper->getHandler('StaffRole'); |
||||
121 | if (!$staffRoleHandler->deleteAll(new \Criteria('roleid', $object->getVar('id')))) { |
||||
0 ignored issues
–
show
It seems like
$object->getVar('id') can also be of type array and array ; however, parameter $value of Criteria::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
122 | return false; |
||||
123 | } |
||||
124 | |||||
125 | $ret = parent::delete($object, $force); |
||||
126 | |||||
127 | return $ret; |
||||
128 | } |
||||
129 | |||||
130 | /** |
||||
131 | * @param int $task |
||||
132 | * @return array |
||||
133 | */ |
||||
134 | public function getRolesByTask(int $task): array |
||||
135 | { |
||||
136 | $task = $task; |
||||
137 | |||||
138 | // Get all roles |
||||
139 | $roles = $this->getObjects(); |
||||
140 | |||||
141 | $aRoles = []; |
||||
142 | foreach ($roles as $role) { |
||||
143 | if (($role->getVar('tasks') & (2 ** $task)) > 0) { |
||||
144 | $aRoles[$role->getVar('id')] = $role; |
||||
145 | } |
||||
146 | } |
||||
147 | |||||
148 | return $aRoles; |
||||
149 | } |
||||
150 | } |
||||
151 |