This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||
2 | |||
3 | /* |
||
4 | * You may not change or alter any portion of this comment or credits |
||
5 | * of supporting developers from this source code or any supporting source code |
||
6 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
7 | * |
||
8 | * This program is distributed in the hope that it will be useful, |
||
9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
11 | */ |
||
12 | |||
13 | /** |
||
14 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||
15 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||
16 | * @author Brian Wahoff <[email protected]> |
||
17 | * @author Eric Juden <[email protected]> |
||
18 | * @author XOOPS Development Team |
||
19 | */ |
||
20 | |||
21 | use Xmf\Request; |
||
22 | use XoopsModules\Xhelp; |
||
23 | |||
24 | require_once __DIR__ . '/header.php'; |
||
25 | |||
26 | $helper = Xhelp\Helper::getInstance(); |
||
27 | |||
28 | $op = 'default'; |
||
29 | //require_once XHELP_INCLUDE_PATH . '/events.php'; |
||
30 | // require_once XHELP_CLASS_PATH . '/faqAdapterFactory.php'; |
||
31 | // require_once XHELP_CLASS_PATH . '/faqCategory.php'; |
||
32 | // require_once XHELP_CLASS_PATH . '/Tree.php'; |
||
33 | |||
34 | if (Request::hasVar('op', 'REQUEST')) { |
||
35 | $op = Request::getString('op', 'default'); |
||
36 | } |
||
37 | |||
38 | if (!$xoopsUser) { |
||
39 | $helper->redirect('', 3, _NOPERM); |
||
40 | } elseif (!$xhelp_isStaff) { |
||
41 | $helper->redirect('', 3, _NOPERM); |
||
42 | } |
||
43 | |||
44 | switch ($op) { |
||
45 | case 'add': |
||
46 | if (isset($_POST['addFaq'])) { |
||
47 | addFaq_action(); |
||
48 | } else { |
||
49 | addFaq_display(); |
||
50 | } |
||
51 | break; |
||
52 | default: |
||
53 | addFaq_display(); |
||
54 | break; |
||
55 | } |
||
56 | |||
57 | /** |
||
58 | * |
||
59 | */ |
||
60 | function addFaq_display() |
||
61 | { |
||
62 | global $xoopsOption, $xoopsTpl, $xoopsConfig, $xoopsUser, $xoopsLogger, $xoopsUserIsAdmin, $session, $staff; |
||
63 | $helper = Xhelp\Helper::getInstance(); |
||
64 | |||
65 | if (!isset($_POST['ticketid']) && 0 === Request::getInt('ticketid', 0, 'POST')) { |
||
66 | $helper->redirect('', 3, _XHELP_MSG_NO_ID); |
||
67 | } |
||
68 | $ticketid = Request::getInt('ticketid', 0, 'POST'); |
||
69 | /** @var \XoopsModules\Xhelp\TicketHandler $ticketHandler */ |
||
70 | $ticketHandler = $helper->getHandler('Ticket'); |
||
71 | /** @var \XoopsModules\Xhelp\ResponseHandler $responseHandler */ |
||
72 | $responseHandler = $helper->getHandler('Response'); |
||
73 | $ticket = $ticketHandler->get($ticketid); |
||
74 | |||
75 | if (!$hasRights = $staff->checkRoleRights(XHELP_SEC_FAQ_ADD, $ticket->getVar('department'))) { |
||
76 | $helper->redirect("ticket.php?id=$ticketid", 3, _AM_XHELP_MESSAGE_NO_ADD_FAQ); |
||
77 | } |
||
78 | |||
79 | $GLOBALS['xoopsOption']['template_main'] = 'xhelp_addFaq.tpl'; |
||
80 | require_once XOOPS_ROOT_PATH . '/header.php'; |
||
81 | |||
82 | $criteria = new \Criteria('ticketid', $ticketid); |
||
83 | $responses = $responseHandler->getObjects($criteria, true); |
||
84 | $responseText = ''; |
||
85 | |||
86 | $allUsers = []; |
||
87 | foreach ($responses as $response) { |
||
88 | $allUsers[$response->getVar('uid')] = ''; |
||
89 | } |
||
90 | |||
91 | $criteria = new \Criteria('uid', '(' . implode(',', array_keys($allUsers)) . ')', 'IN'); |
||
92 | $users = Xhelp\Utility::getUsers($criteria, $helper->getConfig('xhelp_displayName')); |
||
93 | unset($allUsers); |
||
94 | |||
95 | foreach ($responses as $response) { |
||
96 | $responseText .= sprintf(_XHELP_TEXT_USER_SAID, $users[$response->getVar('uid')]) . "\n"; |
||
97 | $responseText .= $response->getVar('message', 'e') . "\n"; |
||
98 | } |
||
99 | |||
100 | // Get current faq adapter |
||
101 | /** @var \XoopsModules\Xhelp\FaqAdapterAbstract $oAdapter */ |
||
102 | $oAdapter = Xhelp\FaqAdapterFactory::getFaqAdapter(); |
||
103 | if (!$oAdapter) { |
||
0 ignored issues
–
show
introduced
by
![]() |
|||
104 | $helper->redirect('', 3, _XHELP_MESSAGE_NO_FAQ); |
||
105 | } |
||
106 | $categories = &$oAdapter->getCategories(); |
||
107 | |||
108 | $tree = new Xhelp\Tree($categories, 'id', 'parent'); |
||
109 | |||
110 | // $xoopsTpl->assign('xhelp_categories', $tree->makeSelBox('categories', 'name', '--', 0, false, 0, $oAdapter->categoryType)); |
||
111 | |||
112 | $categorySelect = $tree->makeSelectElement('categories', 'name', '--', 0, false, 0, $oAdapter->categoryType, ''); |
||
113 | $xoopsTpl->assign('xhelp_categories', $categorySelect->render()); |
||
114 | |||
115 | $xoopsTpl->assign('xhelp_imagePath', XHELP_IMAGE_URL . '/'); |
||
116 | $xoopsTpl->assign('xhelp_baseURL', XHELP_BASE_URL); |
||
117 | $xoopsTpl->assign('xhelp_faqProblem', $ticket->getVar('description', 'e')); |
||
118 | $xoopsTpl->assign('xhelp_faqSolution', $responseText); |
||
119 | $xoopsTpl->assign('xhelp_hasMultiCats', $oAdapter->categoryType); |
||
120 | $xoopsTpl->assign('xhelp_ticketID', $ticketid); |
||
121 | $xoopsTpl->assign('xhelp_faqSubject', $ticket->getVar('subject', 'e')); |
||
122 | |||
123 | require_once XOOPS_ROOT_PATH . '/footer.php'; |
||
124 | } |
||
125 | |||
126 | /** |
||
127 | * |
||
128 | */ |
||
129 | function addFaq_action() |
||
130 | { |
||
131 | global $xoopsUser, $eventService; |
||
132 | $helper = Xhelp\Helper::getInstance(); |
||
133 | /** @var \XoopsModules\Xhelp\TicketHandler $ticketHandler */ |
||
134 | $ticketHandler = $helper->getHandler('Ticket'); |
||
135 | |||
136 | // Retrieve ticket information |
||
137 | $ticketid = $_POST['ticketid']; |
||
138 | $ticket = $ticketHandler->get($ticketid); |
||
139 | |||
140 | $adapter = Xhelp\FaqAdapterFactory::getFaqAdapter(); |
||
141 | $faq = $adapter->createFaq(); |
||
142 | |||
143 | // @todo - Make subject user editable |
||
144 | $faq->setVar('subject', $_POST['subject']); |
||
145 | $faq->setVar('problem', $_POST['problem']); |
||
146 | $faq->setVar('solution', $_POST['solution']); |
||
147 | // BTW - XOBJ_DTYPE_ARRAY vars must be serialized prior to calling setVar in XOOPS 2.0 |
||
148 | $faq->setVar('categories', serialize($_POST['categories'])); |
||
149 | |||
150 | if ($adapter->storeFaq($faq)) { |
||
151 | // Todo: Run events here |
||
152 | $eventService->trigger('new_faq', [&$ticket, &$faq]); |
||
153 | |||
154 | $helper->redirect("ticket.php?id=$ticketid", 3, _XHELP_MESSAGE_ADD_FAQ); |
||
155 | } else { |
||
156 | $helper->redirect("ticket.php?id=$ticketid", 3, _XHELP_MESSAGE_ERR_ADD_FAQ); |
||
157 | } |
||
158 | } |
||
159 |