This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||
2 | |||||
3 | /* |
||||
4 | * You may not change or alter any portion of this comment or credits |
||||
5 | * of supporting developers from this source code or any supporting source code |
||||
6 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||
7 | * |
||||
8 | * This program is distributed in the hope that it will be useful, |
||||
9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
11 | */ |
||||
12 | |||||
13 | /** |
||||
14 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||
15 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||||
16 | * @author Brian Wahoff <[email protected]> |
||||
17 | * @author Eric Juden <[email protected]> |
||||
18 | * @author XOOPS Development Team |
||||
19 | */ |
||||
20 | |||||
21 | use Xmf\Request; |
||||
22 | use XoopsModules\Xhelp; |
||||
23 | |||||
24 | require_once __DIR__ . '/header.php'; |
||||
25 | |||||
26 | $helper = Xhelp\Helper::getInstance(); |
||||
27 | |||||
28 | $op = 'default'; |
||||
29 | //require_once XHELP_INCLUDE_PATH . '/events.php'; |
||||
30 | // require_once XHELP_CLASS_PATH . '/faqAdapterFactory.php'; |
||||
31 | // require_once XHELP_CLASS_PATH . '/faqCategory.php'; |
||||
32 | // require_once XHELP_CLASS_PATH . '/Tree.php'; |
||||
33 | |||||
34 | if (Request::hasVar('op', 'REQUEST')) { |
||||
35 | $op = Request::getString('op', 'default'); |
||||
36 | } |
||||
37 | |||||
38 | if (!$xoopsUser) { |
||||
39 | $helper->redirect('', 3, _NOPERM); |
||||
40 | } elseif (!$xhelp_isStaff) { |
||||
41 | $helper->redirect('', 3, _NOPERM); |
||||
42 | } |
||||
43 | |||||
44 | switch ($op) { |
||||
45 | case 'add': |
||||
46 | if (isset($_POST['addFaq'])) { |
||||
47 | addFaq_action(); |
||||
48 | } else { |
||||
49 | addFaq_display(); |
||||
50 | } |
||||
51 | break; |
||||
52 | default: |
||||
53 | addFaq_display(); |
||||
54 | break; |
||||
55 | } |
||||
56 | |||||
57 | /** |
||||
58 | * |
||||
59 | */ |
||||
60 | function addFaq_display() |
||||
61 | { |
||||
62 | global $xoopsOption, $xoopsTpl, $xoopsConfig, $xoopsUser, $xoopsLogger, $xoopsUserIsAdmin, $session, $staff; |
||||
63 | $helper = Xhelp\Helper::getInstance(); |
||||
64 | |||||
65 | if (!isset($_POST['ticketid']) && 0 === Request::getInt('ticketid', 0, 'POST')) { |
||||
66 | $helper->redirect('', 3, _XHELP_MSG_NO_ID); |
||||
67 | } |
||||
68 | $ticketid = Request::getInt('ticketid', 0, 'POST'); |
||||
69 | /** @var \XoopsModules\Xhelp\TicketHandler $ticketHandler */ |
||||
70 | $ticketHandler = $helper->getHandler('Ticket'); |
||||
71 | /** @var \XoopsModules\Xhelp\ResponseHandler $responseHandler */ |
||||
72 | $responseHandler = $helper->getHandler('Response'); |
||||
73 | $ticket = $ticketHandler->get($ticketid); |
||||
74 | |||||
75 | if (!$hasRights = $staff->checkRoleRights(XHELP_SEC_FAQ_ADD, $ticket->getVar('department'))) { |
||||
0 ignored issues
–
show
Unused Code
introduced
by
![]() |
|||||
76 | $helper->redirect("ticket.php?id=$ticketid", 3, _AM_XHELP_MESSAGE_NO_ADD_FAQ); |
||||
77 | } |
||||
78 | |||||
79 | $GLOBALS['xoopsOption']['template_main'] = 'xhelp_addFaq.tpl'; |
||||
80 | require_once XOOPS_ROOT_PATH . '/header.php'; |
||||
81 | |||||
82 | $criteria = new \Criteria('ticketid', $ticketid); |
||||
83 | $responses = $responseHandler->getObjects($criteria, true); |
||||
84 | $responseText = ''; |
||||
85 | |||||
86 | $allUsers = []; |
||||
87 | foreach ($responses as $response) { |
||||
88 | $allUsers[$response->getVar('uid')] = ''; |
||||
89 | } |
||||
90 | |||||
91 | $criteria = new \Criteria('uid', '(' . implode(',', array_keys($allUsers)) . ')', 'IN'); |
||||
92 | $users = Xhelp\Utility::getUsers($criteria, $helper->getConfig('xhelp_displayName')); |
||||
0 ignored issues
–
show
It seems like
$helper->getConfig('xhelp_displayName') can also be of type null ; however, parameter $displayName of XoopsModules\Xhelp\Utility::getUsers() does only seem to accept integer , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
93 | unset($allUsers); |
||||
94 | |||||
95 | foreach ($responses as $response) { |
||||
96 | $responseText .= sprintf(_XHELP_TEXT_USER_SAID, $users[$response->getVar('uid')]) . "\n"; |
||||
97 | $responseText .= $response->getVar('message', 'e') . "\n"; |
||||
98 | } |
||||
99 | |||||
100 | // Get current faq adapter |
||||
101 | /** @var \XoopsModules\Xhelp\FaqAdapterAbstract $oAdapter */ |
||||
102 | $oAdapter = Xhelp\FaqAdapterFactory::getFaqAdapter(); |
||||
103 | if (!$oAdapter) { |
||||
0 ignored issues
–
show
|
|||||
104 | $helper->redirect('', 3, _XHELP_MESSAGE_NO_FAQ); |
||||
105 | } |
||||
106 | $categories = &$oAdapter->getCategories(); |
||||
0 ignored issues
–
show
Are you sure the usage of
$oAdapter->getCategories() targeting XoopsModules\Xhelp\FaqAd...stract::getCategories() seems to always return null.
This check looks for function or method calls that always return null and whose return value is used. class A
{
function getObject()
{
return null;
}
}
$a = new A();
if ($a->getObject()) {
The method The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes. ![]() |
|||||
107 | |||||
108 | $tree = new Xhelp\Tree($categories, 'id', 'parent'); |
||||
109 | |||||
110 | // $xoopsTpl->assign('xhelp_categories', $tree->makeSelBox('categories', 'name', '--', 0, false, 0, $oAdapter->categoryType)); |
||||
111 | |||||
112 | $categorySelect = $tree->makeSelectElement('categories', 'name', '--', 0, false, 0, $oAdapter->categoryType, ''); |
||||
113 | $xoopsTpl->assign('xhelp_categories', $categorySelect->render()); |
||||
114 | |||||
115 | $xoopsTpl->assign('xhelp_imagePath', XHELP_IMAGE_URL . '/'); |
||||
116 | $xoopsTpl->assign('xhelp_baseURL', XHELP_BASE_URL); |
||||
117 | $xoopsTpl->assign('xhelp_faqProblem', $ticket->getVar('description', 'e')); |
||||
118 | $xoopsTpl->assign('xhelp_faqSolution', $responseText); |
||||
119 | $xoopsTpl->assign('xhelp_hasMultiCats', $oAdapter->categoryType); |
||||
120 | $xoopsTpl->assign('xhelp_ticketID', $ticketid); |
||||
121 | $xoopsTpl->assign('xhelp_faqSubject', $ticket->getVar('subject', 'e')); |
||||
122 | |||||
123 | require_once XOOPS_ROOT_PATH . '/footer.php'; |
||||
124 | } |
||||
125 | |||||
126 | /** |
||||
127 | * |
||||
128 | */ |
||||
129 | function addFaq_action() |
||||
130 | { |
||||
131 | global $xoopsUser, $eventService; |
||||
132 | $helper = Xhelp\Helper::getInstance(); |
||||
133 | /** @var \XoopsModules\Xhelp\TicketHandler $ticketHandler */ |
||||
134 | $ticketHandler = $helper->getHandler('Ticket'); |
||||
135 | |||||
136 | // Retrieve ticket information |
||||
137 | $ticketid = $_POST['ticketid']; |
||||
138 | $ticket = $ticketHandler->get($ticketid); |
||||
139 | |||||
140 | $adapter = Xhelp\FaqAdapterFactory::getFaqAdapter(); |
||||
141 | $faq = $adapter->createFaq(); |
||||
142 | |||||
143 | // @todo - Make subject user editable |
||||
144 | $faq->setVar('subject', $_POST['subject']); |
||||
145 | $faq->setVar('problem', $_POST['problem']); |
||||
146 | $faq->setVar('solution', $_POST['solution']); |
||||
147 | // BTW - XOBJ_DTYPE_ARRAY vars must be serialized prior to calling setVar in XOOPS 2.0 |
||||
148 | $faq->setVar('categories', serialize($_POST['categories'])); |
||||
149 | |||||
150 | if ($adapter->storeFaq($faq)) { |
||||
0 ignored issues
–
show
The call to
XoopsModules\Xhelp\FaqAdapterAbstract::storeFaq() has too many arguments starting with $faq .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue. If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above. ![]() |
|||||
151 | // Todo: Run events here |
||||
152 | $eventService->trigger('new_faq', [&$ticket, &$faq]); |
||||
153 | |||||
154 | $helper->redirect("ticket.php?id=$ticketid", 3, _XHELP_MESSAGE_ADD_FAQ); |
||||
155 | } else { |
||||
156 | $helper->redirect("ticket.php?id=$ticketid", 3, _XHELP_MESSAGE_ERR_ADD_FAQ); |
||||
157 | } |
||||
158 | } |
||||
159 |