This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace XoopsModules\Xnewsletter; |
||
4 | |||
5 | /** |
||
6 | * **************************************************************************** |
||
7 | * - A Project by Developers TEAM For Xoops - ( https://xoops.org ) |
||
8 | * **************************************************************************** |
||
9 | * XNEWSLETTER - MODULE FOR XOOPS |
||
10 | * Copyright (c) 2007 - 2012 |
||
11 | * Goffy ( wedega.com ) |
||
12 | * |
||
13 | * You may not change or alter any portion of this comment or credits |
||
14 | * of supporting developers from this source code or any supporting |
||
15 | * source code which is considered copyrighted (c) material of the |
||
16 | * original comment or credit authors. |
||
17 | * |
||
18 | * This program is distributed in the hope that it will be useful, |
||
19 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
20 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
21 | * GNU General Public License for more details. |
||
22 | * --------------------------------------------------------------------------- |
||
23 | * @copyright Goffy ( wedega.com ) |
||
24 | * @license GPL 2.0 |
||
25 | * @package xnewsletter |
||
26 | * @author Goffy ( [email protected] ) |
||
27 | * |
||
28 | * **************************************************************************** |
||
29 | */ |
||
30 | |||
31 | //use XoopsModules\Xnewsletter; |
||
32 | |||
33 | require_once dirname(__DIR__) . '/include/common.php'; |
||
34 | |||
35 | /** |
||
36 | * Class Import |
||
37 | */ |
||
38 | class Import extends \XoopsObject |
||
39 | { |
||
40 | public $helper = null; |
||
41 | public $db; |
||
42 | |||
43 | //Constructor |
||
44 | |||
45 | public function __construct() |
||
46 | { |
||
47 | $this->helper = Helper::getInstance(); |
||
48 | $this->db = \XoopsDatabaseFactory::getDatabaseConnection(); |
||
49 | $this->initVar('import_id', XOBJ_DTYPE_INT, null, false); |
||
50 | $this->initVar('import_email', XOBJ_DTYPE_TXTBOX, null, false, 100); |
||
51 | $this->initVar('import_firstname', XOBJ_DTYPE_TXTBOX, null, false, 100); |
||
52 | $this->initVar('import_lastname', XOBJ_DTYPE_TXTBOX, null, false, 100); |
||
53 | $this->initVar('import_sex', XOBJ_DTYPE_TXTBOX, null, false, 100); |
||
54 | $this->initVar('import_cat_id', XOBJ_DTYPE_INT, null, false); |
||
55 | $this->initVar('import_subscr_id', XOBJ_DTYPE_INT, null, false); |
||
56 | $this->initVar('import_catsubscr_id', XOBJ_DTYPE_INT, null, false); |
||
57 | $this->initVar('import_status', XOBJ_DTYPE_INT, false, false); // boolean |
||
58 | } |
||
59 | |||
60 | /** |
||
61 | * @param $plugin |
||
62 | * @param int $action_after_read |
||
63 | * @param int $limitcheck |
||
64 | * @param bool $action |
||
65 | * |
||
66 | * @return \XoopsThemeForm |
||
67 | */ |
||
68 | public function getSearchForm($plugin, $action_after_read = 1, $limitcheck = 0, $action = false) |
||
69 | { |
||
70 | global $xoopsDB; |
||
71 | |||
72 | if (false === $action) { |
||
73 | $action = $_SERVER['REQUEST_URI']; |
||
74 | } |
||
75 | |||
76 | $title = _AM_XNEWSLETTER_IMPORT_SEARCH; |
||
77 | |||
78 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
79 | $form = new \XoopsThemeForm($title, 'form_select_import', $action, 'post', true); |
||
80 | $form->setExtra('enctype="multipart/form-data"'); |
||
81 | |||
82 | $catCriteria = new \CriteriaCompo(); |
||
83 | $catCriteria->setSort('cat_id ASC, cat_name'); |
||
84 | $catCriteria->setOrder('ASC'); |
||
85 | $cat_select = new \XoopsFormSelect(_AM_XNEWSLETTER_IMPORT_PRESELECT_CAT, 'cat_id', '1'); |
||
86 | $cat_select->addOptionArray($this->helper->getHandler('Cat')->getList($catCriteria)); |
||
87 | $form->addElement($cat_select, false); |
||
88 | |||
89 | $opt_import_type = new \XoopsFormRadio(_AM_XNEWSLETTER_IMPORT_PLUGINS_AVAIL, 'plugin', $plugin, '<br>'); |
||
90 | $opt_import_type->setExtra('onclick="document.forms.form_select_import.submit()"'); |
||
91 | $aFiles = \XoopsLists::getFileListAsArray(XNEWSLETTER_ROOT_PATH . '/plugins/'); |
||
92 | $arrPlugin = []; |
||
0 ignored issues
–
show
|
|||
93 | $currpluginhasform = 0; |
||
94 | foreach ($aFiles as $file) { |
||
95 | if ('.php' === mb_substr($file, mb_strlen($file) - 4, 4)) { |
||
96 | $pluginName = str_replace('.php', '', $file); |
||
97 | $pluginFile = XNEWSLETTER_ROOT_PATH . '/plugins/' . $pluginName . '.php'; |
||
98 | if (file_exists($pluginFile)) { |
||
99 | require_once $pluginFile; |
||
100 | $function = 'xnewsletter_plugin_getinfo_' . $pluginName; |
||
101 | $arrPlugin = $function(); |
||
102 | $show_plugin = $this->tableExists($arrPlugin['tables'][0]); |
||
103 | if (true === $show_plugin && @is_array($arrPlugin['tables'][1])) { |
||
104 | $show_plugin = $this->tableExists($arrPlugin['tables'][1]); |
||
105 | } |
||
106 | |||
107 | if (true === $show_plugin) { |
||
108 | $label = "<img src='" . $arrPlugin['icon'] . "' title='" . $arrPlugin['descr'] . "' alt='" . $arrPlugin['descr'] . "' style='height:32px;margin-bottom:5px;margin-right:5px'>" . $arrPlugin['descr']; |
||
109 | $opt_import_type->addOption($arrPlugin['name'], $label); |
||
110 | $form->addElement(new \XoopsFormHidden('hasform_' . $pluginName, $arrPlugin['hasform'])); |
||
111 | if ($plugin == $pluginName && 1 == $arrPlugin['hasform']) { |
||
112 | $currpluginhasform = 1; |
||
113 | } |
||
114 | } |
||
115 | } |
||
116 | } |
||
117 | } |
||
118 | $form->addElement($opt_import_type, false); |
||
119 | |||
120 | //option, whether data should be shown for check or directly imported |
||
121 | $check_after = new \XoopsFormRadio(_AM_XNEWSLETTER_IMPORT_AFTER_READ, 'action_after_read', $action_after_read, '<br>'); |
||
122 | $check_after->addOption(0, _AM_XNEWSLETTER_IMPORT_READ_IMPORT); |
||
123 | $check_after->addOption(1, _AM_XNEWSLETTER_IMPORT_READ_CHECK); |
||
124 | $check_after->setExtra('onclick="document.forms.form_select_import.submit()"'); |
||
125 | $form->addElement($check_after, false); |
||
126 | |||
127 | //limit for import |
||
128 | $form->addElement(new \XoopsFormLabel(_AM_XNEWSLETTER_IMPORT_CHECK_LIMIT, '100000'), false); |
||
129 | if (0 == $action_after_read) { |
||
130 | if ($limitcheck < 500 && $limitcheck > 0) { |
||
131 | $limitcheck = 500; |
||
132 | } |
||
133 | } else { |
||
134 | if ($limitcheck > 200) { |
||
135 | $limitcheck = 200; |
||
136 | } |
||
137 | } |
||
138 | $sel_limitcheck = new \XoopsFormSelect(_AM_XNEWSLETTER_IMPORT_CHECK_LIMIT_PACKAGE, 'limitcheck', $limitcheck); |
||
139 | if (0 == $action_after_read) { |
||
140 | $sel_limitcheck->addOption(0, _AM_XNEWSLETTER_IMPORT_NOLIMIT); |
||
141 | $sel_limitcheck->addOption(500, 500); |
||
142 | $sel_limitcheck->addOption(1000, 1000); |
||
143 | $sel_limitcheck->addOption(10000, 10000); |
||
144 | $sel_limitcheck->addOption(25000, 25000); |
||
145 | } else { |
||
146 | $limitOptions = [25, 50, 100, 200, 400]; |
||
147 | foreach ($limitOptions as $limitOption) { |
||
148 | // check if limit options are compatible with php.ini 'max_input_vars' setting |
||
149 | if ((0 == ini_get('max_input_vars')) || ((($limitOption * 7) + 4) < ini_get('max_input_vars'))) { |
||
150 | $sel_limitcheck->addOption($limitOption, $limitOption); |
||
151 | } |
||
152 | } |
||
153 | } |
||
154 | $form->addElement($sel_limitcheck, false); |
||
155 | |||
156 | $skip = 1 == $action_after_read ? 0 : 1; |
||
157 | $skipcatsubscrexist = new \XoopsFormRadioYN(_AM_XNEWSLETTER_IMPORT_SKIP_EXISTING, 'skipcatsubscrexist', $skip); |
||
158 | if (0 == $action_after_read) { |
||
159 | $skipcatsubscrexist->setExtra('disabled="disabled"'); |
||
160 | } |
||
161 | $form->addElement($skipcatsubscrexist, false); |
||
162 | |||
163 | $form->addElement(new \XoopsFormHidden('op', 'default')); |
||
164 | $buttonTray = new \XoopsFormElementTray('', ''); |
||
165 | if (1 == $currpluginhasform) { |
||
166 | //show form for additional options |
||
167 | $button1 = new \XoopsFormButton('', 'form_additional', _AM_XNEWSLETTER_IMPORT_CONTINUE, 'submit1'); |
||
168 | $button1->setExtra('onclick="document.getElementById(\'op\').value = \'form_additional\';document.forms.form_select_import.submit()"'); |
||
169 | $buttonTray->addElement($button1); |
||
170 | } else { |
||
171 | $button2 = new \XoopsFormButton('', 'searchdata', _AM_XNEWSLETTER_IMPORT_CONTINUE, 'submit2'); |
||
172 | $button2->setExtra('onclick="document.getElementById(\'op\').value = \'searchdata\';document.forms.form_select_import.submit()"'); |
||
173 | $buttonTray->addElement($button2); |
||
174 | } |
||
175 | $form->addElement($buttonTray); |
||
176 | |||
177 | return $form; |
||
178 | } |
||
179 | |||
180 | /** |
||
181 | * @param $tablename |
||
182 | * |
||
183 | * @return bool |
||
184 | */ |
||
185 | private function tableExists($tablename) |
||
186 | { |
||
187 | if ('' == $tablename) { |
||
188 | return true; |
||
189 | } |
||
190 | global $xoopsDB; |
||
191 | $result = $xoopsDB->queryF("SHOW TABLES LIKE '$tablename'"); |
||
192 | |||
193 | return ($xoopsDB->getRowsNum($result) > 0); |
||
194 | } |
||
195 | } |
||
196 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.