This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace XoopsModules\Xnewsletter; |
||
4 | |||
5 | /** |
||
6 | * **************************************************************************** |
||
7 | * - A Project by Developers TEAM For Xoops - ( https://xoops.org ) |
||
8 | * **************************************************************************** |
||
9 | * XNEWSLETTER - MODULE FOR XOOPS |
||
10 | * Copyright (c) 2007 - 2012 |
||
11 | * Goffy ( wedega.com ) |
||
12 | * |
||
13 | * You may not change or alter any portion of this comment or credits |
||
14 | * of supporting developers from this source code or any supporting |
||
15 | * source code which is considered copyrighted (c) material of the |
||
16 | * original comment or credit authors. |
||
17 | * |
||
18 | * This program is distributed in the hope that it will be useful, |
||
19 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
20 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
21 | * GNU General Public License for more details. |
||
22 | * --------------------------------------------------------------------------- |
||
23 | * @copyright Goffy ( wedega.com ) |
||
24 | * @license GPL 2.0 |
||
25 | * @package xnewsletter |
||
26 | * @author Goffy ( [email protected] ) |
||
27 | * |
||
28 | * **************************************************************************** |
||
29 | */ |
||
30 | |||
31 | //use XoopsModules\Xnewsletter; |
||
32 | |||
33 | require_once dirname(__DIR__) . '/include/common.php'; |
||
34 | |||
35 | /** |
||
36 | * Class Subscr |
||
37 | */ |
||
38 | class Subscr extends \XoopsObject |
||
39 | { |
||
40 | public $helper = null; |
||
41 | public $db; |
||
42 | |||
43 | //Constructor |
||
44 | |||
45 | public function __construct() |
||
46 | { |
||
47 | $this->helper = Helper::getInstance(); |
||
48 | $this->db = \XoopsDatabaseFactory::getDatabaseConnection(); |
||
49 | $this->initVar('subscr_id', XOBJ_DTYPE_INT, null, false); |
||
50 | $this->initVar('subscr_email', XOBJ_DTYPE_TXTBOX, '', false, 100); |
||
51 | $this->initVar('subscr_firstname', XOBJ_DTYPE_TXTBOX, '', false, 100); |
||
52 | $this->initVar('subscr_lastname', XOBJ_DTYPE_TXTBOX, '', false, 100); |
||
53 | $this->initVar('subscr_uid', XOBJ_DTYPE_INT, null, false); |
||
54 | $this->initVar('subscr_sex', XOBJ_DTYPE_TXTBOX, '', false, 100); |
||
55 | $this->initVar('subscr_submitter', XOBJ_DTYPE_INT, null, false); |
||
56 | $this->initVar('subscr_created', XOBJ_DTYPE_INT, time(), false); |
||
57 | $this->initVar('subscr_actkey', XOBJ_DTYPE_TXTBOX, '', false, 255); |
||
58 | $this->initVar('subscr_ip', XOBJ_DTYPE_TXTBOX, xoops_getenv('REMOTE_ADDR'), false, 32); |
||
59 | $this->initVar('subscr_activated', XOBJ_DTYPE_INT, 0, false); // IN PROGRESS: should be false or timestamp |
||
60 | $this->initVar('subscr_actoptions', XOBJ_DTYPE_ARRAY, [], false); |
||
61 | $this->initVar('start', XOBJ_DTYPE_INT, 0, false); |
||
62 | } |
||
63 | |||
64 | /** |
||
65 | * @param bool $action |
||
66 | * |
||
67 | * @return \XoopsThemeForm |
||
68 | */ |
||
69 | public function getSearchForm($action = false) |
||
70 | { |
||
71 | global $xoopsDB; |
||
72 | |||
73 | if (false === $action) { |
||
74 | $action = $_SERVER['REQUEST_URI']; |
||
75 | } |
||
76 | |||
77 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
78 | $form = new \XoopsThemeForm(_MA_XNEWSLETTER_SUBSCRIPTION_SEARCH, 'formsearch', $action, 'post', true); |
||
79 | $form->setExtra('enctype="multipart/form-data"'); |
||
80 | |||
81 | // subscr_email |
||
82 | $email_field = new \XoopsFormText(_MA_XNEWSLETTER_SUBSCRIPTION_SEARCH_EMAIL, 'subscr_email', 50, 100, $this->getVar('subscr_email')); |
||
83 | if ('' != $this->getVar('subscr_email')) { |
||
84 | //$email_field->setExtra('disabled="disabled"'); |
||
85 | } |
||
86 | $form->addElement($email_field, true); |
||
87 | |||
88 | // captcha |
||
89 | xoops_load('xoopscaptcha'); |
||
90 | $form->addElement(new \XoopsFormCaptcha('', 'xoopscaptcha', true)); |
||
91 | |||
92 | // op |
||
93 | $form->addElement(new \XoopsFormHidden('op', 'list_subscriptions')); |
||
94 | // buttons |
||
95 | $form->addElement(new \XoopsFormButtonTray('', _SUBMIT, 'submit', '', false)); |
||
96 | |||
97 | |||
98 | return $form; |
||
99 | } |
||
100 | |||
101 | /** |
||
102 | * @param bool $action |
||
103 | * |
||
104 | * @return \XoopsThemeForm |
||
105 | */ |
||
106 | public function getForm($action = false) |
||
107 | { |
||
108 | global $xoopsDB, $xoopsUser; |
||
109 | |||
110 | if (false === $action) { |
||
111 | $action = $_SERVER['REQUEST_URI']; |
||
112 | } |
||
113 | |||
114 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
115 | $title = $this->isNew() ? sprintf(_MA_XNEWSLETTER_SUBSCRIPTION_ADD) : sprintf(_MA_XNEWSLETTER_SUBSCRIPTION_EDIT); |
||
116 | $form = new \XoopsThemeForm($title, 'form', $action, 'post', true); |
||
117 | $form->setExtra('enctype="multipart/form-data"'); |
||
118 | |||
119 | $form->addElement(new \XoopsFormLabel("<span style='text-decoration:underline'>" . _MA_XNEWSLETTER_SUBSCRIPTION_INFO_PERS . '</span>', '')); |
||
120 | $subscr_id = $this->isNew() ? 0 : $this->getVar('subscr_id'); |
||
121 | |||
122 | // subscr_email |
||
123 | if ($subscr_id > 0 || '' != $this->getVar('subscr_email')) { |
||
124 | $form->addElement(new \XoopsFormLabel(_AM_XNEWSLETTER_SUBSCR_EMAIL, $this->getVar('subscr_email'))); |
||
125 | $form->addElement(new \XoopsFormHidden('subscr_email', $this->getVar('subscr_email'))); |
||
126 | } else { |
||
127 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_EMAIL, 'subscr_email', 50, 255, $this->getVar('subscr_email')), true); |
||
128 | } |
||
129 | |||
130 | // subscr_sex |
||
131 | if (1 == $this->helper->getConfig('xn_use_salutation')) { |
||
132 | $select_subscr_sex = new \XoopsFormSelect(_AM_XNEWSLETTER_SUBSCR_SEX, 'subscr_sex', $this->getVar('subscr_sex')); |
||
133 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_EMPTY, _AM_XNEWSLETTER_SUBSCR_SEX_EMPTY); |
||
134 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_FEMALE, _AM_XNEWSLETTER_SUBSCR_SEX_FEMALE); |
||
135 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_MALE, _AM_XNEWSLETTER_SUBSCR_SEX_MALE); |
||
136 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_COMP, _AM_XNEWSLETTER_SUBSCR_SEX_COMP); |
||
137 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_FAMILY, _AM_XNEWSLETTER_SUBSCR_SEX_FAMILY); |
||
138 | $form->addElement($select_subscr_sex); |
||
139 | } |
||
140 | |||
141 | // subscr_firstname |
||
142 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_FIRSTNAME, 'subscr_firstname', 50, 255, $this->getVar('subscr_firstname')), false); |
||
143 | |||
144 | // subscr_lastname |
||
145 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_LASTNAME, 'subscr_lastname', 50, 255, $this->getVar('subscr_lastname')), false); |
||
146 | |||
147 | $form->addElement(new \XoopsFormLabel('<br><br>', '')); |
||
148 | |||
149 | // get newsletters available for current user |
||
150 | $opt_cat = []; |
||
0 ignored issues
–
show
|
|||
151 | $opt_tray = new \XoopsFormElementTray("<span style='text-decoration:underline'>" . _MA_XNEWSLETTER_SUBSCRIPTION_CATS_AVAIL . '</span>', '<br>'); |
||
152 | $opt_tray->setDescription(_MA_XNEWSLETTER_SUBSCRIPTION_CATS_AVAIL_DESC); |
||
153 | /** @var \XoopsGroupPermHandler $grouppermHandler */ |
||
154 | $grouppermHandler = xoops_getHandler('groupperm'); |
||
155 | $uid = (is_object($xoopsUser) && isset($xoopsUser)) ? $xoopsUser->uid() : 0; |
||
0 ignored issues
–
show
$uid is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
156 | $groups = is_object($xoopsUser) ? $xoopsUser->getGroups() : [0 => XOOPS_GROUP_ANONYMOUS]; |
||
157 | |||
158 | // cats[], existing_catsubcr_id_{$cat_id}, existing_catsubscr_quited_{$cat_id} |
||
159 | $catCriteria = new \CriteriaCompo(); |
||
160 | $catCriteria->setSort('cat_id'); |
||
161 | $catCriteria->setOrder('ASC'); |
||
162 | $catObjs = $this->helper->getHandler('Cat')->getAll($catCriteria); |
||
163 | // $cat_checkbox = new \XoopsFormCheckBox(_MA_XNEWSLETTER_SUBSCRIPTION_SELECT_CATS, 'cats', null, '<br>'); |
||
164 | // $cat_checkbox->setDescription(_MA_XNEWSLETTER_SUBSCRIPTION_CATS_AVAIL_DESC); |
||
165 | // |
||
166 | // |
||
167 | // $cat_tray = new \XoopsFormElementTray(_MA_XNEWSLETTER_SUBSCRIPTION_SELECT_CATS, '<br>'); |
||
168 | $values = []; |
||
169 | foreach ($catObjs as $cat_id => $catObj) { |
||
170 | // if anonymous user or Xoops user can read cat... |
||
171 | if ($grouppermHandler->checkRight('newsletter_read_cat', $cat_id, XOOPS_GROUP_ANONYMOUS, $this->helper->getModule()->mid()) |
||
172 | || $grouppermHandler->checkRight('newsletter_read_cat', $cat_id, $groups, $this->helper->getModule()->mid())) { |
||
173 | // get existing catsubscr |
||
174 | $catsubscrCriteria = new \CriteriaCompo(); |
||
175 | $catsubscrCriteria->add(new \Criteria('catsubscr_catid', $cat_id)); |
||
176 | $catsubscrCriteria->add(new \Criteria('catsubscr_subscrid', $subscr_id)); |
||
177 | $catsubscrCriteria->setLimit(1); |
||
178 | $catsubscrObjs = $this->helper->getHandler('Catsubscr')->getObjects($catsubscrCriteria); |
||
179 | if (isset($catsubscrObjs[0])) { |
||
180 | $values[] = $cat_id; |
||
181 | $catsubscr_quited = $catsubscrObjs[0]->getVar('catsubscr_quited'); |
||
182 | $catsubscr_id = $catsubscrObjs[0]->getVar('catsubscr_id'); |
||
183 | } else { |
||
184 | $catsubscr_quited = 0; |
||
185 | $catsubscr_id = 0; |
||
186 | } |
||
187 | |||
188 | $cat_checkbox[$cat_id] = new \XoopsFormCheckBox('', 'cats[]', null, ''); |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$cat_checkbox was never initialized. Although not strictly required by PHP, it is generally a good practice to add $cat_checkbox = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
189 | $name = $catObj->getVar('cat_name'); |
||
190 | if ('' !== $catObj->getVar('cat_info')) { |
||
191 | $name .= '<br><span class="xnewsletter-cat_info">' . $catObj->getVar('cat_info', 's') . '</span>'; |
||
192 | } |
||
193 | |||
194 | if (0 == $catsubscr_quited) { |
||
195 | // NOP |
||
196 | } else { |
||
197 | $name .= '<span>'; |
||
198 | $name .= str_replace('%q', formatTimestamp($catsubscr_quited, $this->helper->getConfig('dateformat')), _MA_XNEWSLETTER_SUBSCRIPTION_QUITED_DETAIL); |
||
199 | $name .= '</span>'; |
||
200 | } |
||
201 | // $name .= "<div style='clear:both'></div>"; |
||
202 | $cat_checkbox[$cat_id]->addOption($cat_id, $name); |
||
203 | $form->addElement(new \XoopsFormHidden("existing_catsubcr_id_{$cat_id}", $catsubscr_id)); |
||
204 | $form->addElement(new \XoopsFormHidden("existing_catsubscr_quited_{$cat_id}", $catsubscr_quited)); |
||
205 | $cat_checkbox[$cat_id]->setValue($values); |
||
206 | $opt_tray->addElement($cat_checkbox[$cat_id]); |
||
207 | } |
||
208 | } |
||
209 | $form->addElement($opt_tray); |
||
210 | |||
211 | $form->addElement(new \XoopsFormHidden('subscr_actkey', $this->getVar('subscr_actkey'))); |
||
212 | // op |
||
213 | $form->addElement(new \XoopsFormHidden('op', 'save_subscription')); |
||
214 | // button |
||
215 | $form->addElement(new \XoopsFormButtonTray('', _SUBMIT, 'submit', '', false)); |
||
216 | |||
217 | return $form; |
||
218 | } |
||
219 | |||
220 | //********************************************************************************************** |
||
221 | // form for admin aerea ******************************************************************* |
||
222 | //********************************************************************************************** |
||
223 | |||
224 | /** |
||
225 | * @param bool $action |
||
226 | * |
||
227 | * @return \XoopsThemeForm |
||
228 | */ |
||
229 | public function getFormAdmin($action = false) |
||
230 | { |
||
231 | global $xoopsDB; |
||
232 | |||
233 | if (false === $action) { |
||
234 | $action = $_SERVER['REQUEST_URI']; |
||
235 | } |
||
236 | |||
237 | $title = $this->isNew() ? sprintf(_AM_XNEWSLETTER_SUBSCR_ADD) : sprintf(_AM_XNEWSLETTER_SUBSCR_EDIT); |
||
238 | |||
239 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
240 | $form = new \XoopsThemeForm($title, 'form', $action, 'post', true); |
||
241 | $form->setExtra('enctype="multipart/form-data"'); |
||
242 | |||
243 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_EMAIL, 'subscr_email', 50, 255, $this->getVar('subscr_email')), true); |
||
244 | $select_subscr_sex = new \XoopsFormSelect(_AM_XNEWSLETTER_SUBSCR_SEX, 'subscr_sex', $this->getVar('subscr_sex')); |
||
245 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_EMPTY, _AM_XNEWSLETTER_SUBSCR_SEX_EMPTY); |
||
246 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_FEMALE, _AM_XNEWSLETTER_SUBSCR_SEX_FEMALE); |
||
247 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_MALE, _AM_XNEWSLETTER_SUBSCR_SEX_MALE); |
||
248 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_COMP, _AM_XNEWSLETTER_SUBSCR_SEX_COMP); |
||
249 | $select_subscr_sex->addOption(_AM_XNEWSLETTER_SUBSCR_SEX_FAMILY, _AM_XNEWSLETTER_SUBSCR_SEX_FAMILY); |
||
250 | $form->addElement($select_subscr_sex); |
||
251 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_FIRSTNAME, 'subscr_firstname', 50, 255, $this->getVar('subscr_firstname')), false); |
||
252 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_LASTNAME, 'subscr_lastname', 50, 255, $this->getVar('subscr_lastname')), false); |
||
253 | |||
254 | $form->addElement(new \XoopsFormSelectUser(_AM_XNEWSLETTER_SUBSCR_UID, 'subscr_uid', true, $this->getVar('subscr_uid'), 1, false), false); |
||
255 | |||
256 | $form->addElement(new \XoopsFormHidden('subscr_submitter', $GLOBALS['xoopsUser']->uid())); |
||
257 | $form->addElement(new \XoopsFormLabel(_AM_XNEWSLETTER_SUBMITTER, $GLOBALS['xoopsUser']->uname())); |
||
258 | //$form->addElement(new \XoopsFormSelectUser(_AM_XNEWSLETTER_SUBMITTER, 'subscr_submitter', false, $this->getVar('subscr_submitter'), 1, false), true); |
||
259 | |||
260 | $form->addElement(new \XoopsFormRadioYN(_AM_XNEWSLETTER_SUBSCR_ACTIVATED, 'subscr_activated', $this->getVar('subscr_activated'))); |
||
261 | $subscrActkey = $this->isNew() ? xoops_makepass() : $this->getVar('subscr_actkey'); |
||
262 | if ($this->getVar('subscr_id') > 0) { |
||
263 | $form->addElement(new \XoopsFormLabel(_AM_XNEWSLETTER_CREATED, formatTimestamp($this->getVar('subscr_created'), $this->helper->getConfig('dateformat')) . ' [' . $this->getVar('subscr_ip') . ']')); |
||
264 | $form->addElement(new \XoopsFormHidden('subscr_created', $this->getVar('subscr_created'))); |
||
265 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_IP, 'subscr_ip', 50, 255, $this->getVar('subscr_ip'))); |
||
266 | $form->addElement(new \XoopsFormText(_AM_XNEWSLETTER_SUBSCR_ACTKEY, 'subscr_actkey', 50, 255, $subscrActkey)); |
||
267 | $form->addElement(new \XoopsFormTextArea(_AM_XNEWSLETTER_SUBSCR_ACTOPTIONS, 'subscr_actoptions', serialize($this->getVar('subscr_actoptions', 'e')), 5, 50)); |
||
268 | } else { |
||
269 | $time = time(); |
||
270 | $ip = xoops_getenv('REMOTE_ADDR'); |
||
271 | $form->addElement(new \XoopsFormLabel(_AM_XNEWSLETTER_CREATED, formatTimestamp($time, 's') . " [{$ip}]")); |
||
272 | $form->addElement(new \XoopsFormHidden('subscr_created', $time)); |
||
273 | $form->addElement(new \XoopsFormHidden('subscr_ip', $ip)); |
||
274 | $form->addElement(new \XoopsFormHidden('subscr_actkey', $subscrActkey)); |
||
275 | $form->addElement(new \XoopsFormHidden('subscr_actoptions', $this->getVar('subscr_actoptions'))); |
||
276 | } |
||
277 | |||
278 | $form->addElement(new \XoopsFormHidden('start', $this->getVar('start'))); |
||
279 | $form->addElement(new \XoopsFormHidden('op', 'save_subscr')); |
||
280 | $form->addElement(new \XoopsFormButtonTray('', _SUBMIT, 'submit', '', false)); |
||
281 | |||
282 | return $form; |
||
283 | } |
||
284 | |||
285 | /** |
||
286 | * Get Values |
||
287 | * @param null $keys |
||
288 | * @param string|null $format |
||
289 | * @param int|null $maxDepth |
||
290 | * @return array |
||
291 | */ |
||
292 | public function getValuesSubscr($keys = null, $format = null, $maxDepth = null) |
||
293 | { |
||
294 | $ret = $this->getValues($keys, $format, $maxDepth); |
||
295 | $ret['id'] = $this->getVar('subscr_id'); |
||
296 | $ret['email'] = $this->getVar('subscr_email'); |
||
297 | $ret['firstname'] = $this->getVar('subscr_firstname'); |
||
298 | $ret['lastname'] = $this->getVar('subscr_lastname'); |
||
299 | $ret['uid'] = $this->getVar('subscr_uid'); |
||
300 | $ret['sex'] = $this->getVar('subscr_sex'); |
||
301 | $ret['actkey'] = $this->getVar('subscr_actkey'); |
||
302 | $ret['ip'] = $this->getVar('subscr_ip'); |
||
303 | $ret['activated'] = $this->getVar('subscr_activated'); |
||
304 | $ret['actoptions'] = $this->getVar('subscr_actoptions'); |
||
305 | $ret['created'] = formatTimestamp($this->getVar('subscr_created'), 's'); |
||
306 | $ret['submitter'] = \XoopsUser::getUnameFromId($this->getVar('subscr_submitter')); |
||
307 | return $ret; |
||
308 | } |
||
309 | } |
||
310 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.