Issues (381)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * ****************************************************************************
4
 *  - A Project by Developers TEAM For Xoops - ( https://xoops.org )
5
 * ****************************************************************************
6
 *  XNEWSLETTER - MODULE FOR XOOPS
7
 *  Copyright (c) 2007 - 2012
8
 *  Goffy ( wedega.com )
9
 *
10
 *  You may not change or alter any portion of this comment or credits
11
 *  of supporting developers from this source code or any supporting
12
 *  source code which is considered copyrighted (c) material of the
13
 *  original comment or credit authors.
14
 *
15
 *  This program is distributed in the hope that it will be useful,
16
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
17
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18
 *  GNU General Public License for more details.
19
 *  ---------------------------------------------------------------------------
20
 * @copyright  Goffy ( wedega.com )
21
 * @license    GPL 2.0
22
 * @package    xnewsletter
23
 * @author     Goffy ( [email protected] )
24
 *
25
 *  Version : 1 Wed 2012/11/28 22:18:22 :  Exp $
26
 * ****************************************************************************
27
 */
28
29
use Xmf\Request;
30
31
$currentFile = basename(__FILE__);
32
require_once __DIR__ . '/header.php';
33
34
require_once XOOPS_ROOT_PATH . '/header.php';
35
36
error_reporting(0);
37
$xoopsLogger->activated = false;
38
39
$GLOBALS['xoopsTpl']->assign('xoops_pagetitle', _AM_XNEWSLETTER_LETTER_ACTION_PREVIEW);
40
41
// get letter_id
42
$letter_id = \Xmf\Request::getString('letter_id', 'list');
43
// check letter_id
44
if ($letter_id < 1) {
45
    redirect_header('letter.php', 3, _AM_XNEWSLETTER_ERROR_NO_VALID_ID);
46
}
47
48
$content   = '';
49
$letterObj = $helper->getHandler('Letter')->get($letter_id);
50
if ($letterObj && $letterObj->getVar('letter_templateid') > 0) {
51
    // subscr data
52
    $xoopsTpl->assign('sex', _AM_XNEWSLETTER_SUBSCR_SEX_PREVIEW);
53
    $xoopsTpl->assign('salutation', _AM_XNEWSLETTER_SUBSCR_SEX_PREVIEW); // new from v1.3
54
    $xoopsTpl->assign('firstname', _AM_XNEWSLETTER_SUBSCR_FIRSTNAME_PREVIEW);
55
    $xoopsTpl->assign('lastname', _AM_XNEWSLETTER_SUBSCR_LASTNAME_PREVIEW);
56
    $xoopsTpl->assign('subscr_email', _AM_XNEWSLETTER_SUBSCR_EMAIL_PREVIEW);
57
    $xoopsTpl->assign('email', _AM_XNEWSLETTER_SUBSCR_EMAIL_PREVIEW); // new from v1.3
58
    // letter data
59
    $xoopsTpl->assign('title', $letterObj->getVar('letter_title', 'n')); // new from v1.3
60
    $xoopsTpl->assign('content', $letterObj->getVar('letter_content', 'n'));
61
    // extra
62
    $xoopsTpl->assign('date', time()); // new from v1.3
63
    $xoopsTpl->assign('unsubscribe_url', XOOPS_URL . '/modules/xnewsletter/');
64
    $xoopsTpl->assign('catsubscr_id', '0'); // ???
65
66
    $letter_array                             = $letterObj->toArray();
67
    $letter_array['letter_created_formatted'] = formatTimestamp($letterObj->getVar('letter_created'), $helper->getConfig('dateformat'));
68
    $letter_array['letter_submitter_name']    = \XoopsUserUtility::getUnameFromId($letterObj->getVar('letter_submitter'));
69
70
71
    $content .= "<h2>{$letterObj->getVar('letter_title')}</h2>";
72
    $content .= "<div style='clear:both;'><div style='padding:10px;border:1px solid black;'>";
73
74
    $templateObj = $helper->getHandler('Template')->get($letterObj->getVar('letter_templateid'));
75 View Code Duplication
    if (is_object($templateObj)) {
76
        if ( (int)$templateObj->getVar('template_type') === _XNEWSLETTER_MAILINGLIST_TPL_CUSTOM_VAL) {
77
            // get template from database
78
            $htmlBody = $xoopsTpl->fetchFromData($templateObj->getVar('template_content', 'n'));
79
        } else {
80
            // get template from filesystem
81
            $template_path = XOOPS_ROOT_PATH . '/modules/xnewsletter/language/' . $GLOBALS['xoopsConfig']['language'] . '/templates/';
82
            if (!is_dir($template_path)) {
83
                $template_path = XOOPS_ROOT_PATH . '/modules/xnewsletter/language/english/templates/';
84
            }
85
            $template = $template_path . $templateObj->getVar('template_title') . '.tpl';
86
            $htmlBody = $xoopsTpl->fetch($template);
87
        }
88
        try {
89
            $textBody = xnewsletter_html2text($htmlBody);
90
        }
91
        catch (Html2TextException $e) {
92
            $helper->addLog($e);
93
        }
94
    } else {
95
        $htmlBody = _AM_XNEWSLETTER_TEMPLATE_ERR;
96
    }
97
98
    $content .= $htmlBody;
99
    $content .= "</div></div>\n";
100
}
101
102
if ('' == $content) {
103
    redirect_header('letter.php', 3, _AM_XNEWSLETTER_SEND_ERROR_NO_LETTERCONTENT);
104
}
105
$letter_array['letter_content_templated'] = $xoopsTpl->fetch($letterTemplate);
106
$xoopsTpl->assign('letter', $letter_array);
107
$xoopsTpl->assign('xoopsConfig', $xoopsConfig);
108
$xoopsTpl->assign('xoops_meta_keywords', $xoops_meta_keywords);
109
$xoopsTpl->assign('xoops_meta_description', $xoops_meta_description);
110
111
xnewsletter_printPage($content);
112
113
//******************************************************************
114
//*********************** Printfunktion ****************************
115
//******************************************************************
116
/**
117
 * @param $content
118
 */
119
function xnewsletter_printPage($content)
120
{
121
    global $xoopsConfig, $xoops_meta_keywords, $xoops_meta_description;
122
    $myts = \MyTextSanitizer::getInstance(); ?>
0 ignored issues
show
$myts is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
123
    <!DOCTYPE html>
124
    <html xml:lang="<?php echo _LANGCODE; ?>" lang="<?php echo _LANGCODE; ?>">
125
    <?php
126
    echo "<head>\n";
127
    echo "<title>{$xoopsConfig['sitename']}</title>\n";
128
    echo "<meta http-equiv='Content-Type' content='text/html; charset=UTF-8'>\n";
129
    echo "<meta name='AUTHOR' content='{$xoopsConfig['sitename']}'>\n";
130
    echo "<meta name='keywords' content='{$xoops_meta_keywords}'>\n";
131
    echo "<meta name='COPYRIGHT' content='Copyright (c) " . date('Y') . " by {$xoopsConfig['sitename']}'>\n";
132
    echo "<meta name='DESCRIPTION' content='{$xoops_meta_description}'>\n";
133
    echo "<meta name='GENERATOR' content='XOOPS'>\n";
134
    echo "<!-- Sheet Css -->\n";
135
    echo "<link rel='stylesheet' type='text/css' media='all' title='Style sheet' href='" . XOOPS_URL . "'/xoops.css'>\n";
136
    echo "<link rel='stylesheet' type='text/css' media='all' title='Style sheet' href='" . XOOPS_URL . "'/themes/default/style.css'>\n";
137
    echo "<link rel='stylesheet' type='text/css' media='all' title='Style sheet' href='" . XOOPS_URL . "'/modules/xnewsletter/assets/css/module.css'>\n"; ?>
138
    <script type="text/javascript">
139
        // <![CDATA[
140
        /*------------------------------------------------------------------------------
141
         Function:       footnoteLinks()
142
         Author:         Aaron Gustafson (aaron at easy-designs dot net)
143
         Creation Date:  8 May 2005
144
         Version:        1.3
145
         Homepage:       http://www.easy-designs.net/code/footnoteLinks/
146
         License:        Creative Commons Attribution-ShareAlike 2.0 License
147
         http://creativecommons.org/licenses/by-sa/2.0/
148
         Note:           This version has reduced functionality as it is a demo of
149
         the script's development
150
         ------------------------------------------------------------------------------*/
151
        function footnoteLinks(containerID, targetID) {
152
            if (!document.getElementById || !document.getElementsByTagName || !document.createElement) return false;
153
            if (!document.getElementById(containerID) || !document.getElementById(targetID)) return false;
154
            var container = document.getElementById(containerID);
155
            var target = document.getElementById(targetID);
156
            var h2 = document.createElement('h2');
157
            addClass.apply(h2, ['printOnly']);
158
            var h2_txt = document.createTextNode('<?php echo '_MA_NW_LINKS'; ?>');
159
            h2.appendChild(h2_txt);
160
            var coll = container.getElementsByTagName('*');
161
            var ol = document.createElement('ol');
162
            addClass.apply(ol, ['printOnly']);
163
            var myArr = [];
164
            var thisLink;
165
            var num = 1;
166
            for (var i = 0; i < coll.length; i++) {
167
                if (coll[i].getAttribute('href') ||
168
                    coll[i].getAttribute('cite')) {
169
                    thisLink = coll[i].getAttribute('href') ? coll[i].href : coll[i].cite;
170
                    var note = document.createElement('sup');
171
                    addClass.apply(note, ['printOnly']);
172
                    var note_txt;
173
                    var j = inArray.apply(myArr, [thisLink]);
174
                    if (j || j === 0) { // if a duplirolee
175
                        // get the corresponding number from
176
                        // the array of used links
177
                        note_txt = document.createTextNode(j + 1);
178
                    } else {
179
                        // if not a duplirolee
180
                        var li = document.createElement('li');
181
                        var li_txt = document.createTextNode(thisLink);
182
                        li.appendChild(li_txt);
183
                        ol.appendChild(li);
184
                        myArr.push(thisLink);
185
                        note_txt = document.createTextNode(num);
186
                        num++;
187
                    }
188
                    note.appendChild(note_txt);
189
                    if (coll[i].tagName.toLowerCase() == 'blockquote') {
190
                        var lastChild = lastChildContainingText.apply(coll[i]);
191
                        lastChild.appendChild(note);
192
                    } else {
193
                        coll[i].parentNode.insertBefore(note, coll[i].nextSibling);
194
                    }
195
                }
196
            }
197
            target.appendChild(h2);
198
            target.appendChild(ol);
199
200
            return true;
201
        }
202
203
        // ]]>
204
    </script>
205
    <script type="text/javascript">
206
        // <![CDATA[
207
        /*------------------------------------------------------------------------------
208
         Excerpts from the jsUtilities Library
209
         Version:        2.1
210
         Homepage:       http://www.easy-designs.net/code/jsUtilities/
211
         License:        Creative Commons Attribution-ShareAlike 2.0 License
212
         http://creativecommons.org/licenses/by-sa/2.0/
213
         Note:           If you change or improve on this script, please let us know.
214
         ------------------------------------------------------------------------------*/
215
        if (Array.prototype.push === null) {
216
            Array.prototype.push = function (item) {
217
                this[this.length] = item;
218
219
                return this.length;
220
            };
221
        }
222
        ;
223
        // ---------------------------------------------------------------------
224
        //                  function.apply (if unsupported)
225
        //           Courtesy of Aaron Boodman - http://youngpup.net
226
        // ---------------------------------------------------------------------
227
        if (!Function.prototype.apply) {
228
            Function.prototype.apply = function (oScope, args) {
229
                var sarg = [];
230
                var rtrn, call;
231
                if (!oScope) oScope = window;
232
                if (!args) args = [];
233
                for (var i = 0; i < args.length; i++) {
234
                    sarg[i] = "args[" + i + "]";
235
                }
236
                ;
237
                call = "oScope.__applyTemp__(" + sarg.join(",") + ");";
238
                oScope.__applyTemp__ = this;
239
                rtrn = eval(call);
240
                oScope.__applyTemp__ = null;
241
242
                return rtrn;
243
            };
244
        }
245
        ;
246
247
        function inArray(needle) {
248
            for (var i = 0; i < this.length; i++) {
249
                if (this[i] === needle) {
250
                    return i;
251
                }
252
            }
253
254
            return false;
255
        }
256
257
        function addClass(theClass) {
258
            if (this.className != '') {
259
                this.className += ' ' + theClass;
260
            } else {
261
                this.className = theClass;
262
            }
263
        }
264
265
        function lastChildContainingText() {
266
            var testChild = this.lastChild;
267
            var contentCntnr = ['p', 'li', 'dd'];
268
            while (testChild.nodeType != 1) {
269
                testChild = testChild.previousSibling;
270
            }
271
            var tag = testChild.tagName.toLowerCase();
272
            var tagInArr = inArray.apply(contentCntnr, [tag]);
273
            if (!tagInArr && tagInArr !== 0) {
274
                testChild = lastChildContainingText.apply(testChild);
275
            }
276
277
            return testChild;
278
        }
279
280
        // ]]>
281
    </script>
282
    <style type="text/css" media="screen">
283
        .printOnly {
284
            display: none;
285
        }
286
    </style>
287
    </head>
288
    <body bgcolor="#ffffff" text="#000000" onload="window.print()">
289
    <?php
290
    echo $content; ?>
291
    </body>
292
    </html>
293
    <?php
294
}
295