XoopsModules25x /
xoopspoll
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php declare(strict_types=1); |
||||||
| 2 | |||||||
| 3 | /** |
||||||
| 4 | * Newbb module |
||||||
| 5 | * |
||||||
| 6 | * You may not change or alter any portion of this comment or credits |
||||||
| 7 | * of supporting developers from this source code or any supporting source code |
||||||
| 8 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||||
| 9 | * This program is distributed in the hope that it will be useful, |
||||||
| 10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
| 11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||
| 12 | * |
||||||
| 13 | * @copyright XOOPS Project (https://xoops.org) |
||||||
| 14 | * @license GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||||
| 15 | * @since 4.0 |
||||||
| 16 | * @author Taiwen Jiang <[email protected]> |
||||||
| 17 | */ |
||||||
| 18 | |||||||
| 19 | use Xmf\Request; |
||||||
| 20 | use XoopsModules\Newbb; |
||||||
| 21 | use XoopsModules\Xoopspoll; |
||||||
| 22 | |||||||
| 23 | require_once __DIR__ . '/header.php'; |
||||||
| 24 | |||||||
| 25 | /** @var Xoopspoll\Helper $helper */ |
||||||
| 26 | $helper = Xoopspoll\Helper::getInstance(); |
||||||
| 27 | |||||||
| 28 | if (Request::hasVar('submit', 'POST')) { |
||||||
| 29 | foreach (['forum', 'topic_id', 'newforum', 'newtopic'] as $getint) { |
||||||
| 30 | ${$getint} = (int)(@$_POST[$getint]); |
||||||
| 31 | } |
||||||
| 32 | } else { |
||||||
| 33 | foreach (['forum', 'topic_id'] as $getint) { |
||||||
| 34 | ${$getint} = (int)(@$_GET[$getint]); |
||||||
| 35 | } |
||||||
| 36 | } |
||||||
| 37 | |||||||
| 38 | if (!$topic_id) { |
||||||
| 39 | $redirect = empty($forum_id) ? 'index.php' : "viewforum.php?forum={$forum}"; |
||||||
| 40 | redirect_header($redirect, 2, _MD_ERRORTOPIC); |
||||||
| 41 | } |
||||||
| 42 | |||||||
| 43 | /** @var Newbb\TopicHandler $topicHandler */ |
||||||
| 44 | $topicHandler = Newbb\Helper::getInstance()->getHandler('Topic'); |
||||||
| 45 | $forum = $topicHandler->get($topic_id, 'forum_id'); |
||||||
| 46 | $forum_new = !empty($newtopic) ? $topicHandler->get($newtopic, 'forum_id') : 0; |
||||||
| 47 | |||||||
| 48 | /** @var Newbb\ForumHandler $forumHandler */ |
||||||
| 49 | $forumHandler = Newbb\Helper::getInstance()->getHandler('Forum'); |
||||||
| 50 | if (!$forumHandler->getPermission($forum, 'moderate') |
||||||
| 51 | || (!empty($forum_new) |
||||||
| 52 | && !$forumHandler->getPermission($forum_new, 'reply'))// The forum for the topic to be merged to |
||||||
| 53 | || (!empty($newforum) && !$forumHandler->getPermission($newforum, 'post')) // The forum to be moved to |
||||||
| 54 | ) { |
||||||
| 55 | redirect_header("viewtopic.php?forum={$forum}&topic_id={$topic_id}", 2, _NOPERM); |
||||||
| 56 | } |
||||||
| 57 | |||||||
| 58 | if ($helper->getConfig('wol_enabled')) { |
||||||
| 59 | $onlineHandler = Newbb\Helper::getInstance()->getHandler('Online'); |
||||||
| 60 | $onlineHandler->init($forum); |
||||||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||||||
| 61 | } |
||||||
| 62 | |||||||
| 63 | $action_array = ['merge', 'delete', 'move', 'lock', 'unlock', 'sticky', 'unsticky', 'digest', 'undigest']; |
||||||
| 64 | foreach ($action_array as $_action) { |
||||||
| 65 | $action[$_action] = [ |
||||||
| 66 | 'name' => $_action, |
||||||
| 67 | 'desc' => constant(mb_strtoupper("_MD_DESC_{$_action}")), |
||||||
| 68 | 'submit' => constant(mb_strtoupper("_MD_{$_action}")), |
||||||
| 69 | 'sql' => "topic_{$_action}=1", |
||||||
| 70 | 'msg' => constant(mb_strtoupper("_MD_TOPIC{$_action}")), |
||||||
| 71 | ]; |
||||||
| 72 | } |
||||||
| 73 | $action['lock']['sql'] = 'topic_status = 1'; |
||||||
| 74 | $action['unlock']['sql'] = 'topic_status = 0'; |
||||||
| 75 | $action['unsticky']['sql'] = 'topic_sticky = 0'; |
||||||
| 76 | $action['undigest']['sql'] = 'topic_digest = 0'; |
||||||
| 77 | $action['digest']['sql'] = 'topic_digest = 1, digest_time = ' . time(); |
||||||
| 78 | |||||||
| 79 | // Disable cache |
||||||
| 80 | $xoopsConfig['module_cache'][$xoopsModule->getVar('mid')] = 0; |
||||||
| 81 | require_once XOOPS_ROOT_PATH . '/header.php'; |
||||||
| 82 | |||||||
| 83 | if (Request::hasVar('submit', 'POST')) { |
||||||
| 84 | $mode = $_POST['mode']; |
||||||
| 85 | if ('delete' === $mode) { |
||||||
| 86 | $topic_obj = $topicHandler->get($topic_id); |
||||||
| 87 | $topicHandler->delete($topic_obj); |
||||||
| 88 | $forumHandler->synchronization($forum); |
||||||
| 89 | |||||||
| 90 | $topic_obj->loadFilters('delete'); |
||||||
| 91 | echo $action[$mode]['msg'] . "<p><a href='viewforum.php?forum={$forum}'>" . _MD_RETURNTOTHEFORUM . "</a></p><p><a href='index.php'>" . _MD_RETURNFORUMINDEX . '</a></p>'; |
||||||
| 92 | } elseif ('merge' === $mode) { |
||||||
| 93 | $postHandler = Newbb\Helper::getInstance()->getHandler('Post'); |
||||||
| 94 | |||||||
| 95 | $topic_obj = $topicHandler->get($topic_id); |
||||||
| 96 | $newtopic_obj = $topicHandler->get($newtopic); |
||||||
| 97 | /* return false if destination topic is newer or not existing */ |
||||||
| 98 | if ($newtopic > $topic_id || !is_object($newtopic_obj)) { |
||||||
| 99 | redirect_header(Request::getString('HTTP_REFERER', '', 'SERVER'), 2, _MD_ERROR); |
||||||
| 100 | } |
||||||
| 101 | |||||||
| 102 | $criteria_topic = new \Criteria('topic_id', $topic_id); |
||||||
| 103 | $criteria = new \CriteriaCompo($criteria_topic); |
||||||
| 104 | $criteria->add(new \Criteria('pid', 0)); |
||||||
| 105 | $postHandler->updateAll('pid', $topicHandler->getTopPostId($newtopic), $criteria, true); |
||||||
| 106 | $postHandler->updateAll('topic_id', $newtopic, $criteria_topic, true); |
||||||
| 107 | |||||||
| 108 | $topic_views = $topic_obj->getVar('topic_views') + $newtopic_obj->getVar('topic_views'); |
||||||
| 109 | $criteria_newtopic = new \Criteria('topic_id', $newtopic); |
||||||
| 110 | $topicHandler->updateAll('topic_views', $topic_views, $criteria_newtopic, true); |
||||||
| 111 | |||||||
| 112 | $topicHandler->synchronization($newtopic); |
||||||
| 113 | |||||||
| 114 | $poll_id = $topicHandler->get($topic_id, 'poll_id'); |
||||||
| 115 | |||||||
| 116 | if ($poll_id > 0) { |
||||||
| 117 | /** @var \XoopsModuleHandler $moduleHandler */ |
||||||
| 118 | $moduleHandler = xoops_getHandler('module'); |
||||||
| 119 | $pollModule = $moduleHandler->getByDirname('xoopspoll'); |
||||||
| 120 | if (($pollModule instanceof \XoopsModule) && $pollModule->isactive()) { |
||||||
| 121 | $xpPollHandler = Xoopspoll\Helper::getInstance()->getHandler('Poll'); |
||||||
| 122 | $poll = $xpPollHandler->get($poll_id); |
||||||
| 123 | if (false !== $xpPollHandler->delete($poll)) { |
||||||
| 124 | $xpOptHandler = Xoopspoll\Helper::getInstance()->getHandler('Option'); |
||||||
| 125 | $xpLogHandler = Xoopspoll\Helper::getInstance()->getHandler('Log'); |
||||||
| 126 | $xpOptHandler->deleteByPollId($poll_id); |
||||||
| 127 | $xpLogHandler->deleteByPollId($poll_id); |
||||||
| 128 | xoops_comment_delete($xoopsModule->getVar('mid'), $poll_id); |
||||||
| 129 | } |
||||||
| 130 | } |
||||||
| 131 | } |
||||||
| 132 | |||||||
| 133 | $sql = sprintf('DELETE FROM `%s` WHERE topic_id = %u', $xoopsDB->prefix('bb_topics'), $topic_id); |
||||||
| 134 | $result = $xoopsDB->queryF($sql); |
||||||
| 135 | |||||||
| 136 | $sql = sprintf('DELETE FROM `%s` WHERE topic_id = %u', $xoopsDB->prefix('bb_votedata'), $topic_id); |
||||||
| 137 | $result = $xoopsDB->queryF($sql); |
||||||
| 138 | |||||||
| 139 | $sql = sprintf('UPDATE `%s` SET forum_topics = forum_topics-1 WHERE forum_id = %u', $xoopsDB->prefix('bb_forums'), $forum); |
||||||
| 140 | $result = $xoopsDB->queryF($sql); |
||||||
| 141 | |||||||
| 142 | $topic_obj->loadFilters('delete'); |
||||||
| 143 | $newtopic_obj->loadFilters('update'); |
||||||
| 144 | |||||||
| 145 | echo $action[$mode]['msg'] . "<p><a href='viewtopic.php?topic_id={$newtopic}'>" . _MD_VIEWTHETOPIC . '</a></p>' . "<p><a href='viewforum.php?forum={$forum}'>" . _MD_RETURNTOTHEFORUM . '</a></p>' . "<p><a href='index.php'>" . _MD_RETURNFORUMINDEX . '</a></p>'; |
||||||
| 146 | } elseif ('move' === $mode) { |
||||||
| 147 | if ($newforum > 0) { |
||||||
| 148 | $topic_obj = $topicHandler->get($topic_id); |
||||||
| 149 | $topic_obj->loadFilters('update'); |
||||||
| 150 | $topic_obj->setVar('forum_id', $newforum, true); |
||||||
| 151 | $topicHandler->insert($topic_obj, true); |
||||||
| 152 | $topic_obj->loadFilters('update'); |
||||||
| 153 | |||||||
| 154 | $sql = sprintf('UPDATE `%s` SET forum_id = %u WHERE topic_id = %u', $xoopsDB->prefix('bb_posts'), $newforum, $topic_id); |
||||||
| 155 | if (!$r = $xoopsDB->query($sql)) { |
||||||
| 156 | return false; |
||||||
| 157 | } |
||||||
| 158 | $forumHandler->synchronization($newforum); |
||||||
| 159 | $forumHandler->synchronization($forum); |
||||||
| 160 | echo $action[$mode]['msg'] . "<p><a href='viewtopic.php?topic_id={$topic_id}&forum={$newforum}'>" . _MD_GOTONEWFORUM . "</a></p><p><a href='index.php'>" . _MD_RETURNFORUMINDEX . '</a></p>'; |
||||||
| 161 | } else { |
||||||
| 162 | redirect_header(Request::getString('HTTP_REFERER', '', 'SERVER'), 2, _MD_ERRORFORUM); |
||||||
| 163 | } |
||||||
| 164 | } else { |
||||||
| 165 | $sql = sprintf('UPDATE `%s` SET ' . $action[$mode]['sql'] . ' WHERE topic_id = %u', $xoopsDB->prefix('bb_topics'), $topic_id); |
||||||
| 166 | if (!$r = $xoopsDB->query($sql)) { |
||||||
| 167 | redirect_header("viewtopic.php?forum={$forum}&topic_id={$topic_id}&order={$order}&viewmode={$viewmode}", 2, _MD_ERROR_BACK . '<br>sql:' . $sql); |
||||||
| 168 | } |
||||||
| 169 | if ('digest' === $mode && $xoopsDB->getAffectedRows()) { |
||||||
| 170 | $topic_obj = $topicHandler->get($topic_id); |
||||||
| 171 | $statsHandler = Newbb\Helper::getInstance()->getHandler('Stats'); |
||||||
| 172 | $statsHandler->update($topic_obj->getVar('forum_id'), 'digest'); |
||||||
|
0 ignored issues
–
show
The method
update() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 173 | $userstatsHandler = Newbb\Helper::getInstance()->getHandler('Userstats'); |
||||||
| 174 | $user_stat = $userstatsHandler->get($topic_obj->getVar('topic_poster')); |
||||||
| 175 | if ($user_stat) { |
||||||
| 176 | $user_stat->setVar('user_digests', $user_stat->getVar('user_digests') + 1); |
||||||
| 177 | $userstatsHandler->insert($user_stat); |
||||||
| 178 | } |
||||||
| 179 | } |
||||||
| 180 | echo $action[$mode]['msg'] . "<p><a href='viewtopic.php?topic_id={$topic_id}&forum={$forum}'>" . _MD_VIEWTHETOPIC . "</a></p><p><a href='viewforum.php?forum={$forum}'>" . _MD_RETURNFORUMINDEX . '</a></p>'; |
||||||
| 181 | } |
||||||
| 182 | } else { // No submit |
||||||
| 183 | $mode = $_GET['mode']; |
||||||
| 184 | echo "<form action='" . $_SERVER['SCRIPT_NAME'] . "' method='post'>"; |
||||||
| 185 | echo $GLOBALS['xoopsSecurity']->getTokenHTML(); |
||||||
| 186 | echo "<table border='0' cellpadding='1' cellspacing='0' align='center' width='95%'>"; |
||||||
| 187 | echo "<tr><td class='bg2'>"; |
||||||
| 188 | echo "<table border='0' cellpadding='1' cellspacing='1' width='100%'>"; |
||||||
| 189 | echo "<tr class='bg3' align='left'>"; |
||||||
| 190 | echo "<td colspan='2' align='center'>" . $action[$mode]['desc'] . '</td></tr>'; |
||||||
| 191 | |||||||
| 192 | if ('move' === $mode) { |
||||||
| 193 | echo '<tr><td class="bg3">' . _MD_MOVETOPICTO . '</td><td class="bg1">'; |
||||||
| 194 | $box = '<select name="newforum" size="1">'; |
||||||
| 195 | |||||||
| 196 | $categoryHandler = Newbb\Helper::getInstance()->getHandler('Category'); |
||||||
| 197 | $categories = $categoryHandler->getByPermission('access'); |
||||||
| 198 | $forums = $forumHandler->getForumsByCategory(array_keys($categories), 'post', false); |
||||||
| 199 | |||||||
| 200 | if (count($categories) > 0 && count($forums) > 0) { |
||||||
| 201 | foreach (array_keys($forums) as $key) { |
||||||
| 202 | $box .= "<option value='-1'>[" . $categories[$key]->getVar('cat_title') . ']</option>'; |
||||||
| 203 | foreach ($forums[$key] as $forumid => $_forum) { |
||||||
| 204 | $box .= "<option value='" . $forumid . "'>-- " . $_forum['title'] . '</option>'; |
||||||
| 205 | if (!isset($_forum['sub'])) { |
||||||
| 206 | continue; |
||||||
| 207 | } |
||||||
| 208 | foreach (array_keys($_forum['sub']) as $fid) { |
||||||
| 209 | $box .= "<option value='" . $fid . "'>---- " . $_forum['sub'][$fid]['title'] . '</option>'; |
||||||
| 210 | } |
||||||
| 211 | } |
||||||
| 212 | } |
||||||
| 213 | } else { |
||||||
| 214 | $box .= "<option value='-1'>" . _MD_NOFORUMINDB . '</option>'; |
||||||
| 215 | } |
||||||
| 216 | unset($forums, $categories); |
||||||
| 217 | |||||||
| 218 | echo $box; |
||||||
| 219 | echo '</select></td></tr>'; |
||||||
| 220 | } |
||||||
| 221 | if ('merge' === $mode) { |
||||||
| 222 | echo '<tr><td class="bg3">' . _MD_MERGETOPICTO . '</td><td class="bg1">'; |
||||||
| 223 | echo _MD_TOPIC . " ID-{$topic_id} -> ID: <input name='newtopic' value=''>"; |
||||||
| 224 | echo '</td></tr>'; |
||||||
| 225 | } |
||||||
| 226 | echo '<tr class="bg3"><td colspan="2" align="center">'; |
||||||
| 227 | echo "<input type='hidden' name='mode' value='" . $action[$mode]['name'] . "'>"; |
||||||
| 228 | echo "<input type='hidden' name='topic_id' value='" . $topic_id . "'>"; |
||||||
| 229 | echo "<input type='hidden' name='forum' value='" . $forum . "'>"; |
||||||
| 230 | echo "<input type='submit' name='submit' value='" . $action[$mode]['submit'] . "'>"; |
||||||
| 231 | echo '</td></tr></form></table></td></tr></table>'; |
||||||
| 232 | } |
||||||
| 233 | require_once XOOPS_ROOT_PATH . '/footer.php'; |
||||||
| 234 |