This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | /** |
||||
3 | * Module: XoopsTube |
||||
4 | * |
||||
5 | * You may not change or alter any portion of this comment or credits |
||||
6 | * of supporting developers from this source code or any supporting source code |
||||
7 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||
8 | * |
||||
9 | * PHP version 5 |
||||
10 | * |
||||
11 | * @category Module |
||||
12 | * @package Xoopstube |
||||
13 | * @author XOOPS Development Team |
||||
14 | * @copyright 2001-2016 XOOPS Project (https://xoops.org) |
||||
15 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||
16 | * @link https://xoops.org/ |
||||
17 | * @since 1.0.6 |
||||
18 | */ |
||||
19 | |||||
20 | use Xmf\Module\Admin; |
||||
21 | use Xmf\Request; |
||||
22 | use XoopsModules\Xoopstube; |
||||
23 | |||||
24 | require_once __DIR__ . '/admin_header.php'; |
||||
25 | |||||
26 | //$op = (isset($_REQUEST['op']) && !empty($_REQUEST['op'])) ? $_REQUEST['op'] : ''; |
||||
27 | //$rootpath = (isset($_GET['rootpath'])) ? (int) $_GET['rootpath'] : 0; |
||||
28 | |||||
29 | $op = Request::getCmd('op', Request::getCmd('op', '', 'POST'), 'GET'); |
||||
30 | $rootpath = Request::getInt('rootpath', 0, 'GET'); |
||||
31 | |||||
32 | switch (mb_strtolower($op)) { |
||||
33 | case 'upload': |
||||
34 | if ('' !== $_FILES['uploadfile']['name']) { |
||||
35 | if (file_exists(XOOPS_ROOT_PATH . '/' . Request::getString('uploadpath', '', 'POST') . '/' . $_FILES['uploadfile']['name'])) { |
||||
36 | redirect_header('upload.php', 2, _AM_XOOPSTUBE_VIDEO_IMAGEEXIST); |
||||
37 | } |
||||
38 | $allowed_mimetypes = [ |
||||
39 | 'image/gif', |
||||
40 | 'image/jpeg', |
||||
41 | 'image/pjpeg', |
||||
42 | 'image/x-png', |
||||
43 | 'image/png', |
||||
44 | 'media/flv', |
||||
45 | ]; |
||||
46 | Xoopstube\Utility::uploadFiles($_FILES, Request::getString('uploadpath', '', 'POST'), $allowed_mimetypes, 'upload.php', 1, 0); |
||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||
47 | redirect_header('upload.php', 2, _AM_XOOPSTUBE_VIDEO_IMAGEUPLOAD); |
||||
48 | } else { |
||||
49 | redirect_header('upload.php', 2, _AM_XOOPSTUBE_VIDEO_NOIMAGEEXIST); |
||||
50 | } |
||||
51 | break; |
||||
52 | case 'delfile': |
||||
53 | |||||
54 | if (1 === Request::getInt('confirm', '', 'POST')) { // isset($_POST['confirm']) && $_POST['confirm'] == 1) { |
||||
0 ignored issues
–
show
'' of type string is incompatible with the type integer expected by parameter $default of Xmf\Request::getInt() .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
55 | $filetodelete = XOOPS_ROOT_PATH . '/' . Request::getString('uploadpath', '', 'POST') . '/' . Request::getString('videofile', '', 'POST'); |
||||
56 | if (file_exists($filetodelete)) { |
||||
57 | chmod($filetodelete, 0666); |
||||
58 | if (@unlink($filetodelete)) { |
||||
59 | redirect_header('upload.php', 1, _AM_XOOPSTUBE_VIDEO_FILEDELETED); |
||||
60 | } else { |
||||
61 | redirect_header('upload.php', 1, _AM_XOOPSTUBE_VIDEO_FILEERRORDELETE); |
||||
62 | } |
||||
63 | } |
||||
64 | } else { |
||||
65 | // if (empty($_POST['videofile'])) { |
||||
66 | if (!Request::hasVar('videofile', 'POST')) { |
||||
67 | redirect_header('upload.php', 1, _AM_XOOPSTUBE_VIDEO_NOFILEERROR); |
||||
68 | } |
||||
69 | xoops_cp_header(); |
||||
70 | xoops_confirm( |
||||
71 | [ |
||||
72 | 'op' => 'delfile', |
||||
73 | 'uploadpath' => Request::getString('uploadpath', '', 'POST'), |
||||
74 | 'videofile' => Request::getString('videofile', '', 'POST'), |
||||
75 | 'confirm' => 1, |
||||
76 | ], |
||||
77 | 'upload.php', |
||||
78 | _AM_XOOPSTUBE_VIDEO_DELETEFILE . '<br><br>' . Request::getString('videofile', '', 'POST'), |
||||
79 | _AM_XOOPSTUBE_BDELETE |
||||
80 | ); |
||||
81 | } |
||||
82 | break; |
||||
83 | case 'default': |
||||
84 | default: |
||||
85 | $displayimage = ''; |
||||
86 | xoops_cp_header(); |
||||
87 | $adminObject = Admin::getInstance(); |
||||
88 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
89 | |||||
90 | $dirarray = [ |
||||
91 | 1 => $GLOBALS['xoopsModuleConfig']['catimage'], |
||||
92 | 2 => $GLOBALS['xoopsModuleConfig']['mainimagedir'], |
||||
93 | 3 => $GLOBALS['xoopsModuleConfig']['videoimgdir'], |
||||
94 | ]; |
||||
95 | $namearray = [ |
||||
96 | 1 => _AM_XOOPSTUBE_VIDEO_CATIMAGE, |
||||
97 | 2 => _AM_XOOPSTUBE_VIDEO_MAINIMAGEDIR, |
||||
98 | 3 => _AM_XOOPSTUBE_VIDEO_CATVIDEOIMG, |
||||
99 | ]; |
||||
100 | $listarray = [ |
||||
101 | 1 => _AM_XOOPSTUBE_VIDEO_FCATIMAGE, |
||||
102 | 2 => _AM_XOOPSTUBE_VIDEO_FMAINIMAGEDIR, |
||||
103 | 3 => _AM_XOOPSTUBE_VIDEO_FCATVIDEOIMG, |
||||
104 | ]; |
||||
105 | |||||
106 | // $dirarray = array( |
||||
107 | // 1 => $GLOBALS['xoopsModuleConfig']['catimage'], |
||||
108 | // 2 => $GLOBALS['xoopsModuleConfig']['mainimagedir'] |
||||
109 | // ); |
||||
110 | // $namearray = array( |
||||
111 | // 1 => _AM_XOOPSTUBE_VIDEO_CATIMAGE, |
||||
112 | // 2 => _AM_XOOPSTUBE_VIDEO_MAINIMAGEDIR |
||||
113 | // ); |
||||
114 | // $listarray = array( |
||||
115 | // 1 => _AM_XOOPSTUBE_VIDEO_FCATIMAGE, |
||||
116 | // 2 => _AM_XOOPSTUBE_VIDEO_FMAINIMAGEDIR |
||||
117 | // ); |
||||
118 | |||||
119 | //renderAdminMenu( _AM_XOOPSTUBE_MUPLOADS ); |
||||
120 | Xoopstube\Utility::getServerStatistics(); |
||||
121 | if ($rootpath > 0) { |
||||
122 | echo '<div><b>' . _AM_XOOPSTUBE_VIDEO_FUPLOADPATH . '</b> ' . XOOPS_ROOT_PATH . '/' . $dirarray[$rootpath] . '</div>'; |
||||
123 | echo '<div><b>' . _AM_XOOPSTUBE_VIDEO_FUPLOADURL . '</b> ' . XOOPS_URL . '/' . $dirarray[$rootpath] . '</div><br>'; |
||||
124 | } |
||||
125 | $pathlist = isset($listarray[$rootpath]) ? $namearray[$rootpath] : ''; |
||||
126 | $namelist = isset($listarray[$rootpath]) ? $namearray[$rootpath] : ''; |
||||
127 | |||||
128 | $iform = new \XoopsThemeForm(_AM_XOOPSTUBE_VIDEO_FUPLOADIMAGETO . $pathlist, 'op', xoops_getenv('SCRIPT_NAME'), 'post', true); |
||||
129 | $iform->setExtra('enctype="multipart/form-data"'); |
||||
130 | ob_start(); |
||||
131 | $iform->addElement(new \XoopsFormHidden('dir', $rootpath)); |
||||
132 | Xoopstube\Utility::getDirSelectOption($namelist, $dirarray, $namearray); |
||||
133 | $iform->addElement(new \XoopsFormLabel(_AM_XOOPSTUBE_VIDEO_FOLDERSELECTION, ob_get_clean())); |
||||
134 | |||||
135 | if ($rootpath > 0) { |
||||
136 | $graph_array = Xoopstube\Lists:: getListTypeAsArray(XOOPS_ROOT_PATH . '/' . $dirarray[$rootpath], $type = 'images'); |
||||
137 | $indexImageSelect = new \XoopsFormSelect('', 'videofile', ''); |
||||
138 | $indexImageSelect->addOptionArray($graph_array); |
||||
139 | $indexImageSelect->setExtra("onchange='showImgSelected(\"image\", \"videofile\", \"" . $dirarray[$rootpath] . '", "", "' . XOOPS_URL . "\")'"); |
||||
140 | $indeximage_tray = new \XoopsFormElementTray(_AM_XOOPSTUBE_VIDEO_FSHOWSELECTEDIMAGE, ' '); |
||||
141 | $indeximage_tray->addElement($indexImageSelect); |
||||
142 | if (!empty($imgurl)) { |
||||
143 | $indeximage_tray->addElement(new \XoopsFormLabel('', '<br><br><img src="' . XOOPS_URL . '/' . $dirarray[$rootpath] . '/' . $videofile . '" name="image" id="image" alt"">')); |
||||
144 | } else { |
||||
145 | $indeximage_tray->addElement(new \XoopsFormLabel('', '<br><br><img src="' . XOOPS_URL . '/uploads/blank.gif" name="image" id="image" alt="">')); |
||||
146 | } |
||||
147 | $iform->addElement($indeximage_tray); |
||||
148 | |||||
149 | $iform->addElement(new \XoopsFormFile(_AM_XOOPSTUBE_VIDEO_FUPLOADIMAGE, 'uploadfile', 0)); |
||||
150 | $iform->addElement(new \XoopsFormHidden('uploadpath', $dirarray[$rootpath])); |
||||
151 | $iform->addElement(new \XoopsFormHidden('rootnumber', $rootpath)); |
||||
152 | |||||
153 | $dup_tray = new \XoopsFormElementTray('', ''); |
||||
154 | $dup_tray->addElement(new \XoopsFormHidden('op', 'upload')); |
||||
155 | $butt_dup = new \XoopsFormButton('', '', _AM_XOOPSTUBE_BUPLOAD, 'submit'); |
||||
156 | $butt_dup->setExtra('onclick="this.form.elements.op.value=\'upload\'"'); |
||||
157 | $dup_tray->addElement($butt_dup); |
||||
158 | |||||
159 | $butt_dupct = new \XoopsFormButton('', '', _AM_XOOPSTUBE_BDELETEIMAGE, 'submit'); |
||||
160 | $butt_dupct->setExtra('onclick="this.form.elements.op.value=\'delfile\'"'); |
||||
161 | $dup_tray->addElement($butt_dupct); |
||||
162 | $iform->addElement($dup_tray); |
||||
163 | } |
||||
164 | $iform->display(); |
||||
165 | } |
||||
166 | require_once __DIR__ . '/admin_footer.php'; |
||||
167 |