XoopsModules25x /
xoopstube
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||
| 2 | /** |
||||
| 3 | * Module: XoopsTube |
||||
| 4 | * |
||||
| 5 | * You may not change or alter any portion of this comment or credits |
||||
| 6 | * of supporting developers from this source code or any supporting source code |
||||
| 7 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||
| 8 | * |
||||
| 9 | * PHP version 5 |
||||
| 10 | * |
||||
| 11 | * @category Module |
||||
| 12 | * @package Xoopstube |
||||
| 13 | * @author XOOPS Development Team |
||||
| 14 | * @copyright 2001-2016 XOOPS Project (https://xoops.org) |
||||
| 15 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||
| 16 | * @link https://xoops.org/ |
||||
| 17 | * @since 1.0.6 |
||||
| 18 | */ |
||||
| 19 | |||||
| 20 | use Xmf\Module\Admin; |
||||
| 21 | use Xmf\Request; |
||||
| 22 | use XoopsModules\Xoopstube; |
||||
| 23 | |||||
| 24 | require_once __DIR__ . '/admin_header.php'; |
||||
| 25 | |||||
| 26 | //$op = (isset($_REQUEST['op']) && !empty($_REQUEST['op'])) ? $_REQUEST['op'] : ''; |
||||
| 27 | //$rootpath = (isset($_GET['rootpath'])) ? (int) $_GET['rootpath'] : 0; |
||||
| 28 | |||||
| 29 | $op = Request::getCmd('op', Request::getCmd('op', '', 'POST'), 'GET'); |
||||
| 30 | $rootpath = Request::getInt('rootpath', 0, 'GET'); |
||||
| 31 | |||||
| 32 | switch (mb_strtolower($op)) { |
||||
| 33 | case 'upload': |
||||
| 34 | if ('' !== $_FILES['uploadfile']['name']) { |
||||
| 35 | if (file_exists(XOOPS_ROOT_PATH . '/' . Request::getString('uploadpath', '', 'POST') . '/' . $_FILES['uploadfile']['name'])) { |
||||
| 36 | redirect_header('upload.php', 2, _AM_XOOPSTUBE_VIDEO_IMAGEEXIST); |
||||
| 37 | } |
||||
| 38 | $allowed_mimetypes = [ |
||||
| 39 | 'image/gif', |
||||
| 40 | 'image/jpeg', |
||||
| 41 | 'image/pjpeg', |
||||
| 42 | 'image/x-png', |
||||
| 43 | 'image/png', |
||||
| 44 | 'media/flv', |
||||
| 45 | ]; |
||||
| 46 | Xoopstube\Utility::uploadFiles($_FILES, Request::getString('uploadpath', '', 'POST'), $allowed_mimetypes, 'upload.php', 1, 0); |
||||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||||
| 47 | redirect_header('upload.php', 2, _AM_XOOPSTUBE_VIDEO_IMAGEUPLOAD); |
||||
| 48 | } else { |
||||
| 49 | redirect_header('upload.php', 2, _AM_XOOPSTUBE_VIDEO_NOIMAGEEXIST); |
||||
| 50 | } |
||||
| 51 | break; |
||||
| 52 | case 'delfile': |
||||
| 53 | |||||
| 54 | if (1 === Request::getInt('confirm', '', 'POST')) { // isset($_POST['confirm']) && $_POST['confirm'] == 1) { |
||||
|
0 ignored issues
–
show
'' of type string is incompatible with the type integer expected by parameter $default of Xmf\Request::getInt().
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 55 | $filetodelete = XOOPS_ROOT_PATH . '/' . Request::getString('uploadpath', '', 'POST') . '/' . Request::getString('videofile', '', 'POST'); |
||||
| 56 | if (file_exists($filetodelete)) { |
||||
| 57 | chmod($filetodelete, 0666); |
||||
| 58 | if (@unlink($filetodelete)) { |
||||
| 59 | redirect_header('upload.php', 1, _AM_XOOPSTUBE_VIDEO_FILEDELETED); |
||||
| 60 | } else { |
||||
| 61 | redirect_header('upload.php', 1, _AM_XOOPSTUBE_VIDEO_FILEERRORDELETE); |
||||
| 62 | } |
||||
| 63 | } |
||||
| 64 | } else { |
||||
| 65 | // if (empty($_POST['videofile'])) { |
||||
| 66 | if (!Request::hasVar('videofile', 'POST')) { |
||||
| 67 | redirect_header('upload.php', 1, _AM_XOOPSTUBE_VIDEO_NOFILEERROR); |
||||
| 68 | } |
||||
| 69 | xoops_cp_header(); |
||||
| 70 | xoops_confirm( |
||||
| 71 | [ |
||||
| 72 | 'op' => 'delfile', |
||||
| 73 | 'uploadpath' => Request::getString('uploadpath', '', 'POST'), |
||||
| 74 | 'videofile' => Request::getString('videofile', '', 'POST'), |
||||
| 75 | 'confirm' => 1, |
||||
| 76 | ], |
||||
| 77 | 'upload.php', |
||||
| 78 | _AM_XOOPSTUBE_VIDEO_DELETEFILE . '<br><br>' . Request::getString('videofile', '', 'POST'), |
||||
| 79 | _AM_XOOPSTUBE_BDELETE |
||||
| 80 | ); |
||||
| 81 | } |
||||
| 82 | break; |
||||
| 83 | case 'default': |
||||
| 84 | default: |
||||
| 85 | $displayimage = ''; |
||||
| 86 | xoops_cp_header(); |
||||
| 87 | $adminObject = Admin::getInstance(); |
||||
| 88 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
| 89 | |||||
| 90 | $dirarray = [ |
||||
| 91 | 1 => $GLOBALS['xoopsModuleConfig']['catimage'], |
||||
| 92 | 2 => $GLOBALS['xoopsModuleConfig']['mainimagedir'], |
||||
| 93 | 3 => $GLOBALS['xoopsModuleConfig']['videoimgdir'], |
||||
| 94 | ]; |
||||
| 95 | $namearray = [ |
||||
| 96 | 1 => _AM_XOOPSTUBE_VIDEO_CATIMAGE, |
||||
| 97 | 2 => _AM_XOOPSTUBE_VIDEO_MAINIMAGEDIR, |
||||
| 98 | 3 => _AM_XOOPSTUBE_VIDEO_CATVIDEOIMG, |
||||
| 99 | ]; |
||||
| 100 | $listarray = [ |
||||
| 101 | 1 => _AM_XOOPSTUBE_VIDEO_FCATIMAGE, |
||||
| 102 | 2 => _AM_XOOPSTUBE_VIDEO_FMAINIMAGEDIR, |
||||
| 103 | 3 => _AM_XOOPSTUBE_VIDEO_FCATVIDEOIMG, |
||||
| 104 | ]; |
||||
| 105 | |||||
| 106 | // $dirarray = array( |
||||
| 107 | // 1 => $GLOBALS['xoopsModuleConfig']['catimage'], |
||||
| 108 | // 2 => $GLOBALS['xoopsModuleConfig']['mainimagedir'] |
||||
| 109 | // ); |
||||
| 110 | // $namearray = array( |
||||
| 111 | // 1 => _AM_XOOPSTUBE_VIDEO_CATIMAGE, |
||||
| 112 | // 2 => _AM_XOOPSTUBE_VIDEO_MAINIMAGEDIR |
||||
| 113 | // ); |
||||
| 114 | // $listarray = array( |
||||
| 115 | // 1 => _AM_XOOPSTUBE_VIDEO_FCATIMAGE, |
||||
| 116 | // 2 => _AM_XOOPSTUBE_VIDEO_FMAINIMAGEDIR |
||||
| 117 | // ); |
||||
| 118 | |||||
| 119 | //renderAdminMenu( _AM_XOOPSTUBE_MUPLOADS ); |
||||
| 120 | Xoopstube\Utility::getServerStatistics(); |
||||
| 121 | if ($rootpath > 0) { |
||||
| 122 | echo '<div><b>' . _AM_XOOPSTUBE_VIDEO_FUPLOADPATH . '</b> ' . XOOPS_ROOT_PATH . '/' . $dirarray[$rootpath] . '</div>'; |
||||
| 123 | echo '<div><b>' . _AM_XOOPSTUBE_VIDEO_FUPLOADURL . '</b> ' . XOOPS_URL . '/' . $dirarray[$rootpath] . '</div><br>'; |
||||
| 124 | } |
||||
| 125 | $pathlist = isset($listarray[$rootpath]) ? $namearray[$rootpath] : ''; |
||||
| 126 | $namelist = isset($listarray[$rootpath]) ? $namearray[$rootpath] : ''; |
||||
| 127 | |||||
| 128 | $iform = new \XoopsThemeForm(_AM_XOOPSTUBE_VIDEO_FUPLOADIMAGETO . $pathlist, 'op', xoops_getenv('SCRIPT_NAME'), 'post', true); |
||||
| 129 | $iform->setExtra('enctype="multipart/form-data"'); |
||||
| 130 | ob_start(); |
||||
| 131 | $iform->addElement(new \XoopsFormHidden('dir', $rootpath)); |
||||
| 132 | Xoopstube\Utility::getDirSelectOption($namelist, $dirarray, $namearray); |
||||
| 133 | $iform->addElement(new \XoopsFormLabel(_AM_XOOPSTUBE_VIDEO_FOLDERSELECTION, ob_get_clean())); |
||||
| 134 | |||||
| 135 | if ($rootpath > 0) { |
||||
| 136 | $graph_array = Xoopstube\Lists:: getListTypeAsArray(XOOPS_ROOT_PATH . '/' . $dirarray[$rootpath], $type = 'images'); |
||||
| 137 | $indexImageSelect = new \XoopsFormSelect('', 'videofile', ''); |
||||
| 138 | $indexImageSelect->addOptionArray($graph_array); |
||||
| 139 | $indexImageSelect->setExtra("onchange='showImgSelected(\"image\", \"videofile\", \"" . $dirarray[$rootpath] . '", "", "' . XOOPS_URL . "\")'"); |
||||
| 140 | $indeximage_tray = new \XoopsFormElementTray(_AM_XOOPSTUBE_VIDEO_FSHOWSELECTEDIMAGE, ' '); |
||||
| 141 | $indeximage_tray->addElement($indexImageSelect); |
||||
| 142 | if (!empty($imgurl)) { |
||||
| 143 | $indeximage_tray->addElement(new \XoopsFormLabel('', '<br><br><img src="' . XOOPS_URL . '/' . $dirarray[$rootpath] . '/' . $videofile . '" name="image" id="image" alt"">')); |
||||
| 144 | } else { |
||||
| 145 | $indeximage_tray->addElement(new \XoopsFormLabel('', '<br><br><img src="' . XOOPS_URL . '/uploads/blank.gif" name="image" id="image" alt="">')); |
||||
| 146 | } |
||||
| 147 | $iform->addElement($indeximage_tray); |
||||
| 148 | |||||
| 149 | $iform->addElement(new \XoopsFormFile(_AM_XOOPSTUBE_VIDEO_FUPLOADIMAGE, 'uploadfile', 0)); |
||||
| 150 | $iform->addElement(new \XoopsFormHidden('uploadpath', $dirarray[$rootpath])); |
||||
| 151 | $iform->addElement(new \XoopsFormHidden('rootnumber', $rootpath)); |
||||
| 152 | |||||
| 153 | $dup_tray = new \XoopsFormElementTray('', ''); |
||||
| 154 | $dup_tray->addElement(new \XoopsFormHidden('op', 'upload')); |
||||
| 155 | $butt_dup = new \XoopsFormButton('', '', _AM_XOOPSTUBE_BUPLOAD, 'submit'); |
||||
| 156 | $butt_dup->setExtra('onclick="this.form.elements.op.value=\'upload\'"'); |
||||
| 157 | $dup_tray->addElement($butt_dup); |
||||
| 158 | |||||
| 159 | $butt_dupct = new \XoopsFormButton('', '', _AM_XOOPSTUBE_BDELETEIMAGE, 'submit'); |
||||
| 160 | $butt_dupct->setExtra('onclick="this.form.elements.op.value=\'delfile\'"'); |
||||
| 161 | $dup_tray->addElement($butt_dupct); |
||||
| 162 | $iform->addElement($dup_tray); |
||||
| 163 | } |
||||
| 164 | $iform->display(); |
||||
| 165 | } |
||||
| 166 | require_once __DIR__ . '/admin_footer.php'; |
||||
| 167 |