This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * Module: XoopsTube |
||
5 | * |
||
6 | * You may not change or alter any portion of this comment or credits |
||
7 | * of supporting developers from this source code or any supporting source code |
||
8 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
9 | * |
||
10 | * PHP version 5 |
||
11 | * |
||
12 | * @category Module |
||
13 | * @package Xoopstube |
||
14 | * @author XOOPS Development Team |
||
15 | * @copyright 2001-2016 XOOPS Project (https://xoops.org) |
||
16 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||
17 | * @link https://xoops.org/ |
||
18 | * @since 1.0.6 |
||
19 | */ |
||
20 | |||
21 | use Xmf\Request; |
||
22 | use XoopsModules\Xoopstube\{ |
||
23 | Utility |
||
24 | }; |
||
25 | |||
26 | require_once __DIR__ . '/header.php'; |
||
27 | |||
28 | $op = Request::getCmd('op', Request::getCmd('op', '', 'POST'), 'GET'); |
||
29 | $lid = Request::getInt('lid', Request::getInt('lid', '', 'POST'), 'GET'); |
||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||
30 | |||
31 | $buttonn = mb_strtolower(_MD_XOOPSTUBE_SUBMITBROKEN); |
||
32 | |||
33 | switch (mb_strtolower($op)) { |
||
34 | case $buttonn: |
||
35 | $sender = (is_object($GLOBALS['xoopsUser']) && !empty($GLOBALS['xoopsUser'])) ? $GLOBALS['xoopsUser']->getVar('uid') : 0; |
||
36 | $ip = getenv('REMOTE_ADDR'); |
||
37 | $title = Request::getString('title', '', 'POST'); |
||
38 | $time = time(); |
||
39 | |||
40 | // Check if REG user is trying to report twice |
||
41 | $result = $GLOBALS['xoopsDB']->query('SELECT COUNT(*) FROM ' . $GLOBALS['xoopsDB']->prefix('xoopstube_broken') . ' WHERE lid=' . $lid); |
||
42 | [$count] = $GLOBALS['xoopsDB']->fetchRow($result); |
||
43 | if ($count > 0) { |
||
44 | $ratemessage = _MD_XOOPSTUBE_ALREADYREPORTED; |
||
45 | redirect_header('singlevideo.php?cid=' . (int)$cid . '&lid=' . $lid, 2, $ratemessage); |
||
46 | } else { |
||
47 | $reportid = 0; |
||
48 | $sql = sprintf( |
||
49 | 'INSERT INTO `%s` (reportid, lid, sender, ip, date, confirmed, acknowledged, title ) VALUES ( %u, %u, %u, %s, %u, %u, %u, %s)', |
||
50 | $GLOBALS['xoopsDB']->prefix('xoopstube_broken'), |
||
51 | $reportid, |
||
52 | $lid, |
||
53 | $sender, |
||
54 | $GLOBALS['xoopsDB']->quoteString($ip), |
||
55 | $time, |
||
56 | 0, |
||
57 | 0, |
||
58 | $GLOBALS['xoopsDB']->quoteString($title) |
||
59 | ); |
||
60 | if (!$result = $GLOBALS['xoopsDB']->query($sql)) { |
||
61 | $error[] = _MD_XOOPSTUBE_ERROR; |
||
62 | } |
||
63 | $newid = $GLOBALS['xoopsDB']->getInsertId(); |
||
64 | |||
65 | // Send notifications |
||
66 | $tags = []; |
||
67 | $tags['BROKENREPORTS_URL'] = XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . '/admin/main.php?op=listBrokenvideos'; |
||
68 | /** @var \XoopsNotificationHandler $notificationHandler */ |
||
69 | $notificationHandler = xoops_getHandler('notification'); |
||
70 | $notificationHandler->triggerEvent('global', 0, 'video_broken', $tags); |
||
71 | |||
72 | // Send email to the owner of the linkload stating that it is broken |
||
73 | $sql = 'SELECT * FROM ' . $GLOBALS['xoopsDB']->prefix('xoopstube_videos') . ' WHERE lid=' . $lid . ' AND published > 0 AND published <= ' . time() . ' AND (expired = 0 OR expired > ' . time() . ')'; |
||
74 | $videoArray = $GLOBALS['xoopsDB']->fetchArray($GLOBALS['xoopsDB']->query($sql)); |
||
75 | unset($sql); |
||
76 | |||
77 | /** @var \XoopsMemberHandler $memberHandler */ |
||
78 | $memberHandler = xoops_getHandler('member'); |
||
79 | $submit_user = $memberHandler->getUser($videoArray['submitter']); |
||
80 | if (is_object($submit_user) && null !== $submit_user) { |
||
81 | $subdate = formatTimestamp($videoArray['date'], $GLOBALS['xoopsModuleConfig']['dateformat']); |
||
82 | $cid = $videoArray['cid']; |
||
83 | $title = htmlspecialchars($videoArray['title'], ENT_QUOTES | ENT_HTML5); |
||
84 | $subject = _MD_XOOPSTUBE_BROKENREPORTED; |
||
85 | |||
86 | $xoopsMailer = xoops_getMailer(); |
||
87 | $xoopsMailer->useMail(); |
||
88 | $templateDir = XOOPS_ROOT_PATH . '/modules/' . $xoopsModule->getVar('dirname') . '/language/' . $GLOBALS['xoopsConfig']['language'] . '/mail_template'; |
||
89 | $xoopsMailer->setTemplateDir($templateDir); |
||
90 | $xoopsMailer->setTemplate('videobroken_notify.tpl'); |
||
91 | $xoopsMailer->setToEmails($submit_user->getVar('email')); |
||
92 | $xoopsMailer->setFromEmail($GLOBALS['xoopsConfig']['adminmail']); |
||
93 | $xoopsMailer->setFromName($GLOBALS['xoopsConfig']['sitename']); |
||
94 | $xoopsMailer->assign('X_UNAME', $submit_user->getVar('uname')); |
||
95 | $xoopsMailer->assign('SITENAME', $GLOBALS['xoopsConfig']['sitename']); |
||
96 | $xoopsMailer->assign('X_ADMINMAIL', $GLOBALS['xoopsConfig']['adminmail']); |
||
97 | $xoopsMailer->assign('X_SITEvidid', _AM_XOOPSTUBE_MOD_VIDID . '/'); |
||
98 | $xoopsMailer->assign('X_TITLE', $title); |
||
99 | $xoopsMailer->assign('X_SUB_DATE', $subdate); |
||
100 | $xoopsMailer->assign('X_VIDEOLOAD', XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . '/singlevideo.php?cid=' . $cid . '&lid=' . $lid); |
||
101 | $xoopsMailer->setSubject($subject); |
||
102 | $message = $xoopsMailer->send() ? _MD_XOOPSTUBE_BROKENREPORTED : _MD_XOOPSTUBE_ERRORSENDEMAIL; |
||
103 | } else { |
||
104 | $message = _MD_XOOPSTUBE_ERRORSENDEMAIL; |
||
105 | } |
||
106 | redirect_header('singlevideo.php?cid=' . (int)$cid . '&lid=' . $lid, 2, $message); |
||
107 | } |
||
108 | break; |
||
109 | default: |
||
110 | |||
111 | $GLOBALS['xoopsOption']['template_main'] = 'xoopstube_brokenvideo.tpl'; |
||
112 | require_once XOOPS_ROOT_PATH . '/header.php'; |
||
113 | |||
114 | $catarray['imageheader'] = Utility::renderImageHeader(); |
||
115 | $xoopsTpl->assign('catarray', $catarray); |
||
116 | |||
117 | $sql = 'SELECT * FROM ' . $GLOBALS['xoopsDB']->prefix('xoopstube_videos') . ' WHERE lid=' . $lid; |
||
118 | $videoArray = $GLOBALS['xoopsDB']->fetchArray($GLOBALS['xoopsDB']->query($sql)); |
||
119 | unset($sql); |
||
120 | |||
121 | $sql = 'SELECT * FROM ' . $GLOBALS['xoopsDB']->prefix('xoopstube_broken') . ' WHERE lid=' . $lid; |
||
122 | $brokeArray = $GLOBALS['xoopsDB']->fetchArray($GLOBALS['xoopsDB']->query($sql)); |
||
123 | xoops_load('XoopsUserUtility'); |
||
124 | if (is_array($brokeArray)) { |
||
125 | $broken['title'] = htmlspecialchars($videoArray['title'], ENT_QUOTES | ENT_HTML5); |
||
126 | $broken['id'] = $brokeArray['reportid']; |
||
127 | $broken['reporter'] = \XoopsUserUtility::getUnameFromId($brokeArray['sender']); |
||
128 | $broken['date'] = Utility::getTimestamp(formatTimestamp($brokeArray['date'], $GLOBALS['xoopsModuleConfig']['dateformat'])); |
||
129 | $broken['acknowledged'] = (1 == $brokeArray['acknowledged']) ? _YES : _NO; |
||
130 | $broken['confirmed'] = (1 == $brokeArray['confirmed']) ? _YES : _NO; |
||
131 | $xoopsTpl->assign('broken', $broken); |
||
132 | $xoopsTpl->assign('brokenreport', true); |
||
133 | } else { |
||
134 | if (!is_array($videoArray) || empty($videoArray)) { |
||
135 | $ratemessage = _MD_XOOPSTUBE_THISFILEDOESNOTEXIST; |
||
136 | redirect_header('singlevideo.php?cid=' . (int)$cid . '&lid=' . $lid, 0, $ratemessage); |
||
137 | } |
||
138 | |||
139 | // file info |
||
140 | $video['title'] = htmlspecialchars($videoArray['title'], ENT_QUOTES | ENT_HTML5); |
||
141 | $time = ($videoArray['published'] > 0) ? $videoArray['published'] : $link_arr['updated']; |
||
142 | $video['updated'] = Utility::getTimestamp(formatTimestamp($time, $GLOBALS['xoopsModuleConfig']['dateformat'])); |
||
143 | $isUpdated = (0 !== $videoArray['updated']) ? _MD_XOOPSTUBE_UPDATEDON : _MD_XOOPSTUBE_SUBMITDATE; |
||
144 | |||
145 | $video['publisher'] = \XoopsUserUtility::getUnameFromId($videoArray['submitter']); |
||
146 | |||
147 | $xoopsTpl->assign('video_id', $lid); |
||
148 | $xoopsTpl->assign('lang_subdate', $isUpdated); |
||
149 | $xoopsTpl->assign('video', $video); |
||
150 | } |
||
151 | |||
152 | Utility::setNoIndexNoFollow(); |
||
153 | |||
154 | $xoopsTpl->assign('module_dir', $xoopsModule->getVar('dirname')); |
||
155 | require_once XOOPS_ROOT_PATH . '/footer.php'; |
||
156 | break; |
||
157 | } |
||
158 |