This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Smarty plugin |
||
4 | * @package Smarty |
||
5 | * @subpackage plugins |
||
6 | */ |
||
7 | |||
8 | |||
9 | /** |
||
10 | * Smarty {mailto} function plugin |
||
11 | * |
||
12 | * Type: function<br> |
||
13 | * Name: mailto<br> |
||
14 | * Date: May 21, 2002 |
||
15 | * Purpose: automate mailto address link creation, and optionally |
||
16 | * encode them.<br> |
||
17 | * Input:<br> |
||
18 | * - address = e-mail address |
||
19 | * - text = (optional) text to display, default is address |
||
20 | * - encode = (optional) can be one of: |
||
21 | * * none : no encoding (default) |
||
22 | * * javascript : encode with javascript |
||
23 | * * javascript_charcode : encode with javascript charcode |
||
24 | * * hex : encode with hexidecimal (no javascript) |
||
25 | * - cc = (optional) address(es) to carbon copy |
||
26 | * - bcc = (optional) address(es) to blind carbon copy |
||
27 | * - subject = (optional) e-mail subject |
||
28 | * - newsgroups = (optional) newsgroup(s) to post to |
||
29 | * - followupto = (optional) address(es) to follow up to |
||
30 | * - extra = (optional) extra tags for the href link |
||
31 | * |
||
32 | * Examples: |
||
33 | * <pre> |
||
34 | * {mailto address="[email protected]"} |
||
35 | * {mailto address="[email protected]" encode="javascript"} |
||
36 | * {mailto address="[email protected]" encode="hex"} |
||
37 | * {mailto address="[email protected]" subject="Hello to you!"} |
||
38 | * {mailto address="[email protected]" cc="[email protected],[email protected]"} |
||
39 | * {mailto address="[email protected]" extra='class="mailto"'} |
||
40 | * </pre> |
||
41 | * @link http://smarty.php.net/manual/en/language.function.mailto.php {mailto} |
||
42 | * (Smarty online manual) |
||
43 | * @version 1.2 |
||
44 | * @author Monte Ohrt <monte at ohrt dot com> |
||
45 | * @author credits to Jason Sweat (added cc, bcc and subject functionality) |
||
46 | * @param array |
||
47 | * @param Smarty |
||
48 | * @return string |
||
49 | */ |
||
50 | function smarty_function_mailto($params, &$smarty) |
||
51 | { |
||
52 | $extra = ''; |
||
53 | |||
54 | if (empty($params['address'])) { |
||
55 | $smarty->trigger_error("mailto: missing 'address' parameter"); |
||
56 | return; |
||
57 | } else { |
||
58 | $address = $params['address']; |
||
59 | } |
||
60 | |||
61 | $text = $address; |
||
62 | |||
63 | // netscape and mozilla do not decode %40 (@) in BCC field (bug?) |
||
64 | // so, don't encode it. |
||
65 | $search = array('%40', '%2C'); |
||
66 | $replace = array('@', ','); |
||
67 | $mail_parms = array(); |
||
68 | foreach ($params as $var=>$value) { |
||
69 | switch ($var) { |
||
70 | case 'cc': |
||
71 | case 'bcc': |
||
72 | case 'followupto': |
||
73 | if (!empty($value)) |
||
74 | $mail_parms[] = $var.'='.str_replace($search,$replace,rawurlencode($value)); |
||
75 | break; |
||
76 | |||
77 | case 'subject': |
||
78 | case 'newsgroups': |
||
79 | $mail_parms[] = $var.'='.rawurlencode($value); |
||
80 | break; |
||
81 | |||
82 | case 'extra': |
||
83 | case 'text': |
||
0 ignored issues
–
show
Coding Style
introduced
by
![]() |
|||
84 | $$var = $value; |
||
85 | |||
86 | default: |
||
87 | } |
||
88 | } |
||
89 | |||
90 | $mail_parm_vals = ''; |
||
91 | for ($i=0; $i<count($mail_parms); $i++) { |
||
0 ignored issues
–
show
It seems like you are calling the size function
count() as part of the test condition. You might want to compute the size beforehand, and not on each iteration.
If the size of the collection does not change during the iteration, it is generally a good practice to compute it beforehand, and not on each iteration: for ($i=0; $i<count($array); $i++) { // calls count() on each iteration
}
// Better
for ($i=0, $c=count($array); $i<$c; $i++) { // calls count() just once
}
![]() |
|||
92 | $mail_parm_vals .= (0==$i) ? '?' : '&'; |
||
93 | $mail_parm_vals .= $mail_parms[$i]; |
||
94 | } |
||
95 | $address .= $mail_parm_vals; |
||
96 | |||
97 | $encode = (empty($params['encode'])) ? 'none' : $params['encode']; |
||
98 | if (!in_array($encode,array('javascript','javascript_charcode','hex','none')) ) { |
||
99 | $smarty->trigger_error("mailto: 'encode' parameter must be none, javascript or hex"); |
||
100 | return; |
||
101 | } |
||
102 | |||
103 | if ($encode == 'javascript' ) { |
||
104 | $string = 'document.write(\'<a href="mailto:'.$address.'" '.$extra.'>'.$text.'</a>\');'; |
||
105 | |||
106 | $js_encode = ''; |
||
107 | for ($x=0; $x < strlen($string); $x++) { |
||
108 | $js_encode .= '%' . bin2hex($string[$x]); |
||
109 | } |
||
110 | |||
111 | return '<script type="text/javascript">eval(unescape(\''.$js_encode.'\'))</script>'; |
||
112 | |||
113 | } elseif ($encode == 'javascript_charcode' ) { |
||
114 | $string = '<a href="mailto:'.$address.'" '.$extra.'>'.$text.'</a>'; |
||
115 | |||
116 | for($x = 0, $y = strlen($string); $x < $y; $x++ ) { |
||
117 | $ord[] = ord($string[$x]); |
||
118 | } |
||
119 | |||
120 | $_ret = "<script type=\"text/javascript\" language=\"javascript\">\n"; |
||
121 | $_ret .= "<!--\n"; |
||
122 | $_ret .= "{document.write(String.fromCharCode("; |
||
123 | $_ret .= implode(',',$ord); |
||
124 | $_ret .= "))"; |
||
125 | $_ret .= "}\n"; |
||
126 | $_ret .= "//-->\n"; |
||
127 | $_ret .= "</script>\n"; |
||
128 | |||
129 | return $_ret; |
||
130 | |||
131 | |||
132 | } elseif ($encode == 'hex') { |
||
133 | |||
134 | preg_match('!^(.*)(\?.*)$!',$address,$match); |
||
135 | if(!empty($match[2])) { |
||
136 | $smarty->trigger_error("mailto: hex encoding does not work with extra attributes. Try javascript."); |
||
137 | return; |
||
138 | } |
||
139 | $address_encode = ''; |
||
140 | for ($x=0; $x < strlen($address); $x++) { |
||
141 | if(preg_match('!\w!',$address[$x])) { |
||
142 | $address_encode .= '%' . bin2hex($address[$x]); |
||
143 | } else { |
||
144 | $address_encode .= $address[$x]; |
||
145 | } |
||
146 | } |
||
147 | $text_encode = ''; |
||
148 | for ($x=0; $x < strlen($text); $x++) { |
||
149 | $text_encode .= '&#x' . bin2hex($text[$x]).';'; |
||
150 | } |
||
151 | |||
152 | $mailto = "mailto:"; |
||
153 | return '<a href="'.$mailto.$address_encode.'" '.$extra.'>'.$text_encode.'</a>'; |
||
154 | |||
155 | } else { |
||
156 | // no encoding |
||
157 | return '<a href="mailto:'.$address.'" '.$extra.'>'.$text.'</a>'; |
||
158 | |||
159 | } |
||
160 | |||
161 | } |
||
162 | |||
163 | /* vim: set expandtab: */ |
||
164 | |||
165 | ?> |
||
166 |