This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * |
||
| 4 | * @package sitemaker |
||
| 5 | * @copyright (c) 2016 Daniel A. (blitze) |
||
| 6 | * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2 |
||
| 7 | * |
||
| 8 | */ |
||
| 9 | |||
| 10 | namespace blitze\content\services\comments; |
||
| 11 | |||
| 12 | class comments extends form implements comments_interface |
||
| 13 | { |
||
| 14 | /** @var \phpbb\content_visibility */ |
||
| 15 | protected $content_visibility; |
||
| 16 | |||
| 17 | /** @var \phpbb\db\driver\driver_interface */ |
||
| 18 | protected $db; |
||
| 19 | |||
| 20 | /** @var \phpbb\pagination */ |
||
| 21 | protected $pagination; |
||
| 22 | |||
| 23 | /** @var \phpbb\request\request_interface */ |
||
| 24 | protected $request; |
||
| 25 | |||
| 26 | /** @var \phpbb\template\context */ |
||
| 27 | protected $template_context; |
||
| 28 | |||
| 29 | /** @var \blitze\sitemaker\services\forum\data */ |
||
|
0 ignored issues
–
show
|
|||
| 30 | protected $forum; |
||
| 31 | |||
| 32 | /** @var \blitze\content\services\topic */ |
||
| 33 | protected $topic; |
||
| 34 | |||
| 35 | /** @var array */ |
||
| 36 | private $sort_dir_sql = array('a' => 'ASC', 'd' => 'DESC'); |
||
| 37 | |||
| 38 | /** @var array */ |
||
| 39 | private $sort_by_sql = array( |
||
| 40 | 't' => 'p.post_time', |
||
| 41 | 's' => 'p.post_subject, p.post_id', |
||
| 42 | ); |
||
| 43 | |||
| 44 | /** |
||
| 45 | * Constructor |
||
| 46 | * |
||
| 47 | * @param \phpbb\auth\auth $auth Auth object |
||
| 48 | * @param \phpbb\config\config $config Config object |
||
| 49 | * @param \phpbb\content_visibility $content_visibility Phpbb Content visibility object |
||
| 50 | * @param \phpbb\db\driver\driver_interface $db Database object |
||
| 51 | * @param \phpbb\language\language $language Language Object |
||
| 52 | * @param \phpbb\pagination $pagination Pagination object |
||
| 53 | * @param \phpbb\request\request_interface $request Request object |
||
| 54 | * @param \phpbb\template\template $template Template object |
||
| 55 | * @param \phpbb\template\context $template_context Template context object |
||
| 56 | * @param \phpbb\user $user User object |
||
| 57 | * @param \blitze\sitemaker\services\forum\data $forum Forum Data object |
||
| 58 | * @param \blitze\content\services\topic $topic Topic object |
||
| 59 | * @param string $root_path Path to the phpbb directory. |
||
| 60 | * @param string $php_ext php file extension |
||
| 61 | */ |
||
| 62 | public function __construct(\phpbb\auth\auth $auth, \phpbb\config\config $config, \phpbb\content_visibility $content_visibility, \phpbb\db\driver\driver_interface $db, \phpbb\language\language $language, \phpbb\pagination $pagination, \phpbb\request\request_interface $request, \phpbb\template\template $template, \phpbb\template\context $template_context, \phpbb\user $user, \blitze\sitemaker\services\forum\data $forum, \blitze\content\services\topic $topic, $root_path, $php_ext) |
||
| 63 | { |
||
| 64 | parent::__construct($auth, $config, $language, $template, $user, $root_path, $php_ext); |
||
| 65 | |||
| 66 | $this->content_visibility = $content_visibility; |
||
| 67 | $this->db = $db; |
||
| 68 | $this->pagination = $pagination; |
||
| 69 | $this->request = $request; |
||
| 70 | $this->template_context = $template_context; |
||
| 71 | $this->forum = $forum; |
||
| 72 | $this->topic = $topic; |
||
| 73 | } |
||
| 74 | |||
| 75 | /** |
||
| 76 | * @inheritdoc |
||
| 77 | */ |
||
| 78 | public function get_langname() |
||
| 79 | { |
||
| 80 | return 'COMMENTS'; |
||
| 81 | } |
||
| 82 | |||
| 83 | /** |
||
| 84 | * @inheritdoc |
||
| 85 | */ |
||
| 86 | public function count(array $topic_data) |
||
| 87 | { |
||
| 88 | return $this->content_visibility->get_count('topic_posts', $topic_data, $topic_data['forum_id']) - 1; |
||
| 89 | } |
||
| 90 | |||
| 91 | /** |
||
| 92 | * Show comments for topic |
||
| 93 | * |
||
| 94 | * @param string $content_type |
||
| 95 | * @param array $topic_data |
||
| 96 | * @param array $update_count |
||
| 97 | * @param array $settings |
||
| 98 | * @return void |
||
| 99 | */ |
||
| 100 | public function show_comments($content_type, array $topic_data, array &$update_count, array $settings = array()) |
||
| 101 | { |
||
| 102 | if ($topic_data['total_comments']) |
||
| 103 | { |
||
| 104 | $view = $this->request->variable('view', ''); |
||
| 105 | $start = $this->request->variable('start', 0); |
||
| 106 | $post_id = $this->request->variable('p', 0); |
||
| 107 | |||
| 108 | $this->find_unread($view, $topic_data); |
||
| 109 | |||
| 110 | $sort_days = 0; |
||
| 111 | $sort_key = $sort_dir = $u_sort_param = ''; |
||
| 112 | $this->set_sorting_options($sort_days, $sort_key, $sort_dir, $u_sort_param); |
||
| 113 | |||
| 114 | $base_url = append_sid(trim(build_url(array('start', 'p')), '?'), (strlen($u_sort_param)) ? $u_sort_param : ''); |
||
| 115 | $this->build_pagination($start, (int) $settings['per_page'], $post_id, $topic_data, $sort_dir, $base_url); |
||
| 116 | |||
| 117 | $this->forum->query() |
||
| 118 | ->fetch_date_range(time(), $sort_days * 86400, 'post') |
||
| 119 | ->build(); |
||
| 120 | $posts_data = $this->forum->get_post_data(false, array(), $settings['per_page'], $start, array( |
||
| 121 | 'WHERE' => array( |
||
| 122 | 'p.topic_id = ' . (int) $topic_data['topic_id'], |
||
| 123 | 'p.post_id <> ' . (int) $topic_data['topic_first_post_id'], |
||
| 124 | ), |
||
| 125 | 'ORDER_BY' => $this->sort_by_sql[$sort_key] . ' ' . $this->sort_dir_sql[$sort_dir], |
||
| 126 | )); |
||
| 127 | |||
| 128 | $topic_tracking_info = $this->forum->get_topic_tracking_info(); |
||
| 129 | $users_cache = $this->forum->get_posters_info(); |
||
| 130 | |||
| 131 | $this->show_posts($topic_data, array_values(array_shift($posts_data)), $topic_tracking_info, $users_cache, $update_count, $content_type, $start); |
||
| 132 | } |
||
| 133 | } |
||
| 134 | |||
| 135 | /** |
||
| 136 | * @param array $topic_data |
||
| 137 | * @param array $posts_data |
||
| 138 | * @param array $topic_tracking_info |
||
| 139 | * @param array $users_cache |
||
| 140 | * @param array $update_count |
||
| 141 | * @param string $type |
||
| 142 | * @param int $start |
||
| 143 | * @return void |
||
| 144 | */ |
||
| 145 | protected function show_posts(array $topic_data, array $posts_data, array $topic_tracking_info, array $users_cache, array &$update_count, $type, $start) |
||
| 146 | { |
||
| 147 | $attachments = $this->forum->get_attachments($topic_data['forum_id']); |
||
| 148 | $this->set_form_action($topic_data['topic_url'], $start); |
||
| 149 | |||
| 150 | for ($i = 0, $size = sizeof($posts_data); $i < $size; $i++) |
||
| 151 | { |
||
| 152 | $row = $posts_data[$i]; |
||
| 153 | $poster_id = $row['poster_id']; |
||
| 154 | |||
| 155 | $this->template->assign_block_vars('postrow', array_merge( |
||
| 156 | $this->topic->get_detail_template_data($type, $topic_data, $row, $users_cache, $attachments, $topic_tracking_info, $update_count), |
||
| 157 | $this->get_attachments_tpl_data($row['post_id'], $attachments), |
||
| 158 | array( |
||
| 159 | 'POST_SUBJECT' => $row['post_subject'], |
||
| 160 | 'POST_DATE' => $this->user->format_date($row['post_time'], false, false), |
||
| 161 | 'POSTER_WARNINGS' => $this->get_poster_warnings($users_cache[$poster_id]), |
||
| 162 | 'S_POST_REPORTED' => $this->get_report_status($row), |
||
| 163 | 'S_TOPIC_POSTER' => ($topic_data['topic_poster'] == $poster_id) ? true : false, |
||
| 164 | ) |
||
| 165 | )); |
||
| 166 | |||
| 167 | $this->topic->show_attachments($attachments, $row['post_id'], 'postrow.attachment'); |
||
| 168 | } |
||
| 169 | } |
||
| 170 | |||
| 171 | /** |
||
| 172 | * @param string $view |
||
| 173 | * @param array $topic_data |
||
| 174 | * @retrun void |
||
| 175 | */ |
||
| 176 | protected function find_unread($view, array $topic_data) |
||
| 177 | { |
||
| 178 | if ($view === 'unread') |
||
| 179 | { |
||
| 180 | $forum_id = (int) $topic_data['forum_id']; |
||
| 181 | $topic_id = (int) $topic_data['topic_id']; |
||
| 182 | |||
| 183 | // Get topic tracking info |
||
| 184 | $topic_tracking_info = get_complete_topic_tracking($forum_id, $topic_id); |
||
| 185 | $topic_last_read = (isset($topic_tracking_info[$topic_id])) ? $topic_tracking_info[$topic_id] : 0; |
||
| 186 | |||
| 187 | $sql = 'SELECT post_id, topic_id, forum_id |
||
| 188 | FROM ' . POSTS_TABLE . " |
||
| 189 | WHERE topic_id = $topic_id |
||
| 190 | AND " . $this->content_visibility->get_visibility_sql('post', $forum_id) . " |
||
| 191 | AND post_time > $topic_last_read |
||
| 192 | AND forum_id = $forum_id |
||
| 193 | ORDER BY post_time ASC, post_id ASC"; |
||
| 194 | $result = $this->db->sql_query_limit($sql, 1); |
||
| 195 | $row = $this->db->sql_fetchrow($result); |
||
| 196 | $this->db->sql_freeresult($result); |
||
| 197 | |||
| 198 | if ($row) |
||
| 199 | { |
||
| 200 | redirect(append_sid($topic_data['topic_url'], 'p=' . $row['post_id']) . '#p' . $row['post_id']); |
||
| 201 | } |
||
| 202 | } |
||
| 203 | } |
||
| 204 | |||
| 205 | /** |
||
| 206 | * This is for determining where we are (page) |
||
| 207 | * @param int $start |
||
| 208 | * @param int $posts_per_page |
||
| 209 | * @param int $post_id |
||
| 210 | * @param array $topic_data |
||
| 211 | * @param string $sort_dir |
||
| 212 | * @param string $base_url |
||
| 213 | * @return void |
||
| 214 | */ |
||
| 215 | protected function build_pagination(&$start, $posts_per_page, $post_id, array $topic_data, $sort_dir, $base_url) |
||
| 216 | { |
||
| 217 | if ($post_id) |
||
| 218 | { |
||
| 219 | $post_info = $this->get_post_info($post_id); |
||
| 220 | $this->check_requested_post_id($post_info, $topic_data, $base_url); |
||
| 221 | |||
| 222 | $prev_posts = $this->get_next_posts_count($post_info, $topic_data, $sort_dir, $post_id); |
||
| 223 | $start = (int) floor($prev_posts / $posts_per_page) * $posts_per_page; |
||
| 224 | } |
||
| 225 | |||
| 226 | $start = $this->pagination->validate_start($start, $posts_per_page, $topic_data['total_comments']); |
||
| 227 | $this->pagination->generate_template_pagination($base_url, 'pagination', 'start', $topic_data['total_comments'], $posts_per_page, $start); |
||
| 228 | $this->add_comment_anchor_to_pages(); |
||
| 229 | } |
||
| 230 | |||
| 231 | /** |
||
| 232 | * @return void |
||
| 233 | */ |
||
| 234 | protected function add_comment_anchor_to_pages() |
||
| 235 | { |
||
| 236 | $data =& $this->template_context->get_data_ref()['pagination']; |
||
| 237 | $data = (array) $data; |
||
| 238 | |||
| 239 | foreach ($data as &$row) |
||
| 240 | { |
||
| 241 | $row['PAGE_URL'] .= '#comments'; |
||
| 242 | } |
||
| 243 | } |
||
| 244 | |||
| 245 | /** |
||
| 246 | * @param array $post_info |
||
| 247 | * @param array $topic_data |
||
| 248 | * @param string $base_url |
||
| 249 | * @return void |
||
| 250 | */ |
||
| 251 | protected function check_requested_post_id(array $post_info, array $topic_data, $base_url) |
||
| 252 | { |
||
| 253 | // are we where we are supposed to be? |
||
| 254 | if (($post_info['post_visibility'] == ITEM_UNAPPROVED || $post_info['post_visibility'] == ITEM_REAPPROVE) && !$this->auth->acl_get('m_approve', $topic_data['forum_id'])) |
||
| 255 | { |
||
| 256 | // If post_id was submitted, we try at least to display the topic as a last resort... |
||
| 257 | if ($topic_data['topic_id']) |
||
| 258 | { |
||
| 259 | redirect($base_url); |
||
| 260 | } |
||
| 261 | |||
| 262 | trigger_error('NO_TOPIC'); |
||
| 263 | } |
||
| 264 | } |
||
| 265 | |||
| 266 | /** |
||
| 267 | * @param array $post_info |
||
| 268 | * @param array $topic_data |
||
| 269 | * @param string $sort_dir |
||
| 270 | * @param int $post_id |
||
| 271 | * @return int |
||
| 272 | */ |
||
| 273 | protected function get_next_posts_count(array $post_info, array $topic_data, $sort_dir, $post_id) |
||
| 274 | { |
||
| 275 | if ($post_id == $topic_data['topic_first_post_id'] || $post_id == $topic_data['topic_last_post_id']) |
||
| 276 | { |
||
| 277 | $check_sort = ($post_id == $topic_data['topic_first_post_id']) ? 'd' : 'a'; |
||
| 278 | |||
| 279 | $prev_posts_count = 0; |
||
| 280 | if ($sort_dir == $check_sort) |
||
| 281 | { |
||
| 282 | $prev_posts_count = $this->content_visibility->get_count('topic_posts', $topic_data, $topic_data['forum_id']) - 1; |
||
| 283 | } |
||
| 284 | return $prev_posts_count; |
||
| 285 | } |
||
| 286 | else |
||
| 287 | { |
||
| 288 | return $this->get_prev_posts_count($post_info, $topic_data['forum_id'], $topic_data['topic_id'], $sort_dir) - 1; |
||
| 289 | } |
||
| 290 | } |
||
| 291 | |||
| 292 | /** |
||
| 293 | * @param array $row |
||
| 294 | * @param int $forum_id |
||
| 295 | * @param int $topic_id |
||
| 296 | * @param string $sort_dir |
||
| 297 | * @return int |
||
| 298 | */ |
||
| 299 | protected function get_prev_posts_count(array $row, $forum_id, $topic_id, $sort_dir) |
||
| 300 | { |
||
| 301 | $sql = 'SELECT COUNT(p.post_id) AS prev_posts |
||
| 302 | FROM ' . POSTS_TABLE . " p |
||
| 303 | WHERE p.topic_id = $topic_id |
||
| 304 | AND " . $this->content_visibility->get_visibility_sql('post', $forum_id, 'p.'); |
||
| 305 | |||
| 306 | if ($sort_dir == 'd') |
||
| 307 | { |
||
| 308 | $sql .= " AND (p.post_time > {$row['post_time']} OR (p.post_time = {$row['post_time']} AND p.post_id >= {$row['post_id']}))"; |
||
| 309 | } |
||
| 310 | else |
||
| 311 | { |
||
| 312 | $sql .= " AND (p.post_time < {$row['post_time']} OR (p.post_time = {$row['post_time']} AND p.post_id <= {$row['post_id']}))"; |
||
| 313 | } |
||
| 314 | |||
| 315 | $result = $this->db->sql_query($sql); |
||
| 316 | $row = $this->db->sql_fetchrow($result); |
||
| 317 | $this->db->sql_freeresult($result); |
||
| 318 | |||
| 319 | return $row['prev_posts']; |
||
| 320 | } |
||
| 321 | |||
| 322 | /** |
||
| 323 | * @param int $post_id |
||
| 324 | * @return array |
||
| 325 | */ |
||
| 326 | protected function get_post_info($post_id) |
||
| 327 | { |
||
| 328 | $sql = 'SELECT post_id, post_time, post_visibility |
||
| 329 | FROM ' . POSTS_TABLE . ' p |
||
| 330 | WHERE post_id = ' . (int) $post_id; |
||
| 331 | $result = $this->db->sql_query($sql); |
||
| 332 | $row = $this->db->sql_fetchrow($result); |
||
| 333 | $this->db->sql_freeresult($result); |
||
| 334 | |||
| 335 | return $row; |
||
| 336 | } |
||
| 337 | |||
| 338 | /** |
||
| 339 | * @param int $sort_days |
||
| 340 | * @param string $sort_key |
||
| 341 | * @param string $sort_dir |
||
| 342 | * @param string $u_sort_param |
||
| 343 | * @return void |
||
| 344 | */ |
||
| 345 | protected function set_sorting_options(&$sort_days, &$sort_key, &$sort_dir, &$u_sort_param) |
||
| 346 | { |
||
| 347 | $default_sort_days = (!empty($this->user->data['user_post_show_days'])) ? $this->user->data['user_post_show_days'] : 0; |
||
| 348 | $default_sort_key = (!empty($this->user->data['user_post_sortby_type'])) ? $this->user->data['user_post_sortby_type'] : 't'; |
||
| 349 | $default_sort_dir = (!empty($this->user->data['user_post_sortby_dir'])) ? $this->user->data['user_post_sortby_dir'] : 'a'; |
||
| 350 | |||
| 351 | $sort_days = $this->request->variable('st', $default_sort_days); |
||
| 352 | $sort_key = $this->request->variable('sk', $default_sort_key); |
||
| 353 | $sort_dir = $this->request->variable('sd', $default_sort_dir); |
||
| 354 | |||
| 355 | $limit_days = array(0 => $this->language->lang('ALL_POSTS'), 1 => $this->language->lang('1_DAY'), 7 => $this->language->lang('7_DAYS'), 14 => $this->language->lang('2_WEEKS'), 30 => $this->language->lang('1_MONTH'), 90 => $this->language->lang('3_MONTHS'), 180 => $this->language->lang('6_MONTHS'), 365 => $this->language->lang('1_YEAR')); |
||
| 356 | $sort_by_text = array('t' => $this->language->lang('POST_TIME'), 's' => $this->language->lang('SUBJECT')); |
||
| 357 | |||
| 358 | $s_limit_days = $s_sort_key = $s_sort_dir = ''; |
||
| 359 | gen_sort_selects($limit_days, $sort_by_text, $sort_days, $sort_key, $sort_dir, $s_limit_days, $s_sort_key, $s_sort_dir, $u_sort_param, $default_sort_days, $default_sort_key, $default_sort_dir); |
||
| 360 | |||
| 361 | $this->template->assign_vars(array( |
||
| 362 | 'S_SELECT_SORT_DIR' => $s_sort_dir, |
||
| 363 | 'S_SELECT_SORT_KEY' => $s_sort_key, |
||
| 364 | 'S_SELECT_SORT_DAYS' => $s_limit_days, |
||
| 365 | )); |
||
| 366 | } |
||
| 367 | |||
| 368 | /** |
||
| 369 | * @param int $post_id |
||
| 370 | * @param array $attachments |
||
| 371 | * @return array |
||
| 372 | */ |
||
| 373 | protected function get_attachments_tpl_data($post_id, array $attachments) |
||
| 374 | { |
||
| 375 | $has_attachments = $multi_attachments = false; |
||
| 376 | if (!empty($attachments[$post_id])) |
||
| 377 | { |
||
| 378 | $has_attachments = true; |
||
| 379 | $multi_attachments = sizeof($attachments[$post_id]) > 1; |
||
| 380 | } |
||
| 381 | |||
| 382 | return array( |
||
| 383 | 'S_HAS_ATTACHMENTS' => $has_attachments, |
||
| 384 | 'S_MULTIPLE_ATTACHMENTS' => $multi_attachments, |
||
| 385 | ); |
||
| 386 | } |
||
| 387 | |||
| 388 | /** |
||
| 389 | * @param array $poster_info |
||
| 390 | * @return int |
||
| 391 | */ |
||
| 392 | protected function get_poster_warnings(array $poster_info) |
||
| 393 | { |
||
| 394 | return ($this->auth->acl_get('m_warn') && !empty($poster_info['warnings'])) ? $poster_info['warnings'] : 0; |
||
| 395 | } |
||
| 396 | |||
| 397 | /** |
||
| 398 | * @param array $row |
||
| 399 | * @return bool |
||
| 400 | */ |
||
| 401 | protected function get_report_status(array $row) |
||
| 402 | { |
||
| 403 | return ($row['post_reported'] && $this->auth->acl_get('m_report', $row['forum_id'])) ? true : false; |
||
| 404 | } |
||
| 405 | |||
| 406 | /** |
||
| 407 | * @param string $topic_url |
||
| 408 | * @param int $start |
||
| 409 | * @return void |
||
| 410 | */ |
||
| 411 | protected function set_form_action($topic_url, $start) |
||
| 412 | { |
||
| 413 | $this->template->assign_var('S_TOPIC_ACTION', append_sid($topic_url, (($start == 0) ? '' : "start=$start")) . '#comments'); |
||
| 414 | } |
||
| 415 | } |
||
| 416 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"], you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths