Issues (10)

Security Analysis    no request data  

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

modules/links.php (2 issues)

Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
*
4
* @package Board3 Portal v2.1
5
* @copyright (c) 2013 Board3 Group ( www.board3.de )
6
* @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2
7
*
8
*/
9
10
namespace board3\portal\modules;
11
12
/**
13
* @package Links
14
*/
15
class links extends module_base
16
{
17
	/**
18
	* Allowed columns: Just sum up your options (Exp: left + right = 10)
19
	* top		1
20
	* left		2
21
	* center	4
22
	* right		8
23
	* bottom	16
24
	*/
25
	public $columns = 10;
26
27
	/**
28
	* Default modulename
29
	*/
30
	public $name = 'PORTAL_LINKS';
31
32
	/**
33
	* Default module-image:
34
	* file must be in "{T_THEME_PATH}/images/portal/"
35
	*/
36
	public $image_src = 'portal_links.png';
37
38
	/**
39
	* module-language file
40
	* file must be in "language/{$user->lang}/mods/portal/"
41
	*/
42
	public $language = 'portal_links_module';
43
44
	/**
45
	* custom acp template
46
	* file must be in "adm/style/portal/"
47
	*/
48
	public $custom_acp_tpl = 'acp_portal_links';
49
50
	/** @var bool Can include this module multiple times */
51
	protected $multiple_includes = true;
52
53
	/**
54
	* constants
55
	*/
56
	const LINK_INT = 1;
57
	const LINK_EXT = 2;
58
59
	/** @var \phpbb\config\config */
60
	protected $config;
61
62
	/** @var \phpbb\db\driver\driver_interface */
63
	protected $db;
64
65
	/** @var \phpbb\request\request */
66
	protected $request;
67
68
	/** @var \phpbb\template\template */
69
	protected $template;
70
71
	/** @var string PHP file extension */
72
	protected $php_ext;
73
74
	/** @var string phpBB root path */
75
	protected $phpbb_root_path;
76
77
	/** @var \phpbb\user */
78
	protected $user;
79
80
	/** @var \phpbb\log\log phpBB log */
81
	protected $log;
82
83
	/**
84
	* Construct a links object
85
	*
86
	* @param \phpbb\config\config $config phpBB config
87
	* @param \phpbb\db\driver\driver_interface $db phpBB db driver
88
	* @param \phpbb\request\request $request phpBB request
89
	* @param \phpbb\template\template $template phpBB template
90
	* @param string $phpEx php file extension
91
	* @param string $phpbb_root_path phpBB root path
92
	* @param \phpbb\user $user phpBB user object
93
	* @param \phpbb\log\log phpBB log
94
	*/
95 View Code Duplication
	public function __construct($config, $db, $request, $template, $phpbb_root_path, $phpEx, $user, $log)
96
	{
97
		$this->config = $config;
98
		$this->db = $db;
99
		$this->request = $request;
100
		$this->template = $template;
101
		$this->php_ext = $phpEx;
102
		$this->phpbb_root_path = $phpbb_root_path;
103
		$this->user = $user;
104
		$this->log = $log;
105
	}
106
107
	/**
108
	* {@inheritdoc}
109
	*/
110
	public function get_template_side($module_id)
111
	{
112
		$portal_config = obtain_portal_config();
113
114
		$links = json_decode($portal_config['board3_links_array_' . $module_id], true);
115
116
		// get user's groups
117
		$groups_ary = get_user_groups();
118
119
		$this->template->assign_block_vars('portal_links', array('MODULE_ID' => $module_id));
120
121
		for ($i = 0; $i < sizeof($links); $i++)
122
		{
123 View Code Duplication
			if ($links[$i]['type'] == self::LINK_INT)
124
			{
125
				$links[$i]['url'] = str_replace('&', '&amp;', $links[$i]['url']); // we need to do this in order to prevent XHTML validation errors
126
				$cur_url = append_sid($this->phpbb_root_path . $links[$i]['url']); // the user should know what kind of file it is
127
			}
128
			else
129
			{
130
				$cur_url = $links[$i]['url'];
131
			}
132
133
			$cur_permissions = explode(',', $links[$i]['permission']);
134
			$permission_check = array_intersect($groups_ary, $cur_permissions);
135
136 View Code Duplication
			if (!empty($permission_check) || $links[$i]['permission'] == '')
137
			{
138
				$this->template->assign_block_vars('portal_links.links', array(
139
					'LINK_TITLE'		=> (isset($this->user->lang[$links[$i]['title']])) ? $this->user->lang[$links[$i]['title']] : $links[$i]['title'],
140
					'LINK_URL'			=> $cur_url,
141
					'MODULE_ID'			=> $module_id,
142
					'NEW_WINDOW'		=> ($links[$i]['type'] != self::LINK_INT && $this->config['board3_links_url_new_window_' . $module_id]) ? true : false,
143
				));
144
			}
145
		}
146
147
		return 'links_side.html';
148
	}
149
150
	/**
151
	* {@inheritdoc}
152
	*/
153 View Code Duplication
	public function get_template_acp($module_id)
154
	{
155
		// do not remove this as it is needed in order to run manage_links
156
		return array(
157
			'title'	=> 'ACP_PORTAL_LINKS',
158
			'vars'	=> array(
159
				'legend1'				=> 'ACP_PORTAL_LINKS',
160
				'board3_links_' . $module_id	=> array('lang' => 'ACP_PORTAL_MENU_MANAGE', 'validate' => 'string',	'type' => 'custom',	'explain' => true, 'method' => 'manage_links', 'submit' => 'update_links'),
161
				'board3_links_url_new_window_' . $module_id => array('lang' => 'ACP_PORTAL_LINKS_NEW_WINDOW', 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => false),
162
			),
163
		);
164
	}
165
166
	/**
167
	* {@inheritdoc}
168
	*/
169
	public function install($module_id)
170
	{
171
		$links = array();
172
173
		$links_titles = array(
174
			'Board3.de',
175
			'phpBB.com',
176
		);
177
178
		$links_types = array(
179
			self::LINK_EXT,
180
			self::LINK_EXT,
181
		);
182
183
		$links_urls = array(
184
			'http://www.board3.de/',
185
			'http://www.phpbb.com/',
186
		);
187
188
		$links_permissions = array(
189
			'',
190
			'',
191
		);
192
193 View Code Duplication
		foreach ($links_urls as $i => $url)
194
		{
195
			$links[] = array(
196
				'title' 		=> $links_titles[$i],
197
				'url'			=> $links_urls[$i],
198
				'type'			=> $links_types[$i],
199
				'permission'	=> $links_permissions[$i],
200
			);
201
		}
202
203
		$board3_menu_array = json_encode($links);
204
		set_portal_config('board3_links_array_' . $module_id, $board3_menu_array);
205
		$this->config->set('board3_links_' . $module_id, '');
206
		$this->config->set('board3_links_url_new_window_' . $module_id, 0);
207
208
		return true;
209
	}
210
211
	/**
212
	* {@inheritdoc}
213
	*/
214 View Code Duplication
	public function uninstall($module_id, $db)
215
	{
216
		$del_config = array(
217
			'board3_links_array_' . $module_id,
218
		);
219
		$sql = 'DELETE FROM ' . PORTAL_CONFIG_TABLE . '
220
			WHERE ' . $db->sql_in_set('config_name', $del_config);
221
222
		$db->sql_query($sql);
223
224
		$del_config = array(
225
			'board3_links_' . $module_id,
226
			'board3_links_url_new_window_' . $module_id
227
		);
228
		$sql = 'DELETE FROM ' . CONFIG_TABLE . '
229
			WHERE ' . $db->sql_in_set('config_name', $del_config);
230
		return $db->sql_query($sql);
231
	}
232
233
	/**
234
	* Manage the links
235
	*
236
	* @param mixed $value Value of input
237
	* @param string $key Key name
238
	* @param int $module_id Module ID
239
	*
240
	* @return null
241
	*/
242
	public function manage_links($value, $key, $module_id)
0 ignored issues
show
The parameter $value is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
The parameter $key is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
243
	{
244
		$action = $this->request->variable('action', '');
245
		$action = ($this->request->is_set_post('add')) ? 'add' : $action;
246
		$action = ($this->request->is_set_post('save')) ? 'save' : $action;
247
		$link_id = $this->request->variable('id', 99999999); // 0 will trigger unwanted behavior, therefore we set a number we should never reach
248
		$portal_config = obtain_portal_config();
249
250
		$links = json_decode($portal_config['board3_links_array_' . $module_id], true);
251
252
		$u_action = append_sid('index.' . $this->php_ext, 'i=-board3-portal-acp-portal_module&amp;mode=config&amp;module_id=' . $module_id);
253
254
		switch ($action)
255
		{
256
			// Save changes
257
			case 'save':
258 View Code Duplication
				if (!check_form_key('acp_portal'))
259
				{
260
					trigger_error($this->user->lang['FORM_INVALID']. adm_back_link($u_action), E_USER_WARNING);
261
				}
262
263
				$link_title = $this->request->variable('link_title', ' ', true);
264
				$link_type = $this->request->variable('link_type', 2); // default to B3_LINK_EXT, no categories in Links block
265
				$link_url = $this->request->variable('link_url', ' ', true);
266
				$link_url = str_replace('&amp;', '&', $link_url);
267
				$link_permission = $this->request->variable('permission-setting-link', array(0 => ''));
268
				$groups_ary = array();
269
270
				// get groups and check if the selected groups actually exist
271
				$sql = 'SELECT group_id
272
						FROM ' . GROUPS_TABLE . '
273
						ORDER BY group_id ASC';
274
				$result = $this->db->sql_query($sql);
275
				while ($row = $this->db->sql_fetchrow($result))
276
				{
277
					$groups_ary[] = $row['group_id'];
278
				}
279
				$this->db->sql_freeresult($result);
280
281
				$link_permissions = array_intersect($link_permission, $groups_ary);
282
				$link_permissions = implode(',', $link_permissions);
283
284
				// Check for errors
285 View Code Duplication
				if (!$link_title)
286
				{
287
					trigger_error($this->user->lang['NO_LINK_TITLE'] . adm_back_link($u_action), E_USER_WARNING);
288
				}
289
290 View Code Duplication
				if (!$link_url)
291
				{
292
					trigger_error($this->user->lang['NO_LINK_URL'] . adm_back_link($u_action), E_USER_WARNING);
293
				}
294
295
				// overwrite already existing links and make sure we don't try to save a link outside of the normal array size of $links
296
				if (isset($link_id) && $link_id < sizeof($links))
297
				{
298
					$message = $this->user->lang['LINK_UPDATED'];
299
300
					$links[$link_id] = array(
301
						'title' 		=> $link_title,
302
						'url'			=> htmlspecialchars_decode($link_url),
303
						'type'			=> $link_type,
304
						'permission'	=> $link_permissions,
305
					);
306
307
					$this->log->add('admin', $this->user->data['user_id'], $this->user->data['user_ip'], 'LOG_PORTAL_LINK_UPDATED', false, array($link_title));
308
				}
309
				else
310
				{
311
					$message = $this->user->lang['LINK_ADDED'];
312
313
					$links[] = array(
314
						'title' 		=> $link_title,
315
						'url'			=> htmlspecialchars_decode($link_url),
316
						'type'			=> $link_type,
317
						'permission'	=> $link_permissions,
318
					);
319
					$this->log->add('admin', $this->user->data['user_id'], $this->user->data['user_ip'],'LOG_PORTAL_LINK_ADDED', false, array($link_title));
320
				}
321
322
				$board3_links_array = json_encode($links);
323
				set_portal_config('board3_links_array_' . $module_id, $board3_links_array);
324
325
				trigger_error($message . adm_back_link($u_action));
326
327
			break;
328
329
			// Delete link
330 View Code Duplication
			case 'delete':
331
332
				if (!isset($link_id) && $link_id >= sizeof($links))
333
				{
334
					trigger_error($this->user->lang['MUST_SELECT_LINK'] . adm_back_link($u_action), E_USER_WARNING);
335
				}
336
337
				if (confirm_box(true))
338
				{
339
					$cur_link_title = $links[$link_id]['title'];
340
					// delete the selected link and reset the array numbering afterwards
341
					array_splice($links, $link_id, 1);
342
					$links = array_merge($links);
343
344
					$board3_links_array = json_encode($links);
345
					set_portal_config('board3_links_array_' . $module_id, $board3_links_array);
346
347
					$this->log->add('admin', $this->user->data['user_id'], $this->user->data['user_ip'], 'LOG_PORTAL_LINK_REMOVED', false, array($cur_link_title));
348
				}
349
				else
350
				{
351
					confirm_box(false, $this->user->lang['CONFIRM_OPERATION'], build_hidden_fields(array(
352
						'link_id'	=> $link_id,
353
						'action'	=> 'delete',
354
					)));
355
				}
356
357
			break;
358
359
			// Move items up or down
360
			case 'move_up':
361 View Code Duplication
			case 'move_down':
362
363
				if (!isset($link_id) && $link_id >= sizeof($links))
364
				{
365
					trigger_error($this->user->lang['MUST_SELECT_LINK'] . adm_back_link($u_action), E_USER_WARNING);
366
				}
367
368
				// make sure we don't try to move a link where it can't be moved
369
				if (($link_id == 0 && $action == 'move_up') || ($link_id == (sizeof($links) - 1) && $action == 'move_down'))
370
				{
371
					break;
372
				}
373
374
				/*
375
				* on move_down, switch position with next order_id...
376
				* on move_up, switch position with previous order_id...
377
				* move up means a lower ID, move down means a higher ID
378
				*/
379
				$switch_order_id = ($action == 'move_down') ? $link_id + 1 : $link_id - 1;
380
381
				// back up the info of the link we want to move
382
				$cur_link = array(
383
					'title' 		=> $links[$link_id]['title'],
384
					'url'			=> $links[$link_id]['url'],
385
					'type'			=> $links[$link_id]['type'],
386
					'permission'	=> $links[$link_id]['permission'],
387
				);
388
389
				// move the info of the links we replace in the order
390
				$links[$link_id] = array(
391
					'title'			=> $links[$switch_order_id]['title'],
392
					'url'			=> $links[$switch_order_id]['url'],
393
					'type'			=> $links[$switch_order_id]['type'],
394
					'permission'	=> $links[$switch_order_id]['permission'],
395
				);
396
397
				// insert the info of the moved link
398
				$links[$switch_order_id] = $cur_link;
399
400
				$board3_links_array = json_encode($links);
401
				set_portal_config('board3_links_array_' . $module_id, $board3_links_array);
402
403
			break;
404
405
			// Edit or add menu item
406
			case 'edit':
407
			case 'add':
408
				$this->template->assign_vars(array(
409
					'LINK_TITLE'	=> (isset($links[$link_id]['title']) && $action != 'add') ? $links[$link_id]['title'] : '',
410
					'LINK_URL'		=> (isset($links[$link_id]['url']) && $action != 'add') ? str_replace('&', '&amp;', $links[$link_id]['url']) : '',
411
412
					'S_EDIT'				=> true,
413
					'S_LINK_IS_INT'			=> (isset($links[$link_id]['type']) && $links[$link_id]['type'] == self::LINK_INT) ? true : false,
414
					'LINK_ID'		=> $link_id,
415
				));
416
417
				$groups_ary = (isset($links[$link_id]['permission'])) ? explode(',', $links[$link_id]['permission']) : array();
418
419
				// get group info from database and assign the block vars
420
				$sql = 'SELECT group_id, group_name 
421
						FROM ' . GROUPS_TABLE . '
422
						ORDER BY group_id ASC';
423
				$result = $this->db->sql_query($sql);
424 View Code Duplication
				while ($row = $this->db->sql_fetchrow($result))
425
				{
426
					$this->template->assign_block_vars('permission_setting_link', array(
427
						'SELECTED'		=> (in_array($row['group_id'], $groups_ary)) ? true : false,
428
						'GROUP_NAME'	=> (isset($this->user->lang['G_' . $row['group_name']])) ? $this->user->lang['G_' . $row['group_name']] : $row['group_name'],
429
						'GROUP_ID'		=> $row['group_id'],
430
					));
431
				}
432
				$this->db->sql_freeresult($result);
433
434
				return;
435
		}
436
437
		for ($i = 0; $i < sizeof($links); $i++)
438
		{
439
			$this->template->assign_block_vars('links', array(
440
				'LINK_TITLE'	=> ($action != 'add') ? ((isset($this->user->lang[$links[$i]['title']])) ? $this->user->lang[$links[$i]['title']] : $links[$i]['title']) : '',
441
				'LINK_URL'		=> ($action != 'add') ? str_replace('&', '&amp;', $links[$i]['url']) : '',
442
443
				'U_EDIT'		=> $u_action . '&amp;action=edit&amp;id=' . $i,
444
				'U_DELETE'		=> $u_action . '&amp;action=delete&amp;id=' . $i,
445
				'U_MOVE_UP'		=> $u_action . '&amp;action=move_up&amp;id=' . $i,
446
				'U_MOVE_DOWN'	=> $u_action . '&amp;action=move_down&amp;id=' . $i,
447
			));
448
		}
449
	}
450
451
	/**
452
	* Update links
453
	*
454
	* @param string $key Key name
455
	* @param int $module_id Module ID
456
	*
457
	* @return null
458
	*/
459
	public function update_links($key, $module_id)
460
	{
461
		$this->manage_links('', $key, $module_id);
462
	}
463
}
464