This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * |
||
4 | * @package Board3 Portal v2.1 |
||
5 | * @copyright (c) 2013 Board3 Group ( www.board3.de ) |
||
6 | * @license http://opensource.org/licenses/gpl-2.0.php GNU General Public License v2 |
||
7 | * |
||
8 | */ |
||
9 | |||
10 | namespace board3\portal\modules; |
||
11 | |||
12 | /** |
||
13 | * @package Links |
||
14 | */ |
||
15 | class links extends module_base |
||
16 | { |
||
17 | /** |
||
18 | * Allowed columns: Just sum up your options (Exp: left + right = 10) |
||
19 | * top 1 |
||
20 | * left 2 |
||
21 | * center 4 |
||
22 | * right 8 |
||
23 | * bottom 16 |
||
24 | */ |
||
25 | public $columns = 10; |
||
26 | |||
27 | /** |
||
28 | * Default modulename |
||
29 | */ |
||
30 | public $name = 'PORTAL_LINKS'; |
||
31 | |||
32 | /** |
||
33 | * Default module-image: |
||
34 | * file must be in "{T_THEME_PATH}/images/portal/" |
||
35 | */ |
||
36 | public $image_src = 'portal_links.png'; |
||
37 | |||
38 | /** |
||
39 | * module-language file |
||
40 | * file must be in "language/{$user->lang}/mods/portal/" |
||
41 | */ |
||
42 | public $language = 'portal_links_module'; |
||
43 | |||
44 | /** |
||
45 | * custom acp template |
||
46 | * file must be in "adm/style/portal/" |
||
47 | */ |
||
48 | public $custom_acp_tpl = 'acp_portal_links'; |
||
49 | |||
50 | /** @var bool Can include this module multiple times */ |
||
51 | protected $multiple_includes = true; |
||
52 | |||
53 | /** |
||
54 | * constants |
||
55 | */ |
||
56 | const LINK_INT = 1; |
||
57 | const LINK_EXT = 2; |
||
58 | |||
59 | /** @var \phpbb\config\config */ |
||
60 | protected $config; |
||
61 | |||
62 | /** @var \phpbb\db\driver\driver_interface */ |
||
63 | protected $db; |
||
64 | |||
65 | /** @var \phpbb\request\request */ |
||
66 | protected $request; |
||
67 | |||
68 | /** @var \phpbb\template\template */ |
||
69 | protected $template; |
||
70 | |||
71 | /** @var string PHP file extension */ |
||
72 | protected $php_ext; |
||
73 | |||
74 | /** @var string phpBB root path */ |
||
75 | protected $phpbb_root_path; |
||
76 | |||
77 | /** @var \phpbb\user */ |
||
78 | protected $user; |
||
79 | |||
80 | /** @var \phpbb\log\log phpBB log */ |
||
81 | protected $log; |
||
82 | |||
83 | /** |
||
84 | * Construct a links object |
||
85 | * |
||
86 | * @param \phpbb\config\config $config phpBB config |
||
87 | * @param \phpbb\db\driver\driver_interface $db phpBB db driver |
||
88 | * @param \phpbb\request\request $request phpBB request |
||
89 | * @param \phpbb\template\template $template phpBB template |
||
90 | * @param string $phpEx php file extension |
||
91 | * @param string $phpbb_root_path phpBB root path |
||
92 | * @param \phpbb\user $user phpBB user object |
||
93 | * @param \phpbb\log\log phpBB log |
||
94 | */ |
||
95 | View Code Duplication | public function __construct($config, $db, $request, $template, $phpbb_root_path, $phpEx, $user, $log) |
|
96 | { |
||
97 | $this->config = $config; |
||
98 | $this->db = $db; |
||
99 | $this->request = $request; |
||
100 | $this->template = $template; |
||
101 | $this->php_ext = $phpEx; |
||
102 | $this->phpbb_root_path = $phpbb_root_path; |
||
103 | $this->user = $user; |
||
104 | $this->log = $log; |
||
105 | } |
||
106 | |||
107 | /** |
||
108 | * {@inheritdoc} |
||
109 | */ |
||
110 | public function get_template_side($module_id) |
||
111 | { |
||
112 | $portal_config = obtain_portal_config(); |
||
113 | |||
114 | $links = json_decode($portal_config['board3_links_array_' . $module_id], true); |
||
115 | |||
116 | // get user's groups |
||
117 | $groups_ary = get_user_groups(); |
||
118 | |||
119 | $this->template->assign_block_vars('portal_links', array('MODULE_ID' => $module_id)); |
||
120 | |||
121 | for ($i = 0; $i < sizeof($links); $i++) |
||
122 | { |
||
123 | View Code Duplication | if ($links[$i]['type'] == self::LINK_INT) |
|
124 | { |
||
125 | $links[$i]['url'] = str_replace('&', '&', $links[$i]['url']); // we need to do this in order to prevent XHTML validation errors |
||
126 | $cur_url = append_sid($this->phpbb_root_path . $links[$i]['url']); // the user should know what kind of file it is |
||
127 | } |
||
128 | else |
||
129 | { |
||
130 | $cur_url = $links[$i]['url']; |
||
131 | } |
||
132 | |||
133 | $cur_permissions = explode(',', $links[$i]['permission']); |
||
134 | $permission_check = array_intersect($groups_ary, $cur_permissions); |
||
135 | |||
136 | View Code Duplication | if (!empty($permission_check) || $links[$i]['permission'] == '') |
|
137 | { |
||
138 | $this->template->assign_block_vars('portal_links.links', array( |
||
139 | 'LINK_TITLE' => (isset($this->user->lang[$links[$i]['title']])) ? $this->user->lang[$links[$i]['title']] : $links[$i]['title'], |
||
140 | 'LINK_URL' => $cur_url, |
||
141 | 'MODULE_ID' => $module_id, |
||
142 | 'NEW_WINDOW' => ($links[$i]['type'] != self::LINK_INT && $this->config['board3_links_url_new_window_' . $module_id]) ? true : false, |
||
143 | )); |
||
144 | } |
||
145 | } |
||
146 | |||
147 | return 'links_side.html'; |
||
148 | } |
||
149 | |||
150 | /** |
||
151 | * {@inheritdoc} |
||
152 | */ |
||
153 | View Code Duplication | public function get_template_acp($module_id) |
|
154 | { |
||
155 | // do not remove this as it is needed in order to run manage_links |
||
156 | return array( |
||
157 | 'title' => 'ACP_PORTAL_LINKS', |
||
158 | 'vars' => array( |
||
159 | 'legend1' => 'ACP_PORTAL_LINKS', |
||
160 | 'board3_links_' . $module_id => array('lang' => 'ACP_PORTAL_MENU_MANAGE', 'validate' => 'string', 'type' => 'custom', 'explain' => true, 'method' => 'manage_links', 'submit' => 'update_links'), |
||
161 | 'board3_links_url_new_window_' . $module_id => array('lang' => 'ACP_PORTAL_LINKS_NEW_WINDOW', 'validate' => 'bool', 'type' => 'radio:yes_no', 'explain' => false), |
||
162 | ), |
||
163 | ); |
||
164 | } |
||
165 | |||
166 | /** |
||
167 | * {@inheritdoc} |
||
168 | */ |
||
169 | public function install($module_id) |
||
170 | { |
||
171 | $links = array(); |
||
172 | |||
173 | $links_titles = array( |
||
174 | 'Board3.de', |
||
175 | 'phpBB.com', |
||
176 | ); |
||
177 | |||
178 | $links_types = array( |
||
179 | self::LINK_EXT, |
||
180 | self::LINK_EXT, |
||
181 | ); |
||
182 | |||
183 | $links_urls = array( |
||
184 | 'http://www.board3.de/', |
||
185 | 'http://www.phpbb.com/', |
||
186 | ); |
||
187 | |||
188 | $links_permissions = array( |
||
189 | '', |
||
190 | '', |
||
191 | ); |
||
192 | |||
193 | View Code Duplication | foreach ($links_urls as $i => $url) |
|
194 | { |
||
195 | $links[] = array( |
||
196 | 'title' => $links_titles[$i], |
||
197 | 'url' => $links_urls[$i], |
||
198 | 'type' => $links_types[$i], |
||
199 | 'permission' => $links_permissions[$i], |
||
200 | ); |
||
201 | } |
||
202 | |||
203 | $board3_menu_array = json_encode($links); |
||
204 | set_portal_config('board3_links_array_' . $module_id, $board3_menu_array); |
||
205 | $this->config->set('board3_links_' . $module_id, ''); |
||
206 | $this->config->set('board3_links_url_new_window_' . $module_id, 0); |
||
207 | |||
208 | return true; |
||
209 | } |
||
210 | |||
211 | /** |
||
212 | * {@inheritdoc} |
||
213 | */ |
||
214 | View Code Duplication | public function uninstall($module_id, $db) |
|
215 | { |
||
216 | $del_config = array( |
||
217 | 'board3_links_array_' . $module_id, |
||
218 | ); |
||
219 | $sql = 'DELETE FROM ' . PORTAL_CONFIG_TABLE . ' |
||
220 | WHERE ' . $db->sql_in_set('config_name', $del_config); |
||
221 | |||
222 | $db->sql_query($sql); |
||
223 | |||
224 | $del_config = array( |
||
225 | 'board3_links_' . $module_id, |
||
226 | 'board3_links_url_new_window_' . $module_id |
||
227 | ); |
||
228 | $sql = 'DELETE FROM ' . CONFIG_TABLE . ' |
||
229 | WHERE ' . $db->sql_in_set('config_name', $del_config); |
||
230 | return $db->sql_query($sql); |
||
231 | } |
||
232 | |||
233 | /** |
||
234 | * Manage the links |
||
235 | * |
||
236 | * @param mixed $value Value of input |
||
237 | * @param string $key Key name |
||
238 | * @param int $module_id Module ID |
||
239 | * |
||
240 | * @return null |
||
241 | */ |
||
242 | public function manage_links($value, $key, $module_id) |
||
0 ignored issues
–
show
|
|||
243 | { |
||
244 | $action = $this->request->variable('action', ''); |
||
245 | $action = ($this->request->is_set_post('add')) ? 'add' : $action; |
||
246 | $action = ($this->request->is_set_post('save')) ? 'save' : $action; |
||
247 | $link_id = $this->request->variable('id', 99999999); // 0 will trigger unwanted behavior, therefore we set a number we should never reach |
||
248 | $portal_config = obtain_portal_config(); |
||
249 | |||
250 | $links = json_decode($portal_config['board3_links_array_' . $module_id], true); |
||
251 | |||
252 | $u_action = append_sid('index.' . $this->php_ext, 'i=-board3-portal-acp-portal_module&mode=config&module_id=' . $module_id); |
||
253 | |||
254 | switch ($action) |
||
255 | { |
||
256 | // Save changes |
||
257 | case 'save': |
||
258 | View Code Duplication | if (!check_form_key('acp_portal')) |
|
259 | { |
||
260 | trigger_error($this->user->lang['FORM_INVALID']. adm_back_link($u_action), E_USER_WARNING); |
||
261 | } |
||
262 | |||
263 | $link_title = $this->request->variable('link_title', ' ', true); |
||
264 | $link_type = $this->request->variable('link_type', 2); // default to B3_LINK_EXT, no categories in Links block |
||
265 | $link_url = $this->request->variable('link_url', ' ', true); |
||
266 | $link_url = str_replace('&', '&', $link_url); |
||
267 | $link_permission = $this->request->variable('permission-setting-link', array(0 => '')); |
||
268 | $groups_ary = array(); |
||
269 | |||
270 | // get groups and check if the selected groups actually exist |
||
271 | $sql = 'SELECT group_id |
||
272 | FROM ' . GROUPS_TABLE . ' |
||
273 | ORDER BY group_id ASC'; |
||
274 | $result = $this->db->sql_query($sql); |
||
275 | while ($row = $this->db->sql_fetchrow($result)) |
||
276 | { |
||
277 | $groups_ary[] = $row['group_id']; |
||
278 | } |
||
279 | $this->db->sql_freeresult($result); |
||
280 | |||
281 | $link_permissions = array_intersect($link_permission, $groups_ary); |
||
282 | $link_permissions = implode(',', $link_permissions); |
||
283 | |||
284 | // Check for errors |
||
285 | View Code Duplication | if (!$link_title) |
|
286 | { |
||
287 | trigger_error($this->user->lang['NO_LINK_TITLE'] . adm_back_link($u_action), E_USER_WARNING); |
||
288 | } |
||
289 | |||
290 | View Code Duplication | if (!$link_url) |
|
291 | { |
||
292 | trigger_error($this->user->lang['NO_LINK_URL'] . adm_back_link($u_action), E_USER_WARNING); |
||
293 | } |
||
294 | |||
295 | // overwrite already existing links and make sure we don't try to save a link outside of the normal array size of $links |
||
296 | if (isset($link_id) && $link_id < sizeof($links)) |
||
297 | { |
||
298 | $message = $this->user->lang['LINK_UPDATED']; |
||
299 | |||
300 | $links[$link_id] = array( |
||
301 | 'title' => $link_title, |
||
302 | 'url' => htmlspecialchars_decode($link_url), |
||
303 | 'type' => $link_type, |
||
304 | 'permission' => $link_permissions, |
||
305 | ); |
||
306 | |||
307 | $this->log->add('admin', $this->user->data['user_id'], $this->user->data['user_ip'], 'LOG_PORTAL_LINK_UPDATED', false, array($link_title)); |
||
308 | } |
||
309 | else |
||
310 | { |
||
311 | $message = $this->user->lang['LINK_ADDED']; |
||
312 | |||
313 | $links[] = array( |
||
314 | 'title' => $link_title, |
||
315 | 'url' => htmlspecialchars_decode($link_url), |
||
316 | 'type' => $link_type, |
||
317 | 'permission' => $link_permissions, |
||
318 | ); |
||
319 | $this->log->add('admin', $this->user->data['user_id'], $this->user->data['user_ip'],'LOG_PORTAL_LINK_ADDED', false, array($link_title)); |
||
320 | } |
||
321 | |||
322 | $board3_links_array = json_encode($links); |
||
323 | set_portal_config('board3_links_array_' . $module_id, $board3_links_array); |
||
324 | |||
325 | trigger_error($message . adm_back_link($u_action)); |
||
326 | |||
327 | break; |
||
328 | |||
329 | // Delete link |
||
330 | View Code Duplication | case 'delete': |
|
331 | |||
332 | if (!isset($link_id) && $link_id >= sizeof($links)) |
||
333 | { |
||
334 | trigger_error($this->user->lang['MUST_SELECT_LINK'] . adm_back_link($u_action), E_USER_WARNING); |
||
335 | } |
||
336 | |||
337 | if (confirm_box(true)) |
||
338 | { |
||
339 | $cur_link_title = $links[$link_id]['title']; |
||
340 | // delete the selected link and reset the array numbering afterwards |
||
341 | array_splice($links, $link_id, 1); |
||
342 | $links = array_merge($links); |
||
343 | |||
344 | $board3_links_array = json_encode($links); |
||
345 | set_portal_config('board3_links_array_' . $module_id, $board3_links_array); |
||
346 | |||
347 | $this->log->add('admin', $this->user->data['user_id'], $this->user->data['user_ip'], 'LOG_PORTAL_LINK_REMOVED', false, array($cur_link_title)); |
||
348 | } |
||
349 | else |
||
350 | { |
||
351 | confirm_box(false, $this->user->lang['CONFIRM_OPERATION'], build_hidden_fields(array( |
||
352 | 'link_id' => $link_id, |
||
353 | 'action' => 'delete', |
||
354 | ))); |
||
355 | } |
||
356 | |||
357 | break; |
||
358 | |||
359 | // Move items up or down |
||
360 | case 'move_up': |
||
361 | View Code Duplication | case 'move_down': |
|
362 | |||
363 | if (!isset($link_id) && $link_id >= sizeof($links)) |
||
364 | { |
||
365 | trigger_error($this->user->lang['MUST_SELECT_LINK'] . adm_back_link($u_action), E_USER_WARNING); |
||
366 | } |
||
367 | |||
368 | // make sure we don't try to move a link where it can't be moved |
||
369 | if (($link_id == 0 && $action == 'move_up') || ($link_id == (sizeof($links) - 1) && $action == 'move_down')) |
||
370 | { |
||
371 | break; |
||
372 | } |
||
373 | |||
374 | /* |
||
375 | * on move_down, switch position with next order_id... |
||
376 | * on move_up, switch position with previous order_id... |
||
377 | * move up means a lower ID, move down means a higher ID |
||
378 | */ |
||
379 | $switch_order_id = ($action == 'move_down') ? $link_id + 1 : $link_id - 1; |
||
380 | |||
381 | // back up the info of the link we want to move |
||
382 | $cur_link = array( |
||
383 | 'title' => $links[$link_id]['title'], |
||
384 | 'url' => $links[$link_id]['url'], |
||
385 | 'type' => $links[$link_id]['type'], |
||
386 | 'permission' => $links[$link_id]['permission'], |
||
387 | ); |
||
388 | |||
389 | // move the info of the links we replace in the order |
||
390 | $links[$link_id] = array( |
||
391 | 'title' => $links[$switch_order_id]['title'], |
||
392 | 'url' => $links[$switch_order_id]['url'], |
||
393 | 'type' => $links[$switch_order_id]['type'], |
||
394 | 'permission' => $links[$switch_order_id]['permission'], |
||
395 | ); |
||
396 | |||
397 | // insert the info of the moved link |
||
398 | $links[$switch_order_id] = $cur_link; |
||
399 | |||
400 | $board3_links_array = json_encode($links); |
||
401 | set_portal_config('board3_links_array_' . $module_id, $board3_links_array); |
||
402 | |||
403 | break; |
||
404 | |||
405 | // Edit or add menu item |
||
406 | case 'edit': |
||
407 | case 'add': |
||
408 | $this->template->assign_vars(array( |
||
409 | 'LINK_TITLE' => (isset($links[$link_id]['title']) && $action != 'add') ? $links[$link_id]['title'] : '', |
||
410 | 'LINK_URL' => (isset($links[$link_id]['url']) && $action != 'add') ? str_replace('&', '&', $links[$link_id]['url']) : '', |
||
411 | |||
412 | 'S_EDIT' => true, |
||
413 | 'S_LINK_IS_INT' => (isset($links[$link_id]['type']) && $links[$link_id]['type'] == self::LINK_INT) ? true : false, |
||
414 | 'LINK_ID' => $link_id, |
||
415 | )); |
||
416 | |||
417 | $groups_ary = (isset($links[$link_id]['permission'])) ? explode(',', $links[$link_id]['permission']) : array(); |
||
418 | |||
419 | // get group info from database and assign the block vars |
||
420 | $sql = 'SELECT group_id, group_name |
||
421 | FROM ' . GROUPS_TABLE . ' |
||
422 | ORDER BY group_id ASC'; |
||
423 | $result = $this->db->sql_query($sql); |
||
424 | View Code Duplication | while ($row = $this->db->sql_fetchrow($result)) |
|
425 | { |
||
426 | $this->template->assign_block_vars('permission_setting_link', array( |
||
427 | 'SELECTED' => (in_array($row['group_id'], $groups_ary)) ? true : false, |
||
428 | 'GROUP_NAME' => (isset($this->user->lang['G_' . $row['group_name']])) ? $this->user->lang['G_' . $row['group_name']] : $row['group_name'], |
||
429 | 'GROUP_ID' => $row['group_id'], |
||
430 | )); |
||
431 | } |
||
432 | $this->db->sql_freeresult($result); |
||
433 | |||
434 | return; |
||
435 | } |
||
436 | |||
437 | for ($i = 0; $i < sizeof($links); $i++) |
||
438 | { |
||
439 | $this->template->assign_block_vars('links', array( |
||
440 | 'LINK_TITLE' => ($action != 'add') ? ((isset($this->user->lang[$links[$i]['title']])) ? $this->user->lang[$links[$i]['title']] : $links[$i]['title']) : '', |
||
441 | 'LINK_URL' => ($action != 'add') ? str_replace('&', '&', $links[$i]['url']) : '', |
||
442 | |||
443 | 'U_EDIT' => $u_action . '&action=edit&id=' . $i, |
||
444 | 'U_DELETE' => $u_action . '&action=delete&id=' . $i, |
||
445 | 'U_MOVE_UP' => $u_action . '&action=move_up&id=' . $i, |
||
446 | 'U_MOVE_DOWN' => $u_action . '&action=move_down&id=' . $i, |
||
447 | )); |
||
448 | } |
||
449 | } |
||
450 | |||
451 | /** |
||
452 | * Update links |
||
453 | * |
||
454 | * @param string $key Key name |
||
455 | * @param int $module_id Module ID |
||
456 | * |
||
457 | * @return null |
||
458 | */ |
||
459 | public function update_links($key, $module_id) |
||
460 | { |
||
461 | $this->manage_links('', $key, $module_id); |
||
462 | } |
||
463 | } |
||
464 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.