These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * webtrees: online genealogy |
||
4 | * Copyright (C) 2017 webtrees development team |
||
5 | * This program is free software: you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU General Public License as published by |
||
7 | * the Free Software Foundation, either version 3 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * This program is distributed in the hope that it will be useful, |
||
10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
12 | * GNU General Public License for more details. |
||
13 | * You should have received a copy of the GNU General Public License |
||
14 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
15 | */ |
||
16 | namespace Fisharebest\Webtrees; |
||
17 | |||
18 | use Fisharebest\Webtrees\Controller\RepositoryController; |
||
19 | use Fisharebest\Webtrees\Functions\FunctionsPrint; |
||
20 | use Fisharebest\Webtrees\Functions\FunctionsPrintFacts; |
||
21 | use Fisharebest\Webtrees\Functions\FunctionsPrintLists; |
||
22 | |||
23 | /** @global Tree $WT_TREE */ |
||
24 | global $WT_TREE; |
||
25 | |||
26 | require 'includes/session.php'; |
||
27 | |||
28 | $record = Repository::getInstance(Filter::get('rid', WT_REGEX_XREF), $WT_TREE); |
||
29 | $controller = new RepositoryController($record); |
||
30 | |||
31 | View Code Duplication | if ($controller->record && $controller->record->canShow()) { |
|
32 | if ($controller->record->isPendingDeletion()) { |
||
33 | if (Auth::isModerator($controller->record->getTree())) { |
||
34 | FlashMessages::addMessage(/* I18N: %1$s is “accept”, %2$s is “reject”. These are links. */ I18N::translate( |
||
35 | 'This repository has been deleted. You should review the deletion and then %1$s or %2$s it.', |
||
36 | '<a href="#" onclick="accept_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the deletion and then accept or reject it.', 'accept') . '</a>', |
||
37 | '<a href="#" onclick="reject_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the deletion and then accept or reject it.', 'reject') . '</a>' |
||
38 | ) . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning'); |
||
39 | } elseif (Auth::isEditor($controller->record->getTree())) { |
||
40 | FlashMessages::addMessage(I18N::translate('This repository has been deleted. The deletion will need to be reviewed by a moderator.') . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning'); |
||
41 | } |
||
42 | } elseif ($controller->record->isPendingAddtion()) { |
||
43 | if (Auth::isModerator($controller->record->getTree())) { |
||
44 | FlashMessages::addMessage(/* I18N: %1$s is “accept”, %2$s is “reject”. These are links. */ I18N::translate( |
||
45 | 'This repository has been edited. You should review the changes and then %1$s or %2$s them.', |
||
46 | '<a href="#" onclick="accept_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the changes and then accept or reject them.', 'accept') . '</a>', |
||
47 | '<a href="#" onclick="reject_changes(\'' . $controller->record->getXref() . '\');">' . I18N::translateContext('You should review the changes and then accept or reject them.', 'reject') . '</a>' |
||
48 | ) . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning'); |
||
49 | } elseif (Auth::isEditor($controller->record->getTree())) { |
||
50 | FlashMessages::addMessage(I18N::translate('This repository has been edited. The changes need to be reviewed by a moderator.') . ' ' . FunctionsPrint::helpLink('pending_changes'), 'warning'); |
||
51 | } |
||
52 | } |
||
53 | $controller->pageHeader(); |
||
54 | } else { |
||
55 | FlashMessages::addMessage(I18N::translate('This repository does not exist or you do not have permission to view it.'), 'danger'); |
||
56 | http_response_code(404); |
||
57 | $controller->pageHeader(); |
||
58 | |||
59 | return; |
||
60 | } |
||
61 | |||
62 | $sources = $controller->record->linkedSources('REPO'); |
||
63 | $facts = $controller->record->getFacts(); |
||
64 | |||
65 | usort( |
||
66 | $facts, |
||
67 | function (Fact $x, Fact $y) { |
||
68 | static $order = [ |
||
69 | 'NAME' => 0, |
||
70 | 'ADDR' => 1, |
||
71 | 'NOTE' => 2, |
||
72 | 'WWW' => 3, |
||
73 | 'REFN' => 4, |
||
74 | 'RIN' => 5, |
||
75 | '_UID' => 6, |
||
76 | 'CHAN' => 7, |
||
77 | ]; |
||
78 | |||
79 | return |
||
80 | (array_key_exists($x->getTag(), $order) ? $order[$x->getTag()] : PHP_INT_MAX) |
||
81 | - |
||
82 | (array_key_exists($y->getTag(), $order) ? $order[$y->getTag()] : PHP_INT_MAX); |
||
83 | } |
||
84 | ); |
||
85 | |||
86 | ?> |
||
87 | <h2 class="wt-page-title"> |
||
88 | <?= $controller->record->getFullName() ?> |
||
89 | </h2> |
||
90 | |||
91 | <div class="wt-page-content"> |
||
92 | <ul class="nav nav-tabs" role="tablist"> |
||
93 | <li class="nav-item"> |
||
94 | <a class="nav-link active" data-toggle="tab" role="tab" href="#details"> |
||
95 | <?= I18N::translate('Details') ?> |
||
96 | </a> |
||
97 | </li> |
||
98 | <li class="nav-item"> |
||
99 | <a class="nav-link<?= empty($sources) ? ' text-muted' : '' ?>" data-toggle="tab" role="tab" href="#sources"> |
||
100 | <?= I18N::translate('Sources') ?> |
||
101 | <?= Bootstrap4::badgeCount($sources) ?> |
||
102 | </a> |
||
103 | </li> |
||
104 | </ul> |
||
105 | |||
106 | <div class="tab-content"> |
||
107 | <div class="tab-pane fade show active" role="tabpanel" id="details"> |
||
108 | <table class="facts_table"> |
||
109 | <?php foreach ($facts as $fact): ?> |
||
110 | <?php FunctionsPrintFacts::printFact($fact, $controller->record) ?> |
||
111 | <?php endforeach ?> |
||
112 | |||
113 | <?php if ($controller->record->canEdit()): ?> |
||
114 | <?php FunctionsPrint::printAddNewFact($controller->record->getXref(), $facts, 'REPO') ?> |
||
115 | <?php endif ?> |
||
116 | </table> |
||
117 | </div> |
||
118 | |||
119 | <div class="tab-pane fade" role="tabpanel" id="sources"> |
||
120 | <?= FunctionsPrintLists::sourceTable($sources) ?> |
||
0 ignored issues
–
show
|
|||
121 | </div> |
||
122 | </div> |
||
123 | </div> |
||
124 |
\Fisharebest\Webtrees\Fu...::sourceTable($sources)
can contain request data and is used in output context(s) leading to a potential security vulnerability.4 paths for user data to reach this point
$_FILES,
and$file
is assigned in action.php on line 112$_FILES,
and$file
is assignedin action.php on line 112
$gedcom
is assignedin action.php on line 148
$gedcom
is passed to Tree::createRecord()in action.php on line 158
$gedcom
is passed to GedcomRecord::getInstance()in app/Tree.php on line 782
$gedcom
is passed to GedcomRecord::__construct()in app/GedcomRecord.php on line 202
in app/GedcomRecord.php on line 80
in app/GedcomRecord.php on line 495
$newgedrec
is assignedin app/Report/ReportParserGenerate.php on line 594
in app/Report/ReportParserGenerate.php on line 618
in app/Report/ReportParserGenerate.php on line 1262
in vendor/app/Functions/Functions.php on line 160
$thisSubrecord
is assignedin vendor/app/Functions/Functions.php on line 161
in vendor/app/Functions/Functions.php on line 167
in app/Report/ReportParserGenerate.php on line 1262
$value
is assignedin app/Report/ReportParserGenerate.php on line 1308
in app/Report/ReportParserGenerate.php on line 1358
$id
is assignedin app/Report/ReportParserGenerate.php on line 827
$id
is passed to GedcomRecord::getInstance()in app/Report/ReportParserGenerate.php on line 841
$xref
is passed to GedcomRecord::__construct()in app/GedcomRecord.php on line 202
in app/GedcomRecord.php on line 79
in app/GedcomRecord.php on line 280
in app/GedcomRecord.php on line 351
in app/GedcomRecord.php on line 330
$html
is assignedin app/Functions/FunctionsPrintLists.php on line 1017
in repo.php on line 120
$_POST,
and$newged
is assigned in edit_interface.php on line 426$_POST,
and$newged
is assignedin edit_interface.php on line 426
$newged
is assignedin edit_interface.php on line 446
$newged
is passed through substr(), and$newged
is assignedin edit_interface.php on line 459
$newged
is passed to GedcomRecord::updateFact()in edit_interface.php on line 467
$gedcom
is passed through preg_replace(), and$gedcom
is assignedin app/GedcomRecord.php on line 1192
$gedcom
is passed through trim(), and$gedcom
is assignedin app/GedcomRecord.php on line 1193
$new_gedcom
is assignedin app/GedcomRecord.php on line 1230
in app/GedcomRecord.php on line 1249
in app/GedcomRecord.php on line 495
$newgedrec
is assignedin app/Report/ReportParserGenerate.php on line 594
in app/Report/ReportParserGenerate.php on line 618
in app/Report/ReportParserGenerate.php on line 1262
in vendor/app/Functions/Functions.php on line 160
$thisSubrecord
is assignedin vendor/app/Functions/Functions.php on line 161
in vendor/app/Functions/Functions.php on line 167
in app/Report/ReportParserGenerate.php on line 1262
$value
is assignedin app/Report/ReportParserGenerate.php on line 1308
in app/Report/ReportParserGenerate.php on line 1358
$id
is assignedin app/Report/ReportParserGenerate.php on line 827
$id
is passed to GedcomRecord::getInstance()in app/Report/ReportParserGenerate.php on line 841
$xref
is passed to GedcomRecord::__construct()in app/GedcomRecord.php on line 202
in app/GedcomRecord.php on line 79
in app/GedcomRecord.php on line 280
in app/GedcomRecord.php on line 351
in app/GedcomRecord.php on line 330
$html
is assignedin app/Functions/FunctionsPrintLists.php on line 1017
in repo.php on line 120
$_POST,
and$newged
is assigned in edit_interface.php on line 430$_POST,
and$newged
is assignedin edit_interface.php on line 430
$newged
is assignedin edit_interface.php on line 446
$newged
is passed through substr(), and$newged
is assignedin edit_interface.php on line 459
$newged
is passed to GedcomRecord::updateFact()in edit_interface.php on line 467
$gedcom
is passed through preg_replace(), and$gedcom
is assignedin app/GedcomRecord.php on line 1192
$gedcom
is passed through trim(), and$gedcom
is assignedin app/GedcomRecord.php on line 1193
$new_gedcom
is assignedin app/GedcomRecord.php on line 1230
in app/GedcomRecord.php on line 1249
in app/GedcomRecord.php on line 495
$newgedrec
is assignedin app/Report/ReportParserGenerate.php on line 594
in app/Report/ReportParserGenerate.php on line 618
in app/Report/ReportParserGenerate.php on line 1262
in vendor/app/Functions/Functions.php on line 160
$thisSubrecord
is assignedin vendor/app/Functions/Functions.php on line 161
in vendor/app/Functions/Functions.php on line 167
in app/Report/ReportParserGenerate.php on line 1262
$value
is assignedin app/Report/ReportParserGenerate.php on line 1308
in app/Report/ReportParserGenerate.php on line 1358
$id
is assignedin app/Report/ReportParserGenerate.php on line 827
$id
is passed to GedcomRecord::getInstance()in app/Report/ReportParserGenerate.php on line 841
$xref
is passed to GedcomRecord::__construct()in app/GedcomRecord.php on line 202
in app/GedcomRecord.php on line 79
in app/GedcomRecord.php on line 280
in app/GedcomRecord.php on line 351
in app/GedcomRecord.php on line 330
$html
is assignedin app/Functions/FunctionsPrintLists.php on line 1017
in repo.php on line 120
$_POST,
and$newged
is assigned in edit_interface.php on line 454$_POST,
and$newged
is assignedin edit_interface.php on line 454
$newged
is passed through substr(), and$newged
is assignedin edit_interface.php on line 459
$newged
is passed to GedcomRecord::updateFact()in edit_interface.php on line 467
$gedcom
is passed through preg_replace(), and$gedcom
is assignedin app/GedcomRecord.php on line 1192
$gedcom
is passed through trim(), and$gedcom
is assignedin app/GedcomRecord.php on line 1193
$new_gedcom
is assignedin app/GedcomRecord.php on line 1230
in app/GedcomRecord.php on line 1249
in app/GedcomRecord.php on line 495
$newgedrec
is assignedin app/Report/ReportParserGenerate.php on line 594
in app/Report/ReportParserGenerate.php on line 618
in app/Report/ReportParserGenerate.php on line 1262
in vendor/app/Functions/Functions.php on line 160
$thisSubrecord
is assignedin vendor/app/Functions/Functions.php on line 161
in vendor/app/Functions/Functions.php on line 167
in app/Report/ReportParserGenerate.php on line 1262
$value
is assignedin app/Report/ReportParserGenerate.php on line 1308
in app/Report/ReportParserGenerate.php on line 1358
$id
is assignedin app/Report/ReportParserGenerate.php on line 827
$id
is passed to GedcomRecord::getInstance()in app/Report/ReportParserGenerate.php on line 841
$xref
is passed to GedcomRecord::__construct()in app/GedcomRecord.php on line 202
in app/GedcomRecord.php on line 79
in app/GedcomRecord.php on line 280
in app/GedcomRecord.php on line 351
in app/GedcomRecord.php on line 330
$html
is assignedin app/Functions/FunctionsPrintLists.php on line 1017
in repo.php on line 120
Preventing Cross-Site-Scripting Attacks
Cross-Site-Scripting allows an attacker to inject malicious code into your website - in particular Javascript code, and have that code executed with the privileges of a visiting user. This can be used to obtain data, or perform actions on behalf of that visiting user.
In order to prevent this, make sure to escape all user-provided data:
General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: