This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * \ElggWidget |
||
5 | * |
||
6 | * Stores metadata in private settings rather than as \ElggMetadata |
||
7 | * |
||
8 | * @package Elgg.Core |
||
9 | * @subpackage Widgets |
||
10 | * |
||
11 | * @property-read string $handler internal, do not use |
||
12 | * @property-read string $column internal, do not use |
||
13 | * @property-read string $order internal, do not use |
||
14 | * @property-read string $context internal, do not use |
||
15 | */ |
||
16 | class ElggWidget extends \ElggObject { |
||
17 | |||
18 | /** |
||
19 | * Set subtype to widget. |
||
20 | * |
||
21 | * @return void |
||
22 | */ |
||
23 | protected function initializeAttributes() { |
||
24 | parent::initializeAttributes(); |
||
25 | |||
26 | $this->attributes['subtype'] = "widget"; |
||
27 | } |
||
28 | |||
29 | /** |
||
30 | * Get a value from attributes or private settings |
||
31 | * |
||
32 | * @param string $name The name of the value |
||
33 | * @return mixed |
||
34 | */ |
||
35 | public function __get($name) { |
||
36 | // See if its in our base attribute |
||
37 | if (array_key_exists($name, $this->attributes)) { |
||
38 | return $this->attributes[$name]; |
||
39 | } |
||
40 | |||
41 | // @todo clean up now that private settings return null |
||
42 | // No, so see if its in the private data store. |
||
43 | $meta = $this->getPrivateSetting($name); |
||
44 | if ($meta) { |
||
45 | return $meta; |
||
46 | } |
||
47 | |||
48 | // Can't find it, so return null |
||
49 | return null; |
||
50 | } |
||
51 | |||
52 | /** |
||
53 | * Override entity get and sets in order to save data to private data store. |
||
54 | * |
||
55 | * @param string $name Name |
||
56 | * @return mixed |
||
57 | * @deprecated 1.9 |
||
58 | */ |
||
59 | public function get($name) { |
||
60 | elgg_deprecated_notice("Use -> instead of get()", 1.9); |
||
61 | return $this->__get($name); |
||
62 | } |
||
63 | |||
64 | /** |
||
65 | * Set an attribute or private setting value |
||
66 | * |
||
67 | * @param string $name The name of the value to set |
||
68 | * @param mixed $value The value to set |
||
69 | * @return void |
||
70 | */ |
||
71 | View Code Duplication | public function __set($name, $value) { |
|
0 ignored issues
–
show
|
|||
72 | if (array_key_exists($name, $this->attributes)) { |
||
73 | // Check that we're not trying to change the guid! |
||
74 | if ((array_key_exists('guid', $this->attributes)) && ($name == 'guid')) { |
||
75 | return; |
||
76 | } |
||
77 | |||
78 | $this->attributes[$name] = $value; |
||
79 | } else { |
||
80 | $this->setPrivateSetting($name, $value); |
||
81 | } |
||
82 | } |
||
83 | |||
84 | /** |
||
85 | * Override entity get and sets in order to save data to private data store. |
||
86 | * |
||
87 | * @param string $name Name |
||
88 | * @param string $value Value |
||
89 | * @return bool |
||
90 | * @deprecated 1.9 |
||
91 | */ |
||
92 | public function set($name, $value) { |
||
93 | elgg_deprecated_notice("Use -> instead of set()", 1.9); |
||
94 | $this->__set($name, $value); |
||
95 | |||
96 | return true; |
||
97 | } |
||
98 | |||
99 | /** |
||
100 | * Set the widget context |
||
101 | * |
||
102 | * @param string $context The widget context |
||
103 | * @return bool |
||
104 | * @since 1.8.0 |
||
105 | */ |
||
106 | public function setContext($context) { |
||
107 | return $this->setPrivateSetting('context', $context); |
||
108 | } |
||
109 | |||
110 | /** |
||
111 | * Get the widget context |
||
112 | * |
||
113 | * @return string |
||
114 | * @since 1.8.0 |
||
115 | */ |
||
116 | public function getContext() { |
||
117 | return $this->getPrivateSetting('context'); |
||
118 | } |
||
119 | |||
120 | /** |
||
121 | * Get the title of the widget |
||
122 | * |
||
123 | * @return string |
||
124 | * @since 1.8.0 |
||
125 | */ |
||
126 | public function getTitle() { |
||
127 | $title = $this->title; |
||
128 | if (!$title) { |
||
129 | $title = _elgg_services()->widgets->getNameByType($this->handler); |
||
130 | } |
||
131 | return $title; |
||
132 | } |
||
133 | |||
134 | /** |
||
135 | * Move the widget |
||
136 | * |
||
137 | * @param int $column The widget column |
||
138 | * @param int $rank Zero-based rank from the top of the column |
||
139 | * @return void |
||
140 | * @since 1.8.0 |
||
141 | */ |
||
142 | public function move($column, $rank) { |
||
143 | $options = array( |
||
144 | 'type' => 'object', |
||
145 | 'subtype' => 'widget', |
||
146 | 'container_guid' => $this->container_guid, |
||
147 | 'limit' => false, |
||
148 | 'private_setting_name_value_pairs' => array( |
||
149 | array('name' => 'context', 'value' => $this->getContext()), |
||
150 | array('name' => 'column', 'value' => $column) |
||
151 | ) |
||
152 | ); |
||
153 | $widgets = elgg_get_entities_from_private_settings($options); |
||
154 | if (!$widgets) { |
||
155 | $this->column = (int)$column; |
||
156 | $this->order = 0; |
||
157 | return; |
||
158 | } |
||
159 | |||
160 | usort($widgets, create_function('$a,$b','return (int)$a->order > (int)$b->order;')); |
||
161 | |||
162 | // remove widgets from inactive plugins |
||
163 | $widget_types = elgg_get_widget_types($this->context); |
||
164 | $inactive_widgets = array(); |
||
165 | foreach ($widgets as $index => $widget) { |
||
166 | if (!array_key_exists($widget->handler, $widget_types)) { |
||
167 | $inactive_widgets[] = $widget; |
||
168 | unset($widgets[$index]); |
||
169 | } |
||
170 | } |
||
171 | |||
172 | $bottom_rank = count($widgets); |
||
173 | if ($column == $this->column) { |
||
174 | $bottom_rank--; |
||
175 | } |
||
176 | |||
177 | if ($rank == 0) { |
||
178 | // top of the column |
||
179 | $this->order = reset($widgets)->order - 10; |
||
180 | } elseif ($rank == $bottom_rank) { |
||
181 | // bottom of the column of active widgets |
||
182 | $this->order = end($widgets)->order + 10; |
||
183 | } else { |
||
184 | // reorder widgets |
||
185 | |||
186 | // remove the widget that's being moved from the array |
||
187 | foreach ($widgets as $index => $widget) { |
||
188 | if ($widget->guid == $this->guid) { |
||
189 | unset($widgets[$index]); |
||
190 | } |
||
191 | } |
||
192 | |||
193 | // split the array in two and recombine with the moved widget in middle |
||
194 | $before = array_slice($widgets, 0, $rank); |
||
195 | array_push($before, $this); |
||
196 | $after = array_slice($widgets, $rank); |
||
197 | $widgets = array_merge($before, $after); |
||
198 | ksort($widgets); |
||
199 | $order = 0; |
||
200 | foreach ($widgets as $widget) { |
||
201 | $widget->order = $order; |
||
202 | $order += 10; |
||
203 | } |
||
204 | } |
||
205 | |||
206 | // put inactive widgets at the bottom |
||
207 | if ($inactive_widgets) { |
||
0 ignored issues
–
show
The expression
$inactive_widgets of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using ![]() |
|||
208 | $bottom = 0; |
||
209 | foreach ($widgets as $widget) { |
||
210 | if ($widget->order > $bottom) { |
||
211 | $bottom = $widget->order; |
||
212 | } |
||
213 | } |
||
214 | $bottom += 10; |
||
215 | foreach ($inactive_widgets as $widget) { |
||
216 | $widget->order = $bottom; |
||
217 | $bottom += 10; |
||
218 | } |
||
219 | } |
||
220 | |||
221 | $this->column = $column; |
||
222 | } |
||
223 | |||
224 | /** |
||
225 | * Saves the widget's settings |
||
226 | * |
||
227 | * Plugins can override the save mechanism using the plugin hook: |
||
228 | * 'widget_settings', <widget handler identifier>. The widget and |
||
229 | * the parameters are passed. The plugin hook handler should return |
||
230 | * true to indicate that it has successfully saved the settings. |
||
231 | * |
||
232 | * @warning The values in the parameter array cannot be arrays |
||
233 | * |
||
234 | * @param array $params An array of name => value parameters |
||
235 | * |
||
236 | * @return bool |
||
237 | * @since 1.8.0 |
||
238 | */ |
||
239 | public function saveSettings($params) { |
||
240 | if (!$this->canEdit()) { |
||
241 | return false; |
||
242 | } |
||
243 | |||
244 | // plugin hook handlers should return true to indicate the settings have |
||
245 | // been saved so that default code does not run |
||
246 | $hook_params = array( |
||
247 | 'widget' => $this, |
||
248 | 'params' => $params |
||
249 | ); |
||
250 | if (_elgg_services()->hooks->trigger('widget_settings', $this->handler, $hook_params, false) == true) { |
||
251 | return true; |
||
252 | } |
||
253 | |||
254 | if (is_array($params) && count($params) > 0) { |
||
255 | foreach ($params as $name => $value) { |
||
256 | if (is_array($value)) { |
||
257 | // private settings cannot handle arrays |
||
258 | return false; |
||
259 | } else { |
||
260 | $this->$name = $value; |
||
261 | } |
||
262 | } |
||
263 | $this->save(); |
||
264 | } |
||
265 | |||
266 | return true; |
||
267 | } |
||
268 | } |
||
269 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.