Issues (314)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Files/Templates/User/Defstyle/Rate.php (1 issue)

Labels
Severity
1
<?php
2
3
namespace XoopsModules\Modulebuilder\Files\Templates\User\Defstyle;
4
5
use XoopsModules\Modulebuilder;
6
use XoopsModules\Modulebuilder\{
7
    Files,
8
    Constants
9
};
10
11
/*
12
 You may not change or alter any portion of this comment or credits
13
 of supporting developers from this source code or any supporting source code
14
 which is considered copyrighted (c) material of the original comment or credit authors.
15
16
 This program is distributed in the hope that it will be useful,
17
 but WITHOUT ANY WARRANTY; without even the implied warranty of
18
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
19
 */
20
/**
21
 * modulebuilder module.
22
 *
23
 * @copyright       XOOPS Project (https://xoops.org)
24
 * @license         GNU GPL 2 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
25
 *
26
 * @since           2.5.0
27
 *
28
 * @author          Txmod Xoops https://xoops.org 
29
 *                  Goffy https://myxoops.org
30
 *
31
 */
32
33
/**
34
 * class Rate.
35
 */
36
class Rate extends Files\CreateFile
37
{
38
    /**
39
     * @public function constructor
40
     * @param null
41
     */
42
    public function __construct()
43
    {
44
        parent::__construct();
45
    }
46
47
    /**
48
     * @static function getInstance
49
     * @param null
50
     * @return Rate
51
     */
52
    public static function getInstance()
53
    {
54
        static $instance = false;
55
        if (!$instance) {
56
            $instance = new self();
57
        }
58
59
        return $instance;
60
    }
61
62
    /**
63
     * @public function write
64
     * @param        $module
65
     * @param        $table
66
     * @param string $filename
67
     */
68
    public function write($module, $table, $filename)
69
    {
70
        $this->setModule($module);
71
        $this->setTable($table);
72
        $this->setFileName($filename);
73
    }
74
75
    /**
76
     * @private function getTemplatesUserRateHeader
77
     * @param string $moduleDirname
78
     * @param string $table
79
     * @param string $language
80
     *
81
     * @return string
82
     */
83
    private function getTemplatesUserRateHeader($moduleDirname, $table, $language)
84
    {
85
        $ret    = <<<EOT
86
<{include file="db:{$moduleDirname}_header.tpl"}>
87
<table class="{$moduleDirname}">
88
    <thead class="outer">
89
        <tr class="head">\n
90
EOT;
91
        $fields = $this->getTableFields($table->getVar('table_mid'), $table->getVar('table_id'));
92
        foreach (\array_keys($fields) as $f) {
93
            $fieldName        = $fields[$f]->getVar('field_name');
94
            $langStuFieldName = $language . \mb_strtoupper($fieldName);
95
            if ((1 == $table->getVar('table_autoincrement')) || (1 == $fields[$f]->getVar('field_user'))) {
96
                $ret .= <<<EOT
97
            <th class="center"><{\$smarty.const.{$langStuFieldName}}></th>\n
98
EOT;
99
            }
100
        }
101
        $ret .= <<<EOT
102
        </tr>
103
    </thead>\n
104
EOT;
105
106
        return $ret;
107
    }
108
109
    /**
110
     * @private function getTemplatesUserRateBody
111
     * @param string $moduleDirname
112
     * @param string $table
113
     *
114
     * @return string
115
     */
116
    private function getTemplatesUserRateBody($moduleDirname, $table)
117
    {
118
        $tableName = $table->getVar('table_name');
119
        $ret       = <<<EOT
120
    <tbody>
121
        <{foreach item=list from=\${$tableName}}>
122
            <tr class="<{cycle values='odd, even'}>">\n
123
EOT;
124
        $fields    = $this->getTableFields($table->getVar('table_mid'), $table->getVar('table_id'));
125
        foreach (\array_keys($fields) as $f) {
126
            $fieldName    = $fields[$f]->getVar('field_name');
127
            $fieldElement = $fields[$f]->getVar('field_element');
128
            $rpFieldName  = $this->getRightString($fieldName);
129
            if ((1 == $table->getVar('table_autoincrement')) || (1 == $fields[$f]->getVar('field_user'))) {
130
                switch ($fieldElement) {
131
                    case Constants::FIELD_ELE_COLORPICKER:
132
                        $ret .= <<<EOT
133
                <td class="center"><span style="background-color: #<{\$list.{$rpFieldName}}>;">\t\t</span></td>\n
134
EOT;
135
                        break;
136
                    case Constants::FIELD_ELE_IMAGELIST:
137
                        $ret .= <<<EOT
138
                <td class="center"><img src="<{xoModuleIcons32}><{\$list.{$rpFieldName}}>" alt="{$tableName}"></td>\n
139
EOT;
140
                        break;
141
                    case Constants::FIELD_ELE_UPLOADIMAGE:
142
                        $ret .= <<<EOT
143
                <td class="center"><img src="<{\${$moduleDirname}_upload_url}>/images/{$tableName}/<{\$list.{$rpFieldName}}>" alt="{$tableName}"></td>\n
144
EOT;
145
                        break;
146
                    default:
147
                        $ret .= <<<EOT
148
                <td class="center"><{\$list.{$rpFieldName}}></td>\n
149
EOT;
150
                        break;
151
                }
152
            }
153
        }
154
        $ret .= <<<EOT
155
            </tr>
156
        <{/foreach}>
157
    </tbody>
158
</table>\n
159
EOT;
160
161
        return $ret;
162
    }
163
164
    /**
165
     * @private function getTemplatesUserRateBodyFieldnameEmpty
166
     * @param string $moduleDirname
167
     * @param string $table
168
     *
169
     * @return string
170
     */
171
    private function getTemplatesUserRateBodyFieldnameEmpty($moduleDirname, $table)
172
    {
173
        $tableName = $table->getVar('table_name');
174
        $ret       = <<<EOT
175
    <tbody>
176
        <{foreach item=list from=\${$tableName}}>
177
            <tr class="<{cycle values='odd, even'}>">\n
178
EOT;
179
        $fields    = $this->getTableFields($table->getVar('table_mid'), $table->getVar('table_id'));
180
        foreach (\array_keys($fields) as $f) {
181
            $fieldName    = $fields[$f]->getVar('field_name');
182
            $fieldElement = $fields[$f]->getVar('field_element');
183
            if ((1 == $table->getVar('table_autoincrement')) || (1 == $fields[$f]->getVar('field_user'))) {
184
                switch ($fieldElement) {
185
                    case Constants::FIELD_ELE_COLORPICKER:
186
                        $ret .= <<<EOT
187
            <td class="center"><span style="background-color: #<{\$list.{$fieldName}}>;"></span></td>\n
188
EOT;
189
                        break;
190
                    case Constants::FIELD_ELE_UPLOADIMAGE:
191
                        $ret .= <<<EOT
192
            <td class="center"><img src="<{\${$moduleDirname}_upload_url}>/images/{$tableName}/<{\$list.{$fieldName}}>" alt="{$tableName}"></td>\n
193
EOT;
194
                        break;
195
                    default:
196
                        $ret .= <<<EOT
197
            <td class="center"><{\$list.{$fieldName}}></td>\n
198
EOT;
199
                        break;
200
                }
201
            }
202
        }
203
        $ret .= <<<EOT
204
            </tr>
205
        <{/foreach}>
206
    </tbody>
207
</table>\n
208
EOT;
209
210
        return $ret;
211
    }
212
213
    /**
214
     * @private function getTemplatesUserRateFooter
215
     * @param string $moduleDirname
216
     *
217
     * @return string
218
     */
219
    private function getTemplatesUserRateFooter($moduleDirname)
220
    {
221
        $ret = <<<EOT
222
<{include file="db:{$moduleDirname}_footer.tpl"}>
223
EOT;
224
225
        return $ret;
226
    }
227
228
    /**
229
     * @public function render
230
     * @param null
231
     * @return bool|string
232
     */
233
    public function render()
234
    {
235
        $module         = $this->getModule();
236
        $table          = $this->getTable();
237
        $filename       = $this->getFileName();
238
        $moduleDirname  = $module->getVar('mod_dirname');
239
        $tableFieldname = $table->getVar('table_fieldname');
240
        $language       = $this->getLanguage($moduleDirname, 'MA', '', false);
0 ignored issues
show
false of type false is incompatible with the type string expected by parameter $addFq of XoopsModules\Modulebuild...eateFile::getLanguage(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

240
        $language       = $this->getLanguage($moduleDirname, 'MA', '', /** @scrutinizer ignore-type */ false);
Loading history...
241
        $content        = $this->getTemplatesUserRateHeader($moduleDirname, $table, $language);
242
        // Verify if table_fieldname is not empty
243
        if (!empty($tableFieldname)) {
244
            $content .= $this->getTemplatesUserRateBody($moduleDirname, $table);
245
        } else {
246
            $content .= $this->getTemplatesUserRateBodyFieldnameEmpty($moduleDirname, $table);
247
        }
248
        $content .= $this->getTemplatesUserRateFooter($moduleDirname);
249
250
        $this->create($moduleDirname, 'templates', $filename, $content, \_AM_MODULEBUILDER_FILE_CREATED, \_AM_MODULEBUILDER_FILE_NOTCREATED);
251
252
        return $this->renderFile();
253
    }
254
}
255