This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||
2 | |||||
3 | namespace XoopsModules\Wgevents; |
||||
4 | |||||
5 | /* |
||||
6 | You may not change or alter any portion of this comment or credits |
||||
7 | of supporting developers from this source code or any supporting source code |
||||
8 | which is considered copyrighted (c) material of the original comment or credit authors. |
||||
9 | |||||
10 | This program is distributed in the hope that it will be useful, |
||||
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
13 | */ |
||||
14 | |||||
15 | /** |
||||
16 | * wgEvents module for xoops |
||||
17 | * |
||||
18 | * @copyright 2021 XOOPS Project (https://xoops.org) |
||||
19 | * @license GPL 2.0 or later |
||||
20 | * @package wgevents |
||||
21 | * @since 1.0.0 |
||||
22 | * @min_xoops 2.5.11 Beta1 |
||||
23 | * @author Goffy - Wedega - Email:[email protected] - Website:https://xoops.wedega.com |
||||
24 | */ |
||||
25 | |||||
26 | use XoopsModules\Wgevents; |
||||
27 | |||||
28 | \defined('XOOPS_ROOT_PATH') || die('Restricted access'); |
||||
29 | |||||
30 | /** |
||||
31 | * Class Object Question |
||||
32 | */ |
||||
33 | class Question extends \XoopsObject |
||||
34 | { |
||||
35 | /** |
||||
36 | * @var int |
||||
37 | */ |
||||
38 | public $start = 0; |
||||
39 | |||||
40 | /** |
||||
41 | * @var int |
||||
42 | */ |
||||
43 | public $limit = 0; |
||||
44 | |||||
45 | /** |
||||
46 | * Constructor |
||||
47 | * |
||||
48 | */ |
||||
49 | public function __construct() |
||||
50 | { |
||||
51 | $this->initVar('id', \XOBJ_DTYPE_INT); |
||||
52 | $this->initVar('evid', \XOBJ_DTYPE_INT); |
||||
53 | $this->initVar('fdid', \XOBJ_DTYPE_INT); |
||||
54 | $this->initVar('type', \XOBJ_DTYPE_INT); |
||||
55 | $this->initVar('caption', \XOBJ_DTYPE_TXTBOX); |
||||
56 | $this->initVar('desc', \XOBJ_DTYPE_OTHER); |
||||
57 | $this->initVar('values', \XOBJ_DTYPE_OTHER); |
||||
58 | $this->initVar('placeholder', \XOBJ_DTYPE_TXTBOX); |
||||
59 | $this->initVar('required', \XOBJ_DTYPE_INT); |
||||
60 | $this->initVar('weight', \XOBJ_DTYPE_INT); |
||||
61 | $this->initVar('print', \XOBJ_DTYPE_INT); |
||||
62 | $this->initVar('datecreated', \XOBJ_DTYPE_INT); |
||||
63 | $this->initVar('submitter', \XOBJ_DTYPE_INT); |
||||
64 | } |
||||
65 | |||||
66 | /** |
||||
67 | * @static function &getInstance |
||||
68 | * |
||||
69 | */ |
||||
70 | public static function getInstance() |
||||
71 | { |
||||
72 | static $instance = false; |
||||
73 | if (!$instance) { |
||||
74 | $instance = new self(); |
||||
75 | } |
||||
76 | } |
||||
77 | |||||
78 | /** |
||||
79 | * The new inserted $Id |
||||
80 | * @return inserted id |
||||
0 ignored issues
–
show
|
|||||
81 | */ |
||||
82 | public function getNewInsertedId() |
||||
83 | { |
||||
84 | return $GLOBALS['xoopsDB']->getInsertId(); |
||||
85 | } |
||||
86 | |||||
87 | /** |
||||
88 | * @public function getForm |
||||
89 | * @param bool $action |
||||
90 | * @return \XoopsThemeForm |
||||
91 | */ |
||||
92 | public function getForm($action = false) |
||||
93 | { |
||||
94 | $helper = \XoopsModules\Wgevents\Helper::getInstance(); |
||||
95 | |||||
96 | $eventHandler = $helper->getHandler('Event'); |
||||
97 | $questionHandler = $helper->getHandler('Question'); |
||||
98 | |||||
99 | if (!$action) { |
||||
100 | $action = $_SERVER['REQUEST_URI']; |
||||
101 | } |
||||
102 | $isAdmin = (\is_object($GLOBALS['xoopsUser']) && \is_object($GLOBALS['xoopsModule'])) && $GLOBALS['xoopsUser']->isAdmin($GLOBALS['xoopsModule']->mid()); |
||||
103 | // Title |
||||
104 | $title = $this->isNew() ? \_MA_WGEVENTS_QUESTION_ADD : \_MA_WGEVENTS_QUESTION_EDIT; |
||||
105 | // Get Theme Form |
||||
106 | \xoops_load('XoopsFormLoader'); |
||||
107 | $form = new \XoopsThemeForm($title, 'formQuestion', $action, 'post', true); |
||||
108 | $form->setExtra('enctype="multipart/form-data"'); |
||||
109 | // Form Table events |
||||
110 | $evId = ($this->getVar('evid')) ?? 0; |
||||
111 | $addEvidSelect = new \XoopsFormSelect(\_MA_WGEVENTS_QUESTION_EVID, 'evid', $evId); |
||||
112 | $addEvidSelect->addOptionArray($eventHandler->getList()); |
||||
113 | $form->addElement($addEvidSelect); |
||||
114 | // Form Select queType |
||||
115 | $queType = (int)$this->getVar('fdid') > 0 ? (int)$this->getVar('fdid') : 1; //set default for new as 'Infofield |
||||
116 | $enableValues = true; |
||||
117 | $enablePlaceholder = true; |
||||
118 | $queTypeSelect = new \XoopsFormSelect(\_MA_WGEVENTS_QUESTION_TYPE, 'type', $queType); |
||||
119 | $fieldHandler = $helper->getHandler('Field'); |
||||
120 | $fieldObj = $fieldHandler->get($queType); |
||||
121 | $fieldType = $fieldObj->getVar('type'); |
||||
122 | |||||
123 | $crField = new \CriteriaCompo(); |
||||
124 | $crField->add(new \Criteria('status', Constants::STATUS_ONLINE)); |
||||
125 | $crField->setSort('weight'); |
||||
126 | $crField->setOrder('ASC'); |
||||
127 | $fieldsCount = $fieldHandler->getCount($crField); |
||||
128 | if ($fieldsCount > 0) { |
||||
129 | $fieldsAll = $fieldHandler->getAll($crField); |
||||
130 | foreach (\array_keys($fieldsAll) as $i) { |
||||
131 | $queTypeSelect->addOption($i, $fieldsAll[$i]->getVar('caption')); |
||||
132 | $form->addElement(new \XoopsFormHidden('caption_def[' . $i . ']', $fieldsAll[$i]->getVar('caption'))); |
||||
133 | $form->addElement(new \XoopsFormHidden('placeholder_def[' . $i . ']', $fieldsAll[$i]->getVar('placeholder'))); |
||||
134 | $form->addElement(new \XoopsFormHidden('required_def[' . $i . ']', $fieldsAll[$i]->getVar('required'))); |
||||
135 | $form->addElement(new \XoopsFormHidden('print_def[' . $i . ']', $fieldsAll[$i]->getVar('print'))); |
||||
136 | $form->addElement(new \XoopsFormHidden('display_desc[' . $i . ']', $fieldsAll[$i]->getVar('display_desc'))); |
||||
137 | $form->addElement(new \XoopsFormHidden('display_values[' . $i . ']', $fieldsAll[$i]->getVar('display_values'))); |
||||
138 | $form->addElement(new \XoopsFormHidden('display_placeholder[' . $i . ']', $fieldsAll[$i]->getVar('display_placeholder'))); |
||||
139 | if ((int)$fieldsAll[$i]->getVar('type') == $fieldType) { |
||||
140 | $enableDesc = (bool)$fieldsAll[$i]->getVar('display_desc'); |
||||
141 | $enableValues = (bool)$fieldsAll[$i]->getVar('display_values'); |
||||
142 | $enablePlaceholder = (bool)$fieldsAll[$i]->getVar('display_placeholder'); |
||||
143 | } |
||||
144 | } |
||||
145 | } |
||||
146 | $queTypeSelect->setExtra(" onchange='fillInQuestions()' "); |
||||
147 | $form->addElement($queTypeSelect); |
||||
148 | // Form Text queCaption |
||||
149 | $queCaptionField = new \XoopsFormText(\_MA_WGEVENTS_QUESTION_CAPTION, 'caption', 50, 255, (string)$this->getVar('caption')); |
||||
150 | $queCaptionField->setDescription(\_MA_WGEVENTS_QUESTION_CAPTION_DESC); |
||||
151 | $form->addElement($queCaptionField, true); |
||||
152 | // Form Editor TextArea queDesc |
||||
153 | $editorConfigs = []; |
||||
154 | if ($isAdmin) { |
||||
155 | $editor = $helper->getConfig('editor_admin'); |
||||
156 | } else { |
||||
157 | $editor = $helper->getConfig('editor_user'); |
||||
158 | } |
||||
159 | $editorConfigs['name'] = 'desc'; |
||||
160 | $editorConfigs['value'] = $this->getVar('desc', 'e'); |
||||
161 | $editorConfigs['rows'] = 5; |
||||
162 | $editorConfigs['cols'] = 40; |
||||
163 | $editorConfigs['width'] = '100%'; |
||||
164 | $editorConfigs['height'] = '400px'; |
||||
165 | $editorConfigs['editor'] = $editor; |
||||
166 | $queDescField = new \XoopsFormEditor(\_MA_WGEVENTS_QUESTION_DESC, 'desc', $editorConfigs); |
||||
167 | //$queDescField = new \XoopsFormTextArea(\_MA_WGEVENTS_QUESTION_DESC, 'desc', $this->getVar('desc', 'e'), 3, 47); |
||||
168 | $queDescField->setDescription(\_MA_WGEVENTS_QUESTION_DESC_DESC); |
||||
169 | if (!$enableDesc) { |
||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||
170 | $queDescField->setExtra('disabled="disabled"'); |
||||
171 | } |
||||
172 | $form->addElement($queDescField); |
||||
173 | // Form Editor TextArea queValues |
||||
174 | $queValues = (string)$this->getVar('values'); |
||||
175 | $queValuesText = ''; |
||||
176 | if ('' !== $queValues) { |
||||
177 | $queValuesText = \implode("\n", \unserialize($queValues, ['allowed_classes' => false])); |
||||
178 | } |
||||
179 | $queValuesField = new \XoopsFormTextArea(\_MA_WGEVENTS_QUESTION_VALUE, 'values', $queValuesText, 5, 47); |
||||
180 | $queValuesField->setDescription(\_MA_WGEVENTS_QUESTION_VALUE_DESC); |
||||
181 | if (!$enableValues) { |
||||
182 | $queValuesField->setExtra('disabled="disabled"'); |
||||
183 | } |
||||
184 | $form->addElement($queValuesField); |
||||
185 | // Form Text quePlaceholder |
||||
186 | $quePlaceholderField = new \XoopsFormText(\_MA_WGEVENTS_QUESTION_PLACEHOLDER, 'placeholder', 50, 255, $this->getVar('placeholder')); |
||||
0 ignored issues
–
show
It seems like
$this->getVar('placeholder') can also be of type array and array ; however, parameter $value of XoopsFormText::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
187 | $quePlaceholderField->setDescription(\_MA_WGEVENTS_QUESTION_PLACEHOLDER_DESC); |
||||
188 | if (!$enablePlaceholder) { |
||||
189 | $quePlaceholderField->setExtra('disabled="disabled"'); |
||||
190 | } |
||||
191 | $form->addElement($quePlaceholderField); |
||||
192 | // Form Radio Yes/No queRequired |
||||
193 | $queRequired = (int)$this->getVar('required'); |
||||
194 | $queRequiredField = new \XoopsFormRadioYN(\_MA_WGEVENTS_QUESTION_REQUIRED, 'required', $queRequired); |
||||
195 | $queRequiredField->setDescription(\_MA_WGEVENTS_QUESTION_REQUIRED_DESC); |
||||
196 | $form->addElement($queRequiredField); |
||||
197 | // Form Radio Yes/No quePrint |
||||
198 | $quePrint = (int)$this->getVar('print'); |
||||
199 | $quePrintField = new \XoopsFormRadioYN(\_MA_WGEVENTS_QUESTION_PRINT, 'print', $quePrint); |
||||
200 | $quePrintField->setDescription(\_MA_WGEVENTS_QUESTION_PRINT_DESC); |
||||
201 | $form->addElement($quePrintField); |
||||
202 | // Form Text queWeight |
||||
203 | $queWeight = $this->isNew() ? $questionHandler->getNextWeight($evId) : $this->getVar('weight'); |
||||
204 | if ($isAdmin) { |
||||
205 | $form->addElement(new \XoopsFormText(\_MA_WGEVENTS_WEIGHT, 'weight', 50, 255, $queWeight)); |
||||
206 | } else { |
||||
207 | $form->addElement(new \XoopsFormHidden('weight', $queWeight)); |
||||
0 ignored issues
–
show
It seems like
$queWeight can also be of type array and array ; however, parameter $value of XoopsFormHidden::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
208 | } |
||||
209 | // Form Text Date Select queDatecreated |
||||
210 | // Form Select User queSubmitter |
||||
211 | $queSubmitter = \is_object($GLOBALS['xoopsUser']) ? $GLOBALS['xoopsUser']->uid() : 0; |
||||
212 | if ($isAdmin) { |
||||
213 | // Form Text Date Select queDatecreated |
||||
214 | $queDatecreated = $this->isNew() ? \time() : $this->getVar('datecreated'); |
||||
215 | $form->addElement(new \XoopsFormTextDateSelect(\_MA_WGEVENTS_DATECREATED, 'datecreated', '', $queDatecreated)); |
||||
0 ignored issues
–
show
'' of type string is incompatible with the type integer expected by parameter $size of XoopsFormTextDateSelect::__construct() .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
216 | $form->addElement(new \XoopsFormSelectUser(\_MA_WGEVENTS_SUBMITTER, 'submitter', false, $queSubmitter)); |
||||
217 | } else { |
||||
218 | $form->addElement(new \XoopsFormHidden('datecreated_int', \time())); |
||||
219 | $form->addElement(new \XoopsFormHidden('submitter', $queSubmitter)); |
||||
220 | } |
||||
221 | // To Save |
||||
222 | $form->addElement(new \XoopsFormHidden('op', 'save')); |
||||
223 | $form->addElement(new \XoopsFormHidden('start', $this->start)); |
||||
224 | $form->addElement(new \XoopsFormHidden('limit', $this->limit)); |
||||
225 | $form->addElement(new \XoopsFormButtonTray('submit', \_SUBMIT, 'submit', '', false)); |
||||
226 | return $form; |
||||
227 | } |
||||
228 | |||||
229 | /** |
||||
230 | * Get Values |
||||
231 | * @param null $keys |
||||
0 ignored issues
–
show
|
|||||
232 | * @param null $format |
||||
0 ignored issues
–
show
|
|||||
233 | * @param null $maxDepth |
||||
0 ignored issues
–
show
|
|||||
234 | * @return array |
||||
235 | */ |
||||
236 | public function getValuesQuestions($keys = null, $format = null, $maxDepth = null) |
||||
237 | { |
||||
238 | $helper = \XoopsModules\Wgevents\Helper::getInstance(); |
||||
239 | $utility = new \XoopsModules\Wgevents\Utility(); |
||||
240 | $formelementsHandler = new \XoopsModules\Wgevents\Forms\FormelementsHandler(); |
||||
241 | $fieldsAll = $formelementsHandler->getElementsCollection(); |
||||
242 | $editorMaxchar = $helper->getConfig('admin_maxchar'); |
||||
243 | $ret = $this->getValues($keys, $format, $maxDepth); |
||||
244 | $eventHandler = $helper->getHandler('Event'); |
||||
245 | $eventObj = $eventHandler->get($this->getVar('evid')); |
||||
246 | $ret['eventname'] = $eventObj->getVar('name'); |
||||
247 | $ret['type_text'] = $fieldsAll[$this->getVar('type')]; |
||||
248 | $ret['desc_text'] = $this->getVar('desc', 'e'); |
||||
249 | $ret['desc_short'] = $utility::truncateHtml($ret['desc_text'], $editorMaxchar); |
||||
250 | $ret['value_text'] = ''; |
||||
251 | $ret['value_list'] = ''; |
||||
252 | $queValues = (string)$this->getVar('values'); |
||||
253 | if ('' !== $queValues) { |
||||
254 | $ret['value_text'] = \implode("\n", \unserialize($queValues, ['allowed_classes' => false])); |
||||
255 | $ret['value_list'] = $utility::truncateHtml(\implode('<br>', \unserialize($queValues, ['allowed_classes' => false]))); |
||||
256 | } |
||||
257 | $ret['required_text'] = (int)$this->getVar('required') > 0 ? _YES : _NO; |
||||
258 | $ret['print_text'] = (int)$this->getVar('print') > 0 ? _YES : _NO; |
||||
259 | $ret['datecreated_text'] = \formatTimestamp($this->getVar('datecreated'), 's'); |
||||
260 | $ret['submitter_text'] = \XoopsUser::getUnameFromId($this->getVar('submitter')); |
||||
261 | return $ret; |
||||
262 | } |
||||
263 | |||||
264 | /** |
||||
265 | * Returns an array representation of the object |
||||
266 | * |
||||
267 | * @return array |
||||
268 | */ |
||||
269 | /* |
||||
270 | public function toArray() |
||||
271 | { |
||||
272 | $ret = []; |
||||
273 | $vars = $this->getVars(); |
||||
274 | foreach (\array_keys($vars) as $var) { |
||||
275 | $ret[$var] = $this->getVar($var); |
||||
276 | } |
||||
277 | return $ret; |
||||
278 | } |
||||
279 | */ |
||||
280 | } |
||||
281 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"]
, you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths