Issues (311)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.
Labels
Severity
1
<?php declare(strict_types=1);
2
3
/*
4
 You may not change or alter any portion of this comment or credits
5
 of supporting developers from this source code or any supporting source code
6
 which is considered copyrighted (c) material of the original comment or credit authors.
7
8
 This program is distributed in the hope that it will be useful,
9
 but WITHOUT ANY WARRANTY; without even the implied warranty of
10
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
11
*/
12
13
/**
14
 * wgEvents module for xoops
15
 *
16
 * @copyright    2021 XOOPS Project (https://xoops.org)
17
 * @license      GPL 2.0 or later
18
 * @package      wgevents
19
 * @author       Goffy - Wedega - Email:[email protected] - Website:https://xoops.wedega.com
20
 */
21
22
use Xmf\Request;
0 ignored issues
show
This use statement conflicts with another class in this namespace, Request. Consider defining an alias.

Let?s assume that you have a directory layout like this:

.
|-- OtherDir
|   |-- Bar.php
|   `-- Foo.php
`-- SomeDir
    `-- Foo.php

and let?s assume the following content of Bar.php:

// Bar.php
namespace OtherDir;

use SomeDir\Foo; // This now conflicts the class OtherDir\Foo

If both files OtherDir/Foo.php and SomeDir/Foo.php are loaded in the same runtime, you will see a PHP error such as the following:

PHP Fatal error:  Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.php

However, as OtherDir/Foo.php does not necessarily have to be loaded and the error is only triggered if it is loaded before OtherDir/Bar.php, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias:

// Bar.php
namespace OtherDir;

use SomeDir\Foo as SomeDirFoo; // There is no conflict anymore.
Loading history...
23
use XoopsModules\Wgevents;
24
use XoopsModules\Wgevents\ {
25
    Constants,
26
    Utility,
27
    Common,
28
    MailHandler
29
};
30
31
require __DIR__ . '/header.php';
32
$GLOBALS['xoopsOption']['template_main'] = 'wgevents_event.tpl';
33
require_once \XOOPS_ROOT_PATH . '/header.php';
34
35
// Permission
36
if (!$permissionsHandler->getPermEventsView()) {
37
    \redirect_header('index.php', 0);
38
}
39
$permSubmit = $permissionsHandler->getPermEventsSubmit();
40
$GLOBALS['xoopsTpl']->assign('permSubmit', $permSubmit);
41
$permApprove = $permissionsHandler->getPermEventsApprove();
42
$GLOBALS['xoopsTpl']->assign('permApprove', $permApprove);
43
$permRegister = $permissionsHandler->getPermRegistrationsSubmit();
44
$GLOBALS['xoopsTpl']->assign('permRegister', $permRegister);
45
46
$op     = Request::getCmd('op', 'list');
47
$evId   = Request::getInt('id');
48
$filter = Request::getString('filter');
49
$start  = Request::getInt('start');
50
$limit  = Request::getInt('limit', $helper->getConfig('userpager'));
51
$GLOBALS['xoopsTpl']->assign('start', $start);
52
$GLOBALS['xoopsTpl']->assign('limit', $limit);
53
$catId  = Request::getInt('catid');
54
$filterCats = Request::getArray('filter_cats');
55
if ($catId > 0 && 'save' !== $op) {
56
    $filterCats[$catId] = $catId;
57
}
58
$urlCats = Request::getString('cats');
59
if (0 === \count($filterCats) && '' !== $urlCats) {
60
    $filterCats = \explode(',', $urlCats);
61
}
62
$GLOBALS['xoopsTpl']->assign('urlCats', \implode(',', $filterCats));
63
64
// Define Stylesheet
65
$GLOBALS['xoTheme']->addStylesheet($style, null);
66
// Paths
67
$GLOBALS['xoopsTpl']->assign('xoops_icons32_url', \XOOPS_ICONS32_URL);
68
$GLOBALS['xoopsTpl']->assign('wgevents_url', \WGEVENTS_URL);
69
// JS
70
$GLOBALS['xoTheme']->addScript(\WGEVENTS_URL . '/assets/js/forms.js');
71
// Keywords
72
$keywords = [];
73
// Breadcrumbs
74
$xoBreadcrumbs[] = ['title' => \_MA_WGEVENTS_INDEX, 'link' => 'index.php'];
75
76
//preferences
77
$gmapsEnableEvent = false;
78
$gmapsHeight      = false;
79
$useGMaps         = (bool)$helper->getConfig('use_gmaps');
80
if ($useGMaps) {
81
    $gmapsPositionList = (string)$helper->getConfig('gmaps_enableevent');
82
    $gmapsEnableEvent  = ('top' === $gmapsPositionList || 'bottom' === $gmapsPositionList);
83
    $gmapsHeight       = $helper->getConfig('gmaps_height');
84
}
85
$eventDisplayCats = (string)$helper->getConfig('event_displaycats');
86
$GLOBALS['xoopsTpl']->assign('event_displaycats', $eventDisplayCats);
87
$eventRegprocessbar = (string)$helper->getConfig('event_regprocessbar');
88
$GLOBALS['xoopsTpl']->assign('event_regprocessbar', $eventRegprocessbar);
89
90
//misc
91
$uidCurrent  = 0;
92
$userIsAdmin = false;
93
if (\is_object($GLOBALS['xoopsUser'])) {
94
    $uidCurrent  = $GLOBALS['xoopsUser']->uid();
95
    $userIsAdmin = $GLOBALS['xoopsUser']->isAdmin();
96
}
97
98
$showItem = ($evId > 0);
99
$GLOBALS['xoopsTpl']->assign('showItem', $showItem);
100
101
switch ($op) {
102
    case 'show':
103
    case 'list':
104
    case 'past':
105
    default:
106
        $GLOBALS['xoopsTpl']->assign('wgevents_upload_eventlogos_url', \WGEVENTS_UPLOAD_EVENTLOGOS_URL);
107
        $GLOBALS['xoopsTpl']->assign('wgevents_upload_catlogos_url', \WGEVENTS_UPLOAD_CATLOGOS_URL);
108
        $GLOBALS['xoopsTpl']->assign('wgevents_icons_url_24', \WGEVENTS_ICONS_URL_24 . '/');
109
        $GLOBALS['xoopsTpl']->assign('filter', $filter);
110
111
        $GLOBALS['xoTheme']->addScript(\WGEVENTS_URL . '/assets/js/expander/jquery.expander.min.js');
112
        $GLOBALS['xoopsTpl']->assign('user_maxchar', $helper->getConfig('user_maxchar'));
113
        $useGroups = (bool)$helper->getConfig('use_groups');
114
        $GLOBALS['xoopsTpl']->assign('use_groups', $useGroups);
115
        $GLOBALS['xoopsTpl']->assign('use_urlregistration', $helper->getConfig('use_urlregistration'));
116
117
        // get categories if they should be displayed
118
        if ('none' !== $eventDisplayCats && !$showItem) {
119
            $categories = $categoryHandler->getCategoriesForFilter($eventDisplayCats, $filterCats, $op, $useGroups, $filter);
120
            $GLOBALS['xoopsTpl']->assign('categories', $categories);
121
        }
122
123
        // determine whether there are
124
        // - past events if coming are shown
125
        // - coming events if past are shown
126
        switch($op) {
127
            case 'show':
128
            default:
129
                $listDescr = '';
130
                break;
131
            case 'list':
132
                // get events from the past
133
                $crEventArchieve = new \CriteriaCompo();
134
                $crEventArchieve->add(new \Criteria('datefrom', \time(), '<'));
135
                $eventsCountArchieve = $eventHandler->getCount($crEventArchieve);
136
                unset($crEventArchieve);
137
                $GLOBALS['xoopsTpl']->assign('showBtnPast', $eventsCountArchieve > 0);
138
                $listDescr = \_MA_WGEVENTS_EVENTS_LISTCOMING;
139
                if ('form' === $eventDisplayCats) {
140
                    $formCatsCb = $categoryHandler->getFormCatsCb($filterCats, $op, $filter);
141
                    $GLOBALS['xoopsTpl']->assign('formCatsCb', $formCatsCb->render());
142
                }
143
                break;
144
            case 'past':
145
                $GLOBALS['xoopsTpl']->assign('showBtnComing', true);
146
                $listDescr = \_MA_WGEVENTS_EVENTS_LISTPAST;
147
                if ('form' === $eventDisplayCats) {
148
                    $formCatsCb = $categoryHandler->getFormCatsCb($filterCats, $op, $filter);
149
                    $GLOBALS['xoopsTpl']->assign('formCatsCb', $formCatsCb->render());
150
                }
151
                break;
152
        }
153
        $GLOBALS['xoopsTpl']->assign('listDescr', $listDescr);
154
155
        //misc for displaying events
156
        $crEvent = new \CriteriaCompo();
157
        if ($showItem) {
158
            $GLOBALS['xoopsTpl']->assign('showList', false);
159
            $xoBreadcrumbs[] = ['title' => \_MA_WGEVENTS_EVENT_DETAILS];
160
        } else {
161
            $GLOBALS['xoopsTpl']->assign('showList', true);
162
            $xoBreadcrumbs[] = ['title' => $listDescr];
163
        }
164
165
        // get events
166
        $eventsArr = $eventHandler->getEvents($start, $limit, \time(), 0, '', '', $op, $evId, $filter, $filterCats);
167
168
        $eventsCount = $eventsArr['count'];
169
        $GLOBALS['xoopsTpl']->assign('eventsCount', $eventsCount);
170
        if ($eventsCount > 0) {
171
            $eventsAll = $eventsArr['eventsAll'];
172
            $events    = [];
173
            $eventsMap = [];
174
            $evName    = '';
175
            // Get All Event
176
            foreach (\array_keys($eventsAll) as $i) {
177
                $events[$i] = $eventsAll[$i]->getValuesEvents();
178
179
                $permEdit = $permissionsHandler->getPermEventsEdit($eventsAll[$i]->getVar('submitter'), $eventsAll[$i]->getVar('status')) || $uidCurrent == $eventsAll[$i]->getVar('submitter');
180
                $events[$i]['permEdit'] = $permEdit;
181
                $crQuestion = new \CriteriaCompo();
182
                $crQuestion->add(new \Criteria('evid', $i));
183
                $events[$i]['nb_questions'] = $questionHandler->getCount($crQuestion);
184
                $crRegistration = new \CriteriaCompo();
185
                $crRegistration->add(new \Criteria('evid', $i));
186
                $numberRegCurr = $registrationHandler->getCount($crRegistration);
187
                $events[$i]['nb_registrations'] = $numberRegCurr;
188
                $registerMax = (int)$events[$i]['register_max'];
189
                $events[$i]['regmax'] = $registerMax;
190
                if ($registerMax > 0) {
191
                    $events[$i]['regmax'] = $registerMax;
192
                    $proportion = $numberRegCurr / $registerMax;
193
                    if ($proportion >= 1) {
194
                        $events[$i]['regcurrent'] = \_MA_WGEVENTS_REGISTRATIONS_FULL;
195
                    } elseif (0 === $numberRegCurr) {
196
                        $events[$i]['regcurrent'] = \_MA_WGEVENTS_REGISTRATIONS_NBCURR_0;
197
                    } else {
198
                        $events[$i]['regcurrent'] = \sprintf(\_MA_WGEVENTS_REGISTRATIONS_NBCURR_INDEX, $numberRegCurr, $registerMax);
199
                    }
200
                    $events[$i]['regcurrent_text'] = $events[$i]['regcurrent'];
201
                    $events[$i]['regcurrent_tip'] = true;
202
                    if ($proportion < 0.75) {
203
                        $events[$i]['regcurrentstate'] = 'success';
204
                    } elseif ($proportion < 1) {
205
                        $events[$i]['regcurrentstate'] = 'warning';
206
                    } else {
207
                        $events[$i]['regcurrentstate'] = 'danger';
208
                        $events[$i]['regcurrent_tip'] = false;
209
                    }
210
                    $events[$i]['regpercentage'] = (int)($proportion * 100);
211
                } elseif ('show' === $op) {
212
                    $events[$i]['regcurrent'] = $numberRegCurr;
213
                }
214
                $events[$i]['regenabled'] = $permEdit || (\time() >= $events[$i]['register_from'] && \time() <= $events[$i]['register_to']);
215
                $events[$i]['locked'] = (Constants::STATUS_LOCKED === (int)$events[$i]['status']);
216
                $events[$i]['canceled'] = (Constants::STATUS_CANCELED === (int)$events[$i]['status']);
217
                $evName = $eventsAll[$i]->getVar('name');
218
                if ($useGMaps && $gmapsEnableEvent && (float)$eventsAll[$i]->getVar('locgmlat') > 0) {
219
                    $eventsMap[$i] = [
220
                        'name' => $evName,
221
                        'location' => $events[$i]['location_text_user'],
222
                        'from' => $events[$i]['datefrom_text'],
223
                        'url' => 'event.php?op=show&id=' . $i,
224
                        'lat'  => (float)$eventsAll[$i]->getVar('locgmlat'),
225
                        'lon'  => (float)$eventsAll[$i]->getVar('locgmlon')
226
                    ];
227
                }
228
                $keywords[$i] = $evName;
229
            }
230
            $GLOBALS['xoopsTpl']->assign('events', $events);
231
            if ('show' === $op && $useGMaps) {
232
                $GLOBALS['xoopsTpl']->assign('gmapsShow', true);
233
            }
234
            if ($useGMaps && count($eventsMap) > 0) {
235
                $GLOBALS['xoopsTpl']->assign('gmapsShowList', true);
236
                $GLOBALS['xoopsTpl']->assign('gmapsEnableEvent', $gmapsEnableEvent);
237
                $GLOBALS['xoopsTpl']->assign('gmapsHeight', $gmapsHeight);
238
                $GLOBALS['xoopsTpl']->assign('gmapsPositionList', $gmapsPositionList);
239
                $GLOBALS['xoopsTpl']->assign('api_key', $helper->getConfig('gmaps_api'));
240
                $GLOBALS['xoopsTpl']->assign('eventsMap', $eventsMap);
241
            }
242
            unset($events, $eventMaps);
243
            // Display Navigation
244
            if ($eventsCount > $limit) {
245
                $urlCats = \implode(',', $filterCats);
246
                require_once \XOOPS_ROOT_PATH . '/class/pagenav.php';
247
                $pagenav = new \XoopsPageNav($eventsCount, $limit, $start, 'start', 'op=list&amp;filter=' . $filter . '&amp;limit=' . $limit . '&amp;cats=' . $urlCats);
248
                $GLOBALS['xoopsTpl']->assign('pagenav', $pagenav->renderNav());
249
                /*
250
                $params = [];
251
                $formPageNavCounter = $eventHandler->getFormPageNavCounter($params);
252
                $GLOBALS['xoopsTpl']->assign('formPageNavCounter', $formPageNavCounter->render());
253
                */
254
            }
255
            $GLOBALS['xoopsTpl']->assign('start', $start);
256
            $GLOBALS['xoopsTpl']->assign('limit', $limit);
257
258
            if ('show' === $op && '' !== $evName) {
259
                $GLOBALS['xoopsTpl']->assign('xoops_pagetitle', \strip_tags($evName . ' - ' . $GLOBALS['xoopsModule']->getVar('name')));
260
            }
261
        } elseif (\count($filterCats) > 0) {
262
            $GLOBALS['xoopsTpl']->assign('noEventsReason', \_MA_WGEVENTS_INDEX_THEREARENT_EVENTS_FILTER);
263
        } else {
264
            $GLOBALS['xoopsTpl']->assign('noEventsReason', \_MA_WGEVENTS_INDEX_THEREARENT_EVENTS);
265
        }
266
267
        break;
268
    case 'save':
269
        // Security Check
270
        if (!$GLOBALS['xoopsSecurity']->check()) {
271
            \redirect_header('event.php', 3, \implode(',', $GLOBALS['xoopsSecurity']->getErrors()));
272
        }
273
        // Check permissions
274
        if (!$permissionsHandler->getPermEventsSubmit()) {
275
            \redirect_header('index.php?op=list', 3, \_NOPERM);
276
        }
277
        if ($evId > 0) {
278
            $eventObj = $eventHandler->get($evId);
279
            $eventObjOld = $eventHandler->get($evId);
280
            // Check permissions
281
            if (!$permissionsHandler->getPermEventsEdit($eventObj->getVar('submitter'), $eventObj->getVar('status'))) {
282
                \redirect_header('index.php?op=list', 3, \_NOPERM);
283
            }
284
        } else {
285
            $eventObj = $eventHandler->create();
286
        }
287
288
        $uploaderErrors = '';
289
        $dateErrors = '';
290
        $catId = Request::getInt('catid');
291
        $evSubmitter = Request::getInt('submitter');
292
293
        $eventObj->setVar('catid', $catId);
294
        $subCats = \serialize(Request::getArray('subcats'));
295
        $eventObj->setVar('subcats', $subCats);
296
        $eventObj->setVar('name', Request::getString('name'));
297
        // Set Var logo
298
        require_once \XOOPS_ROOT_PATH . '/class/uploader.php';
299
        $filename    = $_FILES['logo']['name'];
300
        $imgMimetype = $_FILES['logo']['type'];
301
        $imgNameDef  = Request::getString('name');
302
        $uploadPath  = \WGEVENTS_UPLOAD_EVENTLOGOS_PATH . '/' . $uidCurrent . '/';
303
        $uploader    = new \XoopsMediaUploader($uploadPath,
304
                                                    $helper->getConfig('mimetypes_image'), 
305
                                                    $helper->getConfig('maxsize_image'), null, null);
306
        if ($uploader->fetchMedia($_POST['xoops_upload_file'][0])) {
307
            $extension = \preg_replace('/^.+\.([^.]+)$/sU', '', $filename);
308
            $imgName = \str_replace(' ', '', $imgNameDef) . '.' . $extension;
309
            $uploader->setPrefix($imgName);
310
            $uploader->fetchMedia($_POST['xoops_upload_file'][0]);
311
            if ($uploader->upload()) {
312
                $savedFilename = $uploader->getSavedFileName();
313
                $maxwidth  = (int)$helper->getConfig('maxwidth_image');
314
                $maxheight = (int)$helper->getConfig('maxheight_image');
315
                if ($maxwidth > 0 && $maxheight > 0) {
316
                    // Resize image
317
                    $imgHandler                = new Wgevents\Common\Resizer();
318
                    $imgHandler->sourceFile    = $uploadPath . $savedFilename;
319
                    $imgHandler->endFile       = $uploadPath . $savedFilename;
320
                    $imgHandler->imageMimetype = $imgMimetype;
321
                    $imgHandler->maxWidth      = $maxwidth;
322
                    $imgHandler->maxHeight     = $maxheight;
323
                    $result                    = $imgHandler->resizeImage();
324
                }
325
                $filename = $savedFilename;
326
                $eventObj->setVar('logo', $savedFilename);
327
            } else {
328
                $uploaderErrors .= '<br>' . $uploader->getErrors();
329
            }
330
        } else {
331
            if ($filename > '') {
332
                $uploaderErrors .= '<br>' . $uploader->getErrors();
333
            }
334
            $filename = Request::getString('logo');
335
            if ('' !== $filename) {
336
                $eventObj->setVar('logo', $filename);
337
            }
338
        }
339
        if ($evSubmitter !== $uidCurrent) {
340
            //if someone creates/save event for someone else then copy logo
341
            $submitterDirectory = \WGEVENTS_UPLOAD_EVENTLOGOS_PATH . '/' . $evSubmitter;
342
            if (!\file_exists($submitterDirectory)) {
343
                Utility::createFolder($submitterDirectory);
344
                \chmod($submitterDirectory, 0777);
345
                $source = \WGEVENTS_PATH . '/assets/images/blank.gif';
346
                $dest = $submitterDirectory . '/blank.gif';
347
                Utility::copyFile($source, $dest);
348
            }
349
            $dest = \WGEVENTS_UPLOAD_EVENTLOGOS_PATH . '/' . $evSubmitter . '/' . $filename;
350
            if (!\file_exists($dest)) {
351
                Utility::copyFile($uploadPath . $filename, $dest);
352
            }
353
        }
354
        $eventObj->setVar('desc', Request::getText('desc'));
355
        $eventDatefromArr = Request::getArray('datefrom');
356
        $eventDatefromObj = \DateTime::createFromFormat(\_SHORTDATESTRING, $eventDatefromArr['date']);
357
        $eventDatefromObj->setTime(0, 0);
358
        $eventDatefrom = $eventDatefromObj->getTimestamp() + (int)$eventDatefromArr['time'];
359
        $eventObj->setVar('datefrom', $eventDatefrom);
360
        $eventDatetoArr = Request::getArray('dateto');
361
        $eventDatetoObj = \DateTime::createFromFormat(\_SHORTDATESTRING, $eventDatetoArr['date']);
362
        $eventDatetoObj->setTime(0, 0);
363
        $eventDateto = $eventDatetoObj->getTimestamp() + (int)$eventDatetoArr['time'];
364
        if ($eventDateto < $eventDatefrom) {
365
            $eventDateto = $eventDatefrom;
366
            $dateErrors .= '<br>' . \_MA_WGEVENTS_EVENT_DATE_ERROR1;
367
        }
368
        $eventObj->setVar('dateto', $eventDateto);
369
        $eventObj->setVar('allday', Request::getInt('allday'));
370
        $eventObj->setVar('contact', Request::getString('contact'));
371
        $eventObj->setVar('email', Request::getString('email'));
372
        $eventObj->setVar('url', Request::getString('url'));
373
        $eventObj->setVar('location', Request::getString('location'));
374
        $eventObj->setVar('locgmlat', Request::getFloat('locgmlat'));
375
        $eventObj->setVar('locgmlon', Request::getFloat('locgmlon'));
376
        $eventObj->setVar('locgmzoom', Request::getInt('locgmzoom'));
377
        $evFeeType = Request::getInt('fee_type');
378
        $eventObj->setVar('fee_type', $evFeeType);
379
        if (Constants::FEETYPE_DECLARED === $evFeeType) {
380
            $evFeeAmountArr = Request::getArray('fee');
381
            $evFeeDescArr = Request::getArray('feedesc');
382
            $evFeeArr = [];
383
            foreach ($evFeeAmountArr as $key => $evFeeAmount) {
384
                $evFeeArr[] = [Utility::StringToFloat($evFeeAmount), $evFeeDescArr[$key]];
385
            }
386
            // remove last array item, as this is from hidden group
387
            \array_pop($evFeeArr);
388
            $evFee = \json_encode($evFeeArr);
389
        } else {
390
            $evFee = '[[0,""]]';
391
        }
392
        $eventObj->setVar('fee', $evFee);
393
        $eventObj->setVar('paymentinfo', Request::getText('paymentinfo'));
394
        $evRegisterUse = Request::getInt('register_use');
395
        $eventObj->setVar('register_use', $evRegisterUse);
396
        if ($evRegisterUse) {
397
            $evRegisterfromArr = Request::getArray('register_from');
398
            $evRegisterfromObj = \DateTime::createFromFormat(\_SHORTDATESTRING, $evRegisterfromArr['date']);
399
            $evRegisterfromObj->setTime(0, 0);
400
            $evRegisterfrom = $evRegisterfromObj->getTimestamp() + (int)$evRegisterfromArr['time'];
401
            $eventObj->setVar('register_from', $evRegisterfrom);
402
            $evRegistertoArr = Request::getArray('register_to');
403
            $evRegistertoObj = \DateTime::createFromFormat(\_SHORTDATESTRING, $evRegistertoArr['date']);
404
            $evRegistertoObj->setTime(0, 0);
405
            $evRegisterto = $evRegistertoObj->getTimestamp() + (int)$evRegistertoArr['time'];
406
            $eventObj->setVar('register_to', $evRegisterto);
407
            if ($evRegisterto < $evRegisterfrom) {
408
                $evRegisterto = $evRegisterfrom;
409
                $dateErrors .= '<br>' . \_MA_WGEVENTS_EVENT_DATE_ERROR2;
410
            }
411
            $eventObj->setVar('register_max', Request::getInt('register_max'));
412
            $eventObj->setVar('register_listwait', Request::getInt('register_listwait'));
413
            $eventObj->setVar('register_autoaccept', Request::getInt('register_autoaccept'));
414
            $eventObj->setVar('register_notify', Request::getString('register_notify'));
415
            $eventObj->setVar('register_forceverif', Request::getInt('register_forceverif'));
416
            $evRegisterSendermail = Request::getString('register_sendermail');
417
            if ('' === $evRegisterSendermail) {
418
                // Get Form Error
419
                $GLOBALS['xoopsTpl']->assign('error', \_MA_WGEVENTS_EVENT_REGISTER_SENDERMAIL_ERR);
420
                $form = $eventObj->getForm();
421
                $GLOBALS['xoopsTpl']->assign('form', $form->render());
422
                break;
423
            }
424
            $eventObj->setVar('register_sendermail', $evRegisterSendermail);
425
            $eventObj->setVar('register_sendername', Request::getString('register_sendername'));
426
            $eventObj->setVar('register_signature', Request::getString('register_signature'));
427
        } else {
428
            //reset previous values
429
            $eventObj->setVar('register_to', 0);
430
            $eventObj->setVar('register_max', 0);
431
            $eventObj->setVar('register_listwait', 0);
432
            $eventObj->setVar('register_autoaccept', 0);
433
            $eventObj->setVar('register_notify', '');
434
            $eventObj->setVar('register_sendermail', '');
435
            $eventObj->setVar('register_sendername', '');
436
            $eventObj->setVar('register_signature', '');
437
            $eventObj->setVar('register_forceverif', 0);
438
        }
439
        if (Request::hasVar('url_registration')) {
440
            $urlRegistration = Request::getString('url_registration');
441
        } else {
442
            $urlRegistration = '';
443
        }
444
        $eventObj->setVar('url_registration', $urlRegistration);
445
        $eventObj->setVar('status', Request::getInt('status'));
446
        $eventObj->setVar('galid', Request::getInt('galid'));
447
        $arrGroups = Request::getArray('groups');
448
        if (in_array('00000', $arrGroups)) {
449
            $eventObj->setVar('groups', '00000');
450
        } else {
451
            $eventObj->setVar('groups', implode('|', $arrGroups));
452
        }
453
        if (Request::hasVar('datecreated_int')) {
454
            $eventObj->setVar('datecreated', Request::getInt('datecreated_int'));
455
        } else {
456
            $eventDatecreatedObj = \DateTime::createFromFormat(\_SHORTDATESTRING, Request::getString('datecreated'));
457
            $eventObj->setVar('datecreated', $eventDatecreatedObj->getTimestamp());
458
        }
459
        $eventObj->setVar('submitter', Request::getInt('submitter'));
460
        // Insert Data
461
        if ($eventHandler->insert($eventObj)) {
462
            $newEvId = $evId > 0 ? $evId : $eventObj->getNewInsertedId();
463
            // create unique identifier if new event and identifier exists
464
            if (0 === $evId) {
465
                $categoryObj = $categoryHandler->get($catId);
466
                $identifier = (string)$categoryObj->getVar('identifier');
467
                if ('' === $identifier) {
468
                    $identifier .= $eventDatefromObj->format('Y') . '_';
469
                } else {
470
                    if (\substr($identifier, -1) !== '_') {
471
                        $identifier .= '_';
472
                    }
473
                }
474
                $crEvent = new \CriteriaCompo();
475
                $crEvent->add(new \Criteria('identifier', $identifier . '%', 'LIKE'));
476
                $eventsCount = $eventHandler->getCount($crEvent) + 1;
477
                $eventIdentifierObj = $eventHandler->get($newEvId);
478
                $eventIdentifierObj->setVar('identifier', $identifier . ($eventsCount));
479
                $eventHandler->insert($eventIdentifierObj);
480
                unset($eventIdentifierObj);
481
            } else {
482
                $eventIdentifierObj = $eventHandler->get($evId);
483
                $eventIdentifierObj->setVar('identifier', Request::getString('identifier'));
484
                $eventHandler->insert($eventIdentifierObj);
485
                unset($eventIdentifierObj);
486
            }
487
488
            // Handle notification
489
            /*
490
            $evName = $eventObj->getVar('name');
491
            $evStatus = $eventObj->getVar('status');
492
            $tags = [];
493
            $tags['ITEM_NAME'] = $evName;
494
            $tags['ITEM_URL']  = \XOOPS_URL . '/modules/wgevents/event.php?op=show&id=' . $evId;
495
            $notificationHandler = \xoops_getHandler('notification');
496
            if (Constants::STATUS_SUBMITTED == $evStatus) {
497
                // Event approve notification
498
                $notificationHandler->triggerEvent('global', 0, 'global_approve', $tags);
499
                $notificationHandler->triggerEvent('events', $newEvId, 'event_approve', $tags);
500
            } else {
501
                if ($evId > 0) {
502
                    // Event modify notification
503
                    $notificationHandler->triggerEvent('global', 0, 'global_modify', $tags);
504
                    $notificationHandler->triggerEvent('events', $newEvId, 'event_modify', $tags);
505
                } else {
506
                    // Event new notification
507
                    $notificationHandler->triggerEvent('global', 0, 'global_new', $tags);
508
                }
509
            }
510
            */
511
512
            $counterDone = 0;
513
            // check whether there are important changes of the event
514
            // if yes then send notifications to all participants
515
            if ($evId > 0) {
516
                // find changes in table events
517
                $infotext = $eventHandler->getEventsCompare($eventObjOld, $eventObj);
518
                if ('' !== $infotext) {
519
                    $typeConfirm = Constants::MAIL_EVENT_NOTIFY_MODIFY;
520
                    $crRegistration = new \CriteriaCompo();
521
                    $crRegistration->add(new \Criteria('evid', $evId));
522
                    $registrationsCount = $registrationHandler->getCount($crRegistration);
523
                    $mailToArr   = [];
524
                    $informModif = Request::getBool('informModif');
525
                    if ($registrationsCount > 0) {
526
                        $registrationsAll = $registrationHandler->getAll($crRegistration);
527
                        foreach (\array_keys($registrationsAll) as $regId) {
528
                            // Event delete notification
529
                            /*
530
                            $tags = [];
531
                            $tags['ITEM_NAME'] = $regEvid;
532
                            $notificationHandler = \xoops_getHandler('notification');
533
                            $notificationHandler->triggerEvent('global', 0, 'global_delete', $tags);
534
                            $notificationHandler->triggerEvent('registrations', $regId, 'registration_delete', $tags);
535
                            */
536
537
                            if ($informModif) {
538
                                // send notifications emails, only to participants
539
                                $regEmail = (string)$registrationsAll[$regId]->getVar('email');
540
                                if ('' !== $regEmail) {
541
                                    $mailToArr[$regEmail] = $regEmail;
542
                                }
543
                            }
544
                        }
545
                    }
546
                    if (\count($mailToArr) > 0) {
547
                        $mailParams = [];
548
                        $mailParams['evId'] = $evId;
549
                        $mailParams['evName'] = $eventObj->getVar('name');
550
                        $mailParams['evDatefrom'] = $eventObj->getVar('datefrom');
551
                        $mailParams['evLocation'] = $eventObj->getVar('location');
552
                        $mailParams['evSubmitter'] = $eventObj->getVar('submitter');
553
                        $mailParams['evStatus'] = $eventObj->getVar('status');
554
                        $mailParams['evRegister_sendermail'] = $eventObj->getVar('register_sendermail');
555
                        $mailParams['evRegister_sendername'] = $eventObj->getVar('register_sendername');
556
                        $mailParams['evRegister_signature'] = $eventObj->getVar('register_signature');
557
                        $mailParams['mailFrom'] = $eventObj->getVar('register_sendermail');
558
                        $mailParams['mailSubject'] = \sprintf(_MA_WGEVENTS_CONTACT_ALL_MAILSUBJECT_TEXT, $eventObj->getVar('name'));
559
                        $mailParams['mailBody'] = $infotext;
560
561
                        foreach ($mailToArr as $mail) {
562
                            $taskHandler->createTask(Constants::MAIL_EVENT_NOTIFY_ALL, $mail, json_encode($mailParams));
563
                        }
564
565
                        $result = $taskHandler->processTasks();
566
                        $counterDone = (int)$result['done'];
567
                        $counterPending = (int)$result['pending'];
568
569
                    }
570
571
                }
572
            }
573
            // redirect after insert
574
            if ('' !== $uploaderErrors) {
575
                \redirect_header('event.php?op=edit&id=' . $newEvId, 5, $uploaderErrors);
576
            } elseif ($evRegisterUse) {
577
                // clone questions, if event is clone of other event
578
                $idEvSource = Request::getInt('id_source');
579
                $cloneQuestions = Request::getBool('clone_question');
580
                if ($cloneQuestions) {
581
                    $crQuestion = new \CriteriaCompo();
582
                    $crQuestion->add(new \Criteria('evid', $idEvSource));
583
                    $questionsCount = $questionHandler->getCount($crQuestion);
584
                    if ($questionsCount > 0) {
585
                        $questionsAllSource = $questionHandler->getAll($crQuestion);
586
                        foreach ($questionsAllSource as $questionObjSource) {
587
                            $questionObjNew = $questionHandler->create();
588
                            $vars = $questionObjSource->getVars();
589
                            foreach (\array_keys($vars) as $var) {
590
                                switch ($var) {
591
                                    case 'id':
592
                                        break;
593
                                    case 'evid':
594
                                        $questionObjNew->setVar('evid', $newEvId);
595
                                        break;
596
                                    case 'datecreated':
597
                                        $questionObjNew->setVar('datecreated', \time());
598
                                        break;
599
                                    case 'submitter':
600
                                        $questionObjNew->setVar('submitter', $uidCurrent);
601
                                        break;
602
                                    case '':
603
                                    default:
604
                                        $questionObjNew->setVar($var, $questionObjSource->getVar($var));
605
                                        break;
606
                                }
607
                            }
608
                            $questionHandler->insert($questionObjNew);
609
                        }
610
                    }
611
                }
612
                $textFormOK = \_MA_WGEVENTS_FORM_OK . $dateErrors;
613
                if ($counterDone > 0) {
614
                    $textFormOK .= '<br>' . sprintf( \_MA_WGEVENTS_CONTACT_ALL_SUCCESS, $counterDone);
615
                }
616
                if (Request::hasVar('continue_questions')) {
617
                    \redirect_header('question.php?op=list&amp;evid=' . $newEvId . '&amp;start=' . $start . '&amp;limit=' . $limit. '&amp;cats=' . $urlCats, 2, $textFormOK);
618
                }
619
                if ($evId > 0 || !$cloneQuestions) {
620
                    \redirect_header('event.php?op=show&amp;id=' . $evId . '&amp;start=' . $start . '&amp;limit=' . $limit. '&amp;cats=' . $urlCats, 2, $textFormOK);
621
                } else {
622
                    // check whether there are already question infos
623
                    $crQuestion = new \CriteriaCompo();
624
                    $crQuestion->add(new \Criteria('evid', $newEvId));
625
                    if ($questionHandler->getCount($crQuestion) > 0) {
626
                        // set of questions already existing
627
                        \redirect_header('question.php?op=list&amp;evid=' . $newEvId, 2, $textFormOK);
628
                    } else {
629
                        // redirect to question.php in order to add default set of questions
630
                        \redirect_header('question.php?op=newset&amp;evid=' . $newEvId, 0, $textFormOK);
631
                    }
632
                }
633
            } else {
634
                if ($evId > 0) {
635
                    $registrationHandler->cleanupRegistrations($evId);
636
                    $questionHandler->cleanupQuestions($evId);
637
                    $answerHandler->cleanupAnswers($evId);
638
                }
639
                \redirect_header('event.php?op=list&amp;start=' . $start . '&amp;limit=' . $limit. '&amp;cats=' . $urlCats, 2, \_MA_WGEVENTS_FORM_OK . $dateErrors);
640
            }
641
        }
642
        // Get Form Error
643
        $GLOBALS['xoopsTpl']->assign('error', $eventObj->getHtmlErrors());
644
        $form = $eventObj->getForm();
645
        $GLOBALS['xoopsTpl']->assign('form', $form->render());
646
        break;
647
    case 'new':
648
        // Breadcrumbs
649
        $xoBreadcrumbs[] = ['title' => \_MA_WGEVENTS_EVENT_ADD];
650
        // Check permissions
651
        if (!$permissionsHandler->getPermEventsSubmit()) {
652
            \redirect_header('event.php?op=list', 3, \_NOPERM);
653
        }
654
        if ($useGMaps) {
655
            $GLOBALS['xoopsTpl']->assign('gmapsModalSave', $permissionsHandler->getPermEventsSubmit());
656
            $GLOBALS['xoopsTpl']->assign('gmapsModal', true);
657
            $GLOBALS['xoopsTpl']->assign('api_key', $helper->getConfig('gmaps_api'));
658
        }
659
        // Form Create
660
        $eventObj = $eventHandler->create();
661
        $eventDate = Request::getInt('eventDate', \time());
662
        $eventObj->setVar('datefrom', $eventDate);
663
        $eventObj->setVar('dateto', $eventDate);
664
        $eventObj->start = $start;
665
        $eventObj->limit = $limit;
666
        $form = $eventObj->getForm();
667
        $GLOBALS['xoopsTpl']->assign('form', $form->render());
668
        break;
669
    case 'edit':
670
        // Breadcrumbs
671
        $xoBreadcrumbs[] = ['title' => \_MA_WGEVENTS_EVENT_EDIT];
672
        // Check params
673
        if (0 === $evId) {
674
            \redirect_header('event.php?op=list', 3, \_MA_WGEVENTS_INVALID_PARAM);
675
        }
676
        $eventObj = $eventHandler->get($evId);
677
        // Check permissions
678
        $permEdit = !$permissionsHandler->getPermEventsEdit($eventObj->getVar('submitter'), $eventObj->getVar('status'));
679
        if ($permEdit) {
680
            \redirect_header('index.php?op=list', 3, \_NOPERM);
681
        }
682
        if ($useGMaps) {
683
            $GLOBALS['xoopsTpl']->assign('gmapsModalSave', $permEdit);
684
            $GLOBALS['xoopsTpl']->assign('gmapsModal', true);
685
            $GLOBALS['xoopsTpl']->assign('api_key', $helper->getConfig('gmaps_api'));
686
        }
687
        // Get Form
688
        $eventObj = $eventHandler->get($evId);
689
        $eventObj->start = $start;
690
        $eventObj->limit = $limit;
691
        $eventObj->cats  = $urlCats;
692
        $form = $eventObj->getForm();
693
        $GLOBALS['xoopsTpl']->assign('form', $form->render());
694
        break;
695
    case 'clone':
696
        // Check permissions
697
        if (!$permissionsHandler->getPermEventsSubmit()) {
698
            \redirect_header('event.php?op=list', 3, \_NOPERM);
699
        }
700
        // Request source
701
        $evIdSource = Request::getInt('id_source');
702
        // Check params
703
        if (0 === $evIdSource) {
704
            \redirect_header('event.php?op=list', 3, \_MA_WGEVENTS_INVALID_PARAM);
705
        }
706
        // Breadcrumbs
707
        $xoBreadcrumbs[] = ['title' => \_MA_WGEVENTS_EVENT_CLONE];
708
709
        if ($useGMaps) {
710
            $GLOBALS['xoopsTpl']->assign('gmapsModalSave', $permissionsHandler->getPermEventsSubmit());
711
            $GLOBALS['xoopsTpl']->assign('gmapsModal', true);
712
            $GLOBALS['xoopsTpl']->assign('api_key', $helper->getConfig('gmaps_api'));
713
        }
714
715
        // Get Form
716
        $eventObjSource = $eventHandler->get($evIdSource);
717
        $eventObjClone  = $eventHandler->create();
718
        $vars = $eventObjSource->getVars();
719
        foreach (\array_keys($vars) as $var) {
720
            $eventObjClone->setVar($var, $eventObjSource->getVar($var, 'e'));
721
        }
722
        $eventObjClone->idSource = $evIdSource;
723
        $form = $eventObjClone->getForm();
724
        $GLOBALS['xoopsTpl']->assign('form', $form->render());
725
        break;
726
    case 'delete':
727
        // Breadcrumbs
728
        $xoBreadcrumbs[] = ['title' => \_MA_WGEVENTS_EVENT_DELETE];
729
        // Check permissions
730
        if (!$permissionsHandler->getPermEventsSubmit()) {
731
            \redirect_header('event.php?op=list', 3, \_NOPERM);
732
        }
733
        // Check params
734
        if (0 === $evId) {
735
            \redirect_header('event.php?op=list', 3, \_MA_WGEVENTS_INVALID_PARAM);
736
        }
737
        $crRegistration = new \CriteriaCompo();
738
        $crRegistration->add(new \Criteria('evid', $evId));
739
        $registrationsCount = $registrationHandler->getCount($crRegistration);
740
        if ($registrationsCount > 0) {
741
            \redirect_header('event.php?op=list', 3, \_MA_WGEVENTS_EVENT_DELETE_ERR);
742
        }
743
        $eventObj = $eventHandler->get($evId);
744
        $evName = $eventObj->getVar('name');
745
        if (isset($_REQUEST['ok']) && 1 === (int)$_REQUEST['ok']) {
746
            if (!$GLOBALS['xoopsSecurity']->check()) {
747
                \redirect_header('event.php', 3, \implode(', ', $GLOBALS['xoopsSecurity']->getErrors()));
748
            }
749
            $registrationHandler->cleanupRegistrations($evId);
750
            $questionHandler->cleanupQuestions($evId);
751
            $answerHandler->cleanupAnswers($evId);
752
            if ($eventHandler->delete($eventObj)) {
753
                // Event delete notification
754
                /*
755
                $tags = [];
756
                $tags['ITEM_NAME'] = $evName;
757
                $notificationHandler = \xoops_getHandler('notification');
758
                $notificationHandler->triggerEvent('global', 0, 'global_delete', $tags);
759
                $notificationHandler->triggerEvent('events', $evId, 'event_delete', $tags);
760
                */
761
                \redirect_header('event.php', 3, \_MA_WGEVENTS_FORM_DELETE_OK);
762
            } else {
763
                $GLOBALS['xoopsTpl']->assign('error', $eventObj->getHtmlErrors());
764
            }
765
        } else {
766
            $customConfirm = new Common\Confirm(
767
                ['ok' => 1, 'id' => $evId, 'start' => $start, 'limit' => $limit, 'op' => 'delete'],
768
                $_SERVER['REQUEST_URI'],
769
                \sprintf(\_MA_WGEVENTS_CONFIRMDELETE_EVENT, $eventObj->getVar('name')), \_MA_WGEVENTS_CONFIRMDELETE_TITLE, \_MA_WGEVENTS_CONFIRMDELETE_LABEL);
770
            $form = $customConfirm->getFormConfirm();
771
            $GLOBALS['xoopsTpl']->assign('form', $form->render());
772
        }
773
        break;
774
    case 'cancel':
775
        // Breadcrumbs
776
        $xoBreadcrumbs[] = ['title' => \_MA_WGEVENTS_EVENT_CANCEL];
777
        // Check permissions
778
        if (!$permissionsHandler->getPermEventsSubmit()) {
779
            \redirect_header('event.php?op=list', 3, \_NOPERM);
780
        }
781
        // Check params
782
        if (0 === $evId) {
783
            \redirect_header('event.php?op=list', 3, \_MA_WGEVENTS_INVALID_PARAM);
784
        }
785
        $eventObj = $eventHandler->get($evId);
786
        $evName = $eventObj->getVar('name');
787
        if (isset($_REQUEST['ok']) && 1 === (int)$_REQUEST['ok']) {
788
            if (!$GLOBALS['xoopsSecurity']->check()) {
789
                \redirect_header('event.php', 3, \implode(', ', $GLOBALS['xoopsSecurity']->getErrors()));
790
            }
791
            $eventObj->setVar('status', Constants::STATUS_CANCELED);
792
            $eventObj->setVar('datecreated', \time());
793
            $eventObj->setVar('submitter', $uidCurrent);
794
            // delete all questions/registrations/answers
795
            $registrationHandler->cleanupRegistrations($evId);
796
            $questionHandler->cleanupQuestions($evId);
797
            $answerHandler->cleanupAnswers($evId);
798
            // Insert Data
799
            if ($eventHandler->insert($eventObj)) {
800
                // Event delete notification
801
                /*
802
                $tags = [];
803
                $tags['ITEM_NAME'] = $evName;
804
                $notificationHandler = \xoops_getHandler('notification');
805
                $notificationHandler->triggerEvent('global', 0, 'global_delete', $tags);
806
                $notificationHandler->triggerEvent('events', $evId, 'event_delete', $tags);
807
                */
808
                \redirect_header('event.php', 3, \_MA_WGEVENTS_FORM_CANCEL_OK);
809
            } else {
810
                $GLOBALS['xoopsTpl']->assign('error', $eventObj->getHtmlErrors());
811
            }
812
        } else {
813
            $customConfirm = new Common\Confirm(
814
                ['ok' => 1, 'id' => $evId, 'start' => $start, 'limit' => $limit, 'op' => 'cancel'],
815
                $_SERVER['REQUEST_URI'],
816
                \sprintf(\_MA_WGEVENTS_CONFIRMCANCEL_EVENT, $eventObj->getVar('name')), \_MA_WGEVENTS_CONFIRMCANCEL_TITLE, \_MA_WGEVENTS_CONFIRMCANCEL_LABEL);
817
            $form = $customConfirm->getFormConfirm();
818
            $GLOBALS['xoopsTpl']->assign('form', $form->render());
819
        }
820
        break;
821
}
822
823
// Keywords
824
wgeventsMetaKeywords($helper->getConfig('keywords') . ', ' . \implode(',', $keywords));
825
unset($keywords);
826
827
// Description
828
//wgeventsMetaDescription(\_MA_WGEVENTS_EVENTS_DESC);
829
$GLOBALS['xoopsTpl']->assign('xoops_mpageurl', \WGEVENTS_URL.'/event.php');
830
$GLOBALS['xoopsTpl']->assign('wgevents_upload_url', \WGEVENTS_UPLOAD_URL);
831
832
require __DIR__ . '/footer.php';
833