This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||||
2 | |||||||
3 | declare(strict_types=1); |
||||||
4 | |||||||
5 | |||||||
6 | namespace XoopsModules\Wgfilemanager; |
||||||
7 | |||||||
8 | /* |
||||||
9 | You may not change or alter any portion of this comment or credits |
||||||
10 | of supporting developers from this source code or any supporting source code |
||||||
11 | which is considered copyrighted (c) material of the original comment or credit authors. |
||||||
12 | |||||||
13 | This program is distributed in the hope that it will be useful, |
||||||
14 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
15 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||
16 | */ |
||||||
17 | |||||||
18 | /** |
||||||
19 | * wgFileManager module for xoops |
||||||
20 | * |
||||||
21 | * @copyright 2021 XOOPS Project (https://xoops.org) |
||||||
22 | * @license GPL 2.0 or later |
||||||
23 | * @package wgfilemanager |
||||||
24 | * @author Goffy - Wedega - Email:[email protected] - Website:https://xoops.wedega.com |
||||||
25 | */ |
||||||
26 | |||||||
27 | use XoopsModules\Wgfilemanager; |
||||||
28 | |||||||
29 | \defined('XOOPS_ROOT_PATH') || die('Restricted access'); |
||||||
30 | |||||||
31 | /** |
||||||
32 | * Class Object Directory |
||||||
33 | */ |
||||||
34 | class Directory extends \XoopsObject |
||||||
35 | { |
||||||
36 | /** |
||||||
37 | * @var int |
||||||
38 | */ |
||||||
39 | public $start = 0; |
||||||
40 | |||||||
41 | /** |
||||||
42 | * @var int |
||||||
43 | */ |
||||||
44 | public $limit = 0; |
||||||
45 | |||||||
46 | /** |
||||||
47 | * Constructor |
||||||
48 | * |
||||||
49 | */ |
||||||
50 | public function __construct() |
||||||
51 | { |
||||||
52 | $this->initVar('id', \XOBJ_DTYPE_INT); |
||||||
53 | $this->initVar('parent_id', \XOBJ_DTYPE_INT); |
||||||
54 | $this->initVar('name', \XOBJ_DTYPE_TXTBOX); |
||||||
55 | $this->initVar('description', \XOBJ_DTYPE_OTHER); |
||||||
56 | $this->initVar('fullpath', \XOBJ_DTYPE_TXTBOX); |
||||||
57 | $this->initVar('weight', \XOBJ_DTYPE_INT); |
||||||
58 | $this->initVar('date_created', \XOBJ_DTYPE_INT); |
||||||
59 | $this->initVar('submitter', \XOBJ_DTYPE_INT); |
||||||
60 | } |
||||||
61 | |||||||
62 | /** |
||||||
63 | * @static function &getInstance |
||||||
64 | * |
||||||
65 | */ |
||||||
66 | public static function getInstance() |
||||||
67 | { |
||||||
68 | static $instance = false; |
||||||
69 | if (!$instance) { |
||||||
70 | $instance = new self(); |
||||||
71 | } |
||||||
72 | } |
||||||
73 | |||||||
74 | /** |
||||||
75 | * The new inserted $Id |
||||||
76 | * @return integer |
||||||
77 | */ |
||||||
78 | public function getNewInsertedId() |
||||||
79 | { |
||||||
80 | return $GLOBALS['xoopsDB']->getInsertId(); |
||||||
81 | } |
||||||
82 | |||||||
83 | /** |
||||||
84 | * @public function getForm |
||||||
85 | * @param bool $action |
||||||
86 | * @return \XoopsThemeForm |
||||||
87 | */ |
||||||
88 | public function getForm($action = false) |
||||||
89 | { |
||||||
90 | $helper = \XoopsModules\Wgfilemanager\Helper::getInstance(); |
||||||
91 | if (!$action) { |
||||||
92 | $action = $_SERVER['REQUEST_URI']; |
||||||
93 | } |
||||||
94 | $isAdmin = \is_object($GLOBALS['xoopsUser']) && $GLOBALS['xoopsUser']->isAdmin($GLOBALS['xoopsModule']->mid()); |
||||||
95 | // Title |
||||||
96 | $title = $this->isNew() ? \_MA_WGFILEMANAGER_DIRECTORY_ADD : \_MA_WGFILEMANAGER_DIRECTORY_EDIT; |
||||||
97 | // handler |
||||||
98 | $directoryHandler = $helper->getHandler('Directory'); |
||||||
99 | // Get Theme Form |
||||||
100 | \xoops_load('XoopsFormLoader'); |
||||||
101 | $form = new \XoopsThemeForm($title, 'form', $action, 'post', true); |
||||||
102 | $form->setExtra('enctype="multipart/form-data"'); |
||||||
103 | // Form Table directory |
||||||
104 | if ($this->getVar('id') > 1 || $this->isNew()) { |
||||||
105 | $dirParentid = $this->getVar('parent_id'); |
||||||
106 | $dirParent_idSelect = new \XoopsFormSelect(\_MA_WGFILEMANAGER_DIRECTORY_PARENT_ID, 'parent_id', $dirParentid); |
||||||
107 | $dirListSelect = new \RecursiveIteratorIterator(new \RecursiveArrayIterator($directoryHandler->getDirListFormSelect(0))); |
||||||
108 | foreach ($dirListSelect as $key => $value) { |
||||||
109 | $dirParent_idSelect->addOption($key, $value); |
||||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||||
110 | } |
||||||
111 | $form->addElement($dirParent_idSelect); |
||||||
112 | $form->addElement(new \XoopsFormHidden('parent_id_old', $dirParentid)); |
||||||
0 ignored issues
–
show
It seems like
$dirParentid can also be of type array and array ; however, parameter $value of XoopsFormHidden::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
113 | } else { |
||||||
114 | $form->addElement(new \XoopsFormHidden('parent_id', 0)); |
||||||
115 | $form->addElement(new \XoopsFormHidden('parent_id_old', 0)); |
||||||
116 | } |
||||||
117 | // Form Text dirName |
||||||
118 | $dirName = $this->getVar('name'); |
||||||
119 | $form->addElement(new \XoopsFormText(\_MA_WGFILEMANAGER_DIRECTORY_NAME, 'name', 50, 255, $dirName), true); |
||||||
0 ignored issues
–
show
It seems like
$dirName can also be of type array and array ; however, parameter $value of XoopsFormText::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
120 | $form->addElement(new \XoopsFormHidden('name_old', $dirName)); |
||||||
121 | // Form Editor DhtmlTextArea dirDescription |
||||||
122 | $dirDescription = $this->getVar('description', 'e'); |
||||||
123 | $editorConfigs = []; |
||||||
124 | if ($isAdmin) { |
||||||
125 | $editor = $helper->getConfig('editor_admin'); |
||||||
126 | } else { |
||||||
127 | $editor = $helper->getConfig('editor_user'); |
||||||
128 | } |
||||||
129 | $editorConfigs['name'] = 'description'; |
||||||
130 | $editorConfigs['value'] = $dirDescription; |
||||||
131 | $editorConfigs['rows'] = 5; |
||||||
132 | $editorConfigs['cols'] = 40; |
||||||
133 | $editorConfigs['width'] = '100%'; |
||||||
134 | $editorConfigs['height'] = '400px'; |
||||||
135 | $editorConfigs['editor'] = $editor; |
||||||
136 | $form->addElement(new \XoopsFormEditor(\_MA_WGFILEMANAGER_DIRECTORY_DESCRIPTION, 'description', $editorConfigs)); |
||||||
137 | // Form Text dirFullpath |
||||||
138 | $dirFullpath = $this->getVar('fullpath'); |
||||||
139 | if ($isAdmin) { |
||||||
140 | $tbFullpath = new \XoopsFormLabel(\_MA_WGFILEMANAGER_DIRECTORY_FULLPATH, $dirFullpath); |
||||||
0 ignored issues
–
show
It seems like
$dirFullpath can also be of type array and array ; however, parameter $value of XoopsFormLabel::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
141 | $tbFullpath->setDescription(sprintf(\_MA_WGFILEMANAGER_DIRECTORY_FULLPATH_DESCR, WGFILEMANAGER_UPLOAD_PATH . '/repository')); |
||||||
142 | $form->addElement($tbFullpath); |
||||||
143 | $form->addElement(new \XoopsFormHidden('fullpath', $dirFullpath)); |
||||||
144 | $form->addElement(new \XoopsFormHidden('fullpath_old', $dirFullpath)); |
||||||
145 | } else { |
||||||
146 | $form->addElement(new \XoopsFormHidden('fullpath', $dirFullpath)); |
||||||
147 | $form->addElement(new \XoopsFormHidden('fullpath_old', $dirFullpath)); |
||||||
148 | } |
||||||
149 | // Form Text dirWeight |
||||||
150 | $dirWeight = $this->isNew() ? $directoryHandler->getCount() + 1 : $this->getVar('weight'); |
||||||
151 | //if ($isAdmin) { |
||||||
152 | //$form->addElement(new \XoopsFormText(\_MA_WGFILEMANAGER_DIRECTORY_WEIGHT, 'weight', 50, 255, $dirWeight), true); |
||||||
153 | //} else { |
||||||
154 | $form->addElement(new \XoopsFormHidden('weight', $dirWeight)); |
||||||
155 | //} |
||||||
156 | // Form Text Date Select dirDate_created |
||||||
157 | $dirDate_created = $this->isNew() ? \time() : $this->getVar('date_created'); |
||||||
158 | $form->addElement(new \XoopsFormTextDateSelect(\_MA_WGFILEMANAGER_DIRECTORY_DATE_CREATED, 'date_created', '', $dirDate_created)); |
||||||
0 ignored issues
–
show
'' of type string is incompatible with the type integer expected by parameter $size of XoopsFormTextDateSelect::__construct() .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
159 | // Form Select User dirSubmitter |
||||||
160 | $uidCurrent = \is_object($GLOBALS['xoopsUser']) ? $GLOBALS['xoopsUser']->uid() : 0; |
||||||
161 | $dirSubmitter = $this->isNew() ? $uidCurrent : $this->getVar('submitter'); |
||||||
162 | $form->addElement(new \XoopsFormSelectUser(\_MA_WGFILEMANAGER_DIRECTORY_SUBMITTER, 'submitter', false, $dirSubmitter)); |
||||||
163 | // Permissions |
||||||
164 | if ('directory' === $helper->getConfig('permission_type')) { |
||||||
165 | $memberHandler = \xoops_getHandler('member'); |
||||||
166 | $groupList = $memberHandler->getGroupList(); |
||||||
0 ignored issues
–
show
The method
getGroupList() does not exist on XoopsObjectHandler . It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
167 | $grouppermHandler = \xoops_getHandler('groupperm'); |
||||||
168 | $fullList[] = \array_keys($groupList); |
||||||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||||
169 | if ($this->isNew()) { |
||||||
170 | //$groupsCanApproveCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_DIR_APPROVE, 'groups_approve_directory[]', $fullList); |
||||||
171 | $groupsCanSubmitDirCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_DIR_SUBMIT, 'groups_submit_directory[]', $fullList); |
||||||
172 | $groupsCanViewDirCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_DIR_VIEW, 'groups_view_directory[]', $fullList); |
||||||
173 | $groupsCanDownloadCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_FILE_DOWNLOAD_FROM_DIR, 'groups_download_directory[]', $fullList); |
||||||
174 | $groupsCanUploadCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_FILE_UPLOAD_TO_DIR, 'groups_upload_directory[]', $fullList); |
||||||
175 | } else { |
||||||
176 | //$groupsIdsApprove = $grouppermHandler->getGroupIds('wgfilemanager_approve_directory', $this->getVar('id'), $GLOBALS['xoopsModule']->getVar('mid')); |
||||||
177 | //$groupsIdsApprove[] = \array_values($groupsIdsApprove); |
||||||
178 | //$groupsCanApproveCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_APPROVE, 'groups_approve_directory[]', $groupsIdsApprove); |
||||||
179 | $groupsIdsSubmit = $grouppermHandler->getGroupIds('wgfilemanager_submit_directory', $this->getVar('id'), $GLOBALS['xoopsModule']->getVar('mid')); |
||||||
0 ignored issues
–
show
The method
getGroupIds() does not exist on XoopsObjectHandler . It seems like you code against a sub-type of XoopsObjectHandler such as XoopsGroupPermHandler or XoopsPersistableObjectHandler .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
180 | $groupsIdsSubmit[] = \array_values($groupsIdsSubmit); |
||||||
181 | $groupsCanSubmitDirCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_DIR_SUBMIT, 'groups_submit_directory[]', $groupsIdsSubmit); |
||||||
182 | $groupsIdsView = $grouppermHandler->getGroupIds('wgfilemanager_view_directory', $this->getVar('id'), $GLOBALS['xoopsModule']->getVar('mid')); |
||||||
183 | $groupsIdsView[] = \array_values($groupsIdsView); |
||||||
184 | $groupsCanViewDirCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_DIR_VIEW, 'groups_view_directory[]', $groupsIdsView); |
||||||
185 | $groupsIdsDownload = $grouppermHandler->getGroupIds('wgfilemanager_download_directory', $this->getVar('id'), $GLOBALS['xoopsModule']->getVar('mid')); |
||||||
186 | $groupsIdsDownload[] = \array_values($groupsIdsDownload); |
||||||
187 | $groupsCanDownloadCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_FILE_DOWNLOAD_FROM_DIR, 'groups_download_directory[]', $groupsIdsDownload); |
||||||
188 | $groupsIdsUpload = $grouppermHandler->getGroupIds('wgfilemanager_upload_directory', $this->getVar('id'), $GLOBALS['xoopsModule']->getVar('mid')); |
||||||
189 | $groupsIdsUpload[] = \array_values($groupsIdsUpload); |
||||||
190 | $groupsCanUploadCheckbox = new \XoopsFormCheckBox(\_MA_WGFILEMANAGER_PERM_FILE_UPLOAD_TO_DIR, 'groups_upload_directory[]', $groupsIdsUpload); |
||||||
191 | } |
||||||
192 | // To Approve |
||||||
193 | //$groupsCanApproveCheckbox->addOptionArray($groupList); |
||||||
194 | //$form->addElement($groupsCanApproveCheckbox); |
||||||
195 | // To Submit |
||||||
196 | $groupsCanSubmitDirCheckbox->addOptionArray($groupList); |
||||||
197 | $groupsCanSubmitDirCheckbox->setDescription(\_MA_WGFILEMANAGER_PERM_DIR_SUBMIT_DESC); |
||||||
198 | $form->addElement($groupsCanSubmitDirCheckbox); |
||||||
199 | // To View |
||||||
200 | $groupsCanViewDirCheckbox->addOptionArray($groupList); |
||||||
201 | $groupsCanViewDirCheckbox->setDescription(\_MA_WGFILEMANAGER_PERM_DIR_VIEW_DESC); |
||||||
202 | $form->addElement($groupsCanViewDirCheckbox); |
||||||
203 | // To download |
||||||
204 | $groupsCanDownloadCheckbox->addOptionArray($groupList); |
||||||
205 | $groupsCanDownloadCheckbox->setDescription(\_MA_WGFILEMANAGER_PERM_FILE_DOWNLOAD_FROM_DIR_DESC); |
||||||
206 | $form->addElement($groupsCanDownloadCheckbox); |
||||||
207 | // To upload |
||||||
208 | $groupsCanUploadCheckbox->addOptionArray($groupList); |
||||||
209 | $groupsCanUploadCheckbox->setDescription(\_MA_WGFILEMANAGER_PERM_FILE_UPLOAD_TO_DIR_DESC); |
||||||
210 | $form->addElement($groupsCanUploadCheckbox); |
||||||
211 | } |
||||||
212 | // To Save |
||||||
213 | $form->addElement(new \XoopsFormHidden('op', 'save')); |
||||||
214 | $form->addElement(new \XoopsFormHidden('start', $this->start)); |
||||||
215 | $form->addElement(new \XoopsFormHidden('limit', $this->limit)); |
||||||
216 | $form->addElement(new \XoopsFormButtonTray('', \_SUBMIT, 'submit', '', false)); |
||||||
217 | return $form; |
||||||
218 | } |
||||||
219 | |||||||
220 | /** |
||||||
221 | * Get Values |
||||||
222 | * @param null $keys |
||||||
0 ignored issues
–
show
|
|||||||
223 | * @param null $format |
||||||
0 ignored issues
–
show
|
|||||||
224 | * @param null $maxDepth |
||||||
0 ignored issues
–
show
|
|||||||
225 | * @return array |
||||||
226 | */ |
||||||
227 | public function getValuesDir($keys = null, $format = null, $maxDepth = null) |
||||||
228 | { |
||||||
229 | $helper = \XoopsModules\Wgfilemanager\Helper::getInstance(); |
||||||
230 | $utility = new \XoopsModules\Wgfilemanager\Utility(); |
||||||
231 | $ret = $this->getValues($keys, $format, $maxDepth); |
||||||
232 | $editorMaxchar = $helper->getConfig('editor_maxchar'); |
||||||
233 | $directoryHandler = $helper->getHandler('Directory'); |
||||||
234 | $directoryObj = $directoryHandler->get($this->getVar('parent_id')); |
||||||
235 | if (\is_object($directoryObj)) { |
||||||
236 | $ret['parent_text'] = $directoryObj->getVar('name'); |
||||||
237 | } else { |
||||||
238 | $ret['parent_text'] = 'error get parent name'; |
||||||
239 | } |
||||||
240 | //get current user |
||||||
241 | $userUid = 0; |
||||||
242 | if (isset($GLOBALS['xoopsUser']) && \is_object($GLOBALS['xoopsUser'])) { |
||||||
243 | $userUid = $GLOBALS['xoopsUser']->uid(); |
||||||
244 | } |
||||||
245 | $ret['favorite_id'] = 0; |
||||||
246 | if ($userUid > 0) { |
||||||
247 | $favoriteHandler = $helper->getHandler('Favorite'); |
||||||
248 | $crFavorite = new \CriteriaCompo(); |
||||||
249 | $crFavorite->add(new \Criteria('directory_id', $this->getVar('id'))); |
||||||
0 ignored issues
–
show
It seems like
$this->getVar('id') can also be of type array and array ; however, parameter $value of Criteria::__construct() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
250 | $crFavorite->add(new \Criteria('submitter', $userUid)); |
||||||
251 | if ($favoriteHandler->getCount($crFavorite)) { |
||||||
252 | $favoriteObj = $favoriteHandler->getObjects($crFavorite); |
||||||
253 | $ret['favorite_id'] = $favoriteObj[0]->getVar('id'); |
||||||
254 | } |
||||||
255 | unset($favoriteObj); |
||||||
256 | unset($crFavorite); |
||||||
257 | } |
||||||
258 | $ret['count_subdirs'] = $directoryHandler->countSubDirs($this->getVar('id')); |
||||||
259 | $ret['count_files'] = $directoryHandler->countFiles($this->getVar('fullpath')); |
||||||
0 ignored issues
–
show
It seems like
$this->getVar('fullpath') can also be of type array and array ; however, parameter $fullpath of XoopsModules\Wgfilemanag...ryHandler::countFiles() does only seem to accept string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||||
260 | $ret['description_text'] = $this->getVar('description', 'e'); |
||||||
261 | $ret['description_short'] = $utility::truncateHtml($ret['description'], $editorMaxchar); |
||||||
262 | $ret['date_created_text'] = \formatTimestamp($this->getVar('date_created'), 's'); |
||||||
263 | $ret['submitter_text'] = \XoopsUser::getUnameFromId($this->getVar('submitter')); |
||||||
264 | $ret['ctime_text'] = $ret['date_created_text']; |
||||||
265 | $ret['directory_id'] = $this->getVar('id'); |
||||||
266 | return $ret; |
||||||
267 | } |
||||||
268 | } |
||||||
269 |