Issues (1177)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

application/modules/comments/commentsapi.php (19 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
use core\models\Route;
4
use core\src\CoreFactory;
5
use CMSFactory\Events;
6
7
(defined('BASEPATH')) OR exit('No direct script access allowed');
8
9
class Commentsapi extends Comments
10
{
11
12
    public $validation_errors;
13
14
    /**
15
     * @var string $comments_locale
16
     */
17
    private $comments_locale;
18
19
    public function __construct() {
20
        parent::__construct();
21
        $this->load->module('core');
22
        $this->module = $this->getModule($this->input->server('HTTP_REFERER'));
23
        $lang = new MY_Lang();
24
        $lang->load('comments');
25
26
        $this->tpl_name = 'comments_api';
27
    }
28
29
    /**
30
     * New comments realization
31
     * @param string $url
32
     * @return array comments
33
     */
34
    public function getComments($url) {
35
        $this->load->model('base');
36
        $this->_init_settings();
37
        $this->module = $this->getModule($url);
38
        $item_id = $this->parsUrl($url);
39
40
        $comments = $this->base->get($item_id, 0, $this->module, 99999, $this->order_by);
41
42
        // Read comments template
43
        // Set page id for comments form
44 View Code Duplication
        if ($comments != FALSE) {
45
            $this->cache->store('comments_' . $item_id . $this->module, $comments, $this->cache_ttl, 'comments');
46
        }
47
48
        $comment_ch = [];
49
50 View Code Duplication
        if (is_array($comments)) {
51
            $i = 0;
52
            foreach ($comments as $comment) {
53
                if ($comment['parent'] > 0) {
54
                    $comment_ch[] = $comment;
55
                    unset($comments[$i]);
56
                }
57
                $i++;
58
            }
59
        }
60
61
        $data = [
62
                 'comments_arr'       => $comments,
63
                 'comment_ch'         => $comment_ch,
64
                 'comment_controller' => $this->comment_controller,
65
                 'total_comments'     => lang('Total comments: ', 'comments') . count($comments),
66
                 'can_comment'        => $this->can_comment,
67
                 'use_captcha'        => $this->use_captcha,
68
                 'use_moderation'     => $this->use_moderation,
69
                 'enable_comments'    => $this->enable_comments,
70
                ];
71
72 View Code Duplication
        if ($this->use_captcha == TRUE) {
73
            $this->dx_auth->captcha();
74
            $data['cap_image'] = $this->dx_auth->get_captcha_image();
75
        }
76
        return $data;
77
    }
78
79
    /**
80
     * @param string $url
81
     * @return array
82
     */
83
    public function renderAsArray($url) {
84
        $this->load->model('base');
85
        $this->_init_settings();
86
87
        $this->module = $this->getModule($url);
88
        $item_id = $this->parsUrl($url);
89
        $commentsCount = $this->getTotalCommentsForProducts($item_id);
90
91
        $comments = $this->base->get($item_id, 0, $this->module, 99999, $this->order_by);
92
93
        // Read comments template
94
        // Set page id for comments form
95 View Code Duplication
        if ($comments != FALSE) {
96
            $this->cache->store('comments_' . $item_id . $this->module, $comments, $this->cache_ttl, 'comments');
97
        }
98
99
        if ($comments != null) {
100
            $comments_count = count($comments);
101
        } else {
102
            $comments_count = 0;
103
        }
104
105
        $comment_ch = [];
106
107 View Code Duplication
        if (is_array($comments)) {
108
            $i = 0;
109
            foreach ($comments as $comment) {
110
                if ($comment['parent'] > 0) {
111
                    $comment_ch[] = $comment;
112
                    unset($comments[$i]);
113
                }
114
                $i++;
115
            }
116
        }
117
118
        $data = [
119
                 'comments_arr'       => $comments,
120
                 'comment_ch'         => $comment_ch,
121
                 'comment_controller' => $this->comment_controller,
122
                 'total_comments'     => lang('Total comments: ', 'comments') . count($comments),
123
                 'can_comment'        => $this->can_comment,
124
                 'use_captcha'        => $this->use_captcha,
125
                 'use_moderation'     => $this->use_moderation,
126
                 'enable_comments'    => $this->enable_comments,
127
                ];
128
129 View Code Duplication
        if ($this->use_captcha == TRUE) {
130
            $this->dx_auth->captcha();
131
            $data['cap_image'] = $this->dx_auth->get_captcha_image();
132
        }
133
        ($hook = get_hook('comments_read_com_tpl')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_read_com_tpl'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
134
135
        $comments = $this->_fetchComments($data);
136
137
        ($hook = get_hook('comments_assign_tpl_data')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_assign_tpl_data'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
138
        return [
139
                'comments'          => $comments,
140
                'commentsCount'     => $commentsCount[$item_id],
141
                'total_comments'    => $comments_count ? $comments_count . ' ' . SStringHelper::Pluralize($comments_count, [lang('comment', 'comments'), lang('comment', 'comments'), lang('comments', 'comments')]) : lang('Leave comment', 'comments'),
142
                'validation_errors' => $this->validation_errors,
143
               ];
144
    }
145
146
    public function renderPosts() {
147
        $this->load->model('base');
148
        $this->_init_settings();
149
150
        $item_id = $this->parsUrl($this->input->server('HTTP_REFERER'));
151
152
        $commentsCount = $this->getTotalCommentsForProducts($item_id);
153
        $comments = $this->base->get($item_id, 0, $this->module, $this->input->post('countcomment') ?: null, $this->order_by);
154
155
        // Read comments template
156
        // Set page id for comments form
157 View Code Duplication
        if ($comments != FALSE) {
158
            ($hook = get_hook('comments_store_cache')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_store_cache'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
159
            $this->cache->store('comments_' . $item_id . $this->module, $comments, $this->cache_ttl, 'comments');
160
        }
161
162
        if ($comments != null) {
163
            $comments_count = count($comments);
164
        } else {
165
            $comments_count = 0;
166
        }
167
168 View Code Duplication
        if (is_array($comments)) {
169
            $i = 0;
170
            foreach ($comments as $comment) {
171
                if ($comment['parent'] > 0) {
172
                    $comment_ch[] = $comment;
0 ignored issues
show
Coding Style Comprehensibility introduced by
$comment_ch was never initialized. Although not strictly required by PHP, it is generally a good practice to add $comment_ch = array(); before regardless.

Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.

Let’s take a look at an example:

foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}

As you can see in this example, the array $myArray is initialized the first time when the foreach loop is entered. You can also see that the value of the bar key is only written conditionally; thus, its value might result from a previous iteration.

This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.

Loading history...
173
                    unset($comments[$i]);
174
                }
175
                $i++;
176
            }
177
        }
178
179
        $data = [
180
                 'comments_arr'       => $comments,
181
                 'comment_ch'         => $comment_ch,
182
                 'comment_controller' => $this->comment_controller,
183
                 'total_comments'     => lang('Total comments: ', 'comments') . count($comments),
184
                 'can_comment'        => $this->can_comment,
185
                 'use_captcha'        => $this->use_captcha,
186
                 'use_moderation'     => $this->use_moderation,
187
                 'enable_comments'    => $this->enable_comments,
188
                 'visibleMainForm'    => $this->input->post('visibleMainForm'),
189
                ];
190
191 View Code Duplication
        if ($this->use_captcha == TRUE && !$this->dx_auth->is_admin()) {
192
            $this->dx_auth->captcha();
193
            $data['cap_image'] = $this->dx_auth->get_captcha_image();
194
        }
195
        ($hook = get_hook('comments_read_com_tpl')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_read_com_tpl'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
196
197
        $comments = $this->_fetchComments($data);
198
199
        ($hook = get_hook('comments_assign_tpl_data')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_assign_tpl_data'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
200
201
        echo json_encode(
202
            [
203
             'comments'          => $comments,
204
             'total_comments'    => $comments_count ? $comments_count . ' ' . SStringHelper::Pluralize($comments_count, [lang('review', 'comments'), lang('reviews', 'comments'), lang('review', 'comments')]) : lang('Leave a comment', 'comments'),
205
             'commentsCount'     => $commentsCount[$item_id],
206
             'validation_errors' => $this->validation_errors,
207
            ]
208
        );
209
    }
210
211
    /**
212
     * Determinate commented page.
213
     *
214
     * if product - return id
215
     * @param string $url
216
     * @return string
217
     */
218
    public function parsUrl($url) {
219
        $productUrl = parse_url($url);
220
        $urlArraySegments = explode('/', $productUrl['path']);
221
222
        if(!\MY_Controller::isCorporateCMS()) {
223
            $productQuery = $this->db->select('shop_products.id, shop_products.enable_comments')
224
                ->where('route.url', end($urlArraySegments))
225
                ->join('route', 'route.id = shop_products.route_id')
226
                ->get('shop_products');
227
228
            if ($productQuery->num_rows()) {
229
                /** Check is lang segment and remove it from url path * */
230
231
                $id = $productQuery->row();
232
233
                if ($id->enable_comments == 0) {
234
                    $this->enable_comments = false;
235
                }
236
                return $id->id;
237
            }
238
        }
239
240 View Code Duplication
        if (strstr($url, '/image/')) {
241
            $url = explode(DS, $url);
242
            $url = $url[count($url) - 1];
243
244
            return $url;
245
        }
246 View Code Duplication
        if (strstr($url, '/album/')) {
247
            $url = explode(DS, $url);
248
            $url = $url[count($url) - 1];
249
250
            return $url;
251
        }
252
253
        if ($url == site_url()) {
254
            $id = $this->db->select('main_page_id, comments_status')
255
                ->join('content', 'settings.main_page_id=content.id')
256
                ->get('settings')
257
                ->row();
258
259
            if ($id->comments_status == 0) {
260
                $this->enable_comments = false;
261
            }
262
            return $id->main_page_id;
263
        }
264
265
        $paths = explode('/', $url);
266
        $paths = $paths[count($paths) - 1];
267
268
        $lang_id = $this->getCommentsLocale() ?: MY_Controller::getCurrentLanguage('id');
269
270
        $page = $this->db->select('content.id, content.comments_status, content.category')
271
            ->where('route.url', $paths)
272
            ->where('content.lang', $lang_id)
273
            ->join('route', 'route.id = content.route_id')
274
            ->get('content');
275
276
        if ($page) {
277
            $page = $page->row();
278
279
            $pageCategory = $this->db->select('id, comments_default')
280
                ->where('id', $page->category)
281
                ->get('category');
282
283
            if ($pageCategory) {
284
                $pageCategory = $pageCategory->row();
285
                $page->comments_status = $pageCategory->comments_default ? TRUE : $page->comments_status;
286
            }
287
        }
288
289
        if ($page->comments_status == 0) {
290
            $this->enable_comments = FALSE;
291
        }
292
293
        return $page->id;
294
    }
295
296
    /**
297
     * @param string $url
298
     * @return string
299
     */
300
    public function getModule($url) {
301
302
        $url = str_replace(site_url(), '', $url);
303
304
        try {
305
            $route = CoreFactory::getRouter()->findRoute($url);
306
            if ($route) {
307
308
                switch ($route->getType()) {
309
310
                    case Route::TYPE_MODULE:
311
                        return $route->getUrl();
312
                    case Route::TYPE_SHOP_CATEGORY:
313
                    case Route::TYPE_PRODUCT:
314
                        return 'shop';
315
                    default :
316
                        return 'core';
317
                }
318
319
            }
320
        } catch (Exception $e) {
321
            return 'core';
322
        }
323
        return 'core';
324
325
    }
326
327
    /**
328
     * New comments realization
329
     * @return array validation data
330
     */
331
    public function addPost() {
332
333
        $this->setCommentsLocale();
334
        $this->load->model('base');
335
        $this->_init_settings();
336
        $this->load->library('user_agent');
337
        $this->load->library('form_validation');
338
        $this->load->model('base');
339
340
        $referer = explode('?', $this->input->server('HTTP_REFERER'));
341
        $item_id = $this->parsUrl($referer[0]);
342
343
        if ($this->period > 0 && !$this->check_comment_period()) {
344
            return [
345
                    'answer'            => 'error',
346
                    'validation_errors' => ['time_error' => lang('The following comment can be left through', 'comments') . ' ' . $this->period . ' ' . lang('minutes', 'comments')],
347
                   ];
348
        }
349
350
        // Validate email and nickname from unregistered users.
351
        if (!$this->dx_auth->is_logged_in()) {
352
            $this->form_validation->set_rules('comment_email', lang('Email', 'comments'), 'trim|required|xss_clean|valid_email');
353
            $this->form_validation->set_rules('comment_author', lang('Your name', 'comments'), 'trim|required|xss_clean|max_length[50]');
354
            $this->form_validation->set_rules('comment_site', lang('Site', 'comments'), 'trim|xss_clean|max_length[250]');
355
        }
356
357
        // Check captcha code if captcha_check enabled and user in not admin.
358
        if ($this->use_captcha AND !$this->dx_auth->is_admin()) {
359
            $this->form_validation->set_message('callback_captcha_check', lang('Wrong code protection', 'comments'));
360 View Code Duplication
            if ($this->dx_auth->use_recaptcha) {
361
                $this->form_validation->set_rules('recaptcha_response_field', lang('Code protection', 'comments'), 'trim|required|xss_clean|callback_captcha_check');
362
            } else {
363
                $this->form_validation->set_rules('captcha', lang('Code protection', 'comments'), 'trim|required|xss_clean|callback_captcha_check');
364
            }
365
        }
366
367 View Code Duplication
        if ($this->max_comment_length != 0) {
368
            $this->form_validation->set_rules('comment_text', lang('Comment', 'comments'), 'trim|required|xss_clean|max_length[' . $this->max_comment_length . ']');
369
        } else {
370
            $this->form_validation->set_rules('comment_text', lang('Comment', 'comments'), 'trim|required|xss_clean');
371
        }
372
373
        if (!$this->form_validation->run($this)) {
374
            //            $this->dx_auth->captcha();
375
            //            $cap_image = $this->dx_auth->get_captcha_image();
376
            return [
377
                    'answer'            => 'error',
378
                    'validation_errors' => $this->form_validation->getErrorsArray(),
379
                   ];
380
        } else {
381
            if (!$this->dx_auth->is_logged_in()) {
382
                $comment_author = $this->input->post('comment_author');
383
                $comment_email = $this->input->post('comment_email');
384
385
                // Write on cookie nickname and email
386
                $this->_write_cookie($comment_author, $comment_email, $this->input->post('comment_site'));
387
            } else {
388
                $user = $this->db->get_where('users', ['id' => $this->dx_auth->get_user_id()])->row_array();
389
                $comment_author = $user['username'];
0 ignored issues
show
$comment_author is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
390
                $comment_email = $user['email'];
0 ignored issues
show
$comment_email is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
391
            }
392
393
            $comment_text = nl2br($this->input->post('comment_text'));
394
            $comment_text_plus = nl2br($this->input->post('comment_text_plus'));
395
            $comment_text_minus = nl2br($this->input->post('comment_text_minus'));
396
            $rate = $this->input->post('ratec');
397
            if ($rate && SHOP_INSTALLED && class_exists('SProductsQuery') && SProductsQuery::create()->setComment(__METHOD__)->findPk($item_id) !== null) {
398
                $model = SProductsRatingQuery::create()->setComment(__METHOD__)->findPk($item_id);
399
                if ($model === null) {
400
                    $model = new SProductsRating;
401
                    $model->setProductId($item_id);
402
                }
403
                $model->setVotes($model->getVotes() + 1);
404
                $model->setRating($model->getRating() + $rate);
405
                $model->save();
406
            }
407
            $email = $this->db->select('email')
408
                ->get_where('users', ['id' => $this->dx_auth->get_user_id()], 1)
409
                ->row();
410
411
            $comment_data = [
412
                             'module'     => $this->module,
413
                             'user_id'    => $this->dx_auth->get_user_id(), // 0 if unregistered
414
                             'user_name'  => $this->dx_auth->is_logged_in() ? $this->dx_auth->get_username() : $this->input->post('comment_author'),
415
                             'user_mail'  => $this->dx_auth->is_logged_in() ? $email->email : $this->input->post('comment_email'),
416
                             'user_site'  => $this->input->post('comment_site'),
417
                             'text'       => $comment_text,
418
                             'text_plus'  => $comment_text_plus,
419
                             'text_minus' => $comment_text_minus,
420
                             'item_id'    => $item_id,
421
                             'status'     => $this->_comment_status(),
422
                             'agent'      => $this->agent->agent_string(),
423
                             'user_ip'    => $this->input->ip_address(),
424
                             'date'       => time(),
425
                             'rate'       => $this->input->post('ratec'),
426
                             'parent'     => $this->input->post('comment_parent'),
427
                            ];
428
            $this->db->insert('comments', $comment_data);
429
            $this->_recount_comments($item_id, $comment_data['module']);
430
            \CMSFactory\Events::create()->registerEvent(['commentId' => $this->db->insert_id()]);
431
            $this->validation_errors = '';
432
433
            //return sucesfull answer
434
            return [
435
                    'answer'             => 'sucesfull',
436
                    'moderation_enabled' => $this->_comment_status(),
437
                   ];
438
        }
439
    }
440
441
    /**
442
     * @throws \Propel\Runtime\Exception\PropelException
443
     */
444
    public function newPost() {
445
        $this->load->model('base');
446
        $this->_init_settings();
447
448
        ($hook = get_hook('comments_on_add')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_on_add'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
449
450
        $this->load->library('user_agent');
451
        $this->load->library('form_validation');
452
        $this->load->model('base');
453
454
        $item_id = $this->parsUrl($this->input->server('HTTP_REFERER'));
455
456
        if ($this->period > 0) {
457
            if ($this->check_comment_period() == FALSE) {
458
                echo json_encode(
459
                    [
460
                     'answer'            => 'error',
461
                     'validation_errors' => lang('The following comment can be left through', 'comments') . ' ' . $this->period . ' ' . lang('minutes', 'comments'),
462
                    ]
463
                );
464
                return;
465
            }
466
        }
467
468
        // Validate email and nickname from unregistered users.
469 View Code Duplication
        if ($this->dx_auth->is_logged_in() == FALSE) {
470
            ($hook = get_hook('comments_set_val_rules')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_set_val_rules'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
471
472
            $this->form_validation->set_rules('comment_email', lang('Email', 'comments'), 'trim|required|xss_clean|valid_email');
473
            $this->form_validation->set_rules('comment_author', lang('Your name', 'comments'), 'trim|required|xss_clean|max_length[50]');
474
            $this->form_validation->set_rules('comment_site', lang('Site', 'comments'), 'trim|xss_clean|max_length[250]');
475
        }
476
477
        // Check captcha code if captcha_check enabled and user in not admin.
478
        if ($this->use_captcha == TRUE AND $this->dx_auth->is_admin() == FALSE) {
479
            ($hook = get_hook('comments_set_captcha')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_set_captcha'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
480
            $this->form_validation->set_message('callback_captcha_check', lang('Wrong code protection', 'comments'));
481 View Code Duplication
            if ($this->dx_auth->use_recaptcha) {
482
                $this->form_validation->set_rules('recaptcha_response_field', lang('Code protection', 'comments'), 'trim|required|xss_clean|callback_captcha_check');
483
            } else {
484
                $this->form_validation->set_rules('captcha', lang('Code protection', 'comments'), 'trim|required|xss_clean|callback_captcha_check');
485
            }
486
        }
487
488 View Code Duplication
        if ($this->max_comment_length != 0) {
489
            $this->form_validation->set_rules('comment_text', lang('Comment', 'comments'), 'trim|required|xss_clean|max_length[' . $this->max_comment_length . ']');
490
        } else {
491
            $this->form_validation->set_rules('comment_text', lang('Comment', 'comments'), 'trim|required|xss_clean');
492
        }
493
494
        if ($this->form_validation->run($this) == FALSE) {
495
            ($hook = get_hook('comments_validation_failed')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_validation_failed'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
496
            //$this->core->error( validation_errors() );
497
            //            $this->template->assign('comment_errors', validation_errors());
498
        } else {
499
            if ($this->dx_auth->is_logged_in() == FALSE) {
500
                ($hook = get_hook('comments_author_not_logged')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_author_not_logged'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
501
502
                $comment_author = trim(htmlspecialchars($this->input->post('comment_author')));
503
                $comment_email = trim(htmlspecialchars($this->input->post('comment_email')));
504
505
                // Write on cookie nickname and email
506
                $this->_write_cookie($comment_author, $comment_email, $this->input->post('comment_site'));
507
            } else {
508
                ($hook = get_hook('comments_author_logged')) ? eval($hook) : NULL;
0 ignored issues
show
The call to get_hook() has too many arguments starting with 'comments_author_logged'.

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress.

In this case you can add the @ignore PhpDoc annotation to the duplicate definition and it will be ignored.

Loading history...
509
510
                $user = $this->db->get_where('users', ['id' => $this->dx_auth->get_user_id()])->row_array();
511
512
                Events::create()->raiseEvent(['user_info' => $user, 'item_id' => $item_id], 'CommentsApi:newPost');
513
514
                $comment_author = $user['username'];
0 ignored issues
show
$comment_author is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
515
                $comment_email = $user['email'];
0 ignored issues
show
$comment_email is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
516
            }
517
518
            $comment_text = trim(htmlspecialchars($this->input->post('comment_text')));
519
            $comment_text = str_replace("\n", '<br/>', $comment_text);
520
            $comment_text_plus = trim(htmlspecialchars($this->input->post('comment_text_plus')));
521
            $comment_text_plus = str_replace("\n", '<br/>', $comment_text_plus);
522
            $comment_text_minus = trim(htmlspecialchars($this->input->post('comment_text_minus')));
523
            $comment_text_minus = str_replace("\n", '<br/>', $comment_text_minus);
524
            $rate = $this->input->post('ratec');
525 View Code Duplication
            if ($this->input->post('ratec')) {
526
                if (class_exists('SProductsQuery')) {
527
                    if (SProductsQuery::create()->setComment(__METHOD__)->findPk($item_id) !== null) {
528
                        $model = SProductsRatingQuery::create()->setComment(__METHOD__)->findPk($item_id);
529
                        if ($model === null) {
530
                            $model = new SProductsRating;
531
                            $model->setProductId($item_id);
532
                        }
533
                        $model->setVotes($model->getVotes() + 1);
534
                        $model->setRating($model->getRating() + $rate);
535
                        $model->save();
536
                    }
537
                }
538
            }
539
        }
540
        if ($this->input->post('action') == 'newPost') {
541
            $email = $this->db->select('email')
542
                ->get_where('users', ['id' => $this->dx_auth->get_user_id()], 1)
543
                ->row();
544
545
            if (!validation_errors()) {
546
                $comment_data = [
547
                                 'module'     => $this->module,
548
                                 'user_id'    => $this->dx_auth->get_user_id(), // 0 if unregistered
549
                                 'user_name'  => $this->dx_auth->is_logged_in() ? $this->dx_auth->get_username() : trim(htmlspecialchars($this->input->post('comment_author'))),
550
                                 'user_mail'  => $this->dx_auth->is_logged_in() ? $email->email : trim(htmlspecialchars($this->input->post('comment_email'))),
551
                                 'user_site'  => htmlspecialchars($this->input->post(comment_site)),
552
                                 'text'       => $comment_text,
553
                                 'text_plus'  => $comment_text_plus,
554
                                 'text_minus' => $comment_text_minus,
555
                                 'item_id'    => $item_id,
556
                                 'status'     => $this->_comment_status(),
557
                                 'agent'      => $this->agent->agent_string(),
558
                                 'user_ip'    => $this->input->ip_address(),
559
                                 'date'       => time(),
560
                                 'rate'       => $this->input->post('ratec'),
561
                                 'parent'     => $this->input->post('comment_parent'),
562
                                ];
563
564
                $this->db->insert('comments', $comment_data);
565
                $this->_recount_comments($item_id, $comment_data['module']);
566
                \CMSFactory\Events::create()->registerEvent(['commentId' => $this->db->insert_id()]);
567
                $this->validation_errors = '';
568
569
                //return sucesfull JSON answer
570
                echo json_encode(
571
                    ['answer' => 'sucesfull']
572
                );
573
            } else {
574
575
                if ($this->dx_auth->use_recaptcha) {
576
                    $field_name = 'recaptcha_response_field';
0 ignored issues
show
$field_name is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
577
                } else {
578
                    $field_name = 'captcha';
0 ignored issues
show
$field_name is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
579
                }
580
581
                //                if ($this->form_validation->error($field_name)) {
582
                $this->dx_auth->captcha();
583
                $cap_image = $this->dx_auth->get_captcha_image();
584
                //                }
585
                //                if ($this->use_captcha == TRUE && !$this->dx_auth->is_admin()) {
586
                //                    $this->dx_auth->captcha();
587
                //                    $data['cap_image'] = $this->dx_auth->get_captcha_image();
588
                //                }
589
                echo json_encode(
590
                    [
591
                     'answer'            => 'error',
592
                     'validation_errors' => validation_errors(),
593
                     'cap_image'         => $cap_image,
594
                    ]
595
                );
596
            }
597
        }
598
    }
599
600 View Code Duplication
    public function setyes() {
601
        $comid = $this->input->post('comid');
602
        if ($this->session->userdata('commentl' . $comid) != 1) {
603
            $row = $this->db->where('id', $comid)->get('comments')->row();
604
            $like = $row->like;
605
            $like = $like + 1;
606
            $data = ['like' => $like];
607
            $this->db->where('id', $comid);
608
            $this->db->update('comments', $data);
609
            $this->session->set_userdata('commentl' . $comid, 1);
610
            if ($this->input->is_ajax_request()) {
611
                return json_encode(['y_count' => "$like"]);
612
            } else {
613
                $like--;
614
                return json_encode(['y_count' => "$like"]);
615
            }
616
        }
617
    }
618
619 View Code Duplication
    public function setno() {
620
        $comid = $this->input->post('comid');
621
        if ($this->session->userdata('commentl' . $comid) != 1) {
622
            $row = $this->db->where('id', $comid)->get('comments')->row();
623
            $disslike = $row->disslike;
624
            $disslike = $disslike + 1;
625
            $data = ['disslike' => $disslike];
626
            $this->db->where('id', $comid);
627
            $this->db->update('comments', $data);
628
            $this->session->set_userdata('commentl' . $comid, 1);
629
            if ($this->input->is_ajax_request()) {
630
                return json_encode(['n_count' => "$disslike"]);
631
            } else {
632
                $disslike--;
633
                return json_encode(['n_count' => "$disslike"]);
634
            }
635
        }
636
    }
637
638
    /**
639
     * @param array $ids
640
     * @param string $module
641
     * @param int $status
642
     * @return array|void
643
     */
644
    public function getTotalCommentsForProducts($ids, $module = 'shop', $status = 0) {
645
        if ($ids == null || !$this->db->table_exists('comments')) {
646
            return;
647
        }
648
649
        $this->db->select('item_id, COUNT(comments.id) AS `count`');
650
        $this->db->group_by('item_id');
651
        $this->db->where_in('item_id', $ids);
652
        $this->db->where('status', $status);
653
        $this->db->where('module = ', $module);
654
        $query = $this->db->get('comments')->result_array();
655
656
        $result = [];
657
658 View Code Duplication
        foreach ($query as $q) {
659
            $result[$q['item_id']] = $q['count'] . ' ' . SStringHelper::Pluralize((int) $q['count'], [lang('review', 'comments'), lang('reviews', 'comments'), lang('review', 'comments')]);
660
        }
661
662 View Code Duplication
        foreach ((array) $ids as $id) {
663
            if (!$result[$id]) {
664
                $result[$id] = 0 . ' ' . SStringHelper::Pluralize('0', [lang('review', 'comments'), lang('reviews', 'comments'), lang('comments', 'comments')]);
665
            }
666
        }
667
668
        return $result;
669
    }
670
671
    /**
672
     * Get count answers to comment by id
673
     * @param integer $commentId
674
     * @return boolean|int
0 ignored issues
show
Consider making the return type a bit more specific; maybe use integer|false.

This check looks for the generic type array as a return type and suggests a more specific type. This type is inferred from the actual code.

Loading history...
675
     */
676
    public function getCountCommentAnswersByCommentId($commentId) {
677
        $query = $this->db->where('parent', $commentId)->get('comments')->result_array();
678
        if ($query) {
679
            return count($query);
680
        } else {
681
            return false;
682
        }
683
    }
684
685
    /**
686
     * @return string
687
     */
688
    public function getCommentsLocale() {
689
690
        /** @var CI_DB_result $locale */
691
        $locale = $this->db->get_where('languages', ['identif' => $this->comments_locale]);
692
693
        if ($locale->num_rows() > 0) {
694
695
            $locale_arr = $locale->row_array();
696
            return $locale_arr['id'];
697
698
        }
699
        return false;
700
701
    }
702
703
    /**
704
     * @return void
705
     */
706
    public function setCommentsLocale() {
707
708
        $this->comments_locale = MY_Controller::getCurrentLocale();
709
    }
710
711
}