Issues (1177)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

application/modules/sitemap/admin.php (1 issue)

Labels
Severity

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
use CMSFactory\assetManager;
4
5
if (!defined('BASEPATH')) {
6
    exit('No direct script access allowed');
7
}
8
9
/**
10
 * Image CMS
11
 *
12
 * Sample Module Admin
13
 * @property sitemap_model $sitemap_model
14
 */
15
class Admin extends BaseAdminController
16
{
17
18
    /**
19
     * Path to folder where site_maps files exists
20
     * @var string
21
     */
22
    private $site_map_folder_path = './uploads/sitemaps';
23
24
    /**
25
     * Path to saved sitemap file
26
     * @var string
27
     */
28
    private $sitemap_path = './uploads/sitemap/sitemap.xml';
29
30
    public function __construct() {
31
        parent::__construct();
32
33
        $this->load->library('DX_Auth');
34
        $this->load->model('sitemap_model');
35
36
        $lang = new MY_Lang();
37
        $lang->load('sitemap');
38
        //cp_check_perm('module_admin');
39
    }
40
41
    /**
42
     * Site map blocked urls
43
     */
44
    public function blockedUrls() {
45
        if ($this->input->post()) {
46
            /**
47
             * Prepare data to update changefreq
48
             */
49
            $data = [];
50
            $hide_urls = $this->input->post('hide_urls');
51
            $robots_check = $this->input->post('robots_check');
52
53
            if ($hide_urls) {
54
                foreach ($hide_urls as $key => $url) {
55
                    if ($url) {
56
                        $data[] = [
57
                                   'url'          => $url,
58
                                   'robots_check' => $robots_check[$key + 1] ? 1 : 0,
59
                                  ];
60
                    }
61
                }
62
            }
63
64
            /** Set blockedUrls */
65
            if ($this->sitemap_model->updateBlockedUrls($data)) {
66
                showMessage(lang('Changes have been saved', 'sitemap'), lang('Message', 'sitemap'));
67
                $this->lib_admin->log(lang('Sitemap block url was edited', 'sitemap'));
68 View Code Duplication
            } else {
69
                if ($data) {
70
                    showMessage(lang('Changes have not been saved', 'sitemap'), lang('Error', 'sitemap'), 'r');
71
                } else {
72
                    showMessage(lang('Changes have been saved', 'sitemap'), lang('Message', 'sitemap'));
73
                    $this->lib_admin->log(lang('Sitemap block url was edited', 'sitemap'));
74
                }
75
            }
76
77
            $this->_viewSiteMap();
78
        } else {
79
80
            $blockedUrls = $this->sitemap_model->getBlockedUrls();
81
            assetManager::create()
82
                    ->registerScript('admin')
83
                    ->setData('hide_urls', $blockedUrls)
84
                    ->renderAdmin('blocked_urls');
85
        }
86
    }
87
88
    /**
89
     * Site map changefreq
90
     */
91
    public function changefreq() {
92
        if ($this->input->post()) {
93
            /**
94
             * Prepare data to update changefreq
95
             */
96
            if (SHOP_INSTALLED) {
97
                $data = [
98
                         'main_page_changefreq'               => $this->input->post('main_page_changefreq'),
99
                         'categories_changefreq'              => $this->input->post('categories_changefreq'),
100
                         'pages_changefreq'                   => $this->input->post('pages_changefreq'),
101
                         'product_changefreq'                 => $this->input->post('product_changefreq'),
102
                         'products_categories_changefreq'     => $this->input->post('products_categories_changefreq'),
103
                         'products_sub_categories_changefreq' => $this->input->post('products_sub_categories_changefreq'),
104
                         'sub_categories_changefreq'          => $this->input->post('sub_categories_changefreq'),
105
                         'brands_changefreq'                  => $this->input->post('brands_changefreq'),
106
                        ];
107
            } else {
108
                $data = [
109
                         'main_page_changefreq'      => $this->input->post('main_page_changefreq'),
110
                         'categories_changefreq'     => $this->input->post('categories_changefreq'),
111
                         'pages_changefreq'          => $this->input->post('pages_changefreq'),
112
                         'sub_categories_changefreq' => $this->input->post('sub_categories_changefreq'),
113
                        ];
114
            }
115
116
            /** Set changefreq */
117 View Code Duplication
            if ($this->sitemap_model->updateChangefreq($data)) {
118
                showMessage(lang('Changes have been saved', 'sitemap'), lang('Message', 'sitemap'));
119
                $this->lib_admin->log(lang('Sitemaps freq was edited', 'sitemap'));
120
            } else {
121
                showMessage(lang('Changes have not been saved', 'sitemap'), lang('Error', 'sitemap'), 'r');
122
            }
123
124
            $this->_viewSiteMap();
125
        } else {
126
            $changefreq = $this->sitemap_model->getChangefreq();
127
            assetManager::create()
0 ignored issues
show
The call to appendData() misses a required argument $value.

This check looks for function calls that miss required arguments.

Loading history...
128
                    ->setData($changefreq)
129
                    ->appendData(
130
                        [
131
                         'changefreq_options' => [
132
                                                  'always'  => lang('always', 'sitemap'),
133
                                                  'hourly'  => lang('hourly', 'sitemap'),
134
                                                  'daily'   => lang('daily', 'sitemap'),
135
                                                  'weekly'  => lang('weekly', 'sitemap'),
136
                                                  'monthly' => lang('monthly', 'sitemap'),
137
                                                  'yearly'  => lang('yearly', 'sitemap'),
138
                                                  'never'   => lang('never', 'sitemap'),
139
                                                 ],
140
                        ]
141
                    )
142
                    ->renderAdmin('changefreq');
143
        }
144
    }
145
146
    /**
147
     * Show sitemap priorities page
148
     */
149
    public function index() {
150
        $this->priorities();
151
    }
152
153
    /**
154
     * Site map priorities
155
     */
156
    public function priorities() {
157
        if ($this->input->post()) {
158
            /** Priorities validation */
159
            $this->form_validation->set_rules('main_page_priority', lang('Main page priority', 'sitemap'), 'required|callback_priority_validation');
160
            $this->form_validation->set_rules('cats_priority', lang('Categories priority', 'sitemap'), 'required|callback_priority_validation');
161
            $this->form_validation->set_rules('pages_priority', lang('Regular or usual pages priority', 'sitemap'), 'required|callback_priority_validation');
162
            $this->form_validation->set_rules('sub_cats_priority', lang('Subcategories priority', 'sitemap'), 'required|callback_priority_validation');
163
            if (SHOP_INSTALLED) {
164
                $this->form_validation->set_rules('products_priority', lang('Products priority', 'sitemap'), 'required|callback_priority_validation');
165
                $this->form_validation->set_rules('brands_priority', lang('Brands priority', 'sitemap'), 'required|callback_priority_validation');
166
                $this->form_validation->set_rules('products_categories_priority', lang('Products categories priority', 'sitemap'), 'required|callback_priority_validation');
167
                $this->form_validation->set_rules('products_sub_categories_priority', lang('Products subcategories priority', 'sitemap'), 'required|callback_priority_validation');
168
            }
169
170 View Code Duplication
            if ($this->form_validation->run($this) == FALSE) {
171
                showMessage(validation_errors(), lang('Error', 'sitemap'), 'r');
172
                exit;
173
            }
174
175
            /**
176
             * Prepare data to update priorities
177
             *
178
             */
179
            if (SHOP_INSTALLED) {
180
                $data = [
181
                         'main_page_priority'               => $this->input->post('main_page_priority'),
182
                         'cats_priority'                    => $this->input->post('cats_priority'),
183
                         'pages_priority'                   => $this->input->post('pages_priority'),
184
                         'sub_cats_priority'                => $this->input->post('sub_cats_priority'),
185
                         'products_priority'                => $this->input->post('products_priority'),
186
                         'brands_priority'                  => $this->input->post('brands_priority'),
187
                         'products_categories_priority'     => $this->input->post('products_categories_priority'),
188
                         'products_sub_categories_priority' => $this->input->post('products_sub_categories_priority'),
189
                        ];
190
            } else {
191
                $data = [
192
                         'main_page_priority' => $this->input->post('main_page_priority'),
193
                         'cats_priority'      => $this->input->post('cats_priority'),
194
                         'pages_priority'     => $this->input->post('pages_priority'),
195
                         'sub_cats_priority'  => $this->input->post('sub_cats_priority'),
196
                        ];
197
            }
198
199
            /** Set priorities */
200 View Code Duplication
            if ($this->sitemap_model->updatePriorities($data)) {
201
                showMessage(lang('Changes have been saved', 'sitemap'), lang('Message', 'sitemap'));
202
                $this->lib_admin->log(lang('Sitemaps priorities was edited', 'sitemap'));
203
            } else {
204
                showMessage(lang('Changes have not been saved', 'sitemap'), lang('Error', 'sitemap'), 'r');
205
            }
206
207
            $this->_viewSiteMap();
208
        } else {
209
            $priorities = $this->sitemap_model->getPriorities();
210
211
            assetManager::create()
212
                    ->setData($priorities)
213
                    ->registerStyle('style_rating')
214
                    ->registerScript('rating')
215
                    ->renderAdmin('priorities');
216
        }
217
    }
218
219
    /**
220
     * Viev site map
221
     */
222
    private function _viewSiteMap() {
223
        if ($this->input->post('action') == 'show_sitemap') {
224
            echo "<script>location.href = '" . site_url('sitemap.xml') . "';</script>;";
225
            exit;
226
        }
227
    }
228
229
    /**
230
     * Validation for priority name field
231
     * @param int $priority
232
     * @return bool
233
     */
234
    public function priority_validation($priority) {
235
        if ($priority > 0 && $priority <= 1) {
236
            return TRUE;
237
        }
238
        $this->form_validation->set_message('priority_validation', lang('The %s field value can be in range from 0.1 to 1', 'sitemap'));
239
        return FALSE;
240
    }
241
242
    /**
243
     * Render template file
244
     * @param string $viewName
245
     * @param array $data
246
     */
247 View Code Duplication
    public function render($viewName, array $data = []) {
248
        if (!empty($data)) {
249
            $this->template->add_array($data);
250
        }
251
252
        $this->template->show('file:application/' . getModContDirName('sitemap') . '/sitemap/templates/admin/' . $viewName);
253
    }
254
255
    /**
256
     * Save sitemap
257
     */
258
    public function saveSiteMap() {
259
        $lang = new MY_Lang();
260
        $lang->load('sitemap');
261
        $successMessage = lang('Site map have been saved', 'sitemap');
262
        $successMessageTitle = lang('Site map have been saved', 'sitemap');
263
264
        // Get Site Map Data
265
        $sitemap = file_get_contents(site_url('sitemapRegenerate.xml'));
266
        if ($sitemap) {
267
            if (!is_dir($this->site_map_folder_path)) {
268
                mkdir($this->site_map_folder_path, 0777);
269
            }
270
271
            foreach (glob($this->site_map_folder_path . '/sitemap*') as $site_map_file) {
272
                chmod($site_map_file, 0777);
273
                unlink($site_map_file);
274
            }
275
276
            // Create file and puts Site Map data
277
            if (file_put_contents($this->sitemap_path, $sitemap)) {
278
                chmod($this->sitemap_path, 0777);
279
                $this->lib_admin->log($successMessage);
280
                showMessage($successMessage, $successMessageTitle);
281
            } else {
282
                showMessage(lang('Site map have not been saved. Set writing permissions on module folder.', 'sitemap'), lang('Error', 'sitemap'), 'r');
283
            }
284
        } else {
285
            showMessage(lang('Site map have not been saved', 'sitemap'), lang('Error', 'sitemap'), 'r');
286
        }
287
    }
288
289
    /**
290
     * Update settings
291
     */
292
    public function settings() {
293
        if ($this->input->post()) {
294
            /** Data to update */
295
            $data = $this->input->post('settings');
296
297
            /** Update settings */
298 View Code Duplication
            if ($this->sitemap_model->updateSettings($data)) {
299
                $this->lib_admin->log(lang('Sitemap settings edited', 'sitemap'));
300
                showMessage(lang('Changes have been saved', 'sitemap'), lang('Message', 'sitemap'));
301
            } else {
302
                showMessage(lang('Changes have not been saved', 'sitemap'), lang('Error', 'sitemap'), 'r');
303
            }
304
305
            $this->_viewSiteMap();
306
        } else {
307
            // Get Information About Saved Site Map
308
            if (file_exists($this->sitemap_path)) {
309
                $file_data = [
310
                              'url'  => $this->sitemap_path,
311
                              'time' => filemtime($this->sitemap_path),
312
                              'size' => filesize($this->sitemap_path),
313
                             ];
314
            } else {
315
                $file_data = [];
316
            }
317
318
            $settings = $this->sitemap_model->load_settings();
319
320
            assetManager::create()
321
                    ->registerScript('admin')
322
                    ->setData(
323
                        [
324
                         'settings'        => $settings,
325
                         'fileSiteMapData' => $file_data,
326
                        ]
327
                    )
328
                    ->renderAdmin('settings');
329
        }
330
    }
331
332
    /**
333
     * Download saved sitemap xml file
334
     */
335
    public function sitemapDownload() {
336
        $this->load->helper('download');
337
        $sitemap = file_get_contents($this->sitemap_path);
338
339
        if ($sitemap) {
340
            force_download('sitemap.xml', $sitemap);
341
        } else {
342
            redirect(site_url('admin/components/init_window/sitemap/settings'));
343
        }
344
    }
345
346
}
347
348
/* End of file admin.php */