mambax7 /
adslight
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php declare(strict_types=1); |
||||
| 2 | |||||
| 3 | namespace XoopsModules\Adslight; |
||||
| 4 | |||||
| 5 | /* |
||||
| 6 | * You may not change or alter any portion of this comment or credits |
||||
| 7 | * of supporting developers from this source code or any supporting source code |
||||
| 8 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||
| 9 | * |
||||
| 10 | * This program is distributed in the hope that it will be useful, |
||||
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
| 13 | */ |
||||
| 14 | |||||
| 15 | /** |
||||
| 16 | * @copyright XOOPS Project (https://xoops.org) |
||||
| 17 | * @license GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||
| 18 | * @author XOOPS Development Team |
||||
| 19 | * @author Pascal Le Boustouller: original author ([email protected]) |
||||
| 20 | * @author Luc Bizet (www.frxoops.org) |
||||
| 21 | * @author jlm69 (www.jlmzone.com) |
||||
| 22 | * @author mamba (www.xoops.org) |
||||
| 23 | */ |
||||
| 24 | |||||
| 25 | /** |
||||
| 26 | * Protection against inclusion outside the site |
||||
| 27 | */ |
||||
| 28 | |||||
| 29 | /** |
||||
| 30 | * Includes of form objects and uploader |
||||
| 31 | */ |
||||
| 32 | require_once XOOPS_ROOT_PATH . '/class/uploader.php'; |
||||
| 33 | require_once XOOPS_ROOT_PATH . '/kernel/object.php'; |
||||
| 34 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||||
| 35 | require_once XOOPS_ROOT_PATH . '/kernel/object.php'; |
||||
| 36 | |||||
| 37 | /** |
||||
| 38 | * light_pictures class. |
||||
| 39 | * $this class is responsible for providing data access mechanisms to the data source |
||||
| 40 | * of XOOPS user class objects. |
||||
| 41 | */ |
||||
| 42 | class Pictures extends \XoopsObject |
||||
| 43 | { |
||||
| 44 | private $cod_img; |
||||
|
0 ignored issues
–
show
introduced
by
Loading history...
|
|||||
| 45 | private $title; |
||||
|
0 ignored issues
–
show
|
|||||
| 46 | private $date_created; |
||||
|
0 ignored issues
–
show
|
|||||
| 47 | private $date_updated; |
||||
|
0 ignored issues
–
show
|
|||||
| 48 | private $lid; |
||||
|
0 ignored issues
–
show
|
|||||
| 49 | private $uid_owner; |
||||
|
0 ignored issues
–
show
|
|||||
| 50 | private $url; |
||||
|
0 ignored issues
–
show
|
|||||
| 51 | /** |
||||
| 52 | * @var \XoopsMySQLDatabase |
||||
| 53 | */ |
||||
| 54 | public $db; |
||||
| 55 | public $helper; |
||||
| 56 | // constructor |
||||
| 57 | |||||
| 58 | /** |
||||
| 59 | * @param null|int $id |
||||
| 60 | * @param array|null $lid |
||||
| 61 | */ |
||||
| 62 | public function __construct( |
||||
| 63 | $id = null, |
||||
|
0 ignored issues
–
show
The parameter
$id is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. Loading history...
|
|||||
| 64 | $lid = null |
||||
| 65 | ) { |
||||
| 66 | $this->helper = Helper::getInstance(); |
||||
| 67 | $this->db = \XoopsDatabaseFactory::getDatabaseConnection(); |
||||
| 68 | $this->initVar('cod_img', \XOBJ_DTYPE_INT, null, false, 10); |
||||
| 69 | $this->initVar('title', \XOBJ_DTYPE_TXTBOX, null, false); |
||||
| 70 | $this->initVar('date_created', \XOBJ_DTYPE_INT, 0, false); |
||||
| 71 | $this->initVar('date_updated', \XOBJ_DTYPE_INT, 0, false); |
||||
| 72 | $this->initVar('lid', \XOBJ_DTYPE_INT, null, false, 10); |
||||
| 73 | $this->initVar('uid_owner', \XOBJ_DTYPE_TXTBOX, null, false); |
||||
| 74 | $this->initVar('url', \XOBJ_DTYPE_TXTBOX, null, false); |
||||
| 75 | if (!empty($lid)) { |
||||
| 76 | if (\is_array($lid)) { |
||||
|
0 ignored issues
–
show
|
|||||
| 77 | $this->assignVars($lid); |
||||
| 78 | } else { |
||||
| 79 | $this->load((int)$lid); |
||||
| 80 | } |
||||
| 81 | } else { |
||||
| 82 | $this->setNew(); |
||||
| 83 | } |
||||
| 84 | } |
||||
| 85 | |||||
| 86 | /** |
||||
| 87 | * @param int $id |
||||
| 88 | */ |
||||
| 89 | public function load($id): void |
||||
| 90 | { |
||||
| 91 | $sql = 'SELECT * FROM ' . $this->db->prefix('adslight_pictures') . ' WHERE cod_img=' . $id . ' '; |
||||
| 92 | $result = $this->db->query($sql); |
||||
| 93 | if (!$this->db->isResultSet($result)) { |
||||
| 94 | \trigger_error("Query Failed! SQL: $sql- Error: " . $this->db->error(), E_USER_ERROR); |
||||
| 95 | } |
||||
| 96 | $myrow = $this->db->fetchArray($result); |
||||
|
0 ignored issues
–
show
It seems like
$result can also be of type boolean; however, parameter $result of XoopsMySQLDatabase::fetchArray() does only seem to accept mysqli_result, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 97 | $this->assignVars($myrow); |
||||
|
0 ignored issues
–
show
It seems like
$myrow can also be of type false; however, parameter $var_arr of XoopsObject::assignVars() does only seem to accept array, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 98 | if (!$myrow) { |
||||
| 99 | $this->setNew(); |
||||
| 100 | } |
||||
| 101 | } |
||||
| 102 | |||||
| 103 | /** |
||||
| 104 | * @param array $criteria |
||||
| 105 | * @param bool $asobject |
||||
| 106 | * @param string $sort |
||||
| 107 | * @param string $cat_order |
||||
| 108 | * @param int $limit |
||||
| 109 | * @param int $start |
||||
| 110 | * @internal param string $order |
||||
| 111 | * @deprecated this should be handled through {@see PicturesHandler} |
||||
| 112 | */ |
||||
| 113 | public function getAllPictures( |
||||
| 114 | $criteria = [], |
||||
| 115 | $asobject = false, |
||||
| 116 | $sort = 'cod_img', |
||||
| 117 | $cat_order = 'ASC', |
||||
| 118 | $limit = 0, |
||||
| 119 | $start = 0 |
||||
| 120 | ): array { |
||||
| 121 | /** @var \XoopsMySQLDatabase $xoopsDB */ |
||||
| 122 | $xoopsDB = \XoopsDatabaseFactory::getDatabaseConnection(); |
||||
| 123 | $ret = []; |
||||
| 124 | $where_query = ''; |
||||
| 125 | if (\is_array($criteria) && \count($criteria) > 0) { |
||||
| 126 | $where_query = ' WHERE'; |
||||
| 127 | foreach ($criteria as $c) { |
||||
| 128 | $where_query .= " {$c} AND"; |
||||
| 129 | } |
||||
| 130 | $where_query = \mb_substr($where_query, 0, -4); |
||||
| 131 | } elseif (!\is_array($criteria) && $criteria) { |
||||
| 132 | $where_query = " WHERE {$criteria}"; |
||||
| 133 | } |
||||
| 134 | if ($asobject) { |
||||
| 135 | $sql = 'SELECT * FROM ' . $xoopsDB->prefix('adslight_pictures') . "{$where_query} ORDER BY {$sort} {$cat_order}"; |
||||
| 136 | $result = $xoopsDB->query($sql, $limit, $start); |
||||
| 137 | if ($xoopsDB->isResultSet($result)) { |
||||
| 138 | while (false !== ($myrow = $xoopsDB->fetchArray($result))) { |
||||
|
0 ignored issues
–
show
It seems like
$result can also be of type boolean; however, parameter $result of XoopsMySQLDatabase::fetchArray() does only seem to accept mysqli_result, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 139 | $ret[] = new self($myrow); |
||||
|
0 ignored issues
–
show
$myrow of type array is incompatible with the type integer|null expected by parameter $id of XoopsModules\Adslight\Pictures::__construct().
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 140 | } |
||||
| 141 | } else { |
||||
| 142 | \trigger_error("Query Failed! SQL: $sql- Error: " . $xoopsDB->error(), E_USER_ERROR); |
||||
| 143 | } |
||||
| 144 | } else { |
||||
| 145 | $sql = 'SELECT cod_img FROM ' . $xoopsDB->prefix('adslight_pictures') . "{$where_query} ORDER BY {$sort} {$cat_order}"; |
||||
| 146 | $result = $xoopsDB->query($sql, $limit, $start); |
||||
| 147 | if (!$xoopsDB->isResultSet($result)) { |
||||
| 148 | \trigger_error("Query Failed! SQL: $sql- Error: " . $xoopsDB->error(), E_USER_ERROR); |
||||
| 149 | } |
||||
| 150 | while (false !== ($myrow = $xoopsDB->fetchArray($result))) { |
||||
| 151 | $ret[] = $myrow['cog_img']; |
||||
| 152 | } |
||||
| 153 | } |
||||
| 154 | |||||
| 155 | return $ret; |
||||
| 156 | } |
||||
| 157 | |||||
| 158 | /** |
||||
| 159 | * Get form |
||||
| 160 | * |
||||
| 161 | * @param null |
||||
| 162 | * @return Form\PicturesForm |
||||
| 163 | */ |
||||
| 164 | public function getForm(): Form\PicturesForm |
||||
| 165 | { |
||||
| 166 | $form = new Form\PicturesForm($this); |
||||
| 167 | |||||
| 168 | return $form; |
||||
| 169 | } |
||||
| 170 | } |
||||
| 171 | |||||
| 172 | // ------------------------------------------------------------------------- |
||||
| 173 | // ------------------light_pictures user handler class ------------------- |
||||
| 174 | // ------------------------------------------------------------------------- |
||||
| 175 |