xoops_trust_path/libs/altsys/blocks/block_functions.php ➔ b_altsys_admin_menu_show()

Complexity

Conditions	29
Paths	2204

Size

Total Lines

169

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
function b_altsys_admin_menu_show($options)
{
    global $xoopsUser;

    $mydirname = empty($options[0]) ? 'altsys' : $options[0];

    $this_template = empty($options[1]) ? 'db:' . $mydirname . '_block_admin_menu.tpl' : trim($options[1]);

    if (preg_match('/[^0-9a-zA-Z_-]/', $mydirname)) {
        die('Invalid mydirname');
    }

    if (!is_object(@$xoopsUser)) {
        return [];
    }

    // coretype

    $coretype = altsys_get_core_type();

    // mid_selected

    if (is_object(@$GLOBALS['xoopsModule'])) {
        $mid_selected = $GLOBALS['xoopsModule']->getVar('mid');

        // for system->preferences

        if (1 == $mid_selected && 'preferences' == @$_GET['fct'] && 'showmod' == @$_GET['op'] && !empty($_GET['mod'])) {
            $mid_selected = \Xmf\Request::getInt('mod', 0, 'GET');
        }
    } else {
        $mid_selected = 0;
    }

    $db = XoopsDatabaseFactory::getDatabaseConnection();

    (method_exists('MyTextSanitizer', 'sGetInstance') and $myts = MyTextSanitizer::sGetInstance()) || $myts = MyTextSanitizer::getInstance();

    $module_handler = xoops_getHandler('module');

    $current_module = $module_handler->getByDirname($mydirname);

    $configHandler = xoops_getHandler('config');

    $current_configs = $configHandler->getConfigList($current_module->mid());

    $moduleperm_handler = xoops_getHandler('groupperm');

    $admin_mids = $moduleperm_handler->getItemIds('module_admin', $xoopsUser->getGroups());

    $modules = $module_handler->getObjects(new Criteria('mid', '(' . implode(',', $admin_mids) . ')', 'IN'), true);

    $block = [
        'mydirname' => $mydirname,
        'mod_url' => XOOPS_URL . '/modules/' . $mydirname,
        'mod_imageurl' => XOOPS_URL . '/modules/' . $mydirname . '/' . $current_configs['images_dir'],
        'mod_config' => $current_configs,
    ];

    foreach ($modules as $mod) {
        $mid = (int)$mod->getVar('mid');

        $dirname = $mod->getVar('dirname');

        $modinfo = $mod->getInfo();

        $submenus4assign = [];

        $adminmenu = [];

        $adminmenu4altsys = [];

        unset($adminmenu_use_altsys);

        @include XOOPS_ROOT_PATH . '/modules/' . $dirname . '/' . @$modinfo['adminmenu'];

It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

        // from admin_menu.php etc.

        $adminmenu = array_merge($adminmenu, $adminmenu4altsys);

        foreach ($adminmenu as $sub) {
            $link = empty($sub['altsys_link']) ? $sub['link'] : $sub['altsys_link'];

            if (isset($sub['show']) && false === $sub['show']) {
                continue;
            }

            $submenus4assign[] = [
                'title' => htmlspecialchars($sub['title']),
                'url' => XOOPS_URL . '/modules/' . $dirname . '/' . htmlspecialchars($link, ENT_QUOTES),
            ];
        }

        // for modules overriding Module.class.php (eg. Analyzer for XC)

        if (empty($submenus4assign) && defined('XOOPS_CUBE_LEGACY') && !empty($modinfo['cube_style'])) {
            $module_handler = xoops_getHandler('module');

            $module = $module_handler->get($mid);

            $moduleObj = Legacy_Utils::createModule($module);

            $modinfo['adminindex'] = $moduleObj->getAdminIndex();

            $modinfo['adminindex_absolute'] = true;

            foreach ($moduleObj->getAdminMenu() as $sub) {
                if (false === @$sub['show']) {
                    continue;
                }

                $submenus4assign[] = [
                    'title' => htmlspecialchars($sub['title']),
                    'url' => 0 === strncmp($sub['link'], 'http', 4) ? htmlspecialchars($sub['link'], ENT_QUOTES) : XOOPS_URL . '/modules/' . $dirname . '/' . htmlspecialchars($sub['link'], ENT_QUOTES),
                ];
            }
        } elseif (empty($adminmenu4altsys)) {
            // add preferences

            if ($mod->getVar('hasconfig') && !in_array($mod->getVar('dirname'), ['system', 'legacy'])) {
                $submenus4assign[] = [
                    'title' => _PREFERENCES,
                    'url' => htmlspecialchars(altsys_get_link2modpreferences($mid, $coretype), ENT_QUOTES),
                ];
            }

            // add help

            if (defined('XOOPS_CUBE_LEGACY') && !empty($modinfo['help'])) {
                $submenus4assign[] = [
                    'title' => _HELP,
                    'url' => XOOPS_URL . '/modules/legacy/admin/index.php?action=Help&dirname=' . $dirname,
                ];
            }
        }

        $module4assign = [
            'mid' => $mid,
            'dirname' => $dirname,
            'name' => $mod->getVar('name'),
            'version_in_db' => sprintf('%.2f', $mod->getVar('version') / 100.0),
            'version_in_file' => sprintf('%.2f', $modinfo['version']),
            'description' => htmlspecialchars(@$modinfo['description'], ENT_QUOTES),
            'image' => htmlspecialchars($modinfo['image'], ENT_QUOTES),
            'isactive' => $mod->getVar('isactive'),
            'hasmain' => $mod->getVar('hasmain'),
            'hasadmin' => $mod->getVar('hasadmin'),
            'hasconfig' => $mod->getVar('hasconfig'),
            'weight' => $mod->getVar('weight'),
            'adminindex' => htmlspecialchars(@$modinfo['adminindex'], ENT_QUOTES),
            'adminindex_absolute' => @$modinfo['adminindex_absolute'],
            'submenu' => $submenus4assign,
            'selected' => $mid == $mid_selected,
            'dot_suffix' => $mid == $mid_selected ? 'selected_opened' : 'closed',
        ];

        $block['modules'][] = $module4assign;
    }

    require_once XOOPS_TRUST_PATH . '/libs/altsys/class/D3Tpl.class.php';

    $tpl = new D3Tpl();

    $tpl->assign('block', $block);

    $ret['content'] = $tpl->fetch($this_template);

$ret was never initialized. Although not strictly required by PHP, it is generally a good practice to add $ret = array(); before regardless.

    return $ret;
}