mambax7 /
extcal
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||||
| 2 | /* |
||||||
| 3 | * You may not change or alter any portion of this comment or credits |
||||||
| 4 | * of supporting developers from this source code or any supporting source code |
||||||
| 5 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||||
| 6 | * |
||||||
| 7 | * This program is distributed in the hope that it will be useful, |
||||||
| 8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
| 9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||
| 10 | */ |
||||||
| 11 | |||||||
| 12 | /** |
||||||
| 13 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||||||
| 14 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||||||
| 15 | * @package extcal |
||||||
| 16 | * @since |
||||||
| 17 | * @author XOOPS Development Team, |
||||||
| 18 | */ |
||||||
| 19 | |||||||
| 20 | use Xmf\Request; |
||||||
| 21 | use Xmf\Module\Admin; |
||||||
| 22 | use XoopsModules\Extcal\{Helper, |
||||||
| 23 | LocationHandler |
||||||
| 24 | }; |
||||||
| 25 | |||||||
| 26 | // Include xoops admin header |
||||||
| 27 | require_once __DIR__ . '/admin_header.php'; |
||||||
| 28 | // require_once dirname(__DIR__) . '/class/ExtcalPersistableObjectHandler.php'; |
||||||
| 29 | require_once dirname(__DIR__, 3) . '/kernel/module.php'; |
||||||
| 30 | require_once dirname(__DIR__, 3) . '/class/xoopsformloader.php'; |
||||||
| 31 | require_once dirname(__DIR__, 3) . '/class/tree.php'; |
||||||
| 32 | require_once dirname(__DIR__, 3) . '/class/xoopslists.php'; |
||||||
| 33 | require_once dirname(__DIR__, 3) . '/class/pagenav.php'; |
||||||
| 34 | require_once dirname(__DIR__, 3) . '/class/xoopsform/grouppermform.php'; |
||||||
| 35 | require_once dirname(__DIR__, 3) . '/class/uploader.php'; |
||||||
| 36 | require_once dirname(__DIR__) . '/include/constantes.php'; |
||||||
| 37 | |||||||
| 38 | if ($xoopsUser) { |
||||||
| 39 | $xoopsModule = \XoopsModule::getByDirname('extcal'); |
||||||
| 40 | if (!$xoopsUser->isAdmin($xoopsModule->mid())) { |
||||||
| 41 | redirect_header(XOOPS_URL . '/', 3, _NOPERM); |
||||||
| 42 | } |
||||||
| 43 | } else { |
||||||
| 44 | redirect_header(XOOPS_URL . '/', 3, _NOPERM); |
||||||
| 45 | } |
||||||
| 46 | |||||||
| 47 | // Include language file |
||||||
| 48 | xoops_loadLanguage('admin', 'system'); |
||||||
| 49 | Helper::getInstance()->loadLanguage('admin'); |
||||||
| 50 | Helper::getInstance()->loadLanguage('modinfo'); |
||||||
| 51 | $myts = \MyTextSanitizer::getInstance(); |
||||||
| 52 | |||||||
| 53 | //appel des class |
||||||
| 54 | $locationHandler = Helper::getInstance()->getHandler(_EXTCAL_CLN_LOCATION); |
||||||
| 55 | |||||||
| 56 | xoops_cp_header(); |
||||||
| 57 | |||||||
| 58 | $op = 'liste'; |
||||||
| 59 | if (Request::hasVar('op', 'REQUEST')) { |
||||||
| 60 | $op = $_REQUEST['op']; |
||||||
| 61 | } |
||||||
| 62 | |||||||
| 63 | //appel du menu admin |
||||||
| 64 | // if ( !is_readable(XOOPS_ROOT_PATH . "/Frameworks/art/functions.admin.php")) { |
||||||
| 65 | // adminmenu(4, _MI_EXTCAL_LOCATION); |
||||||
| 66 | // } else { |
||||||
| 67 | // require_once XOOPS_ROOT_PATH.'/Frameworks/art/functions.admin.php'; |
||||||
| 68 | // loadModuleAdminMenu (4, _MI_EXTCAL_LOCATION); |
||||||
| 69 | // } |
||||||
| 70 | |||||||
| 71 | //Les valeurs de op qui vont permettre d'aller dans les differentes parties de la page |
||||||
| 72 | switch ($op) { |
||||||
| 73 | // Vue liste |
||||||
| 74 | case 'liste': |
||||||
| 75 | // @author JJDAI |
||||||
| 76 | //*************************************************************************************** |
||||||
| 77 | $adminObject = Admin::getInstance(); |
||||||
| 78 | $adminObject->displayNavigation(basename(__FILE__)); |
||||||
| 79 | //*************************************************************************************** |
||||||
| 80 | |||||||
| 81 | $criteria = new \CriteriaCompo(); |
||||||
| 82 | if (Request::hasVar('limit', 'REQUEST')) { |
||||||
| 83 | $criteria->setLimit($_REQUEST['limit']); |
||||||
| 84 | $limit = $_REQUEST['limit']; |
||||||
| 85 | } else { |
||||||
| 86 | $criteria->setLimit(10); |
||||||
| 87 | $limit = 10; |
||||||
| 88 | } |
||||||
| 89 | if (Request::hasVar('start', 'REQUEST')) { |
||||||
| 90 | $criteria->setStart($_REQUEST['start']); |
||||||
| 91 | $start = $_REQUEST['start']; |
||||||
| 92 | } else { |
||||||
| 93 | $criteria->setStart(0); |
||||||
| 94 | $start = 0; |
||||||
| 95 | } |
||||||
| 96 | $criteria->setSort('nom'); |
||||||
| 97 | $criteria->setOrder('ASC'); |
||||||
| 98 | $location_arr = $locationHandler->getObjects($criteria); |
||||||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||||||
| 99 | $numrows = $locationHandler->getCount($criteria); |
||||||
|
0 ignored issues
–
show
The method
getCount() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of said class. However, the method does not exist in XoopsGroupHandler or XoopsConfigCategoryHandler or XoopsRankHandler or XoopsConfigOptionHandler or XoopsBlockHandler or XoopsImagesetHandler. Are you sure you never get one of those?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 100 | if ($numrows > $limit) { |
||||||
| 101 | $pagenav = new \XoopsPageNav($numrows, $limit, $start, 'start', 'op=liste&limit=' . $limit); |
||||||
| 102 | $pagenav = $pagenav->renderNav(4); |
||||||
| 103 | } else { |
||||||
| 104 | $pagenav = ''; |
||||||
| 105 | } |
||||||
| 106 | //Affichage du tableau des téléchargements brisés |
||||||
| 107 | if ($numrows > 0) { |
||||||
| 108 | echo '<table width="100%" cellspacing="1" class="outer">'; |
||||||
| 109 | echo '<tr>'; |
||||||
| 110 | echo '<th align="center">' . _AM_EXTCAL_LOCATION_FORM_NOM . '</th>'; |
||||||
| 111 | echo '<th align="center" width="20%">' . _AM_EXTCAL_LOCATION_FORM_ADRESSE . '</th>'; |
||||||
| 112 | echo '<th align="center" width="20%">' . _AM_EXTCAL_LOCATION_FORM_CITY . '</th>'; |
||||||
| 113 | echo '<th align="center" width="15%">' . _AM_EXTCAL_LOCATION_FORM_TELEPHONE . '</th>'; |
||||||
| 114 | echo '<th align="center" width="15%">' . _AM_EXTCAL_LOCATION_FORM_ACTION . '</th>'; |
||||||
| 115 | echo '</tr>'; |
||||||
| 116 | $class = 'odd'; |
||||||
| 117 | foreach (array_keys($location_arr) as $i) { |
||||||
| 118 | $class = ('even' === $class) ? 'odd' : 'even'; |
||||||
| 119 | $location_id = $location_arr[$i]->getVar('id'); |
||||||
| 120 | $location_nom = $location_arr[$i]->getVar('nom'); |
||||||
| 121 | $location_adresse = $location_arr[$i]->getVar('adresse'); |
||||||
| 122 | $location_city = $location_arr[$i]->getVar('ville'); |
||||||
| 123 | $location_telephone = $location_arr[$i]->getVar('tel_fixe'); |
||||||
| 124 | echo '<tr class="' . $class . '">'; |
||||||
| 125 | echo '<td align="left">' . '<a href="location.php?op=edit_location&location_id=' . $location_id . '">' . $location_nom . '</a>' . '</td>'; |
||||||
| 126 | |||||||
| 127 | echo '<td align="center"><b>' . $location_adresse . '</td>'; |
||||||
| 128 | echo '<td align="center"><b>' . $location_city . '</td>'; |
||||||
| 129 | echo '<td align="center"><b>' . $location_telephone . '</td>'; |
||||||
| 130 | echo '<td align="center" width="15%">'; |
||||||
| 131 | echo '<a href="location.php?op=edit_location&location_id=' . $location_id . '"><img src=' . $pathIcon16 . '/edit.png alt="' . _AM_EXTCAL_LOCATION_FORM_EDIT . '" title="' . _AM_EXTCAL_LOCATION_FORM_EDIT . '"></a> '; |
||||||
| 132 | echo '<a href="location.php?op=delete_location&location_id=' . $location_id . '"><img src=' . $pathIcon16 . '/delete.png alt="' . _AM_EXTCAL_LOCATION_FORM_DELETE . '" title="' . _AM_EXTCAL_LOCATION_FORM_DELETE . '"></a> '; |
||||||
| 133 | echo '</td>'; |
||||||
| 134 | } |
||||||
| 135 | echo '</table><br>'; |
||||||
| 136 | echo '<br><div align=right>' . $pagenav . '</div><br>'; |
||||||
| 137 | } else { |
||||||
| 138 | echo '<div class="errorMsg" style="text-align: center;">' . _AM_EXTCAL_ERREUR_NO_LOCATION . '</div>'; |
||||||
| 139 | } |
||||||
| 140 | |||||||
| 141 | // Affichage du formulaire |
||||||
| 142 | $obj = $locationHandler->create(); |
||||||
| 143 | $form = $obj->getForm(false); |
||||||
|
0 ignored issues
–
show
The method
getForm() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as SystemSmilies or SystemBanner or SystemBannerclient or ProfileCategory or SystemUserrank or XoopsModules\Extcal\Location or SystemGroup or SystemBlock or SystemAvatar or SystemUsers.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 144 | break; |
||||||
| 145 | // permet de suprimmer le rapport de téléchargment brisé |
||||||
| 146 | case 'delete_location': |
||||||
| 147 | $obj = $locationHandler->get(Request::getInt('location_id', 0)); |
||||||
| 148 | if (Request::hasVar('ok', 'REQUEST') && 1 == $_REQUEST['ok']) { |
||||||
| 149 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||||
| 150 | redirect_header('location.php', 3, implode(',', $GLOBALS['xoopsSecurity']->getErrors())); |
||||||
| 151 | } |
||||||
| 152 | if ($locationHandler->delete($obj)) { |
||||||
| 153 | redirect_header('location.php', 1, _AM_EXTCAL_REDIRECT_DELOK); |
||||||
| 154 | } |
||||||
| 155 | } else { |
||||||
| 156 | xoops_confirm( |
||||||
| 157 | [ |
||||||
| 158 | 'ok' => 1, |
||||||
| 159 | 'location_id' => Request::getInt('location_id', 0), |
||||||
| 160 | 'op' => 'delete_location', |
||||||
| 161 | ], |
||||||
| 162 | $_SERVER['REQUEST_URI'], |
||||||
| 163 | _AM_EXTCAL_LOCATION_SURDEL . '<br>' |
||||||
| 164 | ); |
||||||
| 165 | } |
||||||
| 166 | break; |
||||||
| 167 | case 'edit_location': |
||||||
| 168 | // @author JJDAI |
||||||
| 169 | //*************************************************************************************** |
||||||
| 170 | $adminObject = Admin::getInstance(); |
||||||
| 171 | $adminObject->displayNavigation(basename(__FILE__)); |
||||||
| 172 | //*************************************************************************************** |
||||||
| 173 | //Adisplay of the download creation form |
||||||
| 174 | $obj = $locationHandler->get(Request::getInt('location_id', 0)); |
||||||
| 175 | $form = $obj->getForm(false); |
||||||
| 176 | break; |
||||||
| 177 | case 'save_location': |
||||||
| 178 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||||
| 179 | redirect_header('location.php', 3, implode(',', $GLOBALS['xoopsSecurity']->getErrors())); |
||||||
| 180 | } |
||||||
| 181 | if (Request::hasVar('location_id', 'REQUEST')) { |
||||||
| 182 | $obj = $locationHandler->get(Request::getInt('location_id', 0)); |
||||||
| 183 | } else { |
||||||
| 184 | $obj = $locationHandler->create(); |
||||||
| 185 | } |
||||||
| 186 | |||||||
| 187 | $obj->setVar('nom', $_REQUEST['nom']); |
||||||
| 188 | $obj->setVar('description', $_REQUEST['description']); |
||||||
| 189 | $obj->setVar('categorie', $_REQUEST['categorie']); |
||||||
| 190 | $obj->setVar('adresse', $_REQUEST['adresse']); |
||||||
| 191 | $obj->setVar('adresse2', $_REQUEST['adresse2']); |
||||||
| 192 | $obj->setVar('cp', $_REQUEST['cp']); |
||||||
| 193 | $obj->setVar('ville', $_REQUEST['ville']); |
||||||
| 194 | $obj->setVar('tel_fixe', $_REQUEST['tel_fixe']); |
||||||
| 195 | $obj->setVar('tel_portable', $_REQUEST['tel_portable']); |
||||||
| 196 | $obj->setVar('mail', $_REQUEST['mail']); |
||||||
| 197 | $obj->setVar('site', $_REQUEST['site']); |
||||||
| 198 | $obj->setVar('horaires', $_REQUEST['horaires']); |
||||||
| 199 | $obj->setVar('divers', $_REQUEST['divers']); |
||||||
| 200 | $obj->setVar('tarifs', $_REQUEST['tarifs']); |
||||||
| 201 | $obj->setVar('map', $_REQUEST['map']); |
||||||
| 202 | |||||||
| 203 | //Logo |
||||||
| 204 | $uploaddir_location = XOOPS_ROOT_PATH . '/uploads/extcal/location/'; |
||||||
| 205 | $uploadurl_location = XOOPS_URL . '/uploads/extcal/location/'; |
||||||
| 206 | |||||||
| 207 | $delimg = @$_REQUEST['delimg']; |
||||||
| 208 | $delimg = isset($delimg) ? (int)$delimg : 0; |
||||||
| 209 | if (0 == $delimg && !empty($_REQUEST['xoops_upload_file'][0])) { |
||||||
| 210 | $upload = new \XoopsMediaUploader( |
||||||
| 211 | $uploaddir_location, [ |
||||||
| 212 | 'image/gif', |
||||||
| 213 | 'image/jpeg', |
||||||
| 214 | 'image/pjpeg', |
||||||
| 215 | 'image/x-png', |
||||||
| 216 | 'image/png', |
||||||
| 217 | ], 3145728, null, null |
||||||
| 218 | ); |
||||||
| 219 | if ($upload->fetchMedia($_REQUEST['xoops_upload_file'][0])) { |
||||||
| 220 | $upload->setPrefix('location_'); |
||||||
| 221 | $upload->fetchMedia($_REQUEST['xoops_upload_file'][0]); |
||||||
| 222 | if (!$upload->upload()) { |
||||||
| 223 | $errors = $upload->getErrors(); |
||||||
| 224 | redirect_header('<script>javascript:history.go(-1)</script>', 3, $errors); |
||||||
| 225 | } else { |
||||||
| 226 | $logo = $upload->getSavedFileName(); |
||||||
| 227 | } |
||||||
| 228 | } elseif (!empty($_REQUEST['file'])) { |
||||||
| 229 | $logo = Request::getString('file', ''); |
||||||
| 230 | } |
||||||
| 231 | } else { |
||||||
| 232 | $logo = ''; |
||||||
| 233 | $url_location = XOOPS_ROOT_PATH . '/uploads/extcal/location/' . Request::getString('file', ''); |
||||||
| 234 | if (is_file($url_location)) { |
||||||
| 235 | chmod($url_location, 0777); |
||||||
| 236 | unlink($url_location); |
||||||
| 237 | } |
||||||
| 238 | } |
||||||
| 239 | $obj->setVar('logo', $logo); |
||||||
| 240 | |||||||
| 241 | if ($locationHandler->insert($obj)) { |
||||||
| 242 | } |
||||||
| 243 | |||||||
| 244 | //require_once dirname(__DIR__) . "/include/forms.php"; |
||||||
| 245 | echo $obj->getHtmlErrors(); |
||||||
| 246 | $form = $obj->getForm(false, 0); |
||||||
| 247 | //echo "<hr>exit <<<<<<<<<<<<<<<<<<<<";exit; |
||||||
| 248 | redirect_header('location.php', 2, _AM_EXTCAL_FORMOK); |
||||||
| 249 | |||||||
| 250 | break; |
||||||
| 251 | } |
||||||
| 252 | |||||||
| 253 | require_once __DIR__ . '/admin_footer.php'; |
||||||
| 254 |