Issues (733)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

include/mail_fnc.php (12 issues)

1
<?php
2
/*
3
 * You may not change or alter any portion of this comment or credits
4
 * of supporting developers from this source code or any supporting source code
5
 * which is considered copyrighted (c) material of the original comment or credit authors.
6
 *
7
 * This program is distributed in the hope that it will be useful,
8
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
10
 */
11
12
/**
13
 * @copyright    {@link https://xoops.org/ XOOPS Project}
14
 * @license      {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later}
15
 * @package      extcal
16
 * @since
17
 * @author       XOOPS Development Team,
18
 *
19
 * L'utilisation de ce formulaire d'adminitration suppose
20
 * que la classe correspondante de la table a été générées avec classGenerator
21
 **/
22
23
use XoopsModules\Extcal\{Helper,
24
    Utility
25
};
26
27
require_once dirname(__DIR__, 3) . '/class/uploader.php';
28
require_once dirname(__DIR__, 3) . '/class/mail/phpmailer/class.phpmailer.php'; // First we require_once the PHPMailer libary in our script
29
// require_once  dirname(__DIR__) . '/class/Utility.php';
30
require_once __DIR__ . '/constantes.php';
31
require_once dirname(__DIR__, 3) . '/class/template.php';
32
33
/********************************************************************
34
 *
35
 *******************************************************************
36
 * @param $mode
37
 * @param $eventId
38
 * @param $memberUid
39
 * @param $subject
40
 * @param $tplMessage
41
 */
42
function sendMail2member($mode, $eventId, $memberUid, $subject, $tplMessage)
0 ignored issues
show
The parameter $mode is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

42
function sendMail2member(/** @scrutinizer ignore-unused */ $mode, $eventId, $memberUid, $subject, $tplMessage)

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
43
{
44
    //mode = 0 pas d'entete
45
    //mode = 1 format text
46
    //mode = 2: format html
47
48
    global $xoopsConfig, $xoopsDB;
49
    // $t = print_r($xoopsConfig, true);
50
    // echo "<pre>{$t}</pre>";
51
    /*
52
    $memberUid = 1;
53
    $eventId = 393;
54
    $message = "Bonne journée à tous";
55
    $newStatus = 1;
56
    $oldStatus = 0;
57
58
    */
59
60
    //l'utilisateur ne pas etre notifié par mail
61
    //if ($mode == 0) exit;
62
    //-------------------------------------------------------
63
    $tblMember    = $xoopsDB->prefix('extcal_eventmember');
64
    $tblNotMember = $xoopsDB->prefix('extcal_eventnotmember');
65
    $tblUsers     = $xoopsDB->prefix('users');
66
    $tblEvent     = $xoopsDB->prefix('extcal_event');
0 ignored issues
show
The assignment to $tblEvent is dead and can be removed.
Loading history...
67
68
    //--------------------------------------------------------------
69
    //Recuperation des données event,user et member
70
    //Recuperation des données de l'evennement
71
    $eventHandler = Helper::getInstance()->getHandler(_EXTCAL_CLN_EVENT);
72
    $obj          = $eventHandler->getEvent($eventId);
0 ignored issues
show
The method getEvent() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

72
    /** @scrutinizer ignore-call */ 
73
    $obj          = $eventHandler->getEvent($eventId);
Loading history...
73
    $event        = $eventHandler->objectToArray($obj);
0 ignored issues
show
The method objectToArray() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

73
    /** @scrutinizer ignore-call */ 
74
    $event        = $eventHandler->objectToArray($obj);
Loading history...
74
    $eventHandler->formatEventDate($event, _MD_EXTCAL_FORMAT_DATE);
0 ignored issues
show
The method formatEventDate() does not exist on XoopsObjectHandler. It seems like you code against a sub-type of XoopsObjectHandler such as XoopsPersistableObjectHandler. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

74
    $eventHandler->/** @scrutinizer ignore-call */ 
75
                   formatEventDate($event, _MD_EXTCAL_FORMAT_DATE);
Loading history...
75
76
    $submiter_uid = $event['event_submitter'];
77
    // Utility::echoArray($event,'event');
78
    //--------------------------------------------------------------
79
    //Recuperation des données du user createur de l'evennement
80
    $sql = <<<__sql__
81
  SELECT if(tu.name='', tu.uname, tu.name) AS name,     tu.uname,   tu.email
82
  FROM {$tblUsers} tu
83
  WHERE tu.uid = {$submiter_uid};
84
__sql__;
85
86
    $rst      = $xoopsDB->query($sql);
87
    $submiter = $xoopsDB->fetchArray($rst);
88
    // echo "{$sql}<br>";
89
    // Utility::echoArray($submiter,'submiter');
90
    //--------------------------------------------------------------
91
    //Recuperation des données du membre inscrit
92
    $sql = <<<__sql__
93
  SELECT if(tu.name='', tu.uname, tu.name) AS name,     tu.uname,   tu.email
94
  FROM {$tblUsers} tu
95
  WHERE tu.uid = {$memberUid};
96
__sql__;
97
98
    $rst    = $xoopsDB->query($sql);
99
    $acteur = $xoopsDB->fetchArray($rst);
100
    //echo "{$sql}<br>";
101
    // Utility::echoArray($acteur,'acteur');
102
    //--------------------------------------------------------------
103
    //Recuperation des données des membres présents
104
    $sql = <<<__sql__
105
SELECT tu.uid, if(tu.name='', tu.uname, tu.name) AS name,   tu.uname,   tu.email,
106
        tm.status
107
FROM {$tblMember} tm,
108
     {$tblUsers}  tu
109
WHERE tm.uid = tu.uid
110
  AND tm.event_id = {$eventId}
111
__sql__;
112
113
    $rst     = $xoopsDB->query($sql);
114
    $members = [];
115
    while (false !== ($row = $xoopsDB->fetchArray($rst))) {
116
        $row['status']        = _MD_EXTCAL_PRESENT;
117
        $members[$row['uid']] = $row;
118
    }
119
120
    //--------------------------------------------------------------
121
    //Recuperation des données des membres absents
122
    $sql = <<<__sql__
123
SELECT tu.uid, if(tu.name='', tu.uname, tu.name) AS name,   tu.uname,   tu.email,
124
        tm.status
125
FROM {$tblNotMember} tm,
126
     {$tblUsers}  tu
127
WHERE tm.uid = tu.uid
128
  AND tm.event_id = {$eventId}
129
__sql__;
130
131
    $rst = $xoopsDB->query($sql);
132
    while (false !== ($row = $xoopsDB->fetchArray($rst))) {
133
        $row['status']        = _MD_EXTCAL_ABSENT;
134
        $members[$row['uid']] = $row;
135
    }
136
137
    // Utility::echoArray($members,'members');
138
    // exit;
139
140
    //--------------------------------------------------------------
141
    //Message et sujet du mail
142
    $action  = ''; //a voir   JJD
143
    $message = sprintf($tplMessage, $acteur['name']);
144
    //$subject .= ' (' . rand(1, 100) . ')';
145
    $subject .= ' - ' . $acteur['name'];
146
    //--------------------------------------------------------------
147
    //Chargement du template dans le dossier de langue
148
    //$f = _EXTCAL_PATH_LG . $xoopsConfig['language'] . '\mail_inscription.html';
149
    //$tpl = new tpl($f);
150
    $tpl = new \XoopsTpl();
151
152
    $tpl->assign('dateAction', date(_MD_EXTCAL_FORMAT_DATE));
153
    $tpl->assign('submiter', $submiter);
154
    $tpl->assign('event', $event);
155
    $tpl->assign('acteur', $acteur);
156
    $tpl->assign('members', $members);
157
    $tpl->assign('action', $action);
158
    $tpl->assign('subject', $subject);
159
    $tpl->assign('message', $message);
160
    $tpl->assign('xoopsConfig', $xoopsConfig);
161
    $tpl->assign('br', '<br>');
162
163
    //--------------------------------------------------------------
164
    $destinataires                     = [];
165
    $destinataires[$submiter['email']] = $submiter['email'];
166
    $destinataires[$acteur['email']]   = $acteur['email'];
167
    //    while (list($k, $row) = each($members)) {
168
    foreach ($members as $k => $row) {
169
        $destinataires[$row['email']] = $row['email'];
170
    }
171
172
    // Utility::echoArray($destinataires);
173
    // exit;
174
175
    $mail_fromName  = $xoopsConfig['sitename'];
176
    $mail_fromemail = $xoopsConfig['adminmail'];
177
    $mail_subject   = $subject;
178
179
    $bEcho = false;
0 ignored issues
show
The assignment to $bEcho is dead and can be removed.
Loading history...
180
    $mode  = _EXTCAL_HEADER_HTML;
181
    $sep   = '|';
0 ignored issues
show
The assignment to $sep is dead and can be removed.
Loading history...
182
183
    $template = 'extcal_mail_member_text.tpl';
184
    if (_EXTCAL_HEADER_HTML == $mode) {
0 ignored issues
show
The condition _EXTCAL_HEADER_HTML == $mode is always true.
Loading history...
185
        $template = 'extcal_mail_member_html.tpl';
186
    }
187
    $mail_body = $tpl->fetch('db:' . $template);
188
189
    extcal_SendMail($destinataires, $mail_fromName, $mail_fromemail, $mail_subject, $mail_body, $bEcho = false, $mode = 0, $sep = '|');
190
191
    //Prépartion de l'envoi
192
193
    //--------------------------------------------------------------
194
}
195
196
/*****************************************************************
197
 ****************************************************************
198
 * @param        $destinataires
199
 * @param        $mail_fromname
200
 * @param        $mail_fromemail
201
 * @param        $mail_subject
202
 * @param        $mail_body
203
 * @param bool   $bEcho
204
 * @param int    $mode
205
 * @param string $sep
206
 */
207
function extcal_SendMail(
208
    $destinataires,
209
    $mail_fromname,
210
    $mail_fromemail,
211
    $mail_subject,
212
    $mail_body,
213
    $bEcho = false,
214
    $mode = 0,
0 ignored issues
show
The parameter $mode is not used and could be removed. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-unused  annotation

214
    /** @scrutinizer ignore-unused */ $mode = 0,

This check looks for parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
215
    $sep = '|'
216
) {
217
    global $ModName, $signature, $mail_admin, $xoopsConfig, $xoopsDB, $xoopsModule;
218
219
    //$bEcho=false;
220
    //echo "<hr>function hermesMail<hr>";
221
222
    // $destinataires = array('[email protected]','[email protected]','[email protected]');
223
    //$mail_fromname = "test jjd hermes";
224
    if ('' == $mail_fromname) {
225
        $mail_fromname = $mail_fromemail;
226
    }
227
228
    //$mail_fromemail = "[email protected]";
229
    //$mail_subject = "test hemes";
230
    //$mail_body = getContentTestMail();
231
    //-----------------------------
232
    if (!is_array($destinataires)) {
233
        $destinataires = explode($sep, $destinataires);
234
    }
235
    $header = extcal_getHeader(1, $mail_fromemail);
0 ignored issues
show
The assignment to $header is dead and can be removed.
Loading history...
236
    //-----------------------------
237
    $myts = \MyTextSanitizer::getInstance();
0 ignored issues
show
The assignment to $myts is dead and can be removed.
Loading history...
238
    //$xoopsMailer = getMailer();
239
    $xoopsMailer = xoops_getMailer();
240
241
    //$xoopsMailer->setToUsers($destinataires[$i]);
242
243
    //    while (list($k, $v) = each($destinataires)) {
244
    foreach ($destinataires as $k => $v) {
245
        //for ( $i = 0, $iMax = count($destinataires); $i < $iMax; ++$i) {
246
        //$xoopsMailer->setToUsers($destinataires[$i]);
247
        $xoopsMailer->setToEmails($v);
248
        //echo "setToUsers : {$destinataires[$i]}<br>";
249
    }
250
251
    $xoopsMailer->multimailer->isHTML(true);
252
    $xoopsMailer->setFromName(($mail_fromname));
253
254
    $xoopsMailer->setFromEmail(($mail_fromemail));
255
256
    $xoopsMailer->setSubject(($mail_subject));
257
    $xoopsMailer->setBody(($mail_body));
258
    //$xoopsMailer->encodeBody($mail_body);
259
260
    $xoopsMailer->useMail();
261
262
    //function $xoopsMailer->sendMail($email, $subject, $body, $headers)
263
    $xoopsMailer->send($bEcho);
264
265
    if ($bEcho) {
266
        Utility::extEcho($xoopsMailer->getSuccess());
267
        Utility::extEcho($xoopsMailer->getErrors());
268
    }
269
    /*
270
271
     echo "<hr>mail_fromname : {$mail_fromname}<br>"
272
          ."mail_fromemail : {$mail_fromemail}<br>"
273
          ."mail_subject : {$mail_subject}<br>"
274
          ."mail_body : {$mail_body}<br><hr>";
275
     //---------------------------
276
277
278
      $adresse = "[email protected]";
279
      $bolOk = mail($adresse, "test envoi mail", "test envoi envoi mail via php");
280
      $r= (($bolOk) ? " => Succés" : "Echec");
281
      echo "<hr>==> <b>{$r}</b> de l'envoi du mail a: ==> {$adresse}<br>" ;
282
    */
283
}
284
285
/****************************************************************************
286
 *
287
 ***************************************************************************
288
 * @param $mode
289
 * @param $emailSender
290
 *
291
 * @return string
292
 */
293
function extcal_getHeader($mode, $emailSender)
294
{
295
    //mode = 0 pas d'entete
296
    //mode = 1 format text
297
    //mode = 2: format html
298
299
    global $xoopsConfig;
300
301
    // $t = print_r($xoopsConfig, true);
302
    // echo "<pre>{$t}</pre>";
303
304
    //------------------------------------------------------
305
    $d = date('d-m-Y h:m:h', time());
0 ignored issues
show
The assignment to $d is dead and can be removed.
Loading history...
306
    //-----------------------------------------------------------
307
    //defini l'expediteur du mail
308
    if ('' == $emailSender) {
309
        if ('' == $xoopsConfig['adminmail']) {
310
            $emailSender = "webmaster@{$_SERVER['SERVER_NAME']}";
311
        } else {
312
            $emailSender = $xoopsConfig['adminmail'];
313
        }
314
    }
315
    //-----------------------------------------------------------
316
    $header   = [];
317
    $header[] = "From: {$emailSender}";
318
    $header[] = "Reply-To: {$emailSender}";
319
    $header[] = 'X-Mailer: PHP/' . PHP_VERSION;
320
321
    if (_EXTCAL_HEADER_HTML == $mode) {
322
        $header[] = 'MIME-Version: 1.0';
323
        $header[] = 'Content-type: text/html; charset=iso-8859-1';
324
    }
325
    //bin rien a prori
326
327
    $header[] = '';
328
329
    //$sHeader = implode("\r\n", $header);
330
    $sHeader = implode("\r\n", $header);
331
332
    return $sHeader;
333
}
334