Issues (992)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/PublicPhotoHandler.php (7 issues)

Labels
1
<?php
2
3
namespace XoopsModules\Extgallery;
4
5
/**
6
 * ExtGallery Class Manager
7
 *
8
 * You may not change or alter any portion of this comment or credits
9
 * of supporting developers from this source code or any supporting source code
10
 * which is considered copyrighted (c) material of the original comment or credit authors.
11
 * This program is distributed in the hope that it will be useful,
12
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14
 *
15
 * @copyright   {@link https://xoops.org/ XOOPS Project}
16
 * @license     GNU GPL 2 (https://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
17
 * @author      Zoullou (http://www.zoullou.net)
18
 * @package     ExtGallery
19
 */
20
21
use Criteria;
22
use CriteriaCompo;
23
use XoopsDatabase;
24
use XoopsModules\Extgallery;
25
use XoopsObject;
26
27
28
29
30
//require_once __DIR__ . '/photoHandler.php';
31
//require_once __DIR__ . '/publicPerm.php';
32
33
/**
34
 * Class Extgallery\PublicPhotoHandler
35
 */
36
class PublicPhotoHandler extends Extgallery\PhotoHandler
37
{
38
    /**
39
     * Extgallery\PublicPhotoHandler constructor.
40
     * @param \XoopsDatabase|null $db
41
     */
42
    public function __construct(XoopsDatabase $db = null)
43
    {
44
        parent::__construct($db, 'public');
0 ignored issues
show
It seems like $db can also be of type null; however, parameter $db of XoopsModules\Extgallery\...oHandler::__construct() does only seem to accept XoopsDatabase, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

44
        parent::__construct(/** @scrutinizer ignore-type */ $db, 'public');
Loading history...
45
    }
46
47
    /**
48
     * @param $photo
49
     */
50
    public function deleteFile(XoopsObject $photo = null)
51
    {
52
        if (\is_file(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/thumb/thumb_' . $photo->getVar('photo_name'))) {
0 ignored issues
show
The method getVar() does not exist on null. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

52
        if (\is_file(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/thumb/thumb_' . $photo->/** @scrutinizer ignore-call */ getVar('photo_name'))) {

This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces.

This is most likely a typographical error or the method has been renamed.

Loading history...
53
            \unlink(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/thumb/thumb_' . $photo->getVar('photo_name'));
54
        }
55
56
        if (\is_file(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/medium/' . $photo->getVar('photo_name'))) {
57
            \unlink(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/medium/' . $photo->getVar('photo_name'));
58
        }
59
60
        if (\is_file(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/large/large_' . $photo->getVar('photo_name'))) {
61
            \unlink(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/large/large_' . $photo->getVar('photo_name'));
62
        }
63
64
        if ('' != $photo->getVar('photo_orig_name')
65
            && \is_file(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/original/' . $photo->getVar('photo_orig_name'))) {
66
            \unlink(XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/original/' . $photo->getVar('photo_orig_name'));
67
        }
68
    }
69
70
    /**
71
     * @return array|int|string
72
     */
73
    public function getAllSize()
74
    {
75
        return $this->getSum(null, 'photo_size');
76
    }
77
78
    /**
79
     * @return string
80
     */
81
    public function getUploadPhotoPath()
82
    {
83
        return XOOPS_ROOT_PATH . '/uploads/extgallery/public-photo/';
84
    }
85
86
    /**
87
     * @param $userId
88
     * @param $start
89
     * @param $sortby
90
     * @param $orderby
91
     *
92
     * @return array
93
     */
94
    public function getUserAlbumPhotoPage($userId, $start, $sortby, $orderby)
95
    {
96
        $catHandler = Extgallery\Helper::getInstance()->getHandler('PublicCategory');
97
98
        $criteria = new CriteriaCompo();
99
        $criteria->add($catHandler->getCatRestrictCriteria());
0 ignored issues
show
It seems like $catHandler->getCatRestrictCriteria() can also be of type false; however, parameter $criteriaElement of CriteriaCompo::add() does only seem to accept CriteriaElement, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

99
        $criteria->add(/** @scrutinizer ignore-type */ $catHandler->getCatRestrictCriteria());
Loading history...
100
        $criteria->add(new Criteria('photo_approved', 1));
101
        $criteria->add(new Criteria('uid', $userId));
102
        $criteria->setSort($sortby);
103
        $criteria->setOrder($orderby);
104
        $criteria->setStart($start);
105
        $criteria->setLimit($GLOBALS['xoopsModuleConfig']['nb_column'] * $GLOBALS['xoopsModuleConfig']['nb_line']);
106
107
        return $this->getObjects($criteria);
108
    }
109
110
    /**
111
     * @param $userId
112
     * @param $photoDate
113
     *
114
     * @return array
115
     */
116
    public function getUserAlbumPrevPhoto($userId, $photoDate)
117
    {
118
        $catHandler = Extgallery\Helper::getInstance()->getHandler('PublicCategory');
119
120
        $criteria = new CriteriaCompo();
121
        $criteria->add($catHandler->getCatRestrictCriteria());
0 ignored issues
show
It seems like $catHandler->getCatRestrictCriteria() can also be of type false; however, parameter $criteriaElement of CriteriaCompo::add() does only seem to accept CriteriaElement, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

121
        $criteria->add(/** @scrutinizer ignore-type */ $catHandler->getCatRestrictCriteria());
Loading history...
122
        $criteria->add(new Criteria('photo_approved', 1));
123
        $criteria->add(new Criteria('uid', $userId));
124
        $criteria->add(new Criteria('photo_date', $photoDate, '>'));
125
        $criteria->setSort('photo_date');
126
        $criteria->setOrder('ASC');
127
        $criteria->setLimit(1);
128
129
        return $this->getObjects($criteria);
130
    }
131
132
    /**
133
     * @param $userId
134
     * @param $photoDate
135
     *
136
     * @return array
137
     */
138
    public function getUserAlbumNextPhoto($userId, $photoDate)
139
    {
140
        $catHandler = Extgallery\Helper::getInstance()->getHandler('PublicCategory');
141
142
        $criteria = new CriteriaCompo();
143
        $criteria->add($catHandler->getCatRestrictCriteria());
0 ignored issues
show
It seems like $catHandler->getCatRestrictCriteria() can also be of type false; however, parameter $criteriaElement of CriteriaCompo::add() does only seem to accept CriteriaElement, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

143
        $criteria->add(/** @scrutinizer ignore-type */ $catHandler->getCatRestrictCriteria());
Loading history...
144
        $criteria->add(new Criteria('photo_approved', 1));
145
        $criteria->add(new Criteria('uid', $userId));
146
        $criteria->add(new Criteria('photo_date', $photoDate, '<'));
147
        $criteria->setSort('photo_date');
148
        $criteria->setOrder('DESC');
149
        $criteria->setLimit(1);
150
151
        return $this->getObjects($criteria);
152
    }
153
154
    /**
155
     * @param $userId
156
     * @param $photoDate
157
     *
158
     * @return int
159
     */
160
    public function getUserAlbumCurrentPhotoPlace($userId, $photoDate)
161
    {
162
        $catHandler = Extgallery\Helper::getInstance()->getHandler('PublicCategory');
163
164
        $criteria = new CriteriaCompo();
165
        $criteria->add($catHandler->getCatRestrictCriteria());
0 ignored issues
show
It seems like $catHandler->getCatRestrictCriteria() can also be of type false; however, parameter $criteriaElement of CriteriaCompo::add() does only seem to accept CriteriaElement, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

165
        $criteria->add(/** @scrutinizer ignore-type */ $catHandler->getCatRestrictCriteria());
Loading history...
166
        $criteria->add(new Criteria('photo_approved', 1));
167
        $criteria->add(new Criteria('uid', $userId));
168
        $criteria->add(new Criteria('photo_date', $photoDate, '>='));
169
        $criteria->setSort('photo_date');
170
        $criteria->setOrder('ASC');
171
172
        return $this->getCount($criteria);
173
    }
174
175
    /**
176
     * @param $userId
177
     *
178
     * @return int
179
     */
180
    public function getUserAlbumCount($userId)
181
    {
182
        $catHandler = Extgallery\Helper::getInstance()->getHandler('PublicCategory');
183
184
        $criteria = new CriteriaCompo();
185
        $criteria->add($catHandler->getCatRestrictCriteria());
0 ignored issues
show
It seems like $catHandler->getCatRestrictCriteria() can also be of type false; however, parameter $criteriaElement of CriteriaCompo::add() does only seem to accept CriteriaElement, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

185
        $criteria->add(/** @scrutinizer ignore-type */ $catHandler->getCatRestrictCriteria());
Loading history...
186
        $criteria->add(new Criteria('photo_approved', 1));
187
        $criteria->add(new Criteria('uid', $userId));
188
189
        return $this->getCount($criteria);
190
    }
191
192
    /**
193
     * @param $userId
194
     *
195
     * @return array
196
     */
197
    public function getUserPhotoAlbumId($userId)
198
    {
199
        $ret    = [];
200
        $criteria = new CriteriaCompo();
201
        $criteria->add(new Criteria('uid', $userId));
202
        $criteria->add(new Criteria('photo_approved', 1));
203
204
        $sql = 'SELECT photo_id FROM ' . $this->db->prefix('extgallery_publicphoto') . ' ' . $criteria->renderWhere() . ' ORDER BY photo_date, photo_id DESC;';
205
206
        $result = $this->db->query($sql);
207
        if ($result instanceof \mysqli_result) {
208
            while (false !== ($myrow = $this->db->fetchArray($result))) {
209
                $ret[] = $myrow['photo_id'];
210
            }
211
        }
212
        return $ret;
213
    }
214
}
215