This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | use Xmf\Request; |
||
4 | |||
5 | /** |
||
6 | * admin/attachments.php - file attachment review tool |
||
7 | * |
||
8 | * @copyright Copyright © 2013 geekwright, LLC. All rights reserved. |
||
9 | * @license gwiki/docs/license.txt GNU General Public License (GPL) |
||
10 | * @since 1.0 |
||
11 | * @author Richard Griffith <[email protected]> |
||
12 | * @package gwiki |
||
13 | */ |
||
14 | include __DIR__ . '/header.php'; |
||
15 | //include_once dirname(__DIR__) . '/include/functions.php'; |
||
16 | |||
17 | $moduleAdmin->displayNavigation(basename(__FILE__)); |
||
18 | |||
19 | function showAttachments() |
||
20 | { |
||
21 | global $xoopsDB, $wikiPage; |
||
22 | $dir = basename(dirname(__DIR__)); |
||
23 | /* |
||
24 | gwiki_page_files |
||
25 | file_id int(10) NOT NULL AUTO_INCREMENT, |
||
26 | keyword varchar(128) NOT NULL DEFAULT '', |
||
27 | file_name varchar(128) NOT NULL DEFAULT '', |
||
28 | file_path varchar(255) NOT NULL DEFAULT '', |
||
29 | file_type varchar(128) NOT NULL DEFAULT '', |
||
30 | file_icon varchar(64) NOT NULL DEFAULT '', |
||
31 | file_size int(10) NOT NULL DEFAULT '0', |
||
32 | file_upload_date int(10) NOT NULL DEFAULT '0', |
||
33 | file_description text, |
||
34 | file_uid int(10) NOT NULL DEFAULT '0', |
||
35 | */ |
||
36 | $kw = Request::getString('kw', '', 'get'); |
||
37 | $fn = Request::getString('fn', '', 'get');; |
||
38 | $ty = Request::getString('ty', '', 'get');; |
||
39 | $ds = Request::getString('ds', '', 'get');; |
||
40 | |||
41 | $q_kw = '%' . $wikiPage->escapeForDB($kw) . '%'; |
||
42 | $q_fn = '%' . $wikiPage->escapeForDB($fn) . '%'; |
||
43 | $q_ty = '%' . $wikiPage->escapeForDB($ty) . '%'; |
||
44 | $q_ds = '%' . $wikiPage->escapeForDB($ds) . '%'; |
||
45 | |||
46 | $likeclause = ''; |
||
47 | if (!empty($kw)) { |
||
48 | $likeclause .= (empty($likeclause) ? '' : ' and ') . " keyword like '{$q_kw}' "; |
||
49 | } |
||
50 | if (!empty($fn)) { |
||
51 | $likeclause .= (empty($likeclause) ? '' : ' and ') . " file_name like '{$q_fn}' "; |
||
52 | } |
||
53 | if (!empty($ty)) { |
||
54 | $likeclause .= (empty($likeclause) ? '' : ' and ') . " file_type like '{$q_ty}' "; |
||
55 | } |
||
56 | if (!empty($ds)) { |
||
57 | $likeclause .= (empty($likeclause) ? '' : ' and ') . " file_description like '{$q_ds}' "; |
||
58 | } |
||
59 | //$whereclause=(empty($likeclause)?'':' where '.$likeclause); |
||
60 | $whereclause = (empty($likeclause) ? '' : " where {$likeclause}"); |
||
61 | |||
62 | echo <<<EOT |
||
63 | <style> |
||
64 | div.pagination.default {display:inline;} |
||
65 | form {display:inline;} |
||
66 | </style> |
||
67 | EOT; |
||
68 | $total = 0; |
||
69 | $limit = 10; |
||
70 | $start = 0; |
||
71 | if (!empty($_GET['start'])) { |
||
72 | $start = (int)$_GET['start']; |
||
73 | } |
||
74 | |||
75 | $sql = 'SELECT count(*) FROM ' . $xoopsDB->prefix('gwiki_page_files') . $whereclause; |
||
76 | $result = $xoopsDB->query($sql); |
||
77 | if ($result) { |
||
78 | $myrow = $xoopsDB->fetchRow($result); |
||
79 | $total = $myrow[0]; |
||
80 | } |
||
81 | |||
82 | adminTableStart(_AD_GWIKI_FILES_LIST, 9); |
||
83 | echo '<tr><form method="get">' . '<td><input type="text" name="kw" size="10" value="' . $kw . '"></td>' . '<td><input type="text" name="fn" size="10" value="' . $fn . '"></td>' . '<td> </td>' |
||
84 | . '<td><input type="text" name="ty" size="10" value="' . $ty . '"></td>' . '<td> </td>' . '<td> </td>' . '<td> </td>' . '<td><input type="text" name="ds" size="10" value="' |
||
85 | . $ds . '"></td>' . '<td><input type="submit" value="' . _AD_GWIKI_FILES_FILTER . '"></td>' . '</form></tr>'; |
||
86 | echo '<tr class="head">' . '<th>' . _AD_GWIKI_FILES_KEYWORD . '</th>' . '<th>' . _AD_GWIKI_FILES_NAME . '</th>' . '<th>' . _AD_GWIKI_FILES_PATH . '</th>' . '<th>' . _AD_GWIKI_FILES_TYPE . '</th>' |
||
87 | . '<th>' . _AD_GWIKI_FILES_ICON . '</th>' . '<th>' . _AD_GWIKI_FILES_SIZE . '</th>' . '<th>' . _AD_GWIKI_FILES_DATE . '</th>' . '<th>' . _AD_GWIKI_FILES_DESC . '</th>' . '<th>' |
||
88 | . _AD_GWIKI_FILES_UID . '</th>' . '</tr>'; |
||
89 | |||
90 | $sql = 'SELECT * FROM ' . $xoopsDB->prefix('gwiki_page_files'); |
||
91 | $sql .= $whereclause; |
||
92 | $sql .= ' ORDER BY file_upload_date DESC '; |
||
93 | |||
94 | $result = $xoopsDB->query($sql, $limit, $start); |
||
95 | |||
96 | for ($i = 0, $iMax = $xoopsDB->getRowsNum($result); $i < $iMax; ++$i) { |
||
97 | $row = $xoopsDB->fetchArray($result); |
||
98 | /* |
||
99 | gwiki_page_files |
||
100 | file_id int(10) NOT NULL AUTO_INCREMENT, |
||
101 | keyword varchar(128) NOT NULL DEFAULT '', |
||
102 | file_name varchar(128) NOT NULL DEFAULT '', |
||
103 | file_path varchar(255) NOT NULL DEFAULT '', |
||
104 | file_type varchar(128) NOT NULL DEFAULT '', |
||
105 | file_icon varchar(64) NOT NULL DEFAULT '', |
||
106 | file_size int(10) NOT NULL DEFAULT '0', |
||
107 | file_upload_date int(10) NOT NULL DEFAULT '0', |
||
108 | file_description text, |
||
109 | file_uid int(10) NOT NULL DEFAULT '0', |
||
110 | */ |
||
111 | echo '<tr class="' . (($i % 2) ? 'even' : 'odd') . '"><td><a href="../edit.php?page=' . $row['keyword'] . '">' . htmlspecialchars($row['keyword'], ENT_QUOTES) . '</a></td>' . '<td>' |
||
112 | . htmlspecialchars($row['file_name'], ENT_QUOTES) . '</td>' . '<td><a href="' . XOOPS_URL . '/uploads/' . $dir . '/' . $row['file_path'] . '">' . htmlspecialchars($row['file_path'], |
||
113 | ENT_QUOTES) |
||
114 | . '</a></td>' . '<td>' . htmlspecialchars($row['file_type'], ENT_QUOTES) . '</td>' . '<td><img src="' . XOOPS_URL . '/modules/' . $dir . '/assets/icons/16px/' . $row['file_icon'] |
||
115 | . '.png" alt="' . $row['file_icon'] . '" title="' . $row['file_icon'] . '" /></td>' . '<td>' . htmlspecialchars($row['file_size'], ENT_QUOTES) . '</td>' . '<td>' . date('Y-m-d', |
||
116 | $row['file_upload_date']) |
||
117 | . '</td>' . '<td>' . htmlspecialchars($row['file_description'], ENT_QUOTES) . '</td>' . '<td>' . $wikiPage->getUserName($row['file_uid']) . '</td>' . '</tr>'; |
||
118 | } |
||
119 | if ($i === 0) { |
||
120 | echo '<tr class="odd"><td colspan="9">' . _AD_GWIKI_FILES_EMPTY . '</td></tr>'; |
||
121 | } |
||
122 | |||
123 | // set up pagenav |
||
124 | $endarray = array(); |
||
125 | $pager = ''; |
||
126 | if ($total > $limit) { |
||
127 | include_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||
128 | $likenav = ''; |
||
129 | if (!empty($kw)) { |
||
130 | $likenav .= (empty($likenav) ? '' : '&') . "kw={$kw}"; |
||
131 | } |
||
132 | if (!empty($fn)) { |
||
133 | $likenav .= (empty($likenav) ? '' : '&') . "fn={$fn}"; |
||
134 | } |
||
135 | if (!empty($ty)) { |
||
136 | $likenav .= (empty($likenav) ? '' : '&') . "ty={$ty}"; |
||
137 | } |
||
138 | if (!empty($ds)) { |
||
139 | $likenav .= (empty($likenav) ? '' : '&') . "ds={$ds}"; |
||
140 | } |
||
141 | $nav = new xoopsPageNav($total, $limit, $start, 'start', $likenav); |
||
142 | View Code Duplication | if ((int)($total / $limit) < 5) { |
|
0 ignored issues
–
show
|
|||
143 | $pager = $nav->renderNav(); |
||
144 | } else { |
||
145 | $pager = _AD_GWIKI_PAGENAV . $nav->renderSelect(false); |
||
146 | } |
||
147 | } |
||
148 | if (!empty($pager)) { |
||
149 | $endarray['!PREFORMATTED!'] = $pager; |
||
150 | } |
||
151 | |||
152 | adminTableEnd($endarray); |
||
153 | } |
||
154 | |||
155 | showAttachments(); |
||
156 | |||
157 | include __DIR__ . '/footer.php'; |
||
158 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.