This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * admin/prefixes.php - manage wiki namespaces |
||
4 | * |
||
5 | * @copyright Copyright © 2013 geekwright, LLC. All rights reserved. |
||
6 | * @license gwiki/docs/license.txt GNU General Public License (GPL) |
||
7 | * @since 1.0 |
||
8 | * @author Richard Griffith <[email protected]> |
||
9 | * @package gwiki |
||
10 | */ |
||
11 | include __DIR__ . '/header.php'; |
||
12 | |||
13 | $moduleAdmin->displayNavigation(basename(__FILE__)); |
||
14 | |||
15 | // return groups and current permissions for a prefix as an array of options for a form select |
||
16 | /** |
||
17 | * @param $pid |
||
18 | * |
||
19 | * @return array |
||
20 | */ |
||
21 | function getPrefixGroups($pid) |
||
22 | { |
||
23 | global $xoopsDB; |
||
24 | |||
25 | $sql = 'SELECT groupid, name, prefix_id FROM ' . $xoopsDB->prefix('groups'); |
||
26 | $sql .= ' LEFT JOIN ' . $xoopsDB->prefix('gwiki_group_prefix') . ' on groupid = group_id '; |
||
27 | $sql .= " AND prefix_id = '{$pid}' "; |
||
28 | |||
29 | $result = $xoopsDB->query($sql); |
||
30 | |||
31 | $options = array(); |
||
32 | for ($i = 0, $iMax = $xoopsDB->getRowsNum($result); $i < $iMax; ++$i) { |
||
33 | $row = $xoopsDB->fetchArray($result); |
||
34 | $selected = ($row['prefix_id'] ? 'selected ' : ''); |
||
35 | $options[] = "<option {$selected}value=\"{$row['groupid']}\">{$row['name']}</option>"; |
||
36 | } |
||
37 | |||
38 | return $options; |
||
39 | } |
||
40 | |||
41 | /** |
||
42 | * @param $pid |
||
43 | * @param $groups |
||
44 | */ |
||
45 | function setPrefixGroups($pid, $groups) |
||
46 | { |
||
47 | global $xoopsDB; |
||
48 | |||
49 | $sql = 'DELETE FROM ' . $xoopsDB->prefix('gwiki_group_prefix'); |
||
50 | $sql .= " WHERE prefix_id = '{$pid}' "; |
||
51 | |||
52 | $result = $xoopsDB->query($sql); |
||
0 ignored issues
–
show
|
|||
53 | |||
54 | if (count($groups) > 0) { |
||
55 | $sql = 'INSERT INTO ' . $xoopsDB->prefix('gwiki_group_prefix') . ' (group_id, prefix_id) VALUES '; |
||
56 | $val = ''; |
||
57 | foreach ($groups as $group) { |
||
58 | if (!empty($val)) { |
||
59 | $val .= ', '; |
||
60 | } |
||
61 | $val .= "('$group', '$pid')"; |
||
62 | } |
||
63 | $sql .= $val; |
||
64 | $result = $xoopsDB->query($sql); |
||
0 ignored issues
–
show
$result is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
65 | } |
||
66 | } |
||
67 | |||
68 | function showPrefixes() |
||
69 | { |
||
70 | global $xoopsDB; |
||
71 | /* |
||
72 | gwiki_prefix |
||
73 | prefix_id int(10) NOT NULL auto_increment, |
||
74 | prefix varchar(255) NOT NULL default '', |
||
75 | prefix_home varchar(255) NOT NULL default '', |
||
76 | prefix_template_id int(10) NOT NULL default '0', |
||
77 | prefix_is_external tinyint(1) NOT NULL default '0', |
||
78 | prefix_external_url |
||
79 | */ |
||
80 | |||
81 | echo <<<EOT |
||
82 | <style> |
||
83 | div.pagination.default {display:inline;} |
||
84 | form {display:inline;} |
||
85 | </style> |
||
86 | EOT; |
||
87 | $total = 0; |
||
88 | $limit = 10; |
||
89 | $start = 0; |
||
90 | if (!empty($_GET['start'])) { |
||
91 | $start = (int)$_GET['start']; |
||
92 | } |
||
93 | |||
94 | $sql = 'SELECT count(*) FROM ' . $xoopsDB->prefix('gwiki_prefix'); |
||
95 | $result = $xoopsDB->query($sql); |
||
96 | if ($result) { |
||
97 | $myrow = $xoopsDB->fetchRow($result); |
||
98 | $total = $myrow[0]; |
||
99 | } |
||
100 | |||
101 | adminTableStart(_AD_GWIKI_NAMESPACE_LIST, 6); |
||
102 | echo '<tr class="head">' . '<th>' . _AD_GWIKI_NAMESPACE_PREFIX . '</th>' . '<th>' . _AD_GWIKI_NAMESPACE_HOME . '</th>' . '<th>' . _AD_GWIKI_NAMESPACE_AUTONAME_SHORT . '</th>' . '<th>' |
||
103 | . _AD_GWIKI_NAMESPACE_TEMPLATE . '</th>' . '<th>' . _AD_GWIKI_NAMESPACE_EXTERN_SHORT . '</th>' . '<th>' . _AD_GWIKI_NAMESPACE_EXTERN_URL . '</th>' . '</tr>'; |
||
104 | |||
105 | $sql = 'SELECT * FROM ' . $xoopsDB->prefix('gwiki_prefix'); |
||
106 | $sql .= ' LEFT JOIN ' . $xoopsDB->prefix('gwiki_template') . ' on prefix_template_id = template_id '; |
||
107 | $sql .= ' ORDER BY prefix '; |
||
108 | |||
109 | $result = $xoopsDB->query($sql, $limit, $start); |
||
110 | |||
111 | for ($i = 0, $iMax = $xoopsDB->getRowsNum($result); $i < $iMax; ++$i) { |
||
112 | $row = $xoopsDB->fetchArray($result); |
||
113 | |||
114 | View Code Duplication | if (empty($row['template'])) { |
|
115 | $template = '<a href="prefixes.php?pid=' . $row['prefix_id'] . '&op=newtemplate">' . _AD_GWIKI_TEMPLATE_ADD . '</a>'; |
||
116 | } else { |
||
117 | $template = '<a href="prefixes.php?pid=' . $row['prefix_id'] . '&op=edittemplate" title="' . _AD_GWIKI_TEMPLATE_EDIT . '">' . htmlspecialchars($row['template'], ENT_QUOTES) . '</a>'; |
||
118 | } |
||
119 | |||
120 | echo '<tr class="' . (($i % 2) ? 'even' : 'odd') . '"><td><a href="prefixes.php?pid=' . $row['prefix_id'] . '&op=edit">' . htmlspecialchars($row['prefix'], ENT_QUOTES) . '</a></td>' . '<td>' |
||
121 | . htmlspecialchars($row['prefix_home'], ENT_QUOTES) . '</td>' . '<td>' . ($row['prefix_auto_name'] ? _YES : _NO) . '</td>' . '<td>' . $template . '</td>' . '<td>' |
||
122 | . ($row['prefix_is_external'] ? _YES : _NO) . '</td>' . '<td>' . htmlspecialchars($row['prefix_external_url'], ENT_QUOTES) . '</td>' . '</tr>'; |
||
123 | } |
||
124 | if ($i === 0) { |
||
125 | echo '<tr class="odd"><td colspan="6">' . _AD_GWIKI_NAMESPACE_EMPTY . '</td></tr>'; |
||
126 | } |
||
127 | |||
128 | $endarray[_AD_GWIKI_NAMESPACE_NEW] = 'prefixes.php?op=new'; |
||
129 | |||
130 | // set up pagenav |
||
131 | $pager = ''; |
||
132 | if ($total > $limit) { |
||
133 | include_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||
134 | $nav = new xoopsPageNav($total, $limit, $start, 'start', ''); |
||
135 | View Code Duplication | if ((int)($total / $limit) < 5) { |
|
136 | $pager = $nav->renderNav(); |
||
137 | } else { |
||
138 | $pager = _AD_GWIKI_PAGENAV . $nav->renderSelect(false); |
||
139 | } |
||
140 | } |
||
141 | if (!empty($pager)) { |
||
142 | $endarray['!PREFORMATTED!'] = $pager; |
||
143 | } |
||
144 | |||
145 | adminTableEnd($endarray); |
||
146 | } |
||
147 | |||
148 | // Prefixes |
||
149 | /** |
||
150 | * @param $row |
||
151 | * @param $action |
||
152 | * |
||
153 | * @return string |
||
154 | */ |
||
155 | function prefixForm($row, $action) |
||
156 | { |
||
157 | if (empty($row)) { |
||
158 | return false; |
||
159 | } |
||
160 | $groups = getPrefixGroups($row['prefix_id']); |
||
161 | |||
162 | $form = '<form action="prefixes.php" method="POST">'; |
||
163 | $form .= '<input type="hidden" name="pid" value="' . $row['prefix_id'] . '">'; |
||
164 | $form .= '<input type="hidden" name="op" value="update">'; |
||
165 | |||
166 | View Code Duplication | if (empty($row['template'])) { |
|
167 | $template = '<a href="prefixes.php?pid=' . $row['prefix_id'] . '&op=newtemplate">' . _AD_GWIKI_TEMPLATE_ADD . '</a>'; |
||
168 | } else { |
||
169 | $template = '<a href="prefixes.php?pid=' . $row['prefix_id'] . '&op=edittemplate" title="' . _AD_GWIKI_TEMPLATE_EDIT . '">' . htmlspecialchars($row['template'], ENT_QUOTES) . '</a>'; |
||
170 | } |
||
171 | |||
172 | if ($action !== 'new') { |
||
173 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_PREFIX . '</td><td class="odd">' . $row['prefix'] . '</td></tr>'; |
||
174 | } else { |
||
175 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_PREFIX . '</td><td class="odd"><input name="prefix" type="text" size="25" value="' . htmlspecialchars($row['prefix'], ENT_QUOTES) |
||
176 | . '" ></td></tr>'; |
||
177 | } |
||
178 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_HOME . '</td><td class="odd"><input name="prefix_home" type="text" size="25" value="' . htmlspecialchars($row['prefix_home'], ENT_QUOTES) |
||
179 | . '" ></td></tr>'; |
||
180 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_AUTONAME . '</td><td class="odd"><input type="checkbox" name="prefix_auto_name"' . ($row['prefix_auto_name'] ? ' checked ' : '') |
||
181 | . 'value="auto"></td></tr>'; |
||
182 | if ($action !== 'new') { |
||
183 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_TEMPLATE . '</td><td class="odd">' . $template . '</td></tr>'; |
||
184 | } |
||
185 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_EXTERN . '</td><td class="odd"><input type="checkbox" name="prefix_is_external"' . ($row['prefix_is_external'] ? ' checked ' : '') |
||
186 | . 'value="external"></td></tr>'; |
||
187 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_EXTERN_URL . '</td><td class="odd"><input name="prefix_external_url" type="text" size="60" value="' |
||
188 | . htmlspecialchars($row['prefix_external_url'], ENT_QUOTES) . '" ></td></tr>'; |
||
189 | |||
190 | $form .= '<tr><td class="head">' . _AD_GWIKI_NAMESPACE_GROUPS . '</td><td class="odd"><select name="groups[]" multiple size="8">' . implode($groups, "\n") . '</select></td></tr>'; |
||
191 | $form .= '<tr><td class="head"> </td><td class="odd"><input type="submit" value="' . _AD_GWIKI_NAMESPACE_SUBMIT . '"></td></tr>'; |
||
192 | $form .= '</form>'; |
||
193 | |||
194 | return $form; |
||
195 | } |
||
196 | |||
197 | /** |
||
198 | * @param $pid |
||
199 | * |
||
200 | * @return mixed |
||
201 | */ |
||
202 | function getPrefix($pid) |
||
203 | { |
||
204 | global $xoopsDB; |
||
205 | |||
206 | $sql = 'SELECT * FROM ' . $xoopsDB->prefix('gwiki_prefix'); |
||
207 | $sql .= ' LEFT JOIN ' . $xoopsDB->prefix('gwiki_template') . ' on prefix_template_id = template_id '; |
||
208 | // $sql .= ' WHERE prefix_id = "'.$pid.'" '; |
||
209 | $sql .= " WHERE prefix_id = '{$pid}' "; |
||
210 | |||
211 | $result = $xoopsDB->query($sql); |
||
212 | |||
213 | $rows = $xoopsDB->getRowsNum($result); |
||
214 | if ($rows) { |
||
215 | $row = $xoopsDB->fetchArray($result); |
||
216 | } else { |
||
217 | $row['prefix_id'] = 0; |
||
218 | $row['prefix'] = ''; |
||
219 | $row['prefix_home'] = ''; |
||
220 | $row['prefix_auto_name'] = 0; |
||
221 | $row['prefix_template_id'] = 0; |
||
222 | $row['prefix_is_external'] = 0; |
||
223 | $row['prefix_external_url'] = ''; |
||
224 | |||
225 | $row['template_id'] = 0; |
||
226 | $row['template'] = ''; |
||
227 | $row['template_body'] = ''; |
||
228 | $row['template_notes'] = ''; |
||
229 | } |
||
230 | |||
231 | return $row; |
||
232 | } |
||
233 | |||
234 | function newPrefix() |
||
235 | { |
||
236 | $row = getPrefix(0); |
||
237 | |||
238 | adminTableStart(_AD_GWIKI_NAMESPACE_NEW, 2); |
||
239 | echo prefixForm($row, 'new'); |
||
240 | adminTableEnd(array(_BACK => 'prefixes.php')); |
||
241 | } |
||
242 | |||
243 | /** |
||
244 | * @param $pid |
||
245 | */ |
||
246 | function editPrefix($pid) |
||
247 | { |
||
248 | global $xoopsDB; |
||
249 | |||
250 | $row = getPrefix($pid); |
||
251 | |||
252 | if ($row['prefix_id']) { |
||
253 | adminTableStart(_AD_GWIKI_NAMESPACE_EDIT, 2); |
||
254 | echo prefixForm($row, 'edit'); |
||
255 | adminTableEnd(array(_AD_GWIKI_DELETE => "prefixes.php?pid={$pid}&op=delete", _BACK => 'prefixes.php')); |
||
256 | } else { |
||
257 | echo _AD_GWIKI_NAMESPACE_NOT_FOUND; |
||
258 | } |
||
259 | } |
||
260 | |||
261 | /** |
||
262 | * @param $pid |
||
263 | */ |
||
264 | View Code Duplication | function deletePrefix($pid) |
|
265 | { |
||
266 | global $xoopsDB; |
||
267 | |||
268 | $row = getPrefix($pid); |
||
269 | |||
270 | if ($row['template_id']) { |
||
271 | installTemplate($pid, true); |
||
272 | |||
273 | $sql = 'DELETE FROM ' . $xoopsDB->prefix('gwiki_template'); |
||
274 | $sql .= ' WHERE template_id = "' . $row['template_id'] . '" '; |
||
275 | $result = $xoopsDB->queryF($sql); |
||
0 ignored issues
–
show
$result is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
276 | } |
||
277 | |||
278 | $sql = 'DELETE FROM ' . $xoopsDB->prefix('gwiki_prefix'); |
||
279 | // $sql .= ' WHERE prefix_id = "'.$pid.'" '; |
||
280 | $sql .= " WHERE prefix_id = '{$pid}' "; |
||
281 | $result = $xoopsDB->queryF($sql); |
||
0 ignored issues
–
show
$result is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
282 | |||
283 | redirect_header('prefixes.php', 2, _MD_GWIKI_DBUPDATED); |
||
284 | } |
||
285 | |||
286 | /** |
||
287 | * @param $pid |
||
288 | */ |
||
289 | function updatePrefix($pid) |
||
290 | { |
||
291 | global $xoopsDB, $wikiPage; |
||
292 | |||
293 | $row = getPrefix($pid); |
||
294 | |||
295 | if (isset($_POST['prefix'])) { |
||
296 | $row['prefix'] = $_POST['prefix']; |
||
297 | } |
||
298 | if (isset($_POST['prefix_home'])) { |
||
299 | $row['prefix_home'] = $_POST['prefix_home']; |
||
300 | } |
||
301 | |||
302 | $row['prefix_auto_name'] = 0; |
||
303 | if (isset($_POST['prefix_auto_name']) && $_POST['prefix_auto_name'] === 'auto') { |
||
304 | $row['prefix_auto_name'] = 1; |
||
305 | } |
||
306 | |||
307 | $row['prefix_is_external'] = 0; |
||
308 | if (isset($_POST['prefix_is_external']) && $_POST['prefix_is_external'] === 'external') { |
||
309 | $row['prefix_is_external'] = 1; |
||
310 | } |
||
311 | |||
312 | if (isset($_POST['prefix_external_url'])) { |
||
313 | $row['prefix_external_url'] = $_POST['prefix_external_url']; |
||
314 | } |
||
315 | |||
316 | if ($row['prefix_id']) { |
||
317 | $sql = 'UPDATE ' . $xoopsDB->prefix('gwiki_prefix'); |
||
318 | $sql .= ' SET prefix_home = \'' . $wikiPage->escapeForDB($row['prefix_home']) . '\''; |
||
319 | $sql .= ' , prefix_auto_name = \'' . $wikiPage->escapeForDB($row['prefix_auto_name']) . '\''; |
||
320 | $sql .= ' , prefix_is_external = \'' . $wikiPage->escapeForDB($row['prefix_is_external']) . '\''; |
||
321 | $sql .= ' , prefix_external_url = \'' . $wikiPage->escapeForDB($row['prefix_external_url']) . '\''; |
||
322 | // $sql .= ' WHERE prefix_id = "'.$pid.'" '; |
||
323 | $sql .= " WHERE prefix_id = '{$pid}' "; |
||
324 | $result = $xoopsDB->queryF($sql); |
||
325 | } else { |
||
326 | $sql = 'INSERT INTO ' . $xoopsDB->prefix('gwiki_prefix'); |
||
327 | $sql .= ' (prefix, prefix_home, prefix_auto_name, prefix_template_id, prefix_is_external, prefix_external_url)'; |
||
328 | $sql .= ' VALUES (\'' . $wikiPage->escapeForDB($row['prefix']) . '\''; |
||
329 | $sql .= ' , \'' . $wikiPage->escapeForDB($row['prefix_home']) . '\''; |
||
330 | $sql .= ' , \'' . $wikiPage->escapeForDB($row['prefix_auto_name']) . '\''; |
||
331 | $sql .= ' , \'0\''; |
||
332 | $sql .= ' , \'' . $wikiPage->escapeForDB($row['prefix_is_external']) . '\''; |
||
333 | $sql .= ' , \'' . $wikiPage->escapeForDB($row['prefix_external_url']) . '\''; |
||
334 | $sql .= ' ) '; |
||
335 | $result = $xoopsDB->queryF($sql); |
||
336 | if ($result) { |
||
337 | $pid = $xoopsDB->getInsertId(); |
||
338 | } |
||
339 | } |
||
340 | |||
341 | //echo '<pre>'; print_r($_POST); echo '</pre>'; |
||
342 | //echo '<pre>'; print_r($row); echo '</pre>'; |
||
343 | //echo $sql; |
||
344 | |||
345 | if ($result) { |
||
346 | setPrefixGroups($pid, $row['prefix_is_external'] ? array() : $_POST['groups']); // permissions don't apply to externals |
||
347 | $message = _MD_GWIKI_DBUPDATED; |
||
348 | } else { |
||
349 | $message = _MD_GWIKI_ERRORINSERT; |
||
350 | } |
||
351 | redirect_header('prefixes.php', 2, $message); |
||
352 | } |
||
353 | |||
354 | // Templates |
||
355 | /** |
||
356 | * @param $pid |
||
357 | * @param bool $delete |
||
358 | * |
||
359 | * @return null |
||
360 | */ |
||
361 | function installTemplate($pid, $delete = false) |
||
362 | { |
||
363 | global $xoopsModule; |
||
364 | |||
365 | $template = getPrefix($pid); |
||
366 | if (!$template['template_id']) { |
||
367 | return false; |
||
368 | } |
||
369 | |||
370 | $tplfileHandler = xoops_getHandler('tplfile'); |
||
371 | |||
372 | $dir = basename(dirname(__DIR__)); |
||
373 | $mid = $xoopsModule->getVar('mid'); |
||
374 | $file = $dir . '_prefix_' . $pid . '.tpl'; |
||
375 | |||
376 | $tplfiles = $tplfileHandler->find('default', 'module', $mid, $dir, $file, false); |
||
377 | |||
378 | // if delete requested, delete it if we found it, and leave. |
||
379 | if ($delete && count($tplfiles)) { |
||
380 | $tplfile = $tplfiles[0]; |
||
381 | $tplfileHandler->delete($tplfile); |
||
382 | } |
||
383 | if ($delete) { |
||
384 | return null; |
||
385 | } |
||
386 | |||
387 | View Code Duplication | if (count($tplfiles)) { |
|
388 | $tplfile = $tplfiles[0]; |
||
389 | $isnew = false; |
||
390 | } else { |
||
391 | $tplfile = $tplfileHandler->create(); |
||
392 | $isnew = true; |
||
393 | } |
||
394 | |||
395 | $tplfile->setVar('tpl_source', $template['template_body'], true); |
||
396 | $tplfile->setVar('tpl_refid', $mid); |
||
397 | $tplfile->setVar('tpl_tplset', 'default'); |
||
398 | $tplfile->setVar('tpl_file', $file); |
||
399 | $tplfile->setVar('tpl_desc', $template['template'], true); |
||
400 | $tplfile->setVar('tpl_module', $dir); |
||
401 | $tplfile->setVar('tpl_lastmodified', time()); |
||
402 | $tplfile->setVar('tpl_lastimported', 0); |
||
403 | $tplfile->setVar('tpl_type', 'module'); |
||
404 | View Code Duplication | if ($isnew) { |
|
405 | if (!$tplfileHandler->insert($tplfile)) { |
||
406 | echo '<span style="color:#ff0000;">ERROR: Could not insert template <b>' . htmlspecialchars($file) . '</b> to the database.</span><br>'; |
||
407 | } else { |
||
408 | $tplid = $tplfile->getVar('tpl_id'); |
||
409 | echo 'Template <b>' . htmlspecialchars($file) . '</b> added to the database. (ID: <b>' . $tplid . '</b>)<br>'; |
||
410 | } |
||
411 | } |
||
412 | View Code Duplication | if (!$tplfileHandler->forceUpdate($tplfile)) { |
|
413 | echo '<span style="color:#ff0000;">ERROR: Could not update template <b>' . htmlspecialchars($file) . '</b> to the database.</span><br>'; |
||
414 | } else { |
||
415 | $tplid = $tplfile->getVar('tpl_id'); |
||
416 | echo 'Template <b>' . htmlspecialchars($file) . '</b> updated to the database. (ID: <b>' . $tplid . '</b>)<br>'; |
||
417 | } |
||
418 | |||
419 | return null; |
||
420 | } |
||
421 | |||
422 | /** |
||
423 | * @param $row |
||
424 | * @param $action |
||
425 | * |
||
426 | * @return string |
||
427 | */ |
||
428 | function templateForm($row, $action) |
||
0 ignored issues
–
show
|
|||
429 | { |
||
430 | if (empty($row)) { |
||
431 | return false; |
||
432 | } |
||
433 | |||
434 | $form = '<form action="prefixes.php" method="POST">'; |
||
435 | $form .= '<input type="hidden" name="pid" value="' . $row['prefix_id'] . '">'; |
||
436 | $form .= '<input type="hidden" name="op" value="updatetemplate">'; |
||
437 | $form .= '<tr><td class="head" width="10%">' . _AD_GWIKI_TEMPLATE_NAME . '</td><td class="odd"><input name="template" type="text" size="25" value="' . htmlspecialchars($row['template'], |
||
438 | ENT_QUOTES) |
||
439 | . '" ></td></tr>'; |
||
440 | $form .= '<tr><td class="head">' . _AD_GWIKI_TEMPLATE_BODY . '</td><td class="odd"><textarea name="template_body" rows="20" cols="80">' . htmlspecialchars($row['template_body'], ENT_QUOTES) |
||
441 | . '</textarea></td></tr>'; |
||
442 | $form .= '<tr><td class="head">' . _AD_GWIKI_TEMPLATE_NOTES . '</td><td class="odd"><textarea name="template_notes" rows="2" cols="80">' . htmlspecialchars($row['template_notes'], ENT_QUOTES) |
||
443 | . '</textarea></td></tr>'; |
||
444 | $form .= '<tr><td class="head"> </td><td class="odd"><input type="submit" value="' . _AD_GWIKI_NAMESPACE_SUBMIT . '"></td></tr>'; |
||
445 | $form .= '</form>'; |
||
446 | |||
447 | return $form; |
||
448 | } |
||
449 | |||
450 | /** |
||
451 | * @param $pid |
||
452 | */ |
||
453 | function newTemplate($pid) |
||
454 | { |
||
455 | $row = getPrefix($pid); |
||
456 | |||
457 | adminTableStart(_AD_GWIKI_TEMPLATE_NEW, 2); |
||
458 | |||
459 | $row['template'] = $row['prefix'] . ' ' . _AD_GWIKI_NAMESPACE_PREFIX; |
||
460 | $row['template_body'] = file_get_contents('../templates/gwiki_view.tpl'); |
||
461 | |||
462 | echo templateForm($row, 'new'); |
||
463 | adminTableEnd(array(_BACK => 'prefixes.php?pid=' . $pid . '&op=edit')); |
||
464 | } |
||
465 | |||
466 | /** |
||
467 | * @param $pid |
||
468 | */ |
||
469 | function editTemplate($pid) |
||
470 | { |
||
471 | $row = getPrefix($pid); |
||
472 | |||
473 | adminTableStart(_AD_GWIKI_TEMPLATE_EDIT, 2); |
||
474 | echo templateForm($row, 'edit'); |
||
475 | adminTableEnd(array( |
||
476 | _AD_GWIKI_DELETE => "prefixes.php?pid={$pid}&op=deletetemplate", |
||
477 | _BACK => 'prefixes.php?pid=' . $pid . '&op=edit' |
||
478 | )); |
||
479 | } |
||
480 | |||
481 | /** |
||
482 | * @param $pid |
||
483 | */ |
||
484 | View Code Duplication | function deleteTemplate($pid) |
|
485 | { |
||
486 | global $xoopsDB; |
||
487 | |||
488 | $row = getPrefix($pid); |
||
489 | |||
490 | if ($row['template_id']) { |
||
491 | installTemplate($pid, true); |
||
492 | |||
493 | $sql = 'UPDATE ' . $xoopsDB->prefix('gwiki_prefix'); |
||
494 | $sql .= ' SET prefix_template_id = \'0\''; |
||
495 | // $sql .= ' WHERE prefix_id = "'.$pid.'" '; |
||
496 | $sql .= " WHERE prefix_id = '{$pid}' "; |
||
497 | $result = $xoopsDB->queryF($sql); |
||
0 ignored issues
–
show
$result is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
498 | |||
499 | $sql = 'DELETE FROM ' . $xoopsDB->prefix('gwiki_template'); |
||
500 | $sql .= ' WHERE template_id = "' . $row['template_id'] . '" '; |
||
501 | $result = $xoopsDB->queryF($sql); |
||
0 ignored issues
–
show
$result is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
502 | } |
||
503 | redirect_header('prefixes.php', 2, _MD_GWIKI_DBUPDATED); |
||
504 | } |
||
505 | |||
506 | /** |
||
507 | * @param $pid |
||
508 | */ |
||
509 | function updateTemplate($pid) |
||
510 | { |
||
511 | global $xoopsDB, $wikiPage; |
||
512 | |||
513 | $row = getPrefix($pid); |
||
514 | |||
515 | if (isset($_POST['template'])) { |
||
516 | $row['template'] = $_POST['template']; |
||
517 | } |
||
518 | if (isset($_POST['template_body'])) { |
||
519 | $row['template_body'] = $_POST['template_body']; |
||
520 | } |
||
521 | if (isset($_POST['template_notes'])) { |
||
522 | $row['template_notes'] = $_POST['template_notes']; |
||
523 | } |
||
524 | |||
525 | if ($row['template_id']) { |
||
526 | $sql = 'UPDATE ' . $xoopsDB->prefix('gwiki_template'); |
||
527 | $sql .= ' SET template = \'' . $wikiPage->escapeForDB($row['template']) . '\''; |
||
528 | $sql .= ' , template_body = \'' . $wikiPage->escapeForDB($row['template_body']) . '\''; |
||
529 | $sql .= ' , template_notes = \'' . $wikiPage->escapeForDB($row['template_notes']) . '\''; |
||
530 | $sql .= ' WHERE template_id = "' . $row['template_id'] . '" '; |
||
531 | $result = $xoopsDB->queryF($sql); |
||
532 | } else { |
||
533 | $sql = 'INSERT INTO ' . $xoopsDB->prefix('gwiki_template'); |
||
534 | $sql .= ' (template, template_body, template_notes)'; |
||
535 | $sql .= ' VALUES (\'' . $wikiPage->escapeForDB($row['template']) . '\''; |
||
536 | $sql .= ' , \'' . $wikiPage->escapeForDB($row['template_body']) . '\''; |
||
537 | $sql .= ' , \'' . $wikiPage->escapeForDB($row['template_notes']) . '\''; |
||
538 | $sql .= ' ) '; |
||
539 | $result = $xoopsDB->queryF($sql); |
||
540 | if ($result) { |
||
541 | $row['template_id'] = $xoopsDB->getInsertId(); |
||
542 | } |
||
543 | |||
544 | $sql = 'UPDATE ' . $xoopsDB->prefix('gwiki_prefix'); |
||
545 | $sql .= ' SET prefix_template_id = \'' . $row['template_id'] . '\''; |
||
546 | // $sql .= ' WHERE prefix_id = "'.$pid.'" '; |
||
547 | $sql .= " WHERE prefix_id = '{$pid}' "; |
||
548 | $result = $xoopsDB->queryF($sql); |
||
549 | } |
||
550 | |||
551 | if ($result) { |
||
552 | installTemplate($pid); |
||
553 | $message = _MD_GWIKI_DBUPDATED; |
||
554 | } else { |
||
555 | $message = _MD_GWIKI_ERRORINSERT; |
||
556 | } |
||
557 | redirect_header('prefixes.php', 2, $message); |
||
558 | } |
||
559 | |||
560 | // utility |
||
561 | /** |
||
562 | * @param $action |
||
563 | * @param int $pid |
||
564 | */ |
||
565 | function confirmAction($action, $pid = 0) |
||
566 | { |
||
567 | if ($pid) { |
||
568 | $row = getPrefix($pid); |
||
569 | } |
||
570 | adminTableStart(_AD_GWIKI_CONFIRM, 1); |
||
571 | echo '<tr><td width="100%" >'; |
||
572 | echo '<div class="confirmMsg">'; |
||
573 | echo '<form method="post" action="prefixes.php">'; |
||
574 | |||
575 | switch ($action) { |
||
576 | case 'delete': |
||
577 | echo '<input type="hidden" name="pid" value="' . $pid . '" />'; |
||
578 | echo '<input type="hidden" id="op" name="op" value="deleteit" />'; |
||
579 | $confMsg = sprintf(_AD_GWIKI_NAMESPACE_CONFIRM_DEL, $row['prefix']); |
||
580 | break; |
||
581 | case 'deletetemplate': |
||
582 | echo '<input type="hidden" name="pid" value="' . $pid . '" />'; |
||
583 | echo '<input type="hidden" id="op" name="op" value="deleteittemplate" />'; |
||
584 | $confMsg = sprintf(_AD_GWIKI_TEMPLATE_CONFIRM_DEL, $row['template']); |
||
585 | break; |
||
586 | } |
||
587 | |||
588 | echo '<p align="center">' . $confMsg . '<br><br> |
||
589 | <input type="submit" value="' . _YES . '"> |
||
590 | <input type="button" onclick="history.back();" value="' . _NO . '"></p></form></div>'; |
||
591 | echo '</td></tr>'; |
||
592 | adminTableEnd(array(_BACK => 'prefixes.php')); |
||
593 | } |
||
594 | |||
595 | /** |
||
596 | * @param $string |
||
597 | * @param bool $trim |
||
598 | * |
||
599 | * @return string |
||
600 | */ |
||
601 | View Code Duplication | function cleaner($string, $trim = true) |
|
602 | { |
||
603 | // $string=stripcslashes($string); |
||
604 | $string = html_entity_decode($string); |
||
605 | $string = strip_tags($string); |
||
606 | if ($trim) { |
||
607 | $string = trim($string); |
||
608 | } |
||
609 | $string = stripslashes($string); |
||
610 | |||
611 | return $string; |
||
612 | } |
||
613 | |||
614 | /** |
||
615 | * @param $op |
||
616 | * @param $pid |
||
617 | */ |
||
618 | function tobedone($op, $pid) |
||
619 | { |
||
620 | echo 'Not yet implemented: ' . $op . ' pid=' . $pid . '<br>'; |
||
621 | } |
||
622 | |||
623 | $pid = 0; |
||
624 | $op = ''; |
||
625 | // get variables |
||
626 | if (!empty($_GET['pid'])) { |
||
627 | $pid = (int)$_GET['pid']; |
||
628 | } |
||
629 | if (!empty($_GET['op'])) { |
||
630 | $op = cleaner($_GET['op']); |
||
631 | } |
||
632 | // override get with post |
||
633 | if (!empty($_POST['pid'])) { |
||
634 | $pid = (int)$_POST['pid']; |
||
635 | } |
||
636 | if (!empty($_POST['op'])) { |
||
637 | $op = cleaner($_POST['op']); |
||
638 | } |
||
639 | |||
640 | switch ($op) { |
||
641 | case 'edit': |
||
642 | editPrefix($pid); |
||
643 | break; |
||
644 | case 'new': |
||
645 | newPrefix(); |
||
646 | break; |
||
647 | case 'delete': |
||
648 | confirmAction($op, $pid); |
||
649 | break; |
||
650 | case 'deleteit': |
||
651 | deletePrefix($pid); |
||
652 | break; |
||
653 | case 'update': |
||
654 | updatePrefix($pid); |
||
655 | break; |
||
656 | case 'newtemplate': |
||
657 | newTemplate($pid); |
||
658 | break; |
||
659 | case 'edittemplate': |
||
660 | editTemplate($pid); |
||
661 | break; |
||
662 | case 'deletetemplate': |
||
663 | confirmAction($op, $pid); |
||
664 | break; |
||
665 | case 'deleteittemplate': |
||
666 | deleteTemplate($pid); |
||
667 | break; |
||
668 | case 'updatetemplate': |
||
669 | updateTemplate($pid); |
||
670 | break; |
||
671 | default: |
||
672 | showPrefixes(); |
||
673 | break; |
||
674 | } |
||
675 | |||
676 | include __DIR__ . '/footer.php'; |
||
677 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.