This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | use Xmf\Request; |
||
4 | |||
5 | /* |
||
6 | * getthumb |
||
7 | * |
||
8 | * @copyright Geekwright, LLC http://geekwright.com |
||
9 | * @license GNU General Public License (GPL) |
||
10 | * @since 1.0 |
||
11 | * @author Richard Griffith [email protected] |
||
12 | * @package gwiki |
||
13 | * |
||
14 | * Manage thumbnail cache. Expects gwiki_page_images keyword as page and |
||
15 | * image_name as name, also optional maximal pixel dimension as size. |
||
16 | * |
||
17 | * Thumbnails are generated for requested size on use, and then served |
||
18 | * from cache until source image is changed. |
||
19 | * |
||
20 | * Images which are smaller than requested size, or of an unsupported |
||
21 | * format (currently only jpeg, png and gif are supported,) are served |
||
22 | * as original source. |
||
23 | * |
||
24 | */ |
||
25 | |||
26 | include __DIR__ . '/../../mainfile.php'; |
||
27 | $xoopsLogger->activated = false; |
||
28 | // provide error logging for our sanity in debugging (won't see xoops logger) |
||
29 | restore_error_handler(); |
||
30 | error_reporting(-1); |
||
31 | |||
32 | //$GLOBALS['xoopsOption']['template_main'] = 'gwiki_view.tpl'; |
||
33 | //include XOOPS_ROOT_PATH."/header.php"; |
||
34 | |||
35 | $dir = basename(__DIR__); |
||
36 | include_once XOOPS_ROOT_PATH . '/modules/' . $dir . '/class/GwikiPage.php'; |
||
37 | $wikiPage = new GwikiPage; |
||
38 | |||
39 | $default_thumb_size = $wikiPage->defaultThumbSize; |
||
40 | |||
41 | global $xoopsDB; |
||
42 | |||
43 | /** |
||
44 | * @param $msg |
||
45 | */ |
||
46 | function errorExit($msg) |
||
47 | { |
||
48 | header('Status: 500 Internal Error - ' . $msg); |
||
49 | echo $msg; |
||
50 | exit; |
||
51 | } |
||
52 | |||
53 | /** |
||
54 | * @param $string |
||
55 | * |
||
56 | * @return string |
||
57 | */ |
||
58 | View Code Duplication | function cleaner($string) |
|
0 ignored issues
–
show
|
|||
59 | { |
||
60 | $string = stripcslashes($string); |
||
61 | $string = html_entity_decode($string); |
||
62 | $string = strip_tags($string); // DANGER -- kills wiki text |
||
63 | $string = trim($string); |
||
64 | $string = stripslashes($string); |
||
65 | |||
66 | return $string; |
||
67 | } |
||
68 | |||
69 | /** |
||
70 | * @param $name |
||
71 | * @param $mime |
||
72 | * @param $modtime |
||
73 | * @param bool $nocache |
||
74 | */ |
||
75 | function serveFile($name, $mime, $modtime, $nocache = false) |
||
76 | { |
||
77 | if (!$nocache && (getenv('HTTP_IF_MODIFIED_SINCE') === gmdate('D, d M Y H:i:s', $modtime) . ' GMT')) { |
||
78 | header('HTTP/1.0 304 Not Modified'); |
||
79 | exit; |
||
80 | } |
||
81 | |||
82 | $fp = fopen($name, 'rb'); |
||
83 | |||
84 | header('Content-Type: ' . $mime); |
||
85 | header('Content-Disposition: inline; filename=' . urlencode(basename($name))); |
||
86 | header('Content-Length: ' . filesize($name)); |
||
87 | |||
88 | $seconds_to_cache = 3600; |
||
89 | $ts = gmdate('D, d M Y H:i:s', time() + $seconds_to_cache) . ' GMT'; |
||
90 | header("Expires: $ts"); |
||
91 | header('Pragma: cache'); |
||
92 | header("Cache-Control: max-age=$seconds_to_cache"); |
||
93 | header('last-modified: ' . gmdate('D, d M Y H:i:s', $modtime) . ' GMT'); |
||
94 | |||
95 | fpassthru($fp); |
||
96 | fclose($fp); |
||
97 | exit; |
||
98 | } |
||
99 | |||
100 | unset($page, $name, $size); |
||
101 | $page = Request::getString('page', '', 'get'); |
||
102 | $name = Request::getString('name', '', 'get'); |
||
103 | $size = Request::getInt('size', $default_thumb_size, 'get'); |
||
104 | |||
105 | if (empty($page) || empty($name)) { |
||
106 | errorExit('parameter missing'); |
||
107 | } |
||
108 | if (empty($size) || $size === 0) { |
||
109 | $size = $default_thumb_size; |
||
110 | } |
||
111 | |||
112 | $strategy = 0; |
||
113 | $strategy_no_thumb = 1; // no thumb possible or needed - pass original image |
||
114 | $strategy_old_thumb = 2; // send existing thumbnail image |
||
115 | $strategy_new_thumb = 3; // generate and pass new thumbnail |
||
116 | |||
117 | $image = $wikiPage->getPageImage($page, $name); |
||
118 | if (!$image) { |
||
119 | errorExit('invalid parameters'); |
||
120 | } |
||
121 | |||
122 | $file = $image['image_file']; |
||
123 | $i = strrpos($file, '/'); |
||
124 | if ($i === false) { |
||
125 | errorExit('malformed path'); |
||
126 | } |
||
127 | $file_pre = substr($file, 0, $i); |
||
128 | $file_post = substr($file, $i); |
||
129 | |||
130 | $filename = XOOPS_ROOT_PATH . '/uploads/' . $dir . '/' . $file; |
||
131 | $thumbpath = XOOPS_ROOT_PATH . '/uploads/' . $dir . '/' . $file_pre . '/' . $size; |
||
132 | $thumbname = $thumbpath . $file_post; |
||
133 | //echo $filename.'<br>'.$thumbpath.'<br>'.$thumbname; |
||
134 | |||
135 | $modtime = filemtime($filename); |
||
136 | |||
137 | if (file_exists($thumbname) && (filemtime($thumbname) > $modtime)) { |
||
138 | $strategy = $strategy_old_thumb; |
||
139 | $info = getimagesize($thumbname); |
||
140 | $img_width = $info[0]; |
||
141 | $img_height = $info[1]; |
||
142 | $img_mime = $info['mime']; |
||
143 | } else { // (!file_exists($thumbname) || (file_exists($thumbname) && (filemtime($filename) > filemtime($thumbname)))) |
||
144 | $info = getimagesize($filename); |
||
145 | $img_width = $info[0]; |
||
146 | $img_height = $info[1]; |
||
147 | $img_mime = $info['mime']; |
||
148 | |||
149 | if (($size >= $img_width) && ($size >= $img_height)) { |
||
150 | $thumb_width = $img_width; |
||
151 | $thumb_height = $img_height; |
||
152 | $strategy = $strategy_no_thumb; |
||
153 | } else { |
||
154 | $ratio = max($img_width, $img_height) / $size; |
||
155 | $thumb_width = ceil($img_width / $ratio); |
||
156 | $thumb_height = ceil($img_height / $ratio); |
||
157 | $strategy = $strategy_new_thumb; |
||
158 | } |
||
159 | |||
160 | switch ($info[2]) { |
||
161 | case IMAGETYPE_JPEG: |
||
162 | $img_type = 'jpg'; |
||
163 | break; |
||
164 | case IMAGETYPE_PNG: |
||
165 | $img_type = 'png'; |
||
166 | break; |
||
167 | case IMAGETYPE_GIF: |
||
168 | $img_type = 'gif'; |
||
169 | break; |
||
170 | default: |
||
171 | $img_type = 'unsupported'; |
||
172 | $strategy = $strategy_no_thumb; |
||
173 | break; |
||
174 | } |
||
175 | /* |
||
176 | echo '<br>Image Width: '.$img_width; |
||
177 | echo '<br>Image Height: '.$img_height; |
||
178 | echo '<br>Type: '.$info[2].' '.$img_type.' '.$img_mime; |
||
179 | |||
180 | echo '<br>Thumb Width: '.$thumb_width; |
||
181 | echo '<br>Thumb Height: '.$thumb_height; |
||
182 | */ |
||
183 | } |
||
184 | |||
185 | switch ($strategy) { |
||
186 | case $strategy_new_thumb: |
||
187 | $oldUmask = umask(0); |
||
188 | @mkdir($thumbpath, 0755, true); |
||
189 | umask($oldUmask); |
||
190 | $data = file_get_contents($filename); |
||
191 | $im = imagecreatefromstring($data); |
||
192 | unset($data); |
||
193 | $ti = imagecreatetruecolor($thumb_width, $thumb_height); |
||
194 | imagealphablending($ti, false); |
||
195 | imagesavealpha($ti, true); |
||
196 | imagecopyresampled($ti, $im, 0, 0, 0, 0, $thumb_width, $thumb_height, $img_width, $img_height); |
||
197 | imagedestroy($im); |
||
198 | if ($img_type === 'jpg') { |
||
199 | imagejpeg($ti, $thumbname, 80); |
||
200 | } |
||
201 | if ($img_type === 'png') { |
||
202 | imagepng($ti, $thumbname); |
||
203 | } |
||
204 | if ($img_type === 'git') { |
||
205 | imagegif($ti, $thumbname); |
||
206 | } |
||
207 | imagedestroy($ti); |
||
208 | serveFile($thumbname, $img_mime, $modtime, true); |
||
209 | break; |
||
210 | case $strategy_old_thumb: |
||
211 | serveFile($thumbname, $img_mime, $modtime); |
||
212 | break; |
||
213 | default: |
||
214 | serveFile($filename, $img_mime, $modtime); |
||
215 | break; |
||
216 | } |
||
217 | |||
218 | errorExit('unknown condition'); |
||
219 | //include XOOPS_ROOT_PATH."/footer.php"; |
||
220 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.