mambax7 /
gwiki
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | use Xmf\Request; |
||
| 4 | |||
| 5 | /** |
||
| 6 | * sortpageset.php - change order of pages within a page set |
||
| 7 | * |
||
| 8 | * @copyright Copyright © 2013 geekwright, LLC. All rights reserved. |
||
| 9 | * @license gwiki/docs/license.txt GNU General Public License (GPL) |
||
| 10 | * @since 1.0 |
||
| 11 | * @author Richard Griffith <[email protected]> |
||
| 12 | * @package gwiki |
||
| 13 | */ |
||
| 14 | include __DIR__ . '/header.php'; |
||
| 15 | global $xoTheme, $xoopsTpl; |
||
| 16 | global $wikiPage; |
||
| 17 | $GLOBALS['xoopsOption']['template_main'] = 'gwiki_view.tpl'; |
||
| 18 | include XOOPS_ROOT_PATH . '/header.php'; |
||
| 19 | $currentscript = basename(__FILE__); |
||
| 20 | include_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
| 21 | |||
| 22 | $page_set_home = ''; |
||
| 23 | $display_keyword = ''; |
||
| 24 | |||
| 25 | /** |
||
| 26 | * @param $page |
||
| 27 | * |
||
| 28 | * @return bool |
||
| 29 | */ |
||
| 30 | function fetchPageSet($page) |
||
| 31 | { |
||
| 32 | global $xoopsDB, $wikiPage, $page_set_home, $display_keyword; |
||
| 33 | |||
| 34 | $q_page = $wikiPage->escapeForDB($page); |
||
| 35 | |||
| 36 | $pageset = false; |
||
| 37 | |||
| 38 | $sql = 'SELECT gwiki_id, keyword, display_keyword, page_set_home, page_set_order'; |
||
| 39 | $sql .= ' FROM ' . $xoopsDB->prefix('gwiki_pages'); |
||
| 40 | $sql .= " WHERE active=1 and keyword='{$q_page}' "; |
||
| 41 | |||
| 42 | $result = $xoopsDB->query($sql); |
||
| 43 | |||
| 44 | $rows = $xoopsDB->getRowsNum($result); |
||
| 45 | if ($rows) { |
||
| 46 | $row = $xoopsDB->fetchArray($result); |
||
| 47 | if (!empty($row['page_set_home'])) { |
||
| 48 | $page = $row['page_set_home']; // this is passed back up to caller! |
||
|
0 ignored issues
–
show
|
|||
| 49 | $page_set_home = $row['page_set_home']; |
||
| 50 | $display_keyword = $row['display_keyword']; |
||
| 51 | $q_page = $wikiPage->escapeForDB($row['page_set_home']); |
||
| 52 | $xoopsDB->freeRecordSet($result); |
||
| 53 | $sql = 'SELECT gwiki_id, keyword, display_keyword, page_set_home, page_set_order '; |
||
| 54 | $sql .= ' FROM ' . $xoopsDB->prefix('gwiki_pages'); |
||
| 55 | $sql .= " WHERE active=1 and page_set_home='{$q_page}' "; |
||
| 56 | $sql .= ' ORDER BY page_set_order, keyword '; |
||
| 57 | |||
| 58 | $result = $xoopsDB->query($sql); |
||
| 59 | while ($row = $xoopsDB->fetchArray($result)) { |
||
| 60 | $row['display_keyword'] = strip_tags($row['display_keyword']); |
||
| 61 | if ($row['page_set_home'] === $row['keyword']) { |
||
| 62 | $display_keyword = $row['display_keyword']; |
||
| 63 | } |
||
| 64 | $pageset[$row['gwiki_id'] . ''] = $row; |
||
| 65 | } |
||
| 66 | } |
||
| 67 | } |
||
| 68 | $xoopsDB->freeRecordSet($result); |
||
| 69 | |||
| 70 | return $pageset; |
||
| 71 | } |
||
| 72 | |||
| 73 | $page = $wikiPage->normalizeKeyword(Request::getString('page',$wikiPage->wikiHomePage)); |
||
| 74 | |||
| 75 | $selectalert = _MD_GWIKI_SORT_PAGE_SELECT; |
||
| 76 | $sortelement = 'sortelement'; |
||
| 77 | $sort_js = <<<ENDJSCODE |
||
| 78 | function move(f,bDir) { |
||
| 79 | var el = f.elements["$sortelement"] |
||
| 80 | var idx = el.selectedIndex |
||
| 81 | if (idx==-1) |
||
| 82 | alert("$selectalert") |
||
| 83 | else { |
||
| 84 | var nxidx = idx+( bDir? -1 : 1) |
||
| 85 | if (nxidx<0) return; // nxidx=el.length-1 |
||
| 86 | if (nxidx>=el.length) return; // nxidx=0 |
||
| 87 | var oldVal = el[idx].value |
||
| 88 | var oldText = el[idx].text |
||
| 89 | el[idx].value = el[nxidx].value |
||
| 90 | el[idx].text = el[nxidx].text |
||
| 91 | el[nxidx].value = oldVal |
||
| 92 | el[nxidx].text = oldText |
||
| 93 | el.selectedIndex = nxidx |
||
| 94 | } |
||
| 95 | } |
||
| 96 | |||
| 97 | function reverseorder(f) { |
||
| 98 | var el = f.elements["$sortelement"]; |
||
| 99 | var b = 0; |
||
| 100 | var t = el.length; |
||
| 101 | t = t-1; |
||
| 102 | while (b<t) { |
||
| 103 | var oldVal = el[t].value; |
||
| 104 | var oldText = el[t].text; |
||
| 105 | el[t].value = el[b].value; |
||
| 106 | el[t].text = el[b].text; |
||
| 107 | el[b].value = oldVal; |
||
| 108 | el[b].text = oldText; |
||
| 109 | b = b+1; |
||
| 110 | t = t-1; |
||
| 111 | } |
||
| 112 | } |
||
| 113 | |||
| 114 | function processForm(f) { |
||
| 115 | for (var i=0;i<f.length;i++) { |
||
| 116 | var el = f[i] |
||
| 117 | // If reorder listbox, then generate value for hidden field |
||
| 118 | if (el.name=="$sortelement") { |
||
| 119 | var strIDs = "" |
||
| 120 | for (var j=0;j<f[i].options.length;j++) |
||
| 121 | strIDs += f[i].options[j].value + "," |
||
| 122 | f.elements['neworder'].value = strIDs.substring(0,strIDs.length-1) |
||
| 123 | } |
||
| 124 | } |
||
| 125 | } |
||
| 126 | ENDJSCODE; |
||
| 127 | |||
| 128 | $xoTheme->addScript(null, array('type' => 'text/javascript'), $sort_js); |
||
| 129 | |||
| 130 | $pageX = $wikiPage->getPage($page); |
||
| 131 | if (!$pageX) { |
||
| 132 | redirect_header("index.php?page=$page", 3, _MD_GWIKI_PAGENOTFOUND); |
||
| 133 | } |
||
| 134 | |||
| 135 | // leave if we don't have admin authority |
||
| 136 | $mayEdit = $wikiPage->checkEdit(); |
||
| 137 | if (!$mayEdit) { |
||
| 138 | redirect_header("index.php?page=$page", 3, _NOPERM); |
||
| 139 | } |
||
| 140 | |||
| 141 | $pageset = $page; |
||
| 142 | $pages = fetchPageSet($pageset); |
||
| 143 | |||
| 144 | // leave if there is nothing to sort |
||
| 145 | if ($pages === false || count($pages) < 2) { |
||
| 146 | redirect_header("index.php?page=$page", 3, _MD_GWIKI_SORT_EMPTY); |
||
| 147 | } |
||
| 148 | |||
| 149 | $op = 'display'; |
||
| 150 | if (Request::hasVar('submit', 'POST')) { |
||
| 151 | $op = 'update'; |
||
| 152 | } |
||
| 153 | |||
| 154 | if ($op === 'update') { |
||
| 155 | if (Request::hasVar('neworder', 'POST')) { |
||
| 156 | $neworder = array(); |
||
| 157 | $neworder = explode(',', Request::getString('neworder','', 'POST')); |
||
| 158 | } else { |
||
| 159 | $op = 'display'; |
||
| 160 | } |
||
| 161 | } |
||
| 162 | |||
| 163 | if ($op === 'update') { |
||
| 164 | foreach ($neworder as $i => $p) { |
||
| 165 | if (isset($pages[$p])) { |
||
| 166 | $pages[$p]['page_set_order'] = $i + 1; |
||
| 167 | } else { |
||
| 168 | $op = 'display'; |
||
| 169 | } |
||
| 170 | } |
||
| 171 | } |
||
| 172 | |||
| 173 | if ($op === 'update') { |
||
| 174 | $q_page = $wikiPage->escapeForDB($page); |
||
| 175 | foreach ($pages as $i => $v) { |
||
|
0 ignored issues
–
show
|
|||
| 176 | $sql = 'UPDATE ' . $xoopsDB->prefix('gwiki_pages'); |
||
| 177 | $sql .= ' SET page_set_order = ' . $v['page_set_order']; |
||
| 178 | $sql .= ' WHERE gwiki_id = ' . $v['gwiki_id'] . " and active=1 and page_set_home='{$q_page}' "; |
||
| 179 | $result = $xoopsDB->queryF($sql); |
||
| 180 | } |
||
| 181 | $pages = array(); |
||
| 182 | $pages = fetchPageSet($pageset); |
||
| 183 | $op = 'display'; |
||
| 184 | $pageX = $wikiPage->getPage($page); // reset current to clean up |
||
| 185 | if (!$pageX) { |
||
| 186 | redirect_header("index.php?page=$page", 3, _MD_GWIKI_PAGENOTFOUND); |
||
| 187 | } // better not happen, but ... |
||
| 188 | } |
||
| 189 | |||
| 190 | $token = 0; |
||
| 191 | |||
| 192 | $caption = _MD_GWIKI_SORT_PAGE_FORM; |
||
| 193 | $form = new XoopsThemeForm($caption, 'form1', 'sortpageset.php', 'POST', $token); |
||
| 194 | |||
| 195 | $caption = _MD_GWIKI_SORT_PAGE_FORM; |
||
| 196 | $form->addElement(new XoopsFormLabel($caption, '<a href="edit.php?page=' . $page_set_home . '">' . $display_keyword . '</a>', 'page_set_home'), false); |
||
| 197 | |||
| 198 | $form->addElement(new XoopsFormHidden('page', $page_set_home)); |
||
| 199 | |||
| 200 | $caption = _MD_GWIKI_SORT_ACTIONS; |
||
| 201 | $buttontray = new XoopsFormElementTray($caption, ''); |
||
| 202 | |||
| 203 | $button_moveup = new XoopsFormButton('', 'moveup', _MD_GWIKI_SORT_UP, 'button'); |
||
| 204 | $button_moveup->setExtra('onClick="move(this.form,true)" '); |
||
| 205 | $buttontray->addElement($button_moveup); |
||
| 206 | |||
| 207 | $button_movedown = new XoopsFormButton('', 'movedown', _MD_GWIKI_SORT_DOWN, 'button'); |
||
| 208 | $button_movedown->setExtra('onClick="move(this.form,false)" '); |
||
| 209 | $buttontray->addElement($button_movedown); |
||
| 210 | |||
| 211 | $button_reverse = new XoopsFormButton('', 'reverse', _MD_GWIKI_SORT_REVERSE, 'button'); |
||
| 212 | $button_reverse->setExtra('onClick="reverseorder(this.form)" '); |
||
| 213 | $buttontray->addElement($button_reverse); |
||
| 214 | |||
| 215 | $button_submit = new XoopsFormButton('', 'submit', _MD_GWIKI_SORT_SAVE, 'submit'); |
||
| 216 | $button_submit->setExtra('onClick="processForm(this.form)" '); |
||
| 217 | $buttontray->addElement($button_submit); |
||
| 218 | |||
| 219 | $form->addElement($buttontray); |
||
| 220 | |||
| 221 | // XoopsFormSelect( string $caption, string $name, [mixed $value = null], [int $size = 1], [bool $multiple = false]) |
||
| 222 | $listbox = new XoopsFormSelect(_MD_GWIKI_SORT_PAGES, 'sortelement', null, count($pages), false); |
||
| 223 | foreach ($pages as $i => $v) { |
||
|
0 ignored issues
–
show
|
|||
| 224 | $listbox->addOption($i, $v['display_keyword']); |
||
| 225 | } |
||
| 226 | $form->addElement($listbox); |
||
| 227 | |||
| 228 | $form->addElement($buttontray); |
||
| 229 | |||
| 230 | $form->addElement(new XoopsFormHidden('neworder', '')); |
||
| 231 | $body = $form->render(); |
||
| 232 | |||
| 233 | $title = _MD_GWIKI_SORT_PAGE_FORM; |
||
| 234 | $xoopsTpl->assign('xoops_pagetitle', $title); |
||
| 235 | |||
| 236 | $dir = basename(__DIR__); |
||
| 237 | $pageX['moddir'] = $dir; |
||
| 238 | $pageX['modpath'] = XOOPS_ROOT_PATH . '/modules/' . $dir; |
||
| 239 | $pageX['modurl'] = XOOPS_URL . '/modules/' . $dir; |
||
| 240 | $pageX['mayEdit'] = $mayEdit; |
||
| 241 | $pageX['pageFound'] = true; |
||
| 242 | |||
| 243 | $pageX['body'] = $body; |
||
| 244 | |||
| 245 | $pageX['title'] = $title; |
||
| 246 | $xoopsTpl->assign('gwiki', $pageX); |
||
| 247 | $xoTheme->addStylesheet(XOOPS_URL . '/modules/gwiki/assets/css/module.css'); |
||
| 248 | |||
| 249 | if (isset($message)) { |
||
| 250 | $xoopsTpl->assign('message', $message); |
||
| 251 | } |
||
| 252 | if (isset($err_message)) { |
||
| 253 | $xoopsTpl->assign('err_message', $err_message); |
||
| 254 | } |
||
| 255 | if (isset($debug)) { |
||
| 256 | $xoopsTpl->assign('debug', $debug); |
||
| 257 | } |
||
| 258 | |||
| 259 | include XOOPS_ROOT_PATH . '/footer.php'; |
||
| 260 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVarassignment in line 1 and the$higherassignment in line 2 are dead. The first because$myVaris never used and the second because$higheris always overwritten for every possible time line.