This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | use Xmf\Request; |
||
4 | |||
5 | /** |
||
6 | * sortpageset.php - change order of pages within a page set |
||
7 | * |
||
8 | * @copyright Copyright © 2013 geekwright, LLC. All rights reserved. |
||
9 | * @license gwiki/docs/license.txt GNU General Public License (GPL) |
||
10 | * @since 1.0 |
||
11 | * @author Richard Griffith <[email protected]> |
||
12 | * @package gwiki |
||
13 | */ |
||
14 | include __DIR__ . '/header.php'; |
||
15 | global $xoTheme, $xoopsTpl; |
||
16 | global $wikiPage; |
||
17 | $GLOBALS['xoopsOption']['template_main'] = 'gwiki_view.tpl'; |
||
18 | include XOOPS_ROOT_PATH . '/header.php'; |
||
19 | $currentscript = basename(__FILE__); |
||
20 | include_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
21 | |||
22 | $page_set_home = ''; |
||
23 | $display_keyword = ''; |
||
24 | |||
25 | /** |
||
26 | * @param $page |
||
27 | * |
||
28 | * @return bool |
||
29 | */ |
||
30 | function fetchPageSet($page) |
||
31 | { |
||
32 | global $xoopsDB, $wikiPage, $page_set_home, $display_keyword; |
||
33 | |||
34 | $q_page = $wikiPage->escapeForDB($page); |
||
35 | |||
36 | $pageset = false; |
||
37 | |||
38 | $sql = 'SELECT gwiki_id, keyword, display_keyword, page_set_home, page_set_order'; |
||
39 | $sql .= ' FROM ' . $xoopsDB->prefix('gwiki_pages'); |
||
40 | $sql .= " WHERE active=1 and keyword='{$q_page}' "; |
||
41 | |||
42 | $result = $xoopsDB->query($sql); |
||
43 | |||
44 | $rows = $xoopsDB->getRowsNum($result); |
||
45 | if ($rows) { |
||
46 | $row = $xoopsDB->fetchArray($result); |
||
47 | if (!empty($row['page_set_home'])) { |
||
48 | $page = $row['page_set_home']; // this is passed back up to caller! |
||
0 ignored issues
–
show
|
|||
49 | $page_set_home = $row['page_set_home']; |
||
50 | $display_keyword = $row['display_keyword']; |
||
51 | $q_page = $wikiPage->escapeForDB($row['page_set_home']); |
||
52 | $xoopsDB->freeRecordSet($result); |
||
53 | $sql = 'SELECT gwiki_id, keyword, display_keyword, page_set_home, page_set_order '; |
||
54 | $sql .= ' FROM ' . $xoopsDB->prefix('gwiki_pages'); |
||
55 | $sql .= " WHERE active=1 and page_set_home='{$q_page}' "; |
||
56 | $sql .= ' ORDER BY page_set_order, keyword '; |
||
57 | |||
58 | $result = $xoopsDB->query($sql); |
||
59 | while ($row = $xoopsDB->fetchArray($result)) { |
||
60 | $row['display_keyword'] = strip_tags($row['display_keyword']); |
||
61 | if ($row['page_set_home'] === $row['keyword']) { |
||
62 | $display_keyword = $row['display_keyword']; |
||
63 | } |
||
64 | $pageset[$row['gwiki_id'] . ''] = $row; |
||
65 | } |
||
66 | } |
||
67 | } |
||
68 | $xoopsDB->freeRecordSet($result); |
||
69 | |||
70 | return $pageset; |
||
71 | } |
||
72 | |||
73 | $page = $wikiPage->normalizeKeyword(Request::getString('page',$wikiPage->wikiHomePage)); |
||
74 | |||
75 | $selectalert = _MD_GWIKI_SORT_PAGE_SELECT; |
||
76 | $sortelement = 'sortelement'; |
||
77 | $sort_js = <<<ENDJSCODE |
||
78 | function move(f,bDir) { |
||
79 | var el = f.elements["$sortelement"] |
||
80 | var idx = el.selectedIndex |
||
81 | if (idx==-1) |
||
82 | alert("$selectalert") |
||
83 | else { |
||
84 | var nxidx = idx+( bDir? -1 : 1) |
||
85 | if (nxidx<0) return; // nxidx=el.length-1 |
||
86 | if (nxidx>=el.length) return; // nxidx=0 |
||
87 | var oldVal = el[idx].value |
||
88 | var oldText = el[idx].text |
||
89 | el[idx].value = el[nxidx].value |
||
90 | el[idx].text = el[nxidx].text |
||
91 | el[nxidx].value = oldVal |
||
92 | el[nxidx].text = oldText |
||
93 | el.selectedIndex = nxidx |
||
94 | } |
||
95 | } |
||
96 | |||
97 | function reverseorder(f) { |
||
98 | var el = f.elements["$sortelement"]; |
||
99 | var b = 0; |
||
100 | var t = el.length; |
||
101 | t = t-1; |
||
102 | while (b<t) { |
||
103 | var oldVal = el[t].value; |
||
104 | var oldText = el[t].text; |
||
105 | el[t].value = el[b].value; |
||
106 | el[t].text = el[b].text; |
||
107 | el[b].value = oldVal; |
||
108 | el[b].text = oldText; |
||
109 | b = b+1; |
||
110 | t = t-1; |
||
111 | } |
||
112 | } |
||
113 | |||
114 | function processForm(f) { |
||
115 | for (var i=0;i<f.length;i++) { |
||
116 | var el = f[i] |
||
117 | // If reorder listbox, then generate value for hidden field |
||
118 | if (el.name=="$sortelement") { |
||
119 | var strIDs = "" |
||
120 | for (var j=0;j<f[i].options.length;j++) |
||
121 | strIDs += f[i].options[j].value + "," |
||
122 | f.elements['neworder'].value = strIDs.substring(0,strIDs.length-1) |
||
123 | } |
||
124 | } |
||
125 | } |
||
126 | ENDJSCODE; |
||
127 | |||
128 | $xoTheme->addScript(null, array('type' => 'text/javascript'), $sort_js); |
||
129 | |||
130 | $pageX = $wikiPage->getPage($page); |
||
131 | if (!$pageX) { |
||
132 | redirect_header("index.php?page=$page", 3, _MD_GWIKI_PAGENOTFOUND); |
||
133 | } |
||
134 | |||
135 | // leave if we don't have admin authority |
||
136 | $mayEdit = $wikiPage->checkEdit(); |
||
137 | if (!$mayEdit) { |
||
138 | redirect_header("index.php?page=$page", 3, _NOPERM); |
||
139 | } |
||
140 | |||
141 | $pageset = $page; |
||
142 | $pages = fetchPageSet($pageset); |
||
143 | |||
144 | // leave if there is nothing to sort |
||
145 | if ($pages === false || count($pages) < 2) { |
||
146 | redirect_header("index.php?page=$page", 3, _MD_GWIKI_SORT_EMPTY); |
||
147 | } |
||
148 | |||
149 | $op = 'display'; |
||
150 | if (Request::hasVar('submit', 'POST')) { |
||
151 | $op = 'update'; |
||
152 | } |
||
153 | |||
154 | if ($op === 'update') { |
||
155 | if (Request::hasVar('neworder', 'POST')) { |
||
156 | $neworder = array(); |
||
157 | $neworder = explode(',', Request::getString('neworder','', 'POST')); |
||
158 | } else { |
||
159 | $op = 'display'; |
||
160 | } |
||
161 | } |
||
162 | |||
163 | if ($op === 'update') { |
||
164 | foreach ($neworder as $i => $p) { |
||
165 | if (isset($pages[$p])) { |
||
166 | $pages[$p]['page_set_order'] = $i + 1; |
||
167 | } else { |
||
168 | $op = 'display'; |
||
169 | } |
||
170 | } |
||
171 | } |
||
172 | |||
173 | if ($op === 'update') { |
||
174 | $q_page = $wikiPage->escapeForDB($page); |
||
175 | foreach ($pages as $i => $v) { |
||
0 ignored issues
–
show
|
|||
176 | $sql = 'UPDATE ' . $xoopsDB->prefix('gwiki_pages'); |
||
177 | $sql .= ' SET page_set_order = ' . $v['page_set_order']; |
||
178 | $sql .= ' WHERE gwiki_id = ' . $v['gwiki_id'] . " and active=1 and page_set_home='{$q_page}' "; |
||
179 | $result = $xoopsDB->queryF($sql); |
||
180 | } |
||
181 | $pages = array(); |
||
182 | $pages = fetchPageSet($pageset); |
||
183 | $op = 'display'; |
||
184 | $pageX = $wikiPage->getPage($page); // reset current to clean up |
||
185 | if (!$pageX) { |
||
186 | redirect_header("index.php?page=$page", 3, _MD_GWIKI_PAGENOTFOUND); |
||
187 | } // better not happen, but ... |
||
188 | } |
||
189 | |||
190 | $token = 0; |
||
191 | |||
192 | $caption = _MD_GWIKI_SORT_PAGE_FORM; |
||
193 | $form = new XoopsThemeForm($caption, 'form1', 'sortpageset.php', 'POST', $token); |
||
194 | |||
195 | $caption = _MD_GWIKI_SORT_PAGE_FORM; |
||
196 | $form->addElement(new XoopsFormLabel($caption, '<a href="edit.php?page=' . $page_set_home . '">' . $display_keyword . '</a>', 'page_set_home'), false); |
||
197 | |||
198 | $form->addElement(new XoopsFormHidden('page', $page_set_home)); |
||
199 | |||
200 | $caption = _MD_GWIKI_SORT_ACTIONS; |
||
201 | $buttontray = new XoopsFormElementTray($caption, ''); |
||
202 | |||
203 | $button_moveup = new XoopsFormButton('', 'moveup', _MD_GWIKI_SORT_UP, 'button'); |
||
204 | $button_moveup->setExtra('onClick="move(this.form,true)" '); |
||
205 | $buttontray->addElement($button_moveup); |
||
206 | |||
207 | $button_movedown = new XoopsFormButton('', 'movedown', _MD_GWIKI_SORT_DOWN, 'button'); |
||
208 | $button_movedown->setExtra('onClick="move(this.form,false)" '); |
||
209 | $buttontray->addElement($button_movedown); |
||
210 | |||
211 | $button_reverse = new XoopsFormButton('', 'reverse', _MD_GWIKI_SORT_REVERSE, 'button'); |
||
212 | $button_reverse->setExtra('onClick="reverseorder(this.form)" '); |
||
213 | $buttontray->addElement($button_reverse); |
||
214 | |||
215 | $button_submit = new XoopsFormButton('', 'submit', _MD_GWIKI_SORT_SAVE, 'submit'); |
||
216 | $button_submit->setExtra('onClick="processForm(this.form)" '); |
||
217 | $buttontray->addElement($button_submit); |
||
218 | |||
219 | $form->addElement($buttontray); |
||
220 | |||
221 | // XoopsFormSelect( string $caption, string $name, [mixed $value = null], [int $size = 1], [bool $multiple = false]) |
||
222 | $listbox = new XoopsFormSelect(_MD_GWIKI_SORT_PAGES, 'sortelement', null, count($pages), false); |
||
223 | foreach ($pages as $i => $v) { |
||
0 ignored issues
–
show
|
|||
224 | $listbox->addOption($i, $v['display_keyword']); |
||
225 | } |
||
226 | $form->addElement($listbox); |
||
227 | |||
228 | $form->addElement($buttontray); |
||
229 | |||
230 | $form->addElement(new XoopsFormHidden('neworder', '')); |
||
231 | $body = $form->render(); |
||
232 | |||
233 | $title = _MD_GWIKI_SORT_PAGE_FORM; |
||
234 | $xoopsTpl->assign('xoops_pagetitle', $title); |
||
235 | |||
236 | $dir = basename(__DIR__); |
||
237 | $pageX['moddir'] = $dir; |
||
238 | $pageX['modpath'] = XOOPS_ROOT_PATH . '/modules/' . $dir; |
||
239 | $pageX['modurl'] = XOOPS_URL . '/modules/' . $dir; |
||
240 | $pageX['mayEdit'] = $mayEdit; |
||
241 | $pageX['pageFound'] = true; |
||
242 | |||
243 | $pageX['body'] = $body; |
||
244 | |||
245 | $pageX['title'] = $title; |
||
246 | $xoopsTpl->assign('gwiki', $pageX); |
||
247 | $xoTheme->addStylesheet(XOOPS_URL . '/modules/gwiki/assets/css/module.css'); |
||
248 | |||
249 | if (isset($message)) { |
||
250 | $xoopsTpl->assign('message', $message); |
||
251 | } |
||
252 | if (isset($err_message)) { |
||
253 | $xoopsTpl->assign('err_message', $err_message); |
||
254 | } |
||
255 | if (isset($debug)) { |
||
256 | $xoopsTpl->assign('debug', $debug); |
||
257 | } |
||
258 | |||
259 | include XOOPS_ROOT_PATH . '/footer.php'; |
||
260 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.