mambax7 /
newbb
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php declare(strict_types=1); |
||
| 2 | // |
||
| 3 | // ------------------------------------------------------------------------ // |
||
| 4 | // XOOPS - PHP Content Management System // |
||
| 5 | // Copyright (c) 2000-2020 XOOPS.org // |
||
| 6 | // <https://xoops.org> // |
||
| 7 | // ------------------------------------------------------------------------ // |
||
| 8 | // This program is free software; you can redistribute it and/or modify // |
||
| 9 | // it under the terms of the GNU General Public License as published by // |
||
| 10 | // the Free Software Foundation; either version 2 of the License, or // |
||
| 11 | // (at your option) any later version. // |
||
| 12 | // // |
||
| 13 | // You may not change or alter any portion of this comment or credits // |
||
| 14 | // of supporting developers from this source code or any supporting // |
||
| 15 | // source code which is considered copyrighted (c) material of the // |
||
| 16 | // original comment or credit authors. // |
||
| 17 | // // |
||
| 18 | // This program is distributed in the hope that it will be useful, // |
||
| 19 | // but WITHOUT ANY WARRANTY; without even the implied warranty of // |
||
| 20 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // |
||
| 21 | // GNU General Public License for more details. // |
||
| 22 | // // |
||
| 23 | // You should have received a copy of the GNU General Public License // |
||
| 24 | // along with this program; if not, write to the Free Software // |
||
| 25 | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA // |
||
| 26 | // ------------------------------------------------------------------------ // |
||
| 27 | |||
| 28 | use Xmf\Module\Admin; |
||
| 29 | use Xmf\Request; |
||
| 30 | use XoopsModules\Newbb\{ |
||
| 31 | Helper, |
||
| 32 | ForumHandler |
||
| 33 | }; |
||
| 34 | |||
| 35 | /** @var Admin $adminObject */ |
||
| 36 | require_once __DIR__ . '/admin_header.php'; |
||
| 37 | require_once $GLOBALS['xoops']->path('class/xoopsformloader.php'); |
||
| 38 | |||
| 39 | xoops_cp_header(); |
||
| 40 | $adminObject->displayNavigation(basename(__FILE__)); |
||
| 41 | |||
| 42 | //if (!$newXoopsModuleGui) loadModuleAdminMenu(5, _AM_NEWBB_PRUNE_TITLE); |
||
| 43 | // else $adminObject->displayNavigation(basename(__FILE__)); |
||
| 44 | |||
| 45 | echo "<table class='outer' style='border-collapse: separate; border-spacing: 1px; width: 100%;'>" . "<tr><td class='odd'>"; |
||
| 46 | |||
| 47 | if (Request::hasVar('submit', 'POST')) { |
||
| 48 | $post_list = null; |
||
| 49 | $topic_list = null; |
||
| 50 | $topics_number = 0; |
||
| 51 | $posts_number = 0; |
||
| 52 | $selected_forums = ''; |
||
| 53 | // irmtfan fix if it is array |
||
| 54 | $temp = Request::getArray('forums', null, 'POST'); |
||
| 55 | if (!$temp || !$temp[0]) { |
||
|
0 ignored issues
–
show
|
|||
| 56 | redirect_header('admin_forum_prune.php', 1, _AM_NEWBB_PRUNE_FORUMSELERROR); |
||
| 57 | } elseif (is_array(Request::getArray('forums', '', 'POST'))) { |
||
|
0 ignored issues
–
show
|
|||
| 58 | $selected_forums = implode(',', Request::getArray('forums', null, 'POST')); |
||
| 59 | } else { |
||
| 60 | $selected_forums = Request::getArray('forums', null, 'POST'); |
||
| 61 | } |
||
| 62 | |||
| 63 | $prune_days = Request::getInt('days', 0, 'POST'); |
||
| 64 | $prune_ddays = time() - $prune_days; |
||
| 65 | $archive = Request::getInt('archive', 0, 'POST'); |
||
| 66 | $sticky = Request::getInt('sticky', 0, 'POST'); |
||
| 67 | $digest = Request::getInt('digest', 0, 'POST'); |
||
| 68 | $lock = Request::getInt('lock', 0, 'POST'); |
||
| 69 | $hot = Request::getInt('hot', 0, 'POST'); |
||
| 70 | $store = Request::getInt('store', 0, 'POST'); |
||
| 71 | |||
| 72 | $sql = 'SELECT t.topic_id FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_topics') . ' t, ' . $GLOBALS['xoopsDB']->prefix('newbb_posts') . ' p |
||
| 73 | WHERE t.forum_id IN (' . $selected_forums . ') |
||
| 74 | AND p.post_id =t.topic_last_post_id '; |
||
| 75 | |||
| 76 | if ($sticky) { |
||
| 77 | $sql .= ' AND t.topic_sticky <> 1 '; |
||
| 78 | } |
||
| 79 | if ($digest) { |
||
| 80 | $sql .= ' AND t.topic_digest <> 1 '; |
||
| 81 | } |
||
| 82 | if ($lock) { |
||
| 83 | $sql .= ' AND t.topic_status <> 1 '; |
||
| 84 | } |
||
| 85 | if (0 !== $hot) { |
||
| 86 | $sql .= ' AND t.topic_replies < ' . $hot . ' '; |
||
| 87 | } |
||
| 88 | |||
| 89 | $sql .= ' AND p.post_time<= ' . $prune_ddays . ' '; |
||
| 90 | // Ok now we have the sql query completed, go for topic_id's and posts_id's |
||
| 91 | $topics = []; |
||
| 92 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
| 93 | if (!$GLOBALS['xoopsDB']->isResultSet($result)) { |
||
| 94 | // return _MD_NEWBB_ERROR; |
||
| 95 | \trigger_error("Query Failed! SQL: $sql- Error: " . $GLOBALS['xoopsDB']->error(), E_USER_ERROR); |
||
| 96 | } |
||
| 97 | // Dave_L code |
||
| 98 | while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||
| 99 | $topics[] = $row['topic_id']; |
||
| 100 | } |
||
| 101 | $topics_number = count($topics); |
||
| 102 | $topic_list = implode(',', $topics); |
||
| 103 | $post_list = ''; |
||
| 104 | |||
| 105 | if ('' !== $topic_list) { |
||
| 106 | $sql = 'SELECT post_id FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_posts') . ' WHERE topic_id IN (' . $topic_list . ')'; |
||
| 107 | $posts = []; |
||
| 108 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
| 109 | if (!$GLOBALS['xoopsDB']->isResultSet($result)) { |
||
| 110 | // return _MD_NEWBB_ERROR; |
||
| 111 | \trigger_error("Query Failed! SQL: $sql- Error: " . $GLOBALS['xoopsDB']->error(), E_USER_ERROR); |
||
| 112 | } |
||
| 113 | |||
| 114 | // Dave_L code |
||
| 115 | while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||
| 116 | $posts[] = $row['post_id']; |
||
| 117 | } |
||
| 118 | $posts_number = count($posts); |
||
| 119 | $post_list = implode(',', $posts); |
||
| 120 | } |
||
| 121 | // OKZ Now we have al posts id and topics id |
||
| 122 | if ('' !== $post_list) { |
||
| 123 | // COPY POSTS TO OTHER FORUM |
||
| 124 | if (0 < $store) { |
||
| 125 | $sql = 'UPDATE ' . $GLOBALS['xoopsDB']->prefix('newbb_posts') . " SET forum_id=$store WHERE topic_id IN ($topic_list)"; |
||
| 126 | if (!$result = $GLOBALS['xoopsDB']->query($sql)) { |
||
| 127 | return _MD_NEWBB_ERROR; |
||
| 128 | } |
||
| 129 | |||
| 130 | $sql = 'UPDATE ' . $GLOBALS['xoopsDB']->prefix('newbb_topics') . " SET forum_id=$store WHERE topic_id IN ($topic_list)"; |
||
| 131 | if (!$result = $GLOBALS['xoopsDB']->query($sql)) { |
||
| 132 | return _MD_NEWBB_ERROR; |
||
| 133 | } |
||
| 134 | } else { |
||
| 135 | // ARCHIVING POSTS |
||
| 136 | if (1 == $archive) { |
||
| 137 | $sql = 'SELECT p.topic_id, p.post_id, t.post_text FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_posts') . ' p, ' . $GLOBALS['xoopsDB']->prefix('newbb_posts_text') . " t WHERE p.post_id IN ($post_list) AND p.post_id=t.post_id"; |
||
| 138 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
| 139 | if ($GLOBALS['xoopsDB']->isResultSet($result)) { |
||
| 140 | while ([$topic_id, $post_id, $post_text] = $GLOBALS['xoopsDB']->fetchRow($result)) { |
||
| 141 | $sql = $GLOBALS['xoopsDB']->query('INSERT INTO ' . $GLOBALS['xoopsDB']->prefix('newbb_archive') . " (topic_id, post_id, post_text) VALUES ($topic_id, $post_id, $post_text)"); |
||
| 142 | } |
||
| 143 | } |
||
| 144 | } |
||
| 145 | // DELETE POSTS |
||
| 146 | $sql = 'DELETE FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_posts') . " WHERE topic_id IN ($topic_list)"; |
||
| 147 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
| 148 | if (!$result) { |
||
| 149 | return _MD_NEWBB_ERROR; |
||
| 150 | } |
||
| 151 | // DELETE TOPICS |
||
| 152 | $sql = 'DELETE FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_topics') . " WHERE topic_id IN ($topic_list)"; |
||
| 153 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
| 154 | if (!$result) { |
||
| 155 | return _MD_NEWBB_ERROR; |
||
| 156 | } |
||
| 157 | // DELETE POSTS_TEXT |
||
| 158 | $sql = 'DELETE FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_posts_text') . " WHERE post_id IN ($post_list)"; |
||
| 159 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
| 160 | if (!$result) { |
||
| 161 | return _MD_NEWBB_ERROR; |
||
| 162 | } |
||
| 163 | // SYNC FORUMS AFTER DELETE |
||
| 164 | // /** @var ForumHandler $forumHandler */ |
||
| 165 | // $forumHandler = Helper::getInstance()->getHandler('Forum'); |
||
| 166 | $forumHandler->synchronization(); |
||
| 167 | // I THINK POSTS AND TOPICS HAVE BEEN DESTROYED :LOL: |
||
| 168 | } |
||
| 169 | } |
||
| 170 | |||
| 171 | $tform = new \XoopsThemeForm(_AM_NEWBB_PRUNE_RESULTS_TITLE, 'prune_results', xoops_getenv('SCRIPT_NAME')); |
||
| 172 | $tform->addElement(new \XoopsFormLabel(_AM_NEWBB_PRUNE_RESULTS_FORUMS, $selected_forums)); |
||
| 173 | $tform->addElement(new \XoopsFormLabel(_AM_NEWBB_PRUNE_RESULTS_TOPICS, (string)$topics_number)); |
||
| 174 | $tform->addElement(new \XoopsFormLabel(_AM_NEWBB_PRUNE_RESULTS_POSTS, (string)$posts_number)); |
||
| 175 | $tform->display(); |
||
| 176 | } else { |
||
| 177 | $sform = new \XoopsThemeForm(_AM_NEWBB_PRUNE_TITLE, 'prune', xoops_getenv('SCRIPT_NAME')); |
||
| 178 | $sform->setExtra('enctype="multipart/form-data"'); |
||
| 179 | |||
| 180 | /* Let User select the number of days |
||
| 181 | $sform->addElement( new \XoopsFormText(_AM_NEWBB_PRUNE_DAYS , 'days', 5, 10,100 ), true ); |
||
| 182 | */ |
||
| 183 | // $sql="SELECT p.topic_id, p.post_id t.post_text FROM ".$GLOBALS['xoopsDB']->prefix("newbb_posts")." p, ".$GLOBALS['xoopsDB']->prefix("newbb_posts_text")." t WHERE p.post_id IN ($post_list) AND p.post_id=t.post_id"; |
||
| 184 | // $result = $GLOBALS['xoopsDB']->query(); |
||
| 185 | // Days selected by selbox (better error control :lol:) |
||
| 186 | $days = new \XoopsFormSelect(_AM_NEWBB_PRUNE_DAYS, 'days', null, 1, false); |
||
| 187 | $days->addOptionArray( |
||
| 188 | [ |
||
| 189 | 604800 => _AM_NEWBB_PRUNE_WEEK, |
||
| 190 | 1_209_600 => _AM_NEWBB_PRUNE_2WEEKS, |
||
|
0 ignored issues
–
show
|
|||
| 191 | 2_592_000 => _AM_NEWBB_PRUNE_MONTH, |
||
|
0 ignored issues
–
show
|
|||
| 192 | 5_184_000 => _AM_NEWBB_PRUNE_2MONTH, |
||
|
0 ignored issues
–
show
|
|||
| 193 | 10_368_000 => _AM_NEWBB_PRUNE_4MONTH, |
||
|
0 ignored issues
–
show
|
|||
| 194 | 31_536_000 => _AM_NEWBB_PRUNE_YEAR, |
||
|
0 ignored issues
–
show
|
|||
| 195 | 63_072_000 => _AM_NEWBB_PRUNE_2YEARS, |
||
|
0 ignored issues
–
show
|
|||
| 196 | ] |
||
| 197 | ); |
||
| 198 | $sform->addElement($days); |
||
| 199 | // START irmtfan remove hardcode db access |
||
| 200 | require_once $GLOBALS['xoops']->path('modules/' . $xoopsModule->getVar('dirname') . '/footer.php'); // to include js files |
||
| 201 | require_once \dirname(__DIR__) . '/include/functions.forum.php'; |
||
| 202 | $forumSelMulti = "<select name=\"forums[]\" multiple=\"multiple\" onfocus = \"validate('forums[]','select', false,true)\">"; // disable all categories |
||
| 203 | $forumSelSingle = "<select name=\"store\" onfocus = \"validate('store','select', false,true)\">"; // disable all categories |
||
| 204 | $forumSelBox = '<option value = 0 >-- ' . _AM_NEWBB_PERM_FORUMS . ' --</option>'; |
||
| 205 | $forumSelBox .= newbbForumSelectBox(null, 'access', false); //$accessForums = nothing, $permission = "access", $delimitorCategory = false |
||
| 206 | $forumSelBox .= '</select>'; |
||
| 207 | $forumEle = new \XoopsFormLabel(_AM_NEWBB_PRUNE_FORUMS, $forumSelMulti . $forumSelBox); |
||
| 208 | $storeEle = new \XoopsFormLabel(_AM_NEWBB_PRUNE_STORE, $forumSelSingle . $forumSelBox); |
||
| 209 | /* irmtfan remove hardcode |
||
| 210 | $checkbox = new \XoopsFormCheckBox(_AM_NEWBB_PRUNE_FORUMS, 'forums'); |
||
| 211 | $radiobox = new \XoopsFormRadio(_AM_NEWBB_PRUNE_STORE, 'store'); |
||
| 212 | // PUAJJ I HATE IT, please tidy up |
||
| 213 | $sql = "SELECT forum_name, forum_id FROM " . $GLOBALS['xoopsDB']->prefix("newbb_forums") . " ORDER BY forum_id"; |
||
| 214 | if ($result = $GLOBALS['xoopsDB']->query($sql)) { |
||
| 215 | if ($myrow = $GLOBALS['xoopsDB']->fetchArray($result)) { |
||
| 216 | do { |
||
| 217 | $checkbox->addOption($myrow['forum_id'], $myrow['forum_name']); |
||
| 218 | $radiobox->addOption($myrow['forum_id'], $myrow['forum_name']); |
||
| 219 | } while (false !== ($myrow = $GLOBALS['xoopsDB']->fetchArray($result))); |
||
| 220 | } else { |
||
| 221 | echo "NO FORUMS"; |
||
| 222 | } |
||
| 223 | } else { |
||
| 224 | echo "DB ERROR"; |
||
| 225 | } |
||
| 226 | */ |
||
| 227 | // END irmtfan remove hardcode db access |
||
| 228 | |||
| 229 | $sform->addElement(/*$checkbox*/ $forumEle); // irmtfan |
||
| 230 | |||
| 231 | $sticky_confirmation = new \XoopsFormRadio(_AM_NEWBB_PRUNE_STICKY, 'sticky', '1'); |
||
| 232 | $sticky_confirmation->addOption('1', _AM_NEWBB_PRUNE_YES); |
||
| 233 | $sticky_confirmation->addOption('0', _AM_NEWBB_PRUNE_NO); |
||
| 234 | $sform->addElement($sticky_confirmation); |
||
| 235 | |||
| 236 | $digest_confirmation = new \XoopsFormRadio(_AM_NEWBB_PRUNE_DIGEST, 'digest', '1'); |
||
| 237 | $digest_confirmation->addOption('1', _AM_NEWBB_PRUNE_YES); |
||
| 238 | $digest_confirmation->addOption('0', _AM_NEWBB_PRUNE_NO); |
||
| 239 | $sform->addElement($digest_confirmation); |
||
| 240 | |||
| 241 | $lock_confirmation = new \XoopsFormRadio(_AM_NEWBB_PRUNE_LOCK, 'lock', '0'); |
||
| 242 | $lock_confirmation->addOption('1', _AM_NEWBB_PRUNE_YES); |
||
| 243 | $lock_confirmation->addOption('0', _AM_NEWBB_PRUNE_NO); |
||
| 244 | $sform->addElement($lock_confirmation); |
||
| 245 | |||
| 246 | $hot_confirmation = new \XoopsFormSelect(_AM_NEWBB_PRUNE_HOT, 'hot', null, 1, false); |
||
| 247 | $hot_confirmation->addOptionArray( |
||
| 248 | [ |
||
| 249 | '0' => 0, |
||
| 250 | '5' => 5, |
||
| 251 | '10' => 10, |
||
| 252 | '15' => 15, |
||
| 253 | '20' => 20, |
||
| 254 | '25' => 25, |
||
| 255 | '30' => 30, |
||
| 256 | ] |
||
| 257 | ); |
||
| 258 | $sform->addElement($hot_confirmation); |
||
| 259 | |||
| 260 | $sform->addElement(/*$radiobox*/ $storeEle); // irmtfan |
||
| 261 | |||
| 262 | $archive_confirmation = new \XoopsFormRadio(_AM_NEWBB_PRUNE_ARCHIVE, 'archive', '1'); |
||
| 263 | $archive_confirmation->addOption('1', _AM_NEWBB_PRUNE_YES); |
||
| 264 | $archive_confirmation->addOption('0', _AM_NEWBB_PRUNE_NO); |
||
| 265 | $sform->addElement($archive_confirmation); |
||
| 266 | |||
| 267 | $buttonTray = new \XoopsFormElementTray('', ''); |
||
| 268 | $buttonTray->addElement(new \XoopsFormButton('', 'submit', _SUBMIT, 'submit')); |
||
| 269 | $buttonTray->addElement(new \XoopsFormButton('', 'reset', _AM_NEWBB_PRUNE_RESET, 'reset')); |
||
| 270 | $sform->addElement($buttonTray); |
||
| 271 | |||
| 272 | $sform->display(); |
||
| 273 | } |
||
| 274 | |||
| 275 | echo '</td></tr></table>'; |
||
| 276 | echo '<fieldset>'; |
||
| 277 | echo '<legend> ' . _MI_NEWBB_ADMENU_PRUNE . ' </legend>'; |
||
| 278 | echo _AM_NEWBB_HELP_PRUNE_TAB; |
||
| 279 | echo '</fieldset>'; |
||
| 280 | require_once __DIR__ . '/admin_footer.php'; |
||
| 281 |
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)or! empty(...)instead.