mambax7 /
newbb
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php declare(strict_types=1); |
||||
| 2 | |||||
| 3 | /** |
||||
| 4 | * NewBB, the forum module for XOOPS project |
||||
| 5 | * |
||||
| 6 | * @copyright XOOPS Project (https://xoops.org) |
||||
| 7 | * @license GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||
| 8 | * @author Taiwen Jiang (phppp or D.J.) <[email protected]> |
||||
| 9 | * @since 4.00 |
||||
| 10 | */ |
||||
| 11 | |||||
| 12 | use Xmf\Request; |
||||
| 13 | use XoopsModules\Newbb\{ |
||||
| 14 | Category, |
||||
| 15 | CategoryHandler, |
||||
| 16 | Forum, |
||||
| 17 | ForumHandler, |
||||
| 18 | Helper, |
||||
| 19 | KarmaHandler, |
||||
| 20 | OnlineHandler, |
||||
| 21 | Post, |
||||
| 22 | PostHandler, |
||||
| 23 | StatsHandler, |
||||
| 24 | Topic, |
||||
| 25 | TopicHandler |
||||
| 26 | }; |
||||
| 27 | /** @var Category $categories */ |
||||
| 28 | /** @var CategoryHandler $categoryHandler */ |
||||
| 29 | /** @var Forum $forumsObject */ |
||||
| 30 | /** @var ForumHandler $forumHandler */ |
||||
| 31 | /** @var Helper $helper */ |
||||
| 32 | /** @var KarmaHandler $karmaHandler */ |
||||
| 33 | /** @var OnlineHandler $onlineHandler */ |
||||
| 34 | /** @var Post $postObject */ |
||||
| 35 | /** @var PostHandler $postHandler */ |
||||
| 36 | /** @var StatsHandler $statsHandler */ |
||||
| 37 | /** @var Topic $topicObject */ |
||||
| 38 | /** @var TopicHandler $topicHandler */ |
||||
| 39 | require_once __DIR__ . '/header.php'; |
||||
| 40 | |||||
| 41 | foreach (['forum', 'topic_id', 'post_id', 'order'] as $getint) { |
||||
| 42 | ${$getint} = Request::getInt($getint, 0, 'GET'); |
||||
| 43 | } |
||||
| 44 | |||||
| 45 | if (!$topic_id || !$post_id) { |
||||
| 46 | $redirect = empty($forum) ? 'index.php' : "viewforum.php?forum={$forum}"; |
||||
| 47 | redirect_header($redirect, 2, _MD_NEWBB_ERRORTOPIC); |
||||
| 48 | } |
||||
| 49 | |||||
| 50 | $forumHandler = Helper::getInstance()->getHandler('Forum'); |
||||
| 51 | $topicHandler = Helper::getInstance()->getHandler('Topic'); |
||||
| 52 | $postHandler = Helper::getInstance()->getHandler('Post'); |
||||
| 53 | |||||
| 54 | $postObject = $postHandler->get($post_id); |
||||
| 55 | $topicObject = $topicHandler->get($postObject->getVar('topic_id')); |
||||
| 56 | /** @var Forum $forumObject */ |
||||
| 57 | $forumObject = $forumHandler->get($postObject->getVar('forum_id')); |
||||
| 58 | if (!$forumHandler->getPermission($forumObject)) { |
||||
| 59 | redirect_header('index.php', 2, _MD_NEWBB_NORIGHTTOACCESS); |
||||
| 60 | } |
||||
| 61 | |||||
| 62 | if ($GLOBALS['xoopsModuleConfig']['wol_enabled']) { |
||||
| 63 | // $onlineHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Online'); |
||||
| 64 | $onlineHandler->init($forumObject); |
||||
| 65 | } |
||||
| 66 | $isAdmin = newbbIsAdmin($forumObject); |
||||
| 67 | $uid = is_object($GLOBALS['xoopsUser']) ? $GLOBALS['xoopsUser']->getVar('uid') : 0; |
||||
| 68 | |||||
| 69 | $topic_id = $postObject->getVar('topic_id'); |
||||
| 70 | $topic_status = $topicObject->getVar('topic_status'); |
||||
| 71 | $error_msg = null; |
||||
| 72 | |||||
| 73 | if (!$topicHandler->getPermission($forumObject, $topic_status, 'edit') || (!$isAdmin && !$postObject->checkIdentity())) { |
||||
|
0 ignored issues
–
show
Bug
introduced
by
Loading history...
|
|||||
| 74 | $error_msg = _MD_NEWBB_NORIGHTTOEDIT; |
||||
| 75 | } elseif (!$isAdmin && !$postObject->checkTimelimit('edit_timelimit')) { |
||||
|
0 ignored issues
–
show
The method
checkTimelimit() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as Post or XoopsModules\Newbb\Post.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 76 | $error_msg = _MD_NEWBB_TIMEISUP; |
||||
| 77 | } |
||||
| 78 | |||||
| 79 | if (null !== $error_msg) { |
||||
| 80 | /* |
||||
| 81 | * Build the page query |
||||
| 82 | */ |
||||
| 83 | $query_vars = ['topic_id', 'post_id', 'forum', 'status', 'order', 'mode', 'viewmode']; |
||||
| 84 | $query_array = []; |
||||
| 85 | foreach ($query_vars as $var) { |
||||
| 86 | if (Request::getString($var, '', 'GET')) { |
||||
| 87 | $query_array[$var] = "{$var}=" . Request::getString($var, '', 'GET'); |
||||
| 88 | } |
||||
| 89 | } |
||||
| 90 | $page_query = htmlspecialchars(implode('&', array_values($query_array)), ENT_QUOTES | ENT_HTML5); |
||||
| 91 | unset($query_array); |
||||
| 92 | redirect_header("viewtopic.php?{$page_query}", 2, $error_msg); |
||||
| 93 | } |
||||
| 94 | |||||
| 95 | if ($GLOBALS['xoopsModuleConfig']['wol_enabled']) { |
||||
| 96 | // $onlineHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Online'); |
||||
| 97 | $onlineHandler->init($forumObject); |
||||
| 98 | } |
||||
| 99 | |||||
| 100 | $xoopsOption['template_main'] = 'newbb_edit_post.tpl'; |
||||
| 101 | $GLOBALS['xoopsConfig']['module_cache'][$xoopsModule->getVar('mid')] = 0; |
||||
| 102 | // irmtfan include header.php after defining $xoopsOption['template_main'] |
||||
| 103 | require_once $GLOBALS['xoops']->path('header.php'); |
||||
| 104 | |||||
| 105 | /* |
||||
| 106 | $xoopsTpl->assign('lang_forum_index', sprintf(_MD_NEWBB_FORUMINDEX, htmlspecialchars((string)$GLOBALS['xoopsConfig']['sitename'], ENT_QUOTES))); |
||||
| 107 | |||||
| 108 | $categoryHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Category'); |
||||
| 109 | $categoryObject = $categoryHandler->get($forumObject->getVar('cat_id'), array("cat_title")); |
||||
| 110 | $xoopsTpl->assign('category', array("id" => $forumObject->getVar('cat_id'), "title" => $categoryObject->getVar('cat_title'))); |
||||
| 111 | |||||
| 112 | $form_title = _EDIT.": <a href=\"viewtopic.php?post_id={$post_id}\">".$postObject->getVar('subject'); |
||||
| 113 | $xoopsTpl->assign("form_title", $form_title); |
||||
| 114 | |||||
| 115 | $xoopsTpl->assign("parentforum", $forumHandler->getParents($forumObject)); |
||||
| 116 | |||||
| 117 | $xoopsTpl->assign(array( |
||||
| 118 | 'forum_id' => $forumObject->getVar('forum_id'), |
||||
| 119 | 'forum_name' => $forumObject->getVar('forum_name'), |
||||
| 120 | )); |
||||
| 121 | */ |
||||
| 122 | |||||
| 123 | $dohtml = $postObject->getVar('dohtml'); |
||||
| 124 | $dosmiley = $postObject->getVar('dosmiley'); |
||||
| 125 | $doxcode = $postObject->getVar('doxcode'); |
||||
| 126 | $dobr = $postObject->getVar('dobr'); |
||||
| 127 | $icon = $postObject->getVar('icon'); |
||||
| 128 | $attachsig = $postObject->getVar('attachsig'); |
||||
| 129 | $istopic = $postObject->isTopic() ? 1 : 0; |
||||
|
0 ignored issues
–
show
The method
isTopic() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as Post or XoopsModules\Newbb\Post.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 130 | $isedit = 1; |
||||
| 131 | $subject = $postObject->getVar('subject', 'E'); |
||||
| 132 | $message = $postObject->getVar('post_text', 'E'); |
||||
| 133 | $poster_name = $postObject->getVar('poster_name', 'E'); |
||||
| 134 | $attachments = $postObject->getAttachment(); |
||||
|
0 ignored issues
–
show
The method
getAttachment() does not exist on XoopsObject. It seems like you code against a sub-type of XoopsObject such as Post or XoopsModules\Newbb\Post.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 135 | $post_karma = $postObject->getVar('post_karma'); |
||||
| 136 | $require_reply = $postObject->getVar('require_reply'); |
||||
| 137 | |||||
| 138 | $xoopsTpl->assign('error_message', _MD_NEWBB_EDITEDBY . ' ' . $GLOBALS['xoopsUser']->uname()); |
||||
| 139 | require_once __DIR__ . '/include/form.post.php'; |
||||
| 140 | |||||
| 141 | ///** @var KarmaHandler $karmaHandler */ |
||||
| 142 | //$karmaHandler = Helper::getInstance()->getHandler('Karma'); |
||||
| 143 | $user_karma = $karmaHandler->getUserKarma(); |
||||
| 144 | |||||
| 145 | $posts_context = []; |
||||
| 146 | $posts_contextObject = $istopic ? [] : [$postHandler->get($postObject->getVar('pid'))]; |
||||
| 147 | foreach ($posts_contextObject as $post_contextObject) { |
||||
| 148 | if ($GLOBALS['xoopsModuleConfig']['enable_karma'] && $post_contextObject->getVar('post_karma') > 0) { |
||||
| 149 | $p_message = sprintf(_MD_NEWBB_KARMA_REQUIREMENT, '***', $post_contextObject->getVar('post_karma')) . '</div>'; |
||||
| 150 | } elseif ($GLOBALS['xoopsModuleConfig']['allow_require_reply'] && $post_contextObject->getVar('require_reply')) { |
||||
| 151 | $p_message = _MD_NEWBB_REPLY_REQUIREMENT; |
||||
| 152 | } else { |
||||
| 153 | $p_message = $post_contextObject->getVar('post_text'); |
||||
| 154 | } |
||||
| 155 | |||||
| 156 | if ($post_contextObject->getVar('uid')) { |
||||
| 157 | $p_name = newbbGetUnameFromId($post_contextObject->getVar('uid'), $GLOBALS['xoopsModuleConfig']['show_realname']); |
||||
| 158 | } else { |
||||
| 159 | $poster_name = $post_contextObject->getVar('poster_name'); |
||||
| 160 | $p_name = empty($poster_name) ? htmlspecialchars((string)$GLOBALS['xoopsConfig']['anonymous'], ENT_QUOTES | ENT_HTML5) : $poster_name; |
||||
| 161 | } |
||||
| 162 | $p_date = formatTimestamp($post_contextObject->getVar('post_time')); |
||||
| 163 | $p_subject = $post_contextObject->getVar('subject'); |
||||
| 164 | |||||
| 165 | $posts_context[] = [ |
||||
| 166 | 'subject' => $p_subject, |
||||
| 167 | 'meta' => _MD_NEWBB_BY . ' ' . $p_name . ' ' . _MD_NEWBB_ON . ' ' . $p_date, |
||||
| 168 | 'content' => $p_message, |
||||
| 169 | ]; |
||||
| 170 | } |
||||
| 171 | $xoopsTpl->assign_by_ref('posts_context', $posts_context); |
||||
| 172 | // irmtfan move to footer.php |
||||
| 173 | require_once __DIR__ . '/footer.php'; |
||||
| 174 | require_once $GLOBALS['xoops']->path('footer.php'); |
||||
| 175 |