mambax7 /
newbb
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php declare(strict_types=1); |
||
| 2 | /* |
||
| 3 | * You may not change or alter any portion of this comment or credits |
||
| 4 | * of supporting developers from this source code or any supporting source code |
||
| 5 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
| 6 | * |
||
| 7 | * This program is distributed in the hope that it will be useful, |
||
| 8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
| 10 | */ |
||
| 11 | // ------------------------------------------------------------------------ // |
||
| 12 | // Author: phppp (D.J., [email protected]) // |
||
| 13 | // URL: https://xoops.org // |
||
| 14 | // Project: Article Project // |
||
| 15 | // ------------------------------------------------------------------------ // |
||
| 16 | |||
| 17 | use Xmf\Request; |
||
| 18 | use XoopsModules\Newbb\{ |
||
| 19 | Helper, |
||
| 20 | Forum, |
||
| 21 | ForumHandler, |
||
| 22 | Post, |
||
| 23 | PostHandler, |
||
| 24 | TopicHandler, |
||
| 25 | KarmaHandler |
||
| 26 | }; |
||
| 27 | /** @var Post $post_contextObject */ |
||
| 28 | |||
| 29 | require_once __DIR__ . '/header.php'; |
||
| 30 | |||
| 31 | $forum = Request::getInt('forum', 0, 'GET'); |
||
| 32 | $topic_id = Request::getInt('topic_id', 0, 'GET'); |
||
| 33 | $post_id = Request::getInt('post_id', 0, 'GET'); |
||
| 34 | $order = Request::getInt('order', 0, 'GET'); |
||
| 35 | $start = Request::getInt('start', 0, 'GET'); |
||
| 36 | |||
| 37 | if (!$topic_id && !$post_id) { |
||
| 38 | $redirect = empty($forum) ? 'index.php' : "viewforum.php?forum={$forum}"; |
||
| 39 | redirect_header($redirect, 2, _MD_NEWBB_ERRORTOPIC); |
||
| 40 | } |
||
| 41 | |||
| 42 | /** @var ForumHandler $forumHandler */ |
||
| 43 | $forumHandler = Helper::getInstance()->getHandler('Forum'); |
||
| 44 | /** @var TopicHandler $topicHandler */ |
||
| 45 | $topicHandler = Helper::getInstance()->getHandler('Topic'); |
||
| 46 | /** @var PostHandler $postHandler */ |
||
| 47 | $postHandler = Helper::getInstance()->getHandler('Post'); |
||
| 48 | |||
| 49 | if (!$pid = $post_id) { |
||
| 50 | $pid = $topicHandler->getTopPostId($topic_id); |
||
| 51 | } |
||
| 52 | $postParentObject = $postHandler->get($pid); |
||
| 53 | $topic_id = $postParentObject->getVar('topic_id'); |
||
| 54 | $forum = $postParentObject->getVar('forum_id'); |
||
| 55 | $postObject = $postHandler->create(); |
||
| 56 | $postObject->setVar('pid', $pid); |
||
| 57 | $postObject->setVar('topic_id', $topic_id); |
||
| 58 | $postObject->setVar('forum_id', $forum); |
||
| 59 | |||
| 60 | /** @var Forum $forumObject */ |
||
| 61 | $forumObject = $forumHandler->get($forum); |
||
| 62 | if (!$forumHandler->getPermission($forumObject)) { |
||
| 63 | redirect_header(XOOPS_URL . '/index.php', 2, _MD_NEWBB_NORIGHTTOACCESS); |
||
| 64 | } |
||
| 65 | |||
| 66 | $topicObject = $topicHandler->get($topic_id); |
||
| 67 | $topic_status = $topicObject->getVar('topic_status'); |
||
| 68 | if (!$topicHandler->getPermission($forumObject, $topic_status, 'reply')) { |
||
| 69 | /* |
||
| 70 | * Build the page query |
||
| 71 | */ |
||
| 72 | $query_vars = ['topic_id', 'post_id', 'status', 'order', 'mode', 'viewmode']; |
||
| 73 | $query_array = []; |
||
| 74 | foreach ($query_vars as $var) { |
||
| 75 | if (Request::getString($var, '', 'GET')) { |
||
| 76 | $query_array[$var] = "{$var}=" . Request::getString($var, '', 'GET'); |
||
| 77 | } |
||
| 78 | } |
||
| 79 | $page_query = htmlspecialchars(implode('&', array_values($query_array)), ENT_QUOTES | ENT_HTML5); |
||
| 80 | unset($query_array); |
||
| 81 | |||
| 82 | redirect_header("viewtopic.php?{$page_query}", 2, _MD_NEWBB_NORIGHTTOREPLY); |
||
| 83 | } |
||
| 84 | |||
| 85 | if ($GLOBALS['xoopsModuleConfig']['wol_enabled']) { |
||
| 86 | // /** @var OnlineHandler $onlineHandler */ |
||
| 87 | // $onlineHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Online'); |
||
| 88 | $onlineHandler->init($forumObject); |
||
| 89 | } |
||
| 90 | |||
| 91 | $xoopsOption['template_main'] = 'newbb_edit_post.tpl'; |
||
| 92 | $GLOBALS['xoopsConfig']['module_cache'][$xoopsModule->getVar('mid')] = 0; |
||
| 93 | // irmtfan remove and move to footer.php |
||
| 94 | //$xoopsOption['xoops_module_header']= $xoops_module_header; |
||
| 95 | // irmtfan include header.php after defining $xoopsOption['template_main'] |
||
| 96 | require_once $GLOBALS['xoops']->path('header.php'); |
||
| 97 | //$xoopsTpl->assign('xoops_module_header', $xoops_module_header); |
||
| 98 | |||
| 99 | /* |
||
| 100 | $xoopsTpl->assign('lang_forum_index', sprintf(_MD_NEWBB_FORUMINDEX, htmlspecialchars((string)$GLOBALS['xoopsConfig']['sitename'], ENT_QUOTES))); |
||
| 101 | |||
| 102 | $categoryHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Category'); |
||
| 103 | $categoryObject = $categoryHandler->get($forumObject->getVar("cat_id"), array("cat_title")); |
||
| 104 | $xoopsTpl->assign('category', array("id" => $forumObject->getVar("cat_id"), "title" => $categoryObject->getVar('cat_title'))); |
||
| 105 | |||
| 106 | $form_title = _MD_NEWBB_REPLY.": <a href=\"viewtopic.php?topic_id={$topic_id}\">".$topicObject->getVar("topic_title"); |
||
| 107 | $xoopsTpl->assign("form_title", $form_title); |
||
| 108 | */ |
||
| 109 | |||
| 110 | if ((2 == $GLOBALS['xoopsModuleConfig']['disc_show']) || (3 == $GLOBALS['xoopsModuleConfig']['disc_show'])) { |
||
| 111 | $xoopsTpl->assign('disclaimer', $GLOBALS['xoopsModuleConfig']['disclaimer']); |
||
| 112 | } |
||
| 113 | |||
| 114 | $xoopsTpl->assign('parentforum', $forumHandler->getParents($forumObject)); |
||
| 115 | |||
| 116 | $xoopsTpl->assign( |
||
| 117 | [ |
||
| 118 | 'forum_id' => $forumObject->getVar('forum_id'), |
||
| 119 | 'forum_name' => $forumObject->getVar('forum_name'), |
||
| 120 | ] |
||
| 121 | ); |
||
| 122 | |||
| 123 | if ($postParentObject->getVar('uid')) { |
||
| 124 | $r_name = newbbGetUnameFromId($postParentObject->getVar('uid'), $GLOBALS['xoopsModuleConfig']['show_realname']); |
||
| 125 | } else { |
||
| 126 | $poster_name = $postParentObject->getVar('poster_name'); |
||
| 127 | $r_name = empty($poster_name) ? htmlspecialchars((string)$GLOBALS['xoopsConfig']['anonymous'], ENT_QUOTES | ENT_HTML5) : $poster_name; |
||
| 128 | } |
||
| 129 | |||
| 130 | $r_subject = $postParentObject->getVar('subject', 'E'); |
||
| 131 | |||
| 132 | $subject = $r_subject; |
||
| 133 | if (!preg_match('/^(Re|' . _MD_NEWBB_RE . '):/i', (string) $r_subject)) { |
||
| 134 | $subject = _MD_NEWBB_RE . ': ' . $r_subject; |
||
| 135 | } |
||
| 136 | |||
| 137 | $q_message = $postParentObject->getVar('post_text', 'e'); |
||
| 138 | if ((!$GLOBALS['xoopsModuleConfig']['enable_karma'] || !$postParentObject->getVar('post_karma')) |
||
| 139 | && (!$GLOBALS['xoopsModuleConfig']['allow_require_reply'] || !$postParentObject->getVar('require_reply'))) { |
||
| 140 | if (1 === Request::getInt('quotedac', 0, 'GET')) { |
||
| 141 | $message = "[quote]\n"; |
||
| 142 | $message .= sprintf(_MD_NEWBB_USERWROTE, $r_name); |
||
| 143 | $message .= "\n" . $q_message . '[/quote]'; |
||
| 144 | $hidden = ''; |
||
| 145 | } else { |
||
| 146 | $hidden = "[quote]\n"; |
||
| 147 | $hidden .= sprintf(_MD_NEWBB_USERWROTE, $r_name); |
||
| 148 | $hidden .= "\n" . $q_message . '[/quote]'; |
||
| 149 | $message = ''; |
||
| 150 | } |
||
| 151 | } else { |
||
| 152 | $hidden = ''; |
||
| 153 | $message = ''; |
||
| 154 | } |
||
| 155 | |||
| 156 | $isreply = 1; |
||
| 157 | $istopic = 0; |
||
| 158 | $dohtml = 1; |
||
| 159 | $dosmiley = 1; |
||
| 160 | $doxcode = 1; |
||
| 161 | $dobr = 1; |
||
| 162 | $icon = ''; |
||
| 163 | $attachsig = (is_object($GLOBALS['xoopsUser']) && $GLOBALS['xoopsUser']->getVar('attachsig')) ? 1 : 0; |
||
| 164 | $post_karma = 0; |
||
| 165 | $require_reply = 0; |
||
| 166 | |||
| 167 | require_once __DIR__ . '/include/form.post.php'; |
||
| 168 | |||
| 169 | ///** @var KarmaHandler $karmaHandler */ |
||
| 170 | //$karmaHandler = Helper::getInstance()->getHandler('Karma'); |
||
| 171 | $user_karma = $karmaHandler->getUserKarma(); |
||
| 172 | |||
| 173 | $posts_context = []; |
||
| 174 | //$posts_contextObject = $postHandler->getByLimit($topic_id, 5); //mb |
||
| 175 | |||
| 176 | /** @var array $posts_contextObjects */ |
||
| 177 | $posts_contextObjects = $postHandler->getByLimit(5, 0, null, null, true, $topic_id, 1); |
||
|
0 ignored issues
–
show
|
|||
| 178 | /** @var Post $post_contextObject */ |
||
| 179 | foreach ($posts_contextObjects as $post_contextObject) { |
||
| 180 | // Sorry, in order to save queries, we have to hide the non-open post_text even if you have replied or have adequate karma, even an admin. |
||
| 181 | if ($GLOBALS['xoopsModuleConfig']['enable_karma'] && $post_contextObject->getVar('post_karma') > 0) { |
||
| 182 | $p_message = sprintf(_MD_NEWBB_KARMA_REQUIREMENT, '***', $post_contextObject->getVar('post_karma')) . '</div>'; |
||
| 183 | } elseif ($GLOBALS['xoopsModuleConfig']['allow_require_reply'] && $post_contextObject->getVar('require_reply')) { |
||
| 184 | $p_message = _MD_NEWBB_REPLY_REQUIREMENT; |
||
| 185 | } else { |
||
| 186 | $p_message = $post_contextObject->getVar('post_text'); |
||
| 187 | } |
||
| 188 | |||
| 189 | if ($post_contextObject->getVar('uid')) { |
||
| 190 | $p_name = newbbGetUnameFromId($post_contextObject->getVar('uid'), $GLOBALS['xoopsModuleConfig']['show_realname']); |
||
| 191 | } else { |
||
| 192 | $poster_name = $post_contextObject->getVar('poster_name'); |
||
| 193 | $p_name = empty($poster_name) ? htmlspecialchars((string)$GLOBALS['xoopsConfig']['anonymous'], ENT_QUOTES | ENT_HTML5) : $poster_name; |
||
| 194 | } |
||
| 195 | $p_date = formatTimestamp($post_contextObject->getVar('post_time')); |
||
| 196 | $p_subject = $post_contextObject->getVar('subject'); |
||
| 197 | |||
| 198 | $posts_context[] = [ |
||
| 199 | 'subject' => $p_subject, |
||
| 200 | 'meta' => _MD_NEWBB_BY . ' ' . $p_name . ' ' . _MD_NEWBB_ON . ' ' . $p_date, |
||
| 201 | 'content' => $p_message, |
||
| 202 | ]; |
||
| 203 | } |
||
| 204 | $xoopsTpl->assign_by_ref('posts_context', $posts_context); |
||
| 205 | // irmtfan move to footer.php |
||
| 206 | require_once __DIR__ . '/footer.php'; |
||
| 207 | require_once $GLOBALS['xoops']->path('footer.php'); |
||
| 208 |
This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.
If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.