This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | /** |
||||
3 | * Newbb module |
||||
4 | * |
||||
5 | * You may not change or alter any portion of this comment or credits |
||||
6 | * of supporting developers from this source code or any supporting source code |
||||
7 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||
8 | * This program is distributed in the hope that it will be useful, |
||||
9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
11 | * |
||||
12 | * @copyright XOOPS Project (https://xoops.org) |
||||
13 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||||
14 | * @package newbb |
||||
15 | * @since 4.0 |
||||
16 | * @author Taiwen Jiang <[email protected]> |
||||
17 | */ |
||||
18 | |||||
19 | use XoopsModules\Newbb; |
||||
20 | |||||
21 | |||||
22 | |||||
23 | /** |
||||
24 | * Function to a list of user names associated with their user IDs |
||||
25 | * @param $uid |
||||
26 | * @param int $usereal |
||||
27 | * @param bool $linked |
||||
28 | * @return array |
||||
29 | */ |
||||
30 | function newbbGetUnameFromIds($uid, $usereal = 0, $linked = false) |
||||
31 | { |
||||
32 | xoops_load('xoopsuserutility'); |
||||
33 | $ids = \XoopsUserUtility::getUnameFromIds($uid, $usereal, $linked); |
||||
34 | |||||
35 | return $ids; |
||||
36 | } |
||||
37 | |||||
38 | /** |
||||
39 | * @param $uid |
||||
40 | * @param int $usereal |
||||
41 | * @param bool $linked |
||||
42 | * @return string |
||||
43 | */ |
||||
44 | function newbbGetUnameFromId($uid, $usereal = 0, $linked = false) |
||||
45 | { |
||||
46 | xoops_load('xoopsuserutility'); |
||||
47 | |||||
48 | return \XoopsUserUtility::getUnameFromId($uid, $usereal, $linked); |
||||
49 | } |
||||
50 | |||||
51 | /** |
||||
52 | * Function to check if a user is an administrator of the module |
||||
53 | * |
||||
54 | * @param int|string|array|\XoopsUser $user |
||||
55 | * @param int $mid |
||||
56 | * @return bool |
||||
57 | */ |
||||
58 | function newbbIsAdministrator($user = -1, $mid = 0) |
||||
59 | { |
||||
60 | global $xoopsModule; |
||||
61 | |||||
62 | if (is_numeric($user) && -1 == $user) { |
||||
63 | $user = $GLOBALS['xoopsUser']; |
||||
64 | } |
||||
65 | if (!is_object($user) && (int)$user < 1) { |
||||
66 | return false; |
||||
67 | } |
||||
68 | $uid = is_object($user) ? $user->getVar('uid') : (int)$user; |
||||
69 | |||||
70 | if (!$mid) { |
||||
71 | if (is_object($xoopsModule) && 'newbb' === $xoopsModule->getVar('dirname', 'n')) { |
||||
72 | $mid = $xoopsModule->getVar('mid', 'n'); |
||||
73 | } else { |
||||
74 | /** @var \XoopsModuleHandler $moduleHandler */ |
||||
75 | $moduleHandler = xoops_getHandler('module'); |
||||
76 | $newbb_module = $moduleHandler->getByDirname('newbb'); |
||||
77 | $mid = $newbb_module->getVar('mid', 'n'); |
||||
78 | unset($newbb_module); |
||||
79 | } |
||||
80 | } |
||||
81 | |||||
82 | if (is_object($xoopsModule) && is_object($GLOBALS['xoopsUser']) && $mid == $xoopsModule->getVar('mid', 'n') |
||||
83 | && $uid == $GLOBALS['xoopsUser']->getVar('uid', 'n')) { |
||||
84 | return $GLOBALS['xoopsUserIsAdmin']; |
||||
85 | } |
||||
86 | |||||
87 | /** @var \XoopsMemberHandler $memberHandler */ |
||||
88 | $memberHandler = xoops_getHandler('member'); |
||||
89 | $groups = $memberHandler->getGroupsByUser($uid); |
||||
90 | |||||
91 | /** @var \XoopsGroupPermHandler $grouppermHandler */ |
||||
92 | $grouppermHandler = xoops_getHandler('groupperm'); |
||||
93 | |||||
94 | return $grouppermHandler->checkRight('module_admin', $mid, $groups); |
||||
95 | } |
||||
96 | |||||
97 | /** |
||||
98 | * Function to check if a user is a moderator of a forum |
||||
99 | * |
||||
100 | * @param $forum |
||||
101 | * @param int|array |string|\XoopsUser $user |
||||
102 | * @return bool |
||||
103 | */ |
||||
104 | function newbbIsModerator(&$forum, $user = -1) |
||||
105 | { |
||||
106 | if (!is_object($forum)) { |
||||
107 | $forum_id = (int)$forum; |
||||
108 | if (0 == $forum_id) { |
||||
109 | return false; |
||||
110 | } |
||||
111 | $forumHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Forum'); |
||||
112 | $forum = $forumHandler->get($forum_id); |
||||
113 | } |
||||
114 | |||||
115 | if (is_numeric($user) && -1 == $user) { |
||||
116 | $user = $GLOBALS['xoopsUser']; |
||||
117 | } |
||||
118 | if (!is_object($user) && (int)$user < 1) { |
||||
119 | return false; |
||||
120 | } |
||||
121 | $uid = is_object($user) ? $user->getVar('uid', 'n') : (int)$user; |
||||
122 | |||||
123 | return in_array($uid, $forum->getVar('forum_moderator')); |
||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||
124 | } |
||||
125 | |||||
126 | /** |
||||
127 | * Function to check if a user has moderation permission over a forum |
||||
128 | * |
||||
129 | * @param Newbb\Forum|int $forum |
||||
130 | * @return bool |
||||
131 | */ |
||||
132 | function newbbIsAdmin($forum = 0) |
||||
133 | { |
||||
134 | global $xoopsModule; |
||||
135 | static $_cachedModerators; |
||||
136 | |||||
137 | if (empty($forum)) { |
||||
138 | return $GLOBALS['xoopsUserIsAdmin']; |
||||
139 | } |
||||
140 | |||||
141 | if (!is_object($GLOBALS['xoopsUser'])) { |
||||
142 | return false; |
||||
143 | } |
||||
144 | |||||
145 | if ($GLOBALS['xoopsUserIsAdmin'] && 'newbb' === $xoopsModule->getVar('dirname')) { |
||||
146 | return true; |
||||
147 | } |
||||
148 | |||||
149 | $cache_id = is_object($forum) ? $forum->getVar('forum_id', 'n') : (int)$forum; |
||||
150 | if (!isset($_cachedModerators[$cache_id])) { |
||||
151 | if (!is_object($forum)) { |
||||
152 | $forumHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Forum'); |
||||
153 | $forum = $forumHandler->get((int)$forum); |
||||
154 | } |
||||
155 | $_cachedModerators[$cache_id] = $forum->getVar('forum_moderator'); |
||||
156 | } |
||||
157 | |||||
158 | return in_array($GLOBALS['xoopsUser']->getVar('uid'), $_cachedModerators[$cache_id]); |
||||
159 | } |
||||
160 | |||||
161 | /* use hardcoded DB query to save queries */ |
||||
162 | /** |
||||
163 | * @param array $uid |
||||
164 | * @return array |
||||
165 | */ |
||||
166 | function newbbIsModuleAdministrators(array $uid = []) |
||||
167 | { |
||||
168 | global $xoopsModule; |
||||
169 | $module_administrators = []; |
||||
170 | |||||
171 | // $xoopsMembershipHandler = xoops_getHandler('membership'); |
||||
172 | // $xoopsMembershipTable = $xoopsMembershipHandler->table; |
||||
173 | |||||
174 | /** @var \XoopsMembershipHandler $xoopsMembershipHandler */ |
||||
175 | $xoopsMembershipHandler = xoops_getHandler('membership'); |
||||
176 | $xoopsMembershipTable = $xoopsMembershipHandler->table; |
||||
177 | /** @var \XoopsGroupPermHandler $xoopsGroupPermHandler */ |
||||
178 | $xoopsGroupPermHandler = xoops_getHandler('groupperm'); |
||||
179 | $xoopsGroupPermTable = $xoopsGroupPermHandler->table; |
||||
180 | |||||
181 | if (!(bool)$uid) { |
||||
182 | return $module_administrators; |
||||
183 | } |
||||
184 | $mid = $xoopsModule->getVar('mid'); |
||||
185 | |||||
186 | $sql = 'SELECT COUNT(l.groupid) AS count, l.uid FROM ' |
||||
187 | . $xoopsMembershipTable |
||||
188 | . ' AS l' |
||||
189 | . ' LEFT JOIN ' |
||||
190 | . $xoopsGroupPermTable |
||||
191 | . ' AS p ON p.gperm_groupid=l.groupid' |
||||
192 | . ' WHERE l.uid IN (' |
||||
193 | . implode(', ', array_map('\intval', $uid)) |
||||
194 | . ')' |
||||
195 | . " AND p.gperm_modid = '1' AND p.gperm_name = 'module_admin' AND p.gperm_itemid = '" |
||||
196 | . (int)$mid |
||||
197 | . "'" |
||||
198 | . ' GROUP BY l.uid'; |
||||
199 | |||||
200 | $result = $GLOBALS['xoopsDB']->query($sql); |
||||
201 | if ($result) { |
||||
202 | while (false !== ($myrow = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||||
203 | if (!empty($myrow['count'])) { |
||||
204 | $module_administrators[] = $myrow['uid']; |
||||
205 | } |
||||
206 | } |
||||
207 | } |
||||
208 | |||||
209 | return $module_administrators; |
||||
210 | } |
||||
211 | |||||
212 | /* use hardcoded DB query to save queries */ |
||||
213 | /** |
||||
214 | * @param array $uid |
||||
215 | * @param int $mid |
||||
216 | * @return array |
||||
217 | */ |
||||
218 | function newbbIsForumModerators(array $uid = [], $mid = 0) |
||||
0 ignored issues
–
show
The parameter
$mid is not used and could be removed.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for parameters that have been defined for a function or method, but which are not used in the method body. ![]() |
|||||
219 | { |
||||
220 | $forum_moderators = []; |
||||
221 | |||||
222 | if (!(bool)$uid) { |
||||
223 | return $forum_moderators; |
||||
224 | } |
||||
225 | |||||
226 | $sql = 'SELECT forum_moderator FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_forums'); |
||||
227 | $result = $GLOBALS['xoopsDB']->query($sql); |
||||
228 | if ($result) { |
||||
229 | while (false !== ($myrow = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||||
230 | if (empty($myrow['forum_moderator'])) { |
||||
231 | continue; |
||||
232 | } |
||||
233 | $forum_moderators = array_merge($forum_moderators, unserialize($myrow['forum_moderator'])); |
||||
234 | } |
||||
235 | } |
||||
236 | |||||
237 | return array_unique($forum_moderators); |
||||
238 | } |
||||
239 | //ENDIF; |
||||
240 |