This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | /** |
||
3 | * NewBB 5.0x, the forum module for XOOPS project |
||
4 | * |
||
5 | * @copyright XOOPS Project (https://xoops.org) |
||
6 | * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html) |
||
7 | * @author Taiwen Jiang (phppp or D.J.) <[email protected]> |
||
8 | * @since 4.00 |
||
9 | * @package module::newbb |
||
10 | */ |
||
11 | |||
12 | use Xmf\Request; |
||
13 | |||
14 | require_once __DIR__ . '/header.php'; |
||
15 | |||
16 | global $xoTheme, $xoopsTpl; |
||
17 | $GLOBALS['xoopsOption']['template_main'] = 'newbb_moderate.tpl'; |
||
18 | require_once $GLOBALS['xoops']->path('header.php'); |
||
19 | |||
20 | $forum_userid = Request::getInt('uid', 0); |
||
21 | $forum_id = Request::getInt('forum', 0); |
||
22 | $isAdmin = newbbIsAdmin($forum_id); |
||
23 | if (!$isAdmin) { |
||
24 | redirect_header(XOOPS_URL . '/index.php', 2, _MD_NEWBB_NORIGHTTOACCESS); |
||
25 | } |
||
26 | $is_administrator = $GLOBALS['xoopsUserIsAdmin']; |
||
27 | ///** @var Newbb\ModerateHandler $moderateHandler */ |
||
28 | //$moderateHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Moderate'); |
||
29 | |||
30 | if (Request::hasVar('submit', 'POST') && Request::getInt('expire', 0, 'POST')) { |
||
31 | $ipWithMask = ''; |
||
32 | if (0 == $forum_userid) { |
||
33 | $ipWithMask = Request::getString('ip', null, 'POST'); |
||
34 | $mask = ''; |
||
35 | $ipParts = explode('/', $ipWithMask); |
||
36 | $ip = new \Xmf\IPAddress($ipParts[0]); |
||
37 | if (false === $ip->asReadable()) { |
||
0 ignored issues
–
show
introduced
by
![]() |
|||
38 | $ipWithMask = ''; |
||
39 | } else { |
||
40 | $ipWithMask = $ip->asReadable(); |
||
41 | $mask = empty($ipParts[1]) ? 0 : (int)$ipParts[1]; |
||
42 | $mask = ($mask > ((4 === $ip->ipVersion()) ? 32 : 128) || $mask < 8) ? '' : $mask; |
||
43 | $ipWithMask .= empty($mask) ? '' : '/' . $mask; |
||
44 | } |
||
45 | } |
||
46 | |||
47 | $mod_end = time() + Request::getInt('expire', 0, 'POST') * 3600 * 24; |
||
48 | $mod_desc = Request::getString('desc', '', 'POST'); |
||
49 | |||
50 | $moderateObject = $moderateHandler->create(); |
||
51 | $moderateObject->setVar('uid', $forum_userid); |
||
52 | $moderateObject->setVar('ip', $ipWithMask); |
||
53 | $moderateObject->setVar('forum_id', $forum_id); |
||
54 | $moderateObject->setVar('mod_start', time()); |
||
55 | $moderateObject->setVar('mod_end', $mod_end); |
||
56 | $moderateObject->setVar('mod_desc', $mod_desc); |
||
57 | $res = $moderateHandler->insert($moderateObject); |
||
58 | |||
59 | redirect_header("moderate.php?forum={$forum_id}", 2, _MD_NEWBB_DBUPDATED); |
||
60 | } elseif (Request::hasVar('del')) { |
||
61 | $moderateObject = $moderateHandler->get(Request::getInt('del', 0, 'GET')); |
||
62 | if ($is_administrator || $moderateObject->getVar('forum_id') == $forum_id) { |
||
63 | $moderateHandler->delete($moderateObject, true); |
||
64 | redirect_header("moderate.php?forum={$forum_id}", 2, _MD_NEWBB_DBUPDATED); |
||
65 | } |
||
66 | } |
||
67 | |||
68 | $start = Request::getInt('start', 0, 'GET'); |
||
69 | $sortname = Request::getString('sort', '', 'GET'); |
||
70 | |||
71 | switch ($sortname) { |
||
72 | case 'uid': |
||
73 | $sort = 'uid ASC, ip'; |
||
74 | $order = 'ASC'; |
||
75 | break; |
||
76 | case 'start': |
||
77 | $sort = 'mod_start'; |
||
78 | $order = 'ASC'; |
||
79 | break; |
||
80 | case 'expire': |
||
81 | $sort = 'mod_end'; |
||
82 | $order = 'DESC'; |
||
83 | break; |
||
84 | default: |
||
85 | $sort = 'forum_id ASC, uid ASC, ip'; |
||
86 | $order = 'ASC'; |
||
87 | break; |
||
88 | } |
||
89 | // show all bans for module admin - for moderator just show its forum_id bans |
||
90 | $criteria = new \CriteriaCompo(); |
||
91 | if (!$is_administrator) { |
||
92 | $criteria->add(new \Criteria('forum_id', $forum_id, '=')); |
||
93 | } |
||
94 | $criteria->setLimit($GLOBALS['xoopsModuleConfig']['topics_per_page']); |
||
95 | $criteria->setStart($start); |
||
96 | $criteria->setSort($sort); |
||
97 | $criteria->setOrder($order); |
||
98 | $moderateObjects = $moderateHandler->getObjects($criteria); |
||
99 | $moderate_count = $moderateHandler->getCount($criteria); |
||
100 | |||
101 | $url = 'moderate.php'; |
||
102 | if ($forum_id) { |
||
103 | $url .= '?forum=' . $forum_id; |
||
104 | } |
||
105 | $xoopsTpl->assign('moderate_url', $url); |
||
106 | |||
107 | if (!empty($moderate_count)) { |
||
108 | $_users = []; |
||
109 | foreach (array_keys($moderateObjects) as $id) { |
||
110 | $_users[$moderateObjects[$id]->getVar('uid')] = 1; |
||
111 | } |
||
112 | $users = newbbGetUnameFromIds(array_keys($_users), $GLOBALS['xoopsModuleConfig']['show_realname'], true); |
||
113 | |||
114 | $columnHeaders ['uid'] = [ |
||
115 | 'url' => 'moderate.php?forum=' . $forum_id . '&start=' . $start . '&sort=uid', |
||
116 | 'header' => _MD_NEWBB_SUSPEND_UID, |
||
117 | 'title' => _MD_NEWBB_SUSPEND_UID, |
||
118 | ]; |
||
119 | $columnHeaders ['start'] = [ |
||
120 | 'url' => 'moderate.php?forum=' . $forum_id . '&start=' . $start . '&sort=start', |
||
121 | 'header' => _MD_NEWBB_SUSPEND_START, |
||
122 | 'title' => _MD_NEWBB_SUSPEND_START, |
||
123 | ]; |
||
124 | $columnHeaders['expire'] = [ |
||
125 | 'url' => 'moderate.php?forum=' . $forum_id . '&start=' . $start . '&sort=expire', |
||
126 | 'header' => _MD_NEWBB_SUSPEND_EXPIRE, |
||
127 | 'title' => _MD_NEWBB_SUSPEND_EXPIRE, |
||
128 | ]; |
||
129 | $columnHeaders['forum'] = [ |
||
130 | 'url' => 'moderate.php?forum=' . $forum_id . '&start=' . $start . '&sort=forum', |
||
131 | 'header' => _MD_NEWBB_SUSPEND_SCOPE, |
||
132 | 'title' => _MD_NEWBB_SUSPEND_SCOPE, |
||
133 | ]; |
||
134 | $columnHeaders['desc'] = [ |
||
135 | 'url' => false, |
||
136 | 'header' => _MD_NEWBB_SUSPEND_DESC, |
||
137 | 'title' => _MD_NEWBB_SUSPEND_DESC, |
||
138 | ]; |
||
139 | $columnHeaders['options'] = [ |
||
140 | 'url' => false, |
||
141 | 'header' => _DELETE, |
||
142 | 'title' => _DELETE, |
||
143 | ]; |
||
144 | $xoopsTpl->assign('columnHeaders', $columnHeaders); |
||
145 | |||
146 | // /** @var Newbb\ForumHandler $forumHandler */ |
||
147 | // $forumHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Forum'); |
||
148 | $forum_list = $forumHandler->getAll(null, ['forum_name'], false); |
||
149 | |||
150 | $columnRows = []; |
||
151 | foreach (array_keys($moderateObjects) as $id) { |
||
152 | // for anon, show ip instead |
||
153 | $row['uid'] = ($moderateObjects[$id]->getVar('uid') ? (isset($users[$moderateObjects[$id]->getVar('uid')]) ? $users[$moderateObjects[$id]->getVar('uid')] : $moderateObjects[$id]->getVar('uid')) : $moderateObjects[$id]->getVar('ip')); |
||
154 | $row['start'] = formatTimestamp($moderateObjects[$id]->getVar('mod_start')); |
||
155 | $row['expire'] = formatTimestamp($moderateObjects[$id]->getVar('mod_end')); |
||
156 | $row['forum'] = ($moderateObjects[$id]->getVar('forum_id') ? $forum_list[$moderateObjects[$id]->getVar('forum_id')]['forum_name'] : _ALL); |
||
157 | $row['desc'] = ($moderateObjects[$id]->getVar('mod_desc') ?: _NONE); |
||
158 | $row['options'] = (($is_administrator |
||
159 | || $moderateObjects[$id]->getVar('forum_id') == $forum_id) ? '<a href="moderate.php?forum=' . $forum_id . '&del=' . $moderateObjects[$id]->getVar('mod_id') . '">' . _DELETE . '</a>' : ''); |
||
160 | $columnRows[] = $row; |
||
161 | } |
||
162 | $xoopsTpl->assign('columnRows', $columnRows); |
||
163 | |||
164 | if ($moderate_count > $GLOBALS['xoopsModuleConfig']['topics_per_page']) { |
||
165 | require_once $GLOBALS['xoops']->path('class/pagenav.php'); |
||
166 | $nav = new \XoopsPageNav($moderate_count, $GLOBALS['xoopsModuleConfig']['topics_per_page'], $start, 'start', 'forum=' . $forum_id . '&sort=' . $sortname); |
||
167 | //if (isset($GLOBALS['xoopsModuleConfig']['do_rewrite'])) { |
||
168 | // $nav->url = formatURL(Request::getString('SERVER_NAME', '', 'SERVER')) . ' /' . $nav->url; |
||
169 | //} |
||
170 | $xoopsTpl->assign('moderate_page_nav', $nav->renderNav()); |
||
171 | } |
||
172 | } |
||
173 | |||
174 | require_once $GLOBALS['xoops']->path('class/xoopsformloader.php'); |
||
175 | $forum_form = new \XoopsThemeForm(_ADD, 'suspend_form', 'moderate.php', 'post', true); |
||
176 | $forum_form->addElement(new \XoopsFormSelectUser(_MD_NEWBB_SUSPEND_UID, 'uid', true, $forum_userid, 1, false)); |
||
177 | $forum_form->addElement(new \XoopsFormText(_MD_NEWBB_SUSPEND_IP, 'ip', 50, 50)); |
||
178 | $forum_form->addElement(new \XoopsFormText(_MD_NEWBB_SUSPEND_DURATION, 'expire', 20, 25, '5'), true); |
||
179 | $forum_form->addElement(new \XoopsFormText(_MD_NEWBB_SUSPEND_DESC, 'desc', 50, 255)); |
||
180 | require_once __DIR__ . '/include/functions.forum.php'; |
||
181 | if (newbbIsAdmin()) { |
||
182 | $forumSel = '<select name="forum">'; // if user doesn't select, default is "0" all forums |
||
183 | $forumSel .= '<option value="0"'; |
||
184 | if (0 == $forum_id) { |
||
185 | $forumSel .= ' selected'; |
||
186 | } |
||
187 | $forumSel .= '>' . _ALL . '</option>'; |
||
188 | $forumSel .= newbbForumSelectBox($forum_id, 'access', false); //$accessForums, $permission = "access", $delimitorCategory = true |
||
189 | $forumSel .= '</select>'; |
||
190 | $forumEle = new \XoopsFormLabel(_MD_NEWBB_SELFORUM, $forumSel); |
||
191 | $forumEle->customValidationCode[] = 'if (document.suspend.forum.value < 0) {return false;} '; |
||
192 | $forum_form->addElement($forumEle); |
||
193 | } else { |
||
194 | $forum_form->addElement(new \XoopsFormHidden('forum', $forum_id)); |
||
195 | } |
||
196 | $forum_form->addElement(new \XoopsFormButton('', 'submit', _SUBMIT, 'submit')); |
||
197 | $forum_form->assign($xoopsTpl); |
||
198 | |||
199 | require_once __DIR__ . '/footer.php'; |
||
200 | require_once $GLOBALS['xoops']->path('footer.php'); |
||
201 |