This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | |||||
3 | use Xmf\Highlighter; |
||||
4 | use Xmf\Metagen; |
||||
5 | use Xmf\Request; |
||||
6 | |||||
7 | // |
||||
8 | // ------------------------------------------------------------------------ // |
||||
9 | // XOOPS - PHP Content Management System // |
||||
10 | // Copyright (c) 2000-2020 XOOPS.org // |
||||
11 | // <https://xoops.org> // |
||||
12 | // ------------------------------------------------------------------------ // |
||||
13 | // This program is free software; you can redistribute it and/or modify // |
||||
14 | // it under the terms of the GNU General Public License as published by // |
||||
15 | // the Free Software Foundation; either version 2 of the License, or // |
||||
16 | // (at your option) any later version. // |
||||
17 | // // |
||||
18 | // You may not change or alter any portion of this comment or credits // |
||||
19 | // of supporting developers from this source code or any supporting // |
||||
20 | // source code which is considered copyrighted (c) material of the // |
||||
21 | // original comment or credit authors. // |
||||
22 | // // |
||||
23 | // This program is distributed in the hope that it will be useful, // |
||||
24 | // but WITHOUT ANY WARRANTY; without even the implied warranty of // |
||||
25 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // |
||||
26 | // GNU General Public License for more details. // |
||||
27 | // // |
||||
28 | // You should have received a copy of the GNU General Public License // |
||||
29 | // along with this program; if not, write to the Free Software // |
||||
30 | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA // |
||||
31 | // ------------------------------------------------------------------------ // |
||||
32 | // Author: phppp (D.J., [email protected]) // |
||||
33 | // URL: https://xoops.org // |
||||
34 | // Project: Article Project // |
||||
35 | // ------------------------------------------------------------------------ // |
||||
36 | |||||
37 | require_once __DIR__ . '/header.php'; |
||||
38 | xoops_loadLanguage('search'); |
||||
39 | /** @var \XoopsConfigHandler $configHandler */ |
||||
40 | $configHandler = xoops_getHandler('config'); |
||||
41 | $xoopsConfigSearch = $configHandler->getConfigsByCat(XOOPS_CONF_SEARCH); |
||||
42 | if (1 !== $xoopsConfigSearch['enable_search']) { |
||||
43 | redirect_header(XOOPS_URL . '/modules/newbb/index.php', 2, _MD_NEWBB_SEARCHDISABLED); |
||||
44 | } |
||||
45 | |||||
46 | $GLOBALS['xoopsConfig']['module_cache'][$xoopsModule->getVar('mid')] = 0; |
||||
47 | $xoopsOption['template_main'] = 'newbb_search.tpl'; |
||||
48 | require_once $GLOBALS['xoops']->path('header.php'); |
||||
49 | |||||
50 | require_once __DIR__ . '/include/functions.render.php'; |
||||
51 | require_once __DIR__ . '/include/functions.forum.php'; |
||||
52 | require_once __DIR__ . '/include/functions.time.php'; |
||||
53 | |||||
54 | require_once $GLOBALS['xoops']->path('modules/newbb/include/search.inc.php'); |
||||
55 | $limit = $GLOBALS['xoopsModuleConfig']['topics_per_page']; |
||||
56 | |||||
57 | $queries = []; |
||||
58 | $andor = ''; |
||||
59 | $start = 0; |
||||
60 | $uid = 0; |
||||
61 | $forum = 0; |
||||
62 | $sortby = 'p.post_time'; // irmtfan remove DESC |
||||
63 | $criteriaExtra = new \CriteriaCompo(); // irmtfan new \Criteria |
||||
64 | $searchin = 'both'; |
||||
65 | $sort = ''; |
||||
66 | $since = Request::getInt('since', null); |
||||
67 | $next_search['since'] = $since; |
||||
68 | $term = Request::getString('term', null); |
||||
69 | $uname = Request::getString('uname', null); |
||||
70 | // irmtfan add select parameters |
||||
71 | $selectlength = Request::getInt('selectlength', 200); |
||||
72 | |||||
73 | // irmtfan assign default values to variables |
||||
74 | $show_search = 'post_text'; |
||||
75 | $search_username = trim($uname); |
||||
76 | |||||
77 | if ($GLOBALS['xoopsModuleConfig']['wol_enabled']) { |
||||
78 | // /** @var Newbb\OnlineHandler $onlineHandler */ |
||||
79 | // $onlineHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Online'); |
||||
80 | $onlineHandler->init(0); |
||||
81 | } |
||||
82 | |||||
83 | $xoopsTpl->assign('forumindex', sprintf(_MD_NEWBB_FORUMINDEX, htmlspecialchars($GLOBALS['xoopsConfig']['sitename'], ENT_QUOTES))); |
||||
84 | //$xoopsTpl->assign("img_folder", newbbDisplayImage($forumImage['topic'])); |
||||
85 | |||||
86 | if (!empty($uname) || Request::getString('submit', '') || !empty($term)) { |
||||
87 | // irmtfan filter positive numbers |
||||
88 | $selectlength = !empty($selectlength) ? abs($selectlength) : 200; |
||||
89 | // irmtfan add select parameters for next search |
||||
90 | $next_search['selectlength'] = $selectlength; |
||||
91 | |||||
92 | $start = Request::getInt('start', 0); |
||||
93 | $forum = Request::getInt('forum', null); |
||||
94 | if (empty($forum) || 'all' === $forum || (is_array($forum) && in_array('all', $forum))) { |
||||
95 | $forum = []; |
||||
96 | } elseif (!is_array($forum)) { |
||||
0 ignored issues
–
show
introduced
by
![]() |
|||||
97 | $forum = array_map('\intval', explode('|', $forum)); |
||||
98 | } |
||||
99 | $next_search['forum'] = implode('|', $forum); |
||||
100 | // START irmtfan topic search |
||||
101 | $topic = Request::getString('topic', null); |
||||
102 | $next_search['topic'] = $topic; |
||||
103 | // END irmtfan topic search |
||||
104 | // START irmtfan add show search |
||||
105 | $show_search = Request::getString('show_search', 'post_text'); |
||||
106 | $next_search['show_search'] = $show_search; |
||||
107 | // START irmtfan add show search |
||||
108 | |||||
109 | $addterms = Request::getString('andor', 'AND'); |
||||
110 | $next_search['andor'] = $addterms; |
||||
111 | $andor = mb_strtoupper($addterms); |
||||
112 | if (!in_array($addterms, ['OR', 'AND'])) { |
||||
113 | $andor = 'AND'; |
||||
114 | } |
||||
115 | |||||
116 | $uname_required = false; |
||||
117 | $next_search['uname'] = $search_username; |
||||
118 | if (!empty($search_username)) { |
||||
119 | $uname_required = true; |
||||
120 | $search_username = $GLOBALS['xoopsDB']->escape($search_username); |
||||
121 | if (!$result = $GLOBALS['xoopsDB']->query('SELECT uid FROM ' . $GLOBALS['xoopsDB']->prefix('users') . " WHERE uname LIKE '%$search_username%'")) { |
||||
122 | redirect_header(XOOPS_URL . '/search.php', 1, _MD_NEWBB_ERROROCCURED); |
||||
123 | } |
||||
124 | $uid = []; |
||||
125 | while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||||
126 | $uid[] = $row['uid']; |
||||
127 | } |
||||
128 | } else { |
||||
129 | $uid = 0; |
||||
130 | } |
||||
131 | |||||
132 | $next_search['term'] = htmlspecialchars($term, ENT_QUOTES); |
||||
133 | $query = trim($term); |
||||
134 | |||||
135 | if ('EXACT' !== $andor) { |
||||
136 | $ignored_queries = []; // holds keywords that are shorter than allowed minimum length |
||||
137 | $temp_queries = str_getcsv($query, ' ', '"'); |
||||
138 | foreach ($temp_queries as $q) { |
||||
139 | $q = trim($q); |
||||
140 | if (mb_strlen($q) >= $xoopsConfigSearch['keyword_min']) { |
||||
141 | $queries[] = $q; |
||||
142 | } else { |
||||
143 | $ignored_queries[] = $q; |
||||
144 | } |
||||
145 | } |
||||
146 | if (!$uname_required && 0 === count($queries)) { |
||||
147 | redirect_header(XOOPS_URL . '/search.php', 2, sprintf(_SR_KEYTOOSHORT, $xoopsConfigSearch['keyword_min'])); |
||||
148 | } |
||||
149 | } else { |
||||
150 | //$query = trim($query); |
||||
151 | if (!$uname_required && (mb_strlen($query) < $xoopsConfigSearch['keyword_min'])) { |
||||
152 | redirect_header(XOOPS_URL . '/search.php', 2, sprintf(_SR_KEYTOOSHORT, $xoopsConfigSearch['keyword_min'])); |
||||
153 | } |
||||
154 | $queries = [$query]; |
||||
155 | } |
||||
156 | |||||
157 | // entries must be lowercase |
||||
158 | $allowed = ['p.post_time', 'p.subject']; // irmtfan just post time and subject |
||||
159 | |||||
160 | $sortby = Request::getString('sortby', 'p.post_time'); |
||||
161 | $next_search['sortby'] = $sortby; |
||||
162 | //$sortby = (in_array(strtolower($sortby), $allowed)) ? $sortby : 't.topic_last_post_id'; |
||||
163 | $sortby = in_array(mb_strtolower($sortby), $allowed) ? $sortby : 'p.post_time'; |
||||
164 | $searchin = Request::getString('searchin', 'both'); |
||||
165 | $next_search['searchin'] = $searchin; |
||||
166 | // START irmtfan use criteria - add since and topic search |
||||
167 | if (!empty($since)) { |
||||
168 | $criteriaExtra->add(new \Criteria('p.post_time', time() - newbbGetSinceTime($since), '>='), 'OR'); |
||||
169 | } |
||||
170 | if (is_numeric($topic) && !empty($topic)) { |
||||
171 | $criteriaExtra->add(new \Criteria('p.topic_id', $topic), 'OR'); |
||||
172 | } |
||||
173 | // END irmtfan use criteria - add since and topic search |
||||
174 | |||||
175 | if ($uname_required && (!$uid || count($uid) < 1)) { |
||||
0 ignored issues
–
show
It seems like
$uid can also be of type integer ; however, parameter $var of count() does only seem to accept Countable|array , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
176 | $results = []; |
||||
177 | } // irmtfan bug fix array() |
||||
178 | else { |
||||
179 | $results = newbb_search($queries, $andor, $limit, $start, $uid, $forum, $sortby, $searchin, $criteriaExtra); |
||||
0 ignored issues
–
show
$forum of type array is incompatible with the type integer expected by parameter $forums of newbb_search() .
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
180 | } // irmtfan $criteriaExtra |
||||
181 | |||||
182 | $search_info_keywords = Highlighter::apply($myts->htmlSpecialChars($term, ENT_QUOTES), implode(' ', $queries), '<mark>', '</mark>'); |
||||
183 | $num_results = count($results); |
||||
184 | if ($num_results < 1) { |
||||
185 | $xoopsTpl->assign('lang_nomatch', _SR_NOMATCH); |
||||
186 | } else { |
||||
187 | $skipresults = 0; |
||||
188 | foreach ($results as $row) { |
||||
189 | $post_text_select = ''; |
||||
190 | $post_subject_select = Highlighter::apply($queries, $row['title'], '<mark>', '</mark>'); |
||||
191 | if ('post_text' === $show_search) { |
||||
192 | $post_text_select = Metagen::getSearchSummary($row['post_text'], $queries, $selectlength); |
||||
0 ignored issues
–
show
It seems like
$selectlength can also be of type double ; however, parameter $length of Xmf\Metagen::getSearchSummary() does only seem to accept integer , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
193 | $post_text_select = Highlighter::apply($queries, $post_text_select, '<mark>', '</mark>'); |
||||
194 | } |
||||
195 | // if no text remained after select text continue |
||||
196 | if (empty($post_text_select) && empty($post_subject_select)) { |
||||
197 | ++$skipresults; |
||||
198 | continue; |
||||
199 | } |
||||
200 | $xoopsTpl->append( |
||||
201 | 'results', |
||||
202 | [ |
||||
203 | 'forum_name' => $row['forum_name'], |
||||
204 | 'forum_link' => $row['forum_link'], |
||||
205 | 'link' => $row['link'], |
||||
206 | 'title' => $post_subject_select, |
||||
207 | 'poster' => $row['poster'], |
||||
208 | 'post_time' => formatTimestamp($row['time'], 'm'), |
||||
209 | 'post_text' => $post_text_select, |
||||
210 | ] |
||||
211 | ); |
||||
212 | } |
||||
213 | unset($results); |
||||
214 | |||||
215 | if (count($next_search) > 0) { |
||||
216 | $items = []; |
||||
217 | foreach ($next_search as $para => $val) { |
||||
218 | $items[] = "{$para}=" . urlencode($val); |
||||
219 | } |
||||
220 | if (count($items) > 0) { |
||||
221 | $paras = implode('&', $items); |
||||
222 | } |
||||
223 | unset($next_search, $items); |
||||
224 | } |
||||
225 | $search_url = XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . '/search.php?' . $paras; |
||||
226 | // irmtfan remove to have just one query and appropriate next and prev links |
||||
227 | //$next_results = newbb_search($queries, $andor, 1, $start + $limit, $uid, $forum, $sortby, $searchin, $subquery); |
||||
228 | //$next_count = count($next_results); |
||||
229 | //$has_next = false; |
||||
230 | //if (is_array($next_results) && $next_count >0) { |
||||
231 | //$has_next = true; |
||||
232 | //} |
||||
233 | // irmtfan if $results < $limit => it is impossible to have next |
||||
234 | if ($num_results == $limit) { |
||||
235 | $next = $start + $limit; |
||||
236 | $queries = implode(',', $queries); |
||||
237 | $search_url_next = htmlspecialchars($search_url . "&direction=next&start={$next}", ENT_QUOTES | ENT_HTML5); |
||||
238 | $search_next = '<a href="' . $search_url_next . '">' . _SR_NEXT . '</a>'; |
||||
239 | $xoopsTpl->assign('search_next', $search_next); |
||||
240 | $xoopsTpl->assign('search_next_url', $search_url_next); |
||||
241 | } |
||||
242 | if ($start > 0) { |
||||
243 | $prev = $start - $limit; |
||||
244 | $search_url_prev = htmlspecialchars($search_url . "&direction=previous&start={$prev}", ENT_QUOTES | ENT_HTML5); |
||||
245 | $search_prev = '<a href="' . $search_url_prev . '">' . _SR_PREVIOUS . '</a>'; |
||||
246 | $xoopsTpl->assign('search_prev', $search_prev); |
||||
247 | $xoopsTpl->assign('search_prev_url', $search_url_prev); |
||||
248 | } |
||||
249 | // irmtfan if all results skipped then redirect to the next/previous page |
||||
250 | if ($num_results == $skipresults) { |
||||
251 | $direction = Request::getString('direction', 'next'); |
||||
252 | $search_url_redirect = ('next' === mb_strtolower($direction)) ? $search_url_next : $search_url_prev; |
||||
253 | redirect_header($search_url_redirect, 1, constant(mb_strtoupper("_SR_{$direction}"))); |
||||
254 | } |
||||
255 | } |
||||
256 | $search_info = _SR_KEYWORDS . ': ' . $search_info_keywords; |
||||
257 | if ($uname_required) { |
||||
258 | if ($search_info) { |
||||
259 | $search_info .= '<br>'; |
||||
260 | } |
||||
261 | $search_info .= _MD_NEWBB_USERNAME . ': ' . $myts->htmlSpecialChars($search_username); |
||||
262 | } |
||||
263 | // add num_results |
||||
264 | $search_info .= '<br>' . sprintf(_SR_SHOWING, $start + 1, $start + $num_results); |
||||
265 | // if any result skip show the counter |
||||
266 | if (!empty($skipresults)) { |
||||
267 | $search_info .= ' - ' . sprintf(_SR_FOUND, $num_results - $skipresults); |
||||
268 | } |
||||
269 | $xoopsTpl->assign('search_info', $search_info); |
||||
270 | } |
||||
271 | // assign template vars for search |
||||
272 | /* term */ |
||||
273 | $xoopsTpl->assign('search_term', htmlspecialchars($term, ENT_QUOTES)); |
||||
274 | |||||
275 | /* andor */ |
||||
276 | $andor_select = '<select name="andor" id="andor" class="form-control">'; |
||||
277 | $andor_select .= '<option value="OR"'; |
||||
278 | if ('OR' === $andor) { |
||||
279 | $andor_select .= ' selected="selected"'; |
||||
280 | } |
||||
281 | $andor_select .= '>' . _SR_ANY . '</option>'; |
||||
282 | $andor_select .= '<option value="AND"'; |
||||
283 | if ('AND' === $andor || empty($andor)) { |
||||
284 | $andor_select .= ' selected="selected"'; |
||||
285 | } |
||||
286 | $andor_select .= '>' . _SR_ALL . '</option>'; |
||||
287 | $andor_select .= '</select>'; |
||||
288 | $xoopsTpl->assign('andor_selection_box', $andor_select); |
||||
289 | |||||
290 | /* forum */ |
||||
291 | $select_forum = '<select class="form-control" name="forum[]" id="forum" size="5" multiple="multiple">'; |
||||
292 | $select_forum .= '<option value="all">' . _MD_NEWBB_SEARCHALLFORUMS . '</option>'; |
||||
293 | $select_forum .= newbbForumSelectBox($forum); |
||||
0 ignored issues
–
show
It seems like
$forum can also be of type integer ; however, parameter $value of newbbForumSelectBox() does only seem to accept array|null , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
294 | $select_forum .= '</select>'; |
||||
295 | $xoopsTpl->assign_by_ref('forum_selection_box', $select_forum); |
||||
296 | |||||
297 | /* searchin */ |
||||
298 | $searchin_select = ''; |
||||
299 | $searchin_select .= '<label class="radio-inline"><input type="radio" name="searchin" value="title"'; |
||||
300 | if ('title' === $searchin) { |
||||
301 | $searchin_select .= ' checked'; |
||||
302 | } |
||||
303 | $searchin_select .= ' >' . _MD_NEWBB_SUBJECT . ' </label>'; |
||||
304 | $searchin_select .= '<label class="radio-inline"><input type="radio" name="searchin" value="text"'; |
||||
305 | if ('text' === $searchin) { |
||||
306 | $searchin_select .= ' checked'; |
||||
307 | } |
||||
308 | $searchin_select .= ' >' . _MD_NEWBB_BODY . ' </label>'; |
||||
309 | $searchin_select .= '<label class="radio-inline"><input type="radio" name="searchin" value="both"'; |
||||
310 | if ('both' === $searchin || empty($searchin)) { |
||||
311 | $searchin_select .= ' checked'; |
||||
312 | } |
||||
313 | $searchin_select .= ' >' . _MD_NEWBB_SUBJECT . ' & ' . _MD_NEWBB_BODY . ' </label>'; |
||||
314 | $xoopsTpl->assign('searchin_radio', $searchin_select); |
||||
315 | |||||
316 | /* show_search */ |
||||
317 | $show_search_select = ''; |
||||
318 | $show_search_select .= '<label class="radio-inline"><input type="radio" name="show_search" value="post"'; |
||||
319 | if ('post' === $show_search) { |
||||
320 | $show_search_select .= ' checked'; |
||||
321 | } |
||||
322 | $show_search_select .= ' >' . _MD_NEWBB_POSTS . ' </label>'; |
||||
323 | $show_search_select .= '<label class="radio-inline"><input type="radio" name="show_search" value="post_text"'; |
||||
324 | if ('post_text' === $show_search || empty($show_search)) { |
||||
325 | $show_search_select .= ' checked'; |
||||
326 | } |
||||
327 | $show_search_select .= ' >' . _MD_NEWBB_SEARCHPOSTTEXT . ' </label>'; |
||||
328 | $xoopsTpl->assign('show_search_radio', $show_search_select); |
||||
329 | |||||
330 | /* author */ |
||||
331 | $xoopsTpl->assign('author_select', $search_username); |
||||
332 | |||||
333 | /* sortby */ |
||||
334 | $sortby_select = '<select name="sortby" id="sortby" class="form-control">'; |
||||
335 | $sortby_select .= '<option value=\'p.post_time\''; |
||||
336 | if ('p.post_time' === $sortby || empty($sortby)) { |
||||
337 | $sortby_select .= ' selected=\'selected\''; |
||||
338 | } |
||||
339 | $sortby_select .= '>' . _MD_NEWBB_DATE . '</option>'; |
||||
340 | $sortby_select .= '<option value=\'p.subject\''; |
||||
341 | if ('p.subject' === $sortby) { |
||||
342 | $sortby_select .= ' selected="selected"'; |
||||
343 | } |
||||
344 | $sortby_select .= '>' . _MD_NEWBB_TOPIC . '</option>'; |
||||
345 | $sortby_select .= '</select>'; |
||||
346 | $xoopsTpl->assign('sortby_selection_box', $sortby_select); |
||||
347 | |||||
348 | /* selectlength */ |
||||
349 | $xoopsTpl->assign('selectlength_select', $selectlength); |
||||
350 | |||||
351 | // irmtfan get since from the user for selction box |
||||
352 | $since = Request::getInt('since', $GLOBALS['xoopsModuleConfig']['since_default']); |
||||
353 | $select_since = newbbSinceSelectBox($since); |
||||
354 | $xoopsTpl->assign_by_ref('since_selection_box', $select_since); |
||||
355 | |||||
356 | if ($xoopsConfigSearch['keyword_min'] > 0) { |
||||
357 | $xoopsTpl->assign('search_rule', sprintf(_SR_KEYIGNORE, $xoopsConfigSearch['keyword_min'])); |
||||
358 | } |
||||
359 | // irmtfan move to footer.php |
||||
360 | require_once __DIR__ . '/footer.php'; |
||||
361 | require_once $GLOBALS['xoops']->path('footer.php'); |
||||
362 |