This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | |||
3 | use Xmf\Highlighter; |
||
4 | use Xmf\Metagen; |
||
5 | use Xmf\Request; |
||
6 | |||
7 | // |
||
8 | // ------------------------------------------------------------------------ // |
||
9 | // XOOPS - PHP Content Management System // |
||
10 | // Copyright (c) 2000-2020 XOOPS.org // |
||
11 | // <https://xoops.org> // |
||
12 | // ------------------------------------------------------------------------ // |
||
13 | // This program is free software; you can redistribute it and/or modify // |
||
14 | // it under the terms of the GNU General Public License as published by // |
||
15 | // the Free Software Foundation; either version 2 of the License, or // |
||
16 | // (at your option) any later version. // |
||
17 | // // |
||
18 | // You may not change or alter any portion of this comment or credits // |
||
19 | // of supporting developers from this source code or any supporting // |
||
20 | // source code which is considered copyrighted (c) material of the // |
||
21 | // original comment or credit authors. // |
||
22 | // // |
||
23 | // This program is distributed in the hope that it will be useful, // |
||
24 | // but WITHOUT ANY WARRANTY; without even the implied warranty of // |
||
25 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // |
||
26 | // GNU General Public License for more details. // |
||
27 | // // |
||
28 | // You should have received a copy of the GNU General Public License // |
||
29 | // along with this program; if not, write to the Free Software // |
||
30 | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA // |
||
31 | // ------------------------------------------------------------------------ // |
||
32 | // Author: phppp (D.J., [email protected]) // |
||
33 | // URL: https://xoops.org // |
||
34 | // Project: Article Project // |
||
35 | // ------------------------------------------------------------------------ // |
||
36 | |||
37 | require_once __DIR__ . '/header.php'; |
||
38 | xoops_loadLanguage('search'); |
||
39 | /** @var \XoopsConfigHandler $configHandler */ |
||
40 | $configHandler = xoops_getHandler('config'); |
||
41 | $xoopsConfigSearch = $configHandler->getConfigsByCat(XOOPS_CONF_SEARCH); |
||
42 | if (1 !== $xoopsConfigSearch['enable_search']) { |
||
43 | redirect_header(XOOPS_URL . '/modules/newbb/index.php', 2, _MD_NEWBB_SEARCHDISABLED); |
||
44 | } |
||
45 | |||
46 | $GLOBALS['xoopsConfig']['module_cache'][$xoopsModule->getVar('mid')] = 0; |
||
47 | $xoopsOption['template_main'] = 'newbb_search.tpl'; |
||
48 | require_once $GLOBALS['xoops']->path('header.php'); |
||
49 | |||
50 | require_once __DIR__ . '/include/functions.render.php'; |
||
51 | require_once __DIR__ . '/include/functions.forum.php'; |
||
52 | require_once __DIR__ . '/include/functions.time.php'; |
||
53 | |||
54 | require_once $GLOBALS['xoops']->path('modules/newbb/include/search.inc.php'); |
||
55 | $limit = $GLOBALS['xoopsModuleConfig']['topics_per_page']; |
||
56 | |||
57 | $queries = []; |
||
58 | $andor = ''; |
||
59 | $start = 0; |
||
60 | $uid = 0; |
||
61 | $forum = 0; |
||
62 | $sortby = 'p.post_time'; // irmtfan remove DESC |
||
63 | $criteriaExtra = new \CriteriaCompo(); // irmtfan new \Criteria |
||
64 | $searchin = 'both'; |
||
65 | $sort = ''; |
||
66 | $since = Request::getInt('since', null); |
||
67 | $next_search['since'] = $since; |
||
68 | $term = Request::getString('term', null); |
||
69 | $uname = Request::getString('uname', null); |
||
70 | // irmtfan add select parameters |
||
71 | $selectlength = Request::getInt('selectlength', 200); |
||
72 | |||
73 | // irmtfan assign default values to variables |
||
74 | $show_search = 'post_text'; |
||
75 | $search_username = trim($uname); |
||
76 | |||
77 | if ($GLOBALS['xoopsModuleConfig']['wol_enabled']) { |
||
78 | // /** @var Newbb\OnlineHandler $onlineHandler */ |
||
79 | // $onlineHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Online'); |
||
80 | $onlineHandler->init(0); |
||
81 | } |
||
82 | |||
83 | $xoopsTpl->assign('forumindex', sprintf(_MD_NEWBB_FORUMINDEX, htmlspecialchars($GLOBALS['xoopsConfig']['sitename'], ENT_QUOTES))); |
||
84 | //$xoopsTpl->assign("img_folder", newbbDisplayImage($forumImage['topic'])); |
||
85 | |||
86 | if (!empty($uname) || Request::getString('submit', '') || !empty($term)) { |
||
87 | // irmtfan filter positive numbers |
||
88 | $selectlength = !empty($selectlength) ? abs($selectlength) : 200; |
||
89 | // irmtfan add select parameters for next search |
||
90 | $next_search['selectlength'] = $selectlength; |
||
91 | |||
92 | $start = Request::getInt('start', 0); |
||
93 | $forum = Request::getInt('forum', null); |
||
94 | if (empty($forum) || 'all' === $forum || (is_array($forum) && in_array('all', $forum))) { |
||
95 | $forum = []; |
||
96 | } elseif (!is_array($forum)) { |
||
0 ignored issues
–
show
introduced
by
![]() |
|||
97 | $forum = array_map('\intval', explode('|', $forum)); |
||
98 | } |
||
99 | $next_search['forum'] = implode('|', $forum); |
||
100 | // START irmtfan topic search |
||
101 | $topic = Request::getString('topic', null); |
||
102 | $next_search['topic'] = $topic; |
||
103 | // END irmtfan topic search |
||
104 | // START irmtfan add show search |
||
105 | $show_search = Request::getString('show_search', 'post_text'); |
||
106 | $next_search['show_search'] = $show_search; |
||
107 | // START irmtfan add show search |
||
108 | |||
109 | $addterms = Request::getString('andor', 'AND'); |
||
110 | $next_search['andor'] = $addterms; |
||
111 | $andor = mb_strtoupper($addterms); |
||
112 | if (!in_array($addterms, ['OR', 'AND'])) { |
||
113 | $andor = 'AND'; |
||
114 | } |
||
115 | |||
116 | $uname_required = false; |
||
117 | $next_search['uname'] = $search_username; |
||
118 | if (!empty($search_username)) { |
||
119 | $uname_required = true; |
||
120 | $search_username = $GLOBALS['xoopsDB']->escape($search_username); |
||
121 | if (!$result = $GLOBALS['xoopsDB']->query('SELECT uid FROM ' . $GLOBALS['xoopsDB']->prefix('users') . " WHERE uname LIKE '%$search_username%'")) { |
||
122 | redirect_header(XOOPS_URL . '/search.php', 1, _MD_NEWBB_ERROROCCURED); |
||
123 | } |
||
124 | $uid = []; |
||
125 | while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||
126 | $uid[] = $row['uid']; |
||
127 | } |
||
128 | } else { |
||
129 | $uid = 0; |
||
130 | } |
||
131 | |||
132 | $next_search['term'] = htmlspecialchars($term, ENT_QUOTES); |
||
133 | $query = trim($term); |
||
134 | |||
135 | if ('EXACT' !== $andor) { |
||
136 | $ignored_queries = []; // holds keywords that are shorter than allowed minimum length |
||
137 | $temp_queries = str_getcsv($query, ' ', '"'); |
||
138 | foreach ($temp_queries as $q) { |
||
139 | $q = trim($q); |
||
140 | if (mb_strlen($q) >= $xoopsConfigSearch['keyword_min']) { |
||
141 | $queries[] = $q; |
||
142 | } else { |
||
143 | $ignored_queries[] = $q; |
||
144 | } |
||
145 | } |
||
146 | if (!$uname_required && 0 === count($queries)) { |
||
147 | redirect_header(XOOPS_URL . '/search.php', 2, sprintf(_SR_KEYTOOSHORT, $xoopsConfigSearch['keyword_min'])); |
||
148 | } |
||
149 | } else { |
||
150 | //$query = trim($query); |
||
151 | if (!$uname_required && (mb_strlen($query) < $xoopsConfigSearch['keyword_min'])) { |
||
152 | redirect_header(XOOPS_URL . '/search.php', 2, sprintf(_SR_KEYTOOSHORT, $xoopsConfigSearch['keyword_min'])); |
||
153 | } |
||
154 | $queries = [$query]; |
||
155 | } |
||
156 | |||
157 | // entries must be lowercase |
||
158 | $allowed = ['p.post_time', 'p.subject']; // irmtfan just post time and subject |
||
159 | |||
160 | $sortby = Request::getString('sortby', 'p.post_time'); |
||
161 | $next_search['sortby'] = $sortby; |
||
162 | //$sortby = (in_array(strtolower($sortby), $allowed)) ? $sortby : 't.topic_last_post_id'; |
||
163 | $sortby = in_array(mb_strtolower($sortby), $allowed) ? $sortby : 'p.post_time'; |
||
164 | $searchin = Request::getString('searchin', 'both'); |
||
165 | $next_search['searchin'] = $searchin; |
||
166 | // START irmtfan use criteria - add since and topic search |
||
167 | if (!empty($since)) { |
||
168 | $criteriaExtra->add(new \Criteria('p.post_time', time() - newbbGetSinceTime($since), '>='), 'OR'); |
||
169 | } |
||
170 | if (is_numeric($topic) && !empty($topic)) { |
||
171 | $criteriaExtra->add(new \Criteria('p.topic_id', $topic), 'OR'); |
||
172 | } |
||
173 | // END irmtfan use criteria - add since and topic search |
||
174 | |||
175 | if ($uname_required && (!$uid || count($uid) < 1)) { |
||
176 | $results = []; |
||
177 | } // irmtfan bug fix array() |
||
178 | else { |
||
179 | $results = newbb_search($queries, $andor, $limit, $start, $uid, $forum, $sortby, $searchin, $criteriaExtra); |
||
180 | } // irmtfan $criteriaExtra |
||
181 | |||
182 | $search_info_keywords = Highlighter::apply($myts->htmlSpecialChars($term, ENT_QUOTES), implode(' ', $queries), '<mark>', '</mark>'); |
||
183 | $num_results = count($results); |
||
184 | if ($num_results < 1) { |
||
185 | $xoopsTpl->assign('lang_nomatch', _SR_NOMATCH); |
||
186 | } else { |
||
187 | $skipresults = 0; |
||
188 | foreach ($results as $row) { |
||
189 | $post_text_select = ''; |
||
190 | $post_subject_select = Highlighter::apply($queries, $row['title'], '<mark>', '</mark>'); |
||
191 | if ('post_text' === $show_search) { |
||
192 | $post_text_select = Metagen::getSearchSummary($row['post_text'], $queries, $selectlength); |
||
193 | $post_text_select = Highlighter::apply($queries, $post_text_select, '<mark>', '</mark>'); |
||
194 | } |
||
195 | // if no text remained after select text continue |
||
196 | if (empty($post_text_select) && empty($post_subject_select)) { |
||
197 | ++$skipresults; |
||
198 | continue; |
||
199 | } |
||
200 | $xoopsTpl->append( |
||
201 | 'results', |
||
202 | [ |
||
203 | 'forum_name' => $row['forum_name'], |
||
204 | 'forum_link' => $row['forum_link'], |
||
205 | 'link' => $row['link'], |
||
206 | 'title' => $post_subject_select, |
||
207 | 'poster' => $row['poster'], |
||
208 | 'post_time' => formatTimestamp($row['time'], 'm'), |
||
209 | 'post_text' => $post_text_select, |
||
210 | ] |
||
211 | ); |
||
212 | } |
||
213 | unset($results); |
||
214 | |||
215 | if (count($next_search) > 0) { |
||
216 | $items = []; |
||
217 | foreach ($next_search as $para => $val) { |
||
218 | $items[] = "{$para}=" . urlencode($val); |
||
219 | } |
||
220 | if (count($items) > 0) { |
||
221 | $paras = implode('&', $items); |
||
222 | } |
||
223 | unset($next_search, $items); |
||
224 | } |
||
225 | $search_url = XOOPS_URL . '/modules/' . $xoopsModule->getVar('dirname') . '/search.php?' . $paras; |
||
226 | // irmtfan remove to have just one query and appropriate next and prev links |
||
227 | //$next_results = newbb_search($queries, $andor, 1, $start + $limit, $uid, $forum, $sortby, $searchin, $subquery); |
||
228 | //$next_count = count($next_results); |
||
229 | //$has_next = false; |
||
230 | //if (is_array($next_results) && $next_count >0) { |
||
231 | //$has_next = true; |
||
232 | //} |
||
233 | // irmtfan if $results < $limit => it is impossible to have next |
||
234 | if ($num_results == $limit) { |
||
235 | $next = $start + $limit; |
||
236 | $queries = implode(',', $queries); |
||
237 | $search_url_next = htmlspecialchars($search_url . "&direction=next&start={$next}", ENT_QUOTES | ENT_HTML5); |
||
238 | $search_next = '<a href="' . $search_url_next . '">' . _SR_NEXT . '</a>'; |
||
239 | $xoopsTpl->assign('search_next', $search_next); |
||
240 | $xoopsTpl->assign('search_next_url', $search_url_next); |
||
241 | } |
||
242 | if ($start > 0) { |
||
243 | $prev = $start - $limit; |
||
244 | $search_url_prev = htmlspecialchars($search_url . "&direction=previous&start={$prev}", ENT_QUOTES | ENT_HTML5); |
||
245 | $search_prev = '<a href="' . $search_url_prev . '">' . _SR_PREVIOUS . '</a>'; |
||
246 | $xoopsTpl->assign('search_prev', $search_prev); |
||
247 | $xoopsTpl->assign('search_prev_url', $search_url_prev); |
||
248 | } |
||
249 | // irmtfan if all results skipped then redirect to the next/previous page |
||
250 | if ($num_results == $skipresults) { |
||
251 | $direction = Request::getString('direction', 'next'); |
||
252 | $search_url_redirect = ('next' === mb_strtolower($direction)) ? $search_url_next : $search_url_prev; |
||
253 | redirect_header($search_url_redirect, 1, constant(mb_strtoupper("_SR_{$direction}"))); |
||
254 | } |
||
255 | } |
||
256 | $search_info = _SR_KEYWORDS . ': ' . $search_info_keywords; |
||
257 | if ($uname_required) { |
||
258 | if ($search_info) { |
||
259 | $search_info .= '<br>'; |
||
260 | } |
||
261 | $search_info .= _MD_NEWBB_USERNAME . ': ' . $myts->htmlSpecialChars($search_username); |
||
262 | } |
||
263 | // add num_results |
||
264 | $search_info .= '<br>' . sprintf(_SR_SHOWING, $start + 1, $start + $num_results); |
||
265 | // if any result skip show the counter |
||
266 | if (!empty($skipresults)) { |
||
267 | $search_info .= ' - ' . sprintf(_SR_FOUND, $num_results - $skipresults); |
||
268 | } |
||
269 | $xoopsTpl->assign('search_info', $search_info); |
||
270 | } |
||
271 | // assign template vars for search |
||
272 | /* term */ |
||
273 | $xoopsTpl->assign('search_term', htmlspecialchars($term, ENT_QUOTES)); |
||
274 | |||
275 | /* andor */ |
||
276 | $andor_select = '<select name="andor" id="andor" class="form-control">'; |
||
277 | $andor_select .= '<option value="OR"'; |
||
278 | if ('OR' === $andor) { |
||
279 | $andor_select .= ' selected="selected"'; |
||
280 | } |
||
281 | $andor_select .= '>' . _SR_ANY . '</option>'; |
||
282 | $andor_select .= '<option value="AND"'; |
||
283 | if ('AND' === $andor || empty($andor)) { |
||
284 | $andor_select .= ' selected="selected"'; |
||
285 | } |
||
286 | $andor_select .= '>' . _SR_ALL . '</option>'; |
||
287 | $andor_select .= '</select>'; |
||
288 | $xoopsTpl->assign('andor_selection_box', $andor_select); |
||
289 | |||
290 | /* forum */ |
||
291 | $select_forum = '<select class="form-control" name="forum[]" id="forum" size="5" multiple="multiple">'; |
||
292 | $select_forum .= '<option value="all">' . _MD_NEWBB_SEARCHALLFORUMS . '</option>'; |
||
293 | $select_forum .= newbbForumSelectBox($forum); |
||
294 | $select_forum .= '</select>'; |
||
295 | $xoopsTpl->assign_by_ref('forum_selection_box', $select_forum); |
||
296 | |||
297 | /* searchin */ |
||
298 | $searchin_select = ''; |
||
299 | $searchin_select .= '<label class="radio-inline"><input type="radio" name="searchin" value="title"'; |
||
300 | if ('title' === $searchin) { |
||
301 | $searchin_select .= ' checked'; |
||
302 | } |
||
303 | $searchin_select .= ' >' . _MD_NEWBB_SUBJECT . ' </label>'; |
||
304 | $searchin_select .= '<label class="radio-inline"><input type="radio" name="searchin" value="text"'; |
||
305 | if ('text' === $searchin) { |
||
306 | $searchin_select .= ' checked'; |
||
307 | } |
||
308 | $searchin_select .= ' >' . _MD_NEWBB_BODY . ' </label>'; |
||
309 | $searchin_select .= '<label class="radio-inline"><input type="radio" name="searchin" value="both"'; |
||
310 | if ('both' === $searchin || empty($searchin)) { |
||
311 | $searchin_select .= ' checked'; |
||
312 | } |
||
313 | $searchin_select .= ' >' . _MD_NEWBB_SUBJECT . ' & ' . _MD_NEWBB_BODY . ' </label>'; |
||
314 | $xoopsTpl->assign('searchin_radio', $searchin_select); |
||
315 | |||
316 | /* show_search */ |
||
317 | $show_search_select = ''; |
||
318 | $show_search_select .= '<label class="radio-inline"><input type="radio" name="show_search" value="post"'; |
||
319 | if ('post' === $show_search) { |
||
320 | $show_search_select .= ' checked'; |
||
321 | } |
||
322 | $show_search_select .= ' >' . _MD_NEWBB_POSTS . ' </label>'; |
||
323 | $show_search_select .= '<label class="radio-inline"><input type="radio" name="show_search" value="post_text"'; |
||
324 | if ('post_text' === $show_search || empty($show_search)) { |
||
325 | $show_search_select .= ' checked'; |
||
326 | } |
||
327 | $show_search_select .= ' >' . _MD_NEWBB_SEARCHPOSTTEXT . ' </label>'; |
||
328 | $xoopsTpl->assign('show_search_radio', $show_search_select); |
||
329 | |||
330 | /* author */ |
||
331 | $xoopsTpl->assign('author_select', $search_username); |
||
332 | |||
333 | /* sortby */ |
||
334 | $sortby_select = '<select name="sortby" id="sortby" class="form-control">'; |
||
335 | $sortby_select .= '<option value=\'p.post_time\''; |
||
336 | if ('p.post_time' === $sortby || empty($sortby)) { |
||
337 | $sortby_select .= ' selected=\'selected\''; |
||
338 | } |
||
339 | $sortby_select .= '>' . _MD_NEWBB_DATE . '</option>'; |
||
340 | $sortby_select .= '<option value=\'p.subject\''; |
||
341 | if ('p.subject' === $sortby) { |
||
342 | $sortby_select .= ' selected="selected"'; |
||
343 | } |
||
344 | $sortby_select .= '>' . _MD_NEWBB_TOPIC . '</option>'; |
||
345 | $sortby_select .= '</select>'; |
||
346 | $xoopsTpl->assign('sortby_selection_box', $sortby_select); |
||
347 | |||
348 | /* selectlength */ |
||
349 | $xoopsTpl->assign('selectlength_select', $selectlength); |
||
350 | |||
351 | // irmtfan get since from the user for selction box |
||
352 | $since = Request::getInt('since', $GLOBALS['xoopsModuleConfig']['since_default']); |
||
353 | $select_since = newbbSinceSelectBox($since); |
||
354 | $xoopsTpl->assign_by_ref('since_selection_box', $select_since); |
||
355 | |||
356 | if ($xoopsConfigSearch['keyword_min'] > 0) { |
||
357 | $xoopsTpl->assign('search_rule', sprintf(_SR_KEYIGNORE, $xoopsConfigSearch['keyword_min'])); |
||
358 | } |
||
359 | // irmtfan move to footer.php |
||
360 | require_once __DIR__ . '/footer.php'; |
||
361 | require_once $GLOBALS['xoops']->path('footer.php'); |
||
362 |