mambax7 /
newbb5
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||
| 2 | |||||
| 3 | |||||
| 4 | use XoopsModules\Newbb; |
||||
| 5 | |||||
| 6 | define('REAL_MODULE_NAME', 'modules/newbb'); //this is the Real Module directory |
||||
| 7 | define('SEO_MODULE_NAME', 'modules/newbb'); //this is SEO Name for rewrite Hack |
||||
| 8 | |||||
| 9 | //ob_start('seo_urls'); |
||||
| 10 | |||||
| 11 | /** |
||||
| 12 | * @param $s |
||||
| 13 | * @return mixed |
||||
| 14 | */ |
||||
| 15 | function seo_urls($s) |
||||
| 16 | { |
||||
| 17 | $XPS_URL = str_replace('/', '\/', quotemeta(XOOPS_URL)); |
||||
| 18 | $module_name = str_replace('/', '\/', quotemeta(SEO_MODULE_NAME)); |
||||
| 19 | |||||
| 20 | $search = [ |
||||
| 21 | // Search URLs of modules' directry. |
||||
| 22 | '/<(a|meta)([^>]*)(href|url)=([\'\"]{0,1})' . $XPS_URL . '\/' . $module_name . '\/(index.php)([^>\'\"]*)([\'\"]{1})([^>]*)>/i', |
||||
| 23 | '/<(a|meta)([^>]*)(href|url)=([\'\"]{0,1})' . $XPS_URL . '\/' . $module_name . '\/(viewpost.php)([^>\'\"]*)([\'\"]{1})([^>]*)>/i', |
||||
| 24 | '/<(a|meta)([^>]*)(href|url)=([\'\"]{0,1})' . $XPS_URL . '\/' . $module_name . '\/(rss.php)([^>\'\"]*)([\'\"]{1})([^>]*)>/i', |
||||
| 25 | '/<(a|meta)([^>]*)(href|url)=([\'\"]{0,1})' . $XPS_URL . '\/' . $module_name . '\/(viewforum.php)([^>\'\"]*)([\'\"]{1})([^>]*)>/i', |
||||
| 26 | '/<(a|meta)([^>]*)(href|url)=([\'\"]{0,1})' . $XPS_URL . '\/' . $module_name . '\/(viewtopic.php)([^>\'\"]*)([\'\"]{1})([^>]*)>/i', |
||||
| 27 | '/<(a|meta)([^>]*)(href|url)=([\'\"]{0,1})' . $XPS_URL . '\/' . $module_name . '\/(newtopic.php)([^>\'\"]*)([\'\"]{1})([^>]*)>/i', |
||||
| 28 | '/<(a|meta)([^>]*)(href|url)=([\'\"]{0,1})' . $XPS_URL . '\/' . $module_name . '\/(.*)([^>\'\"]*)([\'\"]{1})([^>]*)>/i', |
||||
| 29 | ]; |
||||
| 30 | |||||
| 31 | $s = preg_replace_callback($search, 'replace_links', $s); |
||||
| 32 | |||||
| 33 | return $s; |
||||
| 34 | } |
||||
| 35 | |||||
| 36 | /** |
||||
| 37 | * @param $matches |
||||
| 38 | * @return string |
||||
| 39 | */ |
||||
| 40 | function replace_links($matches) |
||||
| 41 | { |
||||
| 42 | switch ($matches[5]) { |
||||
| 43 | case 'index.php': |
||||
| 44 | $add_to_url = ''; |
||||
| 45 | $req_string = $matches[6]; |
||||
| 46 | if (!empty($matches[6])) { |
||||
| 47 | // replacing cat=x |
||||
| 48 | if (preg_match('/cat=(\d+)/', $matches[6], $mvars)) { |
||||
| 49 | $add_to_url = 'c-' . $mvars[1] . '/' . forum_seo_cat($mvars[1]) . ''; |
||||
| 50 | $req_string = preg_replace('/cat=\d+/', '', $matches[6]); |
||||
| 51 | } else { |
||||
| 52 | return $matches['0']; |
||||
| 53 | } |
||||
| 54 | } |
||||
| 55 | break; |
||||
| 56 | case 'viewpost.php': |
||||
| 57 | $add_to_url = ''; |
||||
| 58 | $req_string = $matches[6]; |
||||
| 59 | if (!empty($matches[6])) { |
||||
| 60 | // replacing status=x |
||||
| 61 | if (preg_match('/status=([a-z]+)/', $matches[6], $mvars)) { |
||||
| 62 | $add_to_url = 'viewpost.php' . $matches[6]; |
||||
| 63 | $req_string = preg_replace('/status=([a-z])+/', '', $matches[6]); |
||||
| 64 | } else { |
||||
| 65 | return $matches['0']; |
||||
| 66 | } |
||||
| 67 | } else { |
||||
| 68 | $add_to_url = 'viewpost.php' . $matches[6]; |
||||
| 69 | } |
||||
| 70 | break; |
||||
| 71 | case 'rss.php': |
||||
| 72 | $add_to_url = ''; |
||||
| 73 | $req_string = $matches[6]; |
||||
| 74 | if (!empty($matches[6])) { |
||||
| 75 | // replacing c=x |
||||
| 76 | if (preg_match('/c=(\d+)/', $matches[6], $mvars)) { |
||||
| 77 | $add_to_url = 'rc-'; |
||||
| 78 | if ($mvars[1] > 0) { |
||||
| 79 | $add_to_url .= $mvars[1] . '/' . forum_seo_cat($mvars[1]) . ''; |
||||
| 80 | } else { |
||||
| 81 | $add_to_url .= $mvars[1] . '/rss.html'; |
||||
| 82 | } |
||||
| 83 | $req_string = preg_replace('/c=\d+/', '', $matches[6]); |
||||
| 84 | } elseif (preg_match('/f=(\d+)/', $matches[6], $mvars)) { |
||||
| 85 | $add_to_url = 'rf-'; |
||||
| 86 | if ($mvars[1] > 0) { |
||||
| 87 | $add_to_url .= $mvars[1] . '/' . forum_seo_forum($mvars[1]) . ''; |
||||
| 88 | } else { |
||||
| 89 | $add_to_url .= $mvars[1] . '/rss.html'; |
||||
| 90 | } |
||||
| 91 | $req_string = preg_replace('/f=\d+/', '', $matches[6]); |
||||
| 92 | } else { |
||||
| 93 | return $matches['0']; |
||||
| 94 | } |
||||
| 95 | //$add_to_url .= 'rss-feed.html'; |
||||
| 96 | } |
||||
| 97 | break; |
||||
| 98 | case 'viewforum.php': |
||||
| 99 | $add_to_url = ''; |
||||
| 100 | $req_string = $matches[6]; |
||||
| 101 | if (!empty($matches[6])) { |
||||
| 102 | // replacing forum=x |
||||
| 103 | if (preg_match('/forum=(\d+)/', $matches[6], $mvars)) { |
||||
| 104 | $add_to_url = 'f-' . $mvars[1] . '/' . forum_seo_forum($mvars[1]) . ''; |
||||
| 105 | $req_string = preg_replace('/forum=\d+/', '', $matches[6]); |
||||
| 106 | } else { |
||||
| 107 | return $matches['0']; |
||||
| 108 | } |
||||
| 109 | } |
||||
| 110 | break; |
||||
| 111 | case 'viewtopic.php': |
||||
| 112 | $add_to_url = ''; |
||||
| 113 | $req_string = $matches[6]; |
||||
| 114 | if (!empty($matches[6])) { |
||||
| 115 | // replacing topic_id=x |
||||
| 116 | if (preg_match('/topic_id=(\d+)/', $matches[6], $mvars)) { |
||||
| 117 | $add_to_url = 't-' . $mvars[1] . '/' . forum_seo_topic($mvars[1]) . ''; |
||||
| 118 | $req_string = preg_replace('/topic_id=\d+/', '', $matches[6]); |
||||
| 119 | } //replacing post_id=x |
||||
| 120 | elseif (preg_match('/post_id=(\d+)/', $matches[6], $mvars)) { |
||||
| 121 | $add_to_url = 'p-' . $mvars[1] . '/' . forum_seo_post($mvars[1]) . ''; |
||||
| 122 | $req_string = preg_replace('/post_id=\d+/', '', $matches[6]); |
||||
| 123 | } else { |
||||
| 124 | return $matches['0']; |
||||
| 125 | } |
||||
| 126 | } |
||||
| 127 | break; |
||||
| 128 | case 'print.php': |
||||
| 129 | $add_to_url = ''; |
||||
| 130 | $req_string = $matches[6]; |
||||
| 131 | if (!empty($matches[6])) { |
||||
| 132 | // replacing topic_id=x |
||||
| 133 | if (preg_match('/topic_id=(\d+)/', $matches[6], $mvars)) { |
||||
| 134 | $add_to_url = 'pr-' . $mvars[1] . '/' . forum_seo_topic($mvars[1]) . ''; |
||||
| 135 | $req_string = preg_replace('/topic_id=\d+/', '', $matches[6]); |
||||
| 136 | } //replacing post_id=x |
||||
| 137 | elseif (preg_match('/post_id=(\d+)/', $matches[6], $mvars)) { |
||||
| 138 | $add_to_url = 'pr-' . $mvars[1] . '/' . forum_seo_post($mvars[1]) . ''; |
||||
| 139 | $req_string = preg_replace('/post_id=\d+/', '', $matches[6]); |
||||
| 140 | } else { |
||||
| 141 | return $matches['0']; |
||||
| 142 | } |
||||
| 143 | } |
||||
| 144 | break; |
||||
| 145 | case 'makepdf.php': |
||||
| 146 | $add_to_url = ''; |
||||
| 147 | $req_string = $matches[6]; |
||||
| 148 | if (!empty($matches[6])) { |
||||
| 149 | // replacing topic_id=x |
||||
| 150 | if (preg_match('/topic_id=(\d+)/', $matches[6], $mvars)) { |
||||
| 151 | $add_to_url = 'pdf-' . $mvars[1] . '/' . forum_seo_topic($mvars[1]) . ''; |
||||
| 152 | $req_string = preg_replace('/topic_id=\d+/', '', $matches[6]); |
||||
| 153 | } //replacing post_id=x |
||||
| 154 | elseif (preg_match('/post_id=(\d+)/', $matches[6], $mvars)) { |
||||
| 155 | $add_to_url = 'pdf-' . $mvars[1] . '/' . forum_seo_post($mvars[1]) . ''; |
||||
| 156 | $req_string = preg_replace('/post_id=\d+/', '', $matches[6]); |
||||
| 157 | } else { |
||||
| 158 | return $matches['0']; |
||||
| 159 | } |
||||
| 160 | } |
||||
| 161 | break; |
||||
| 162 | default: |
||||
| 163 | $req_string = $matches[6]; |
||||
| 164 | $add_to_url = $matches[5]; |
||||
| 165 | //if ($add_to_url === '') $add_to_url ='index.php'; |
||||
| 166 | break; |
||||
| 167 | } |
||||
| 168 | if ('?' === $req_string) { |
||||
| 169 | $req_string = ''; |
||||
| 170 | } |
||||
| 171 | $ret = '<' . $matches[1] . $matches[2] . $matches[3] . '=' . $matches[4] . XOOPS_URL . '/' . SEO_MODULE_NAME . '/' . $add_to_url . $req_string . $matches[7] . $matches[8] . '>'; |
||||
| 172 | |||||
| 173 | //$ret = '<'.$matches[1].$matches[2].$matches[3].'='.$matches[4].XOOPS_URL.'/'.REAL_MODULE_NAME.'/'.$add_to_url.$req_string.$matches[7].$matches[8].'>'; |
||||
| 174 | return $ret; |
||||
| 175 | } |
||||
| 176 | |||||
| 177 | /** |
||||
| 178 | * @param $_cat_id |
||||
| 179 | * @return bool|mixed |
||||
| 180 | */ |
||||
| 181 | function forum_seo_cat($_cat_id) |
||||
| 182 | { |
||||
| 183 | xoops_load('XoopsCache'); |
||||
| 184 | $key = 'newbb_seo_cat'; |
||||
| 185 | $ret = false; |
||||
|
0 ignored issues
–
show
Unused Code
introduced
by
Loading history...
|
|||||
| 186 | $ret = \XoopsCache::read($key); |
||||
| 187 | if ($ret) { |
||||
| 188 | $ret = @$ret[$_cat_id]; |
||||
| 189 | if ($ret) { |
||||
| 190 | return $ret; |
||||
| 191 | } |
||||
| 192 | } |
||||
| 193 | $query = 'SELECT cat_id, cat_title FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_categories'); |
||||
| 194 | $result = $GLOBALS['xoopsDB']->query($query); |
||||
| 195 | $_ret = []; |
||||
| 196 | while (false !== ($res = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||||
| 197 | $_ret[$res['cat_id']] = forum_seo_title($res['cat_title']); |
||||
| 198 | } |
||||
| 199 | XoopsCache::write($key, $_ret); |
||||
| 200 | $ret = \XoopsCache::read($key); |
||||
| 201 | $ret = $ret[$_cat_id]; |
||||
| 202 | |||||
| 203 | return $ret; |
||||
| 204 | } |
||||
| 205 | |||||
| 206 | /** |
||||
| 207 | * @param $_cat_id |
||||
| 208 | * @return bool|mixed |
||||
| 209 | */ |
||||
| 210 | function forum_seo_forum($_cat_id) |
||||
| 211 | { |
||||
| 212 | xoops_load('XoopsCache'); |
||||
| 213 | $key = 'newbb_seo_forum'; |
||||
| 214 | $ret = false; |
||||
|
0 ignored issues
–
show
|
|||||
| 215 | $ret = \XoopsCache::read($key); |
||||
| 216 | if ($ret) { |
||||
| 217 | $ret = @$ret[$_cat_id]; |
||||
| 218 | if ($ret) { |
||||
| 219 | return $ret; |
||||
| 220 | } |
||||
| 221 | } |
||||
| 222 | $query = 'SELECT forum_id, forum_name FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_forums'); |
||||
| 223 | $result = $GLOBALS['xoopsDB']->query($query); |
||||
| 224 | $_ret = []; |
||||
| 225 | while (false !== ($res = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||||
| 226 | $_ret[$res['forum_id']] = forum_seo_title($res['forum_name']); |
||||
| 227 | } |
||||
| 228 | XoopsCache::write($key, $_ret); |
||||
| 229 | $ret = \XoopsCache::read($key); |
||||
| 230 | $ret = $ret[$_cat_id]; |
||||
| 231 | |||||
| 232 | return $ret; |
||||
| 233 | } |
||||
| 234 | |||||
| 235 | /** |
||||
| 236 | * @param $_cat_id |
||||
| 237 | * @return mixed|string |
||||
| 238 | */ |
||||
| 239 | function forum_seo_topic($_cat_id) |
||||
| 240 | { |
||||
| 241 | $query = 'SELECT topic_title FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_topics') . ' WHERE topic_id = ' . $_cat_id; |
||||
| 242 | $result = $GLOBALS['xoopsDB']->query($query); |
||||
| 243 | $res = $GLOBALS['xoopsDB']->fetchArray($result); |
||||
| 244 | $ret = forum_seo_title($res['topic_title']); |
||||
| 245 | |||||
| 246 | $moduleDirName = basename(__DIR__); |
||||
|
0 ignored issues
–
show
|
|||||
| 247 | /** @var Newbb\TopicHandler $topicsHandler */ |
||||
| 248 | $topicsHandler = \XoopsModules\Newbb\Helper::getInstance()->getHandler('Topic'); |
||||
| 249 | $criteria = new \CriteriaCompo(new \Criteria('topic_id', $_cat_id, '=')); |
||||
| 250 | $fields = ['topic_title']; |
||||
| 251 | $ret0 = $topicsHandler->getAll($criteria, $fields, false); |
||||
|
0 ignored issues
–
show
|
|||||
| 252 | |||||
| 253 | return $ret; |
||||
| 254 | } |
||||
| 255 | |||||
| 256 | /** |
||||
| 257 | * @param $_cat_id |
||||
| 258 | * @return mixed|string |
||||
| 259 | */ |
||||
| 260 | function forum_seo_post($_cat_id) |
||||
| 261 | { |
||||
| 262 | $query = 'SELECT subject FROM ' . $GLOBALS['xoopsDB']->prefix('newbb_posts') . ' WHERE post_id = ' . $_cat_id; |
||||
| 263 | $result = $GLOBALS['xoopsDB']->query($query); |
||||
| 264 | $res = $GLOBALS['xoopsDB']->fetchArray($result); |
||||
| 265 | $ret = forum_seo_title($res['subject']); |
||||
| 266 | |||||
| 267 | return $ret; |
||||
| 268 | } |
||||
| 269 | |||||
| 270 | /** |
||||
| 271 | * @param string $title |
||||
| 272 | * @param bool $withExt |
||||
| 273 | * @return mixed|string |
||||
| 274 | */ |
||||
| 275 | function forum_seo_title($title = '', $withExt = true) |
||||
| 276 | { |
||||
| 277 | /** |
||||
| 278 | * if XOOPS ML is present, let's sanitize the title with the current language |
||||
| 279 | */ |
||||
| 280 | $myts = \MyTextSanitizer::getInstance(); |
||||
| 281 | if (method_exists($myts, 'formatForML')) { |
||||
| 282 | $title = $myts->formatForML($title); |
||||
| 283 | } |
||||
| 284 | |||||
| 285 | // Transformation de la chaine en minuscule |
||||
| 286 | // Codage de la chaine afin d'�viter les erreurs 500 en cas de caract�res impr�vus |
||||
| 287 | $title = rawurlencode(mb_strtolower($title)); |
||||
| 288 | |||||
| 289 | // Transformation des ponctuations |
||||
| 290 | // Tab Space ! " # % & ' ( ) , / : ; < = > ? @ [ \ ] ^ { | } ~ . |
||||
| 291 | $pattern = [ |
||||
| 292 | '/%09/', |
||||
| 293 | '/%20/', |
||||
| 294 | '/%21/', |
||||
| 295 | '/%22/', |
||||
| 296 | '/%23/', |
||||
| 297 | '/%25/', |
||||
| 298 | '/%26/', |
||||
| 299 | '/%27/', |
||||
| 300 | '/%28/', |
||||
| 301 | '/%29/', |
||||
| 302 | '/%2C/', |
||||
| 303 | '/%2F/', |
||||
| 304 | '/%3A/', |
||||
| 305 | '/%3B/', |
||||
| 306 | '/%3C/', |
||||
| 307 | '/%3D/', |
||||
| 308 | '/%3E/', |
||||
| 309 | '/%3F/', |
||||
| 310 | '/%40/', |
||||
| 311 | '/%5B/', |
||||
| 312 | '/%5C/', |
||||
| 313 | '/%5D/', |
||||
| 314 | '/%5E/', |
||||
| 315 | '/%7B/', |
||||
| 316 | '/%7C/', |
||||
| 317 | '/%7D/', |
||||
| 318 | '/%7E/', |
||||
| 319 | '/\./', |
||||
| 320 | '/%2A/', |
||||
| 321 | ]; |
||||
| 322 | $rep_pat = [ |
||||
| 323 | '-', |
||||
| 324 | '-', |
||||
| 325 | '', |
||||
| 326 | '', |
||||
| 327 | '', |
||||
| 328 | '-100', |
||||
| 329 | '', |
||||
| 330 | '-', |
||||
| 331 | '', |
||||
| 332 | '', |
||||
| 333 | '', |
||||
| 334 | '-', |
||||
| 335 | '', |
||||
| 336 | '', |
||||
| 337 | '', |
||||
| 338 | '-', |
||||
| 339 | '', |
||||
| 340 | '', |
||||
| 341 | '-at-', |
||||
| 342 | '', |
||||
| 343 | '-', |
||||
| 344 | '', |
||||
| 345 | '-', |
||||
| 346 | '', |
||||
| 347 | '-', |
||||
| 348 | '', |
||||
| 349 | '-', |
||||
| 350 | '', |
||||
| 351 | '', |
||||
| 352 | ]; |
||||
| 353 | $title = preg_replace($pattern, $rep_pat, $title); |
||||
| 354 | |||||
| 355 | // Transformation des caractères accentués |
||||
| 356 | // è é ê ë ç à â ä î ï ù ü û ô ö |
||||
| 357 | $pattern = [ |
||||
| 358 | '/%B0/', |
||||
| 359 | '/%E8/', |
||||
| 360 | '/%E9/', |
||||
| 361 | '/%EA/', |
||||
| 362 | '/%EB/', |
||||
| 363 | '/%E7/', |
||||
| 364 | '/%E0/', |
||||
| 365 | '/%E2/', |
||||
| 366 | '/%E4/', |
||||
| 367 | '/%EE/', |
||||
| 368 | '/%EF/', |
||||
| 369 | '/%F9/', |
||||
| 370 | '/%FC/', |
||||
| 371 | '/%FB/', |
||||
| 372 | '/%F4/', |
||||
| 373 | '/%F6/', |
||||
| 374 | '/%E3%BC/', |
||||
| 375 | '/%E3%96/', |
||||
| 376 | '/%E3%84/', |
||||
| 377 | '/%E3%9C/', |
||||
| 378 | '/%E3%FF/', |
||||
| 379 | '/%E3%B6/', |
||||
| 380 | '/%E3%A4/', |
||||
| 381 | '/%E3%9F/', |
||||
| 382 | ]; |
||||
| 383 | $rep_pat = [ |
||||
| 384 | '-', |
||||
| 385 | 'e', |
||||
| 386 | 'e', |
||||
| 387 | 'e', |
||||
| 388 | 'e', |
||||
| 389 | 'c', |
||||
| 390 | 'a', |
||||
| 391 | 'a', |
||||
| 392 | 'a', |
||||
| 393 | 'i', |
||||
| 394 | 'i', |
||||
| 395 | 'u', |
||||
| 396 | 'u', |
||||
| 397 | 'u', |
||||
| 398 | 'o', |
||||
| 399 | 'o', |
||||
| 400 | 'ue', |
||||
| 401 | 'oe', |
||||
| 402 | 'ae', |
||||
| 403 | 'ue', |
||||
| 404 | 'ss', |
||||
| 405 | 'oe', |
||||
| 406 | 'ae', |
||||
| 407 | 'ss', |
||||
| 408 | ]; |
||||
| 409 | $title = preg_replace($pattern, $rep_pat, $title); |
||||
| 410 | |||||
| 411 | /*$string = str_replace(' ', '-', $title); |
||||
| 412 | $string = iconv('utf-8', 'ascii//translit', $string); |
||||
| 413 | $string = preg_replace('#[^a-z0-9\-\.]#si', '', $string); |
||||
| 414 | $title = str_replace('\/','', $string); */ |
||||
| 415 | |||||
| 416 | if (count($title) > 0) { |
||||
|
0 ignored issues
–
show
$title of type string is incompatible with the type Countable|array expected by parameter $var of count().
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||
| 417 | if ($withExt) { |
||||
| 418 | $title .= '.html'; |
||||
| 419 | } |
||||
| 420 | |||||
| 421 | return $title; |
||||
| 422 | } |
||||
| 423 | |||||
| 424 | return ''; |
||||
| 425 | } |
||||
| 426 |