This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | /* ------------------------------------------------------------------------ |
||
3 | pedigree |
||
4 | Copyright 2004, James Cotton |
||
5 | http://www.dobermannvereniging.nl |
||
6 | Template |
||
7 | Copyright 2004 Thomas Hill |
||
8 | <a href="http://www.worldware.com">worldware.com</a> |
||
9 | ------------------------------------------------------------------------ |
||
10 | ------------------------------------------------------------------------ |
||
11 | This program is free software; you can redistribute it and/or modify |
||
12 | it under the terms of the GNU General Public License as published by |
||
13 | the Free Software Foundation; either version 2 of the License, or |
||
14 | (at your option) any later version. |
||
15 | |||
16 | You may not change or alter any portion of this comment or credits |
||
17 | of supporting developers from this source code or any supporting |
||
18 | source code which is considered copyrighted (c) material of the |
||
19 | original comment or credit authors. |
||
20 | |||
21 | This program is distributed in the hope that it will be useful, |
||
22 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
23 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
24 | GNU General Public License for more details. |
||
25 | |||
26 | You should have received a copy of the GNU General Public License |
||
27 | along with this program; if not, write to the Free Software |
||
28 | Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
||
29 | ------------------------------------------------------------------------ |
||
30 | */ |
||
31 | |||
32 | /** |
||
33 | * @package XoopsModules\Pedigree |
||
34 | * @copyright Copyright 2004, James Cotton <https://www.dobermannvereniging.nl> |
||
35 | * @copyright Copyright 2004, Thomas Hill <https://www.worldware.com> |
||
36 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||
37 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||
38 | * @author XOOPS Module Dev Team |
||
39 | */ |
||
40 | |||
41 | use Xmf\Request; |
||
42 | use XoopsModules\Pedigree; |
||
43 | |||
44 | //To be deleted? |
||
45 | |||
46 | require_once \dirname(__DIR__, 3) . '/include/cp_header.php'; |
||
47 | //require_once XOOPS_ROOT_PATH . "/modules/" . $xoopsModule->dirname() . "/include/pedigree_includes.php"; |
||
48 | //require_once \dirname(__DIR__) . "/include/pedigree_includes.php"; |
||
49 | |||
50 | xoops_loadLanguage('modinfo', basename(\dirname(__DIR__, 2))); |
||
51 | require_once $GLOBALS['xoops']->path('modules/pedigree/admin/menu.php'); |
||
52 | |||
53 | // Get HTTP post/get parameters. |
||
54 | //import_request_variables("gp", "param_"); |
||
55 | extract($_GET, EXTR_PREFIX_ALL, 'param'); |
||
56 | extract($_POST, EXTR_PREFIX_ALL, 'param'); |
||
57 | |||
58 | $op = Request::getCmd('op', 'main'); |
||
59 | // |
||
60 | // Writes out the form to get all config parameters. |
||
61 | // |
||
62 | function pedigree_fields_form() |
||
63 | { |
||
64 | $config_fields = pedigree_get_config_fields(); |
||
65 | $values = pedigree_get_config(); |
||
66 | print " |
||
67 | <form action='fields.php' method='POST' enctype='application/x-www-form-urlencoded'>\n |
||
68 | <table border='1' cellpadding='0' cellspacing='0' width='100%'>\n |
||
69 | <tr><th>" . _AM_PEDIGREE_CTITLE . "</th></tr>\n |
||
70 | <tr>\n |
||
71 | <td class='bg2'>\n |
||
72 | <table width='100%' border='0' cellpadding='4' cellspacing='1'>\n"; |
||
73 | |||
74 | foreach ($config_fields as $field => $prompt) { |
||
75 | if ('config_id' === $field) { |
||
76 | continue; |
||
77 | } |
||
78 | $pname = 'param_' . $field; |
||
0 ignored issues
–
show
Unused Code
introduced
by
![]() |
|||
79 | print " |
||
80 | <tr nowrap='nowrap'>\n |
||
81 | <td class ='head'>{$prompt}</td>\n |
||
82 | <td class='even aligntop'>\n |
||
83 | <input type='text' name='{$field}' size='32' maxlength='32' value ='{$values[$field]}'>\n |
||
84 | </td></tr>\n |
||
85 | </tr>\n"; |
||
86 | } |
||
87 | print " |
||
88 | <td class='head'> </td>\n |
||
89 | <td class='even'>\n |
||
90 | <input type='hidden' name='op' value='config'>\n |
||
91 | <input type='hidden' name='window' value='config'>\n |
||
92 | <input type='submit' value='" . _AM_PEDIGREE_BUT_GO . "'>\n |
||
93 | </td></tr>\n |
||
94 | </table>\n |
||
95 | </td></tr>\n |
||
96 | </table>\n |
||
97 | </form>\n"; |
||
98 | } |
||
99 | |||
100 | /** |
||
101 | * @todo: create pedigree_admin_hmenu - it doesn't exist |
||
102 | * |
||
103 | * Displays the main admin interface |
||
104 | */ |
||
105 | function pedigree_fields_main() |
||
106 | { |
||
107 | //xoops_cp_header(); |
||
108 | $p_title = _AM_PEDIGREE_CONFIGURE; |
||
109 | print "<h4 style='text-align:left;'>$p_title</h4>"; |
||
110 | pedigree_admin_hmenu(); |
||
111 | pedigree_fields_form(); |
||
112 | xoops_cp_footer(); |
||
113 | exit(); |
||
114 | } |
||
115 | |||
116 | /** |
||
117 | * @todo: create pedigree_get_config_fields() method, it doesn't exist anywhere |
||
118 | * |
||
119 | * Processes the configuration update request, by |
||
120 | * getting the HTTP parameters, and putting them into the database. |
||
121 | */ |
||
122 | function pedigree_fields_post() |
||
123 | { |
||
124 | $config_fields = pedigree_get_config_fields(); |
||
125 | foreach ($config_fields as $field => $prompt) { |
||
126 | $param = 'param_' . $field; |
||
0 ignored issues
–
show
|
|||
127 | global $$param; |
||
128 | } |
||
129 | $param_config_id = 1; |
||
130 | $sql = 'REPLACE INTO ' . $GLOBALS['xoopsDB']->prefix('pedigree_fields') . ' (' . pedigree_to_string($config_fields) . ') VALUES ('; |
||
131 | |||
132 | $first = true; |
||
133 | foreach ($config_fields as $field => $prompt) { |
||
134 | $param = 'param_' . $field; |
||
135 | if (!$first) { |
||
136 | $sql .= ', '; |
||
137 | } |
||
138 | // Handle a 'feature' of PHP that adds backslashes to HTTP parameters. |
||
139 | $param_value = $$param; |
||
140 | $sql .= "'" . $GLOBALS['xoopsDB']->escape($param_value) . "'"; |
||
141 | $first = false; |
||
142 | } |
||
143 | $sql .= ' )'; |
||
144 | if (!$GLOBALS['xoopsDB']->query($sql)) { |
||
145 | $error = $GLOBALS['xoopsDB']->error(); |
||
146 | xoops_cp_header(); |
||
147 | pedigree_show_sql_error(_AM_PEDIGREE_ERR_ADD_FAILED, $error, $sql); |
||
148 | xoops_cp_footer(); |
||
149 | } else { |
||
150 | redirect_header('fields.php', 1, _AM_PEDIGREE_OK_DB); |
||
151 | } |
||
152 | exit(); |
||
153 | } |
||
154 | |||
155 | switch ($op) { |
||
156 | case 'main': |
||
157 | pedigree_fields_main(); |
||
158 | break; |
||
159 | case 'config': |
||
160 | pedigree_fields_post(); |
||
161 | break; |
||
162 | default: |
||
163 | //xoops_cp_header(); |
||
164 | /* @todo: move hard coded language string to language file */ |
||
165 | print "<h1>Unknown method requested ('{$op}')</h1>"; |
||
166 | xoops_cp_footer(); |
||
167 | } |
||
168 |