This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | /* |
||||
3 | You may not change or alter any portion of this comment or credits |
||||
4 | of supporting developers from this source code or any supporting source code |
||||
5 | which is considered copyrighted (c) material of the original comment or credit authors. |
||||
6 | |||||
7 | This program is distributed in the hope that it will be useful, |
||||
8 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||
9 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||
10 | */ |
||||
11 | |||||
12 | /** |
||||
13 | * Pedigree module for XOOPS |
||||
14 | * |
||||
15 | * @copyright @link http://sourceforge.net/projects/xoops/ The XOOPS Project} |
||||
16 | * @license GPL 2.0 or later |
||||
17 | * @package pedigree |
||||
18 | * @since |
||||
19 | * @author XOOPS Module Dev Team (https://xoops.org) |
||||
20 | */ |
||||
21 | |||||
22 | use Xmf\Request; |
||||
23 | use XoopsModules\Pedigree\{ |
||||
24 | Helper |
||||
25 | }; |
||||
26 | |||||
27 | /** @var \XoopsThemeForm $form */ |
||||
28 | |||||
29 | require_once __DIR__ . '/admin_header.php'; |
||||
30 | |||||
31 | xoops_cp_header(); |
||||
32 | //$adminObject = \Xmf\Module\Admin::getInstance(); |
||||
33 | |||||
34 | $tempHandler = Helper::getInstance()->getHandler('Temp'); |
||||
35 | |||||
36 | //It recovered the value of argument op in URL$ |
||||
37 | $op = Request::getCmd('op', 'list'); |
||||
38 | switch ($op) { |
||||
39 | case 'list': |
||||
40 | default: |
||||
41 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
42 | $adminObject->addItemButton(_AM_PEDIGREE_NEWPEDIGREE_TEMP, 'pedigree_temp.php?op=new_pedigree_temp', 'add'); |
||||
43 | $adminObject->displayButton('left'); |
||||
44 | $criteria = new \CriteriaCompo(); |
||||
45 | $criteria->setSort('id'); |
||||
46 | $criteria->setOrder('ASC'); |
||||
47 | $numrows = $tempHandler->getCount(); |
||||
48 | $pedigree_temp_arr = $tempHandler->getAll($criteria); |
||||
49 | |||||
50 | //Table view |
||||
51 | if ($numrows > 0) { |
||||
52 | echo "<table cellspacing='1' class='outer width100'> |
||||
53 | <thead> |
||||
54 | <tr> |
||||
55 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_PNAME . "</th> |
||||
56 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_ID_OWNER . "</th> |
||||
57 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_ID_BREEDER . "</th> |
||||
58 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_USER . "</th> |
||||
59 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_ROFT . "</th> |
||||
60 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_MOTHER . "</th> |
||||
61 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_FATHER . "</th> |
||||
62 | <th class='txtcenter'>" . _AM_PEDIGREE_PEDIGREE_TEMP_FOTO . "</th> |
||||
63 | <th class='txtcenter width10'>" . _AM_PEDIGREE_FORMACTION . '</th> |
||||
64 | </tr> |
||||
65 | </thead> |
||||
66 | <tbody>'; |
||||
67 | |||||
68 | $class = 'odd'; |
||||
69 | |||||
70 | foreach (array_keys($pedigree_temp_arr) as $i) { |
||||
71 | if (0 == $pedigree_temp_arr[$i]->getVar('pedigree_temp_pid')) { |
||||
72 | echo "<tr class='{$class}'>"; |
||||
73 | $class = ('even' === $class) ? 'odd' : 'even'; |
||||
74 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('pname') . '</td>'; |
||||
75 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('id_owner') . '</td>'; |
||||
76 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('id_breeder') . '</td>'; |
||||
77 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('user') . '</td>'; |
||||
78 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('roft') . '</td>'; |
||||
79 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('mother') . '</td>'; |
||||
80 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('father') . '</td>'; |
||||
81 | echo "<td class='txtcenter'>" . $pedigree_temp_arr[$i]->getVar('foto') . '</td>'; |
||||
82 | echo "<td class-'txtcenter width10'> |
||||
83 | <a href='pedigree_temp.php?op=edit_pedigree_temp&id=" . $pedigree_temp_arr[$i]->getVar('id') . "'><img src=" . $pathIcon16 . "/edit.png alt='" . _EDIT . "' title='" . _EDIT . "'></a> |
||||
84 | <a href='pedigree_temp.php?op=delete_pedigree_temp&id=" . $pedigree_temp_arr[$i]->getVar('id') . "'><img src=" . $pathIcon16 . "/delete.png alt='" . _DELETE . "' title='" . _DELETE . "'></a> |
||||
85 | </td>"; |
||||
86 | echo '</tr>'; |
||||
87 | } |
||||
88 | } |
||||
89 | echo '</tbody> |
||||
90 | </table> |
||||
91 | <br><br>'; |
||||
92 | } |
||||
93 | |||||
94 | break; |
||||
95 | case 'new_pedigree_temp': |
||||
96 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
97 | $adminObject->addItemButton(_AM_PEDIGREE_PEDIGREE_TEMPLIST, 'pedigree_temp.php?op=list', 'list'); |
||||
98 | $adminObject->displayButton('left'); |
||||
99 | |||||
100 | $tempHandler = Helper::getInstance()->getHandler('Temp'); |
||||
101 | $obj = $tempHandler->create(); |
||||
102 | $form = $obj->getForm(); |
||||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||||
103 | $form->display(); |
||||
104 | break; |
||||
105 | case 'save_pedigree_temp': |
||||
106 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||
107 | $helper->redirect('admin/pedigree_temp.php', 3, implode(',', $GLOBALS['xoopsSecurity']->getErrors())); |
||||
108 | } |
||||
109 | if (isset($_REQUEST['id']) && (($id = Request::getInt('id', 1)) > 0)) { |
||||
110 | $obj = $tempHandler->get($id); |
||||
111 | } else { |
||||
112 | $obj = $tempHandler->create(); |
||||
113 | } |
||||
114 | |||||
115 | //Form pname |
||||
116 | $obj->setVar('pname', $_REQUEST['pname']); |
||||
117 | //Form id_owner |
||||
118 | $obj->setVar('id_owner', $_REQUEST['id_owner']); |
||||
119 | //Form id_breeder |
||||
120 | $obj->setVar('id_breeder', $_REQUEST['id_breeder']); |
||||
121 | //Form user |
||||
122 | $obj->setVar('user', $_REQUEST['user']); |
||||
123 | //Form roft |
||||
124 | $obj->setVar('roft', $_REQUEST['roft']); |
||||
125 | //Form mother |
||||
126 | $obj->setVar('mother', $_REQUEST['mother']); |
||||
127 | //Form father |
||||
128 | $obj->setVar('father', $_REQUEST['father']); |
||||
129 | //Form foto |
||||
130 | $obj->setVar('foto', $_REQUEST['foto']); |
||||
131 | //Form coi |
||||
132 | $obj->setVar('coi', $_REQUEST['coi']); |
||||
133 | |||||
134 | if ($tempHandler->insert($obj)) { |
||||
135 | $helper->redirect('admin/pedigree_temp.php?op=list', 2, _AM_PEDIGREE_FORMOK); |
||||
136 | } |
||||
137 | |||||
138 | echo $obj->getHtmlErrors(); |
||||
139 | $form = $obj->getForm(); |
||||
140 | $form->display(); |
||||
141 | break; |
||||
142 | case 'edit_pedigree_temp': |
||||
143 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
144 | $adminObject->addItemButton(_AM_PEDIGREE_NEWPEDIGREE_TEMP, 'pedigree_temp.php?op=new_pedigree_temp', 'add'); |
||||
145 | $adminObject->addItemButton(_AM_PEDIGREE_PEDIGREE_TEMPLIST, 'pedigree_temp.php?op=list', 'list'); |
||||
146 | $adminObject->displayButton('left'); |
||||
147 | $obj = $tempHandler->get($_REQUEST['id']); |
||||
148 | $form = $obj->getForm(); |
||||
149 | $form->display(); |
||||
150 | break; |
||||
151 | case 'delete_pedigree_temp': |
||||
152 | $obj = $tempHandler->get($_REQUEST['id']); |
||||
153 | if (isset($_REQUEST['ok']) && 1 == $_REQUEST['ok']) { |
||||
154 | if (!$GLOBALS['xoopsSecurity']->check()) { |
||||
155 | $helper->redirect('admin/pedigree_temp.php', 3, implode(',', $GLOBALS['xoopsSecurity']->getErrors())); |
||||
156 | } |
||||
157 | if ($tempHandler->delete($obj)) { |
||||
158 | $helper->redirect('admin/pedigree_temp.php', 3, _AM_PEDIGREE_FORMDELOK); |
||||
159 | } else { |
||||
160 | echo $obj->getHtmlErrors(); |
||||
161 | } |
||||
162 | } else { |
||||
163 | xoops_confirm(['ok' => 1, 'id' => $_REQUEST['id'], 'op' => 'delete_pedigree_temp'], $_SERVER['REQUEST_URI'], sprintf(_AM_PEDIGREE_FORMSUREDEL, $obj->getVar('pedigree_temp'))); |
||||
0 ignored issues
–
show
It seems like
$obj->getVar('pedigree_temp') can also be of type array and array ; however, parameter $values of sprintf() does only seem to accept double|integer|string , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
164 | } |
||||
165 | break; |
||||
166 | } |
||||
167 | require_once __DIR__ . '/admin_footer.php'; |
||||
168 |