Issues in tools.php (master) - Issues in master - mambax7/pedigree - Measure and Improve Code Quality continuously with Scrutinizer

Issues (838)

Security Analysis not enabled

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

Header Injection

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/tools.php (2 issues)

Labels

Severity

Minor 2

<?php
/*
 * You may not change or alter any portion of this comment or credits
 * of supporting developers from this source code or any supporting source code
 * which is considered copyrighted (c) material of the original comment or credit authors.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/

/**
 * @package         XoopsModules\Pedigree
 * @copyright       {@link https://xoops.org/ XOOPS Project}
 * @license         {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later}
 * @author          XOOPS Module Dev Team
 */


use Xmf\Request;
use XoopsModules\Pedigree\{
    Constants,
    Helper
};

require_once \dirname(__DIR__, 3) . '/mainfile.php';

// Include any common code for this module.
require_once \dirname(__DIR__) . '/include/common.php';

$GLOBALS['xoopsOption']['template_main'] = 'pedigree_tools.tpl';

require XOOPS_ROOT_PATH . '/header.php';
$helper = Helper::getInstance();
$helper->loadLanguage('main');

//@todo move language string to language file
$GLOBALS['xoopsTpl']->assign('page_title', 'Pedigree database - Add owner/breeder');

//check for access
$xoopsModule = XoopsModule::getByDirname($moduleDirName);
if (empty($GLOBALS['xoopsUser'])) {
    $helper->redirect('admin/index.php', 3, _NOPERM . '<br>' . _MA_PEDIGREE_REGIST);
}

//add JS routines
//@todo change this to send to Tpl addScript
echo "<script type=\"text/javascript\" src=\"assets/js/picker.js\"></script>\n";

//set form to be empty
$form = '';

$helper = Helper::getInstance();
////get module configuration
///** @var \XoopsModuleHandler $moduleHandler */
//$moduleHandler = xoops_getHandler('module');
//$module        = $moduleHandler->getByDirname($moduleDirName);
///** @var \XoopsConfigHandler $configHandler */
//$configHandler = xoops_getHandler('config');
//$moduleConfig  = $configHandler->getConfigsByCat(0, $module->getVar('mid'));

$op = Request::getString('op', '', 'GET');
switch ($op) {
    case 'lang':
        lang();
        break;
    case 'langsave':
        langsave();
        break;
    case 'colours':
        colours();
        break;
    case 'settings':
        settings();
        break;
    case 'settingssave':
        settingssave();
        break;
    case 'pro':
        pro();
        break;
    case 'userfields':
        userfields();
        break;
    case 'deleted':
        deleted();
        break;
    case 'delperm':
        delperm($_GET['id']);
        break;
    case 'delall':
        delall();
        break;
    case 'restore':
        restore($_GET['id']);
        break;
    case 'database':
        database();
        $db = true;
        break;
    case 'dbanc':
        database_oa();
        $db = true;
        break;
    case 'fltypar':
        database_fp();
        $db = true;
        break;
    case 'credits':
        credits();
        break;
    default:
        index();
        break;
}

//create tools array
//@todo move language strings to language files
$tools[] = ['title' => 'General settings', 'link' => 'tools.php?op=settings', 'main' => '1'];
if ('1' == $helper->getConfig('proversion')) {
    $tools[] = ['title' => 'Pro-version settings', 'link' => 'tools.php?op=pro', 'main' => '1'];
}
$tools[] = ['title' => 'Language options', 'link' => 'tools.php?op=lang', 'main' => '1'];
$tools[] = ['title' => 'Create user fields', 'link' => 'tools.php?op=userfields', 'main' => '1'];
$tools[] = ['title' => 'Create colours', 'link' => 'tools.php?op=colours', 'main' => '1'];
$tools[] = ['title' => "Deleted pedigree's", 'link' => 'tools.php?op=deleted', 'main' => '1'];
$tools[] = ['title' => 'Database tools', 'link' => 'tools.php?op=database', 'main' => '1'];
if (isset($db)) {
    //create database submenu
    $tools[] = ['title' => 'Own ancestors', 'link' => 'tools.php?op=dbanc', 'main' => '0'];
    $tools[] = ['title' => 'Incorrect gender', 'link' => 'tools.php?op=fltypar', 'main' => '0'];
    $tools[] = ['title' => 'User Queries', 'link' => 'tools.php?op=userq', 'main' => '0'];
}
$tools[] = ['title' => 'Credits', 'link' => 'tools.php?op=credits', 'main' => '1'];
$tools[] = ['title' => 'Logout', 'link' => '../../user.php?op=logout', 'main' => '1'];
//add data (form) to smarty template

$xoopsTpl->assign('tools', $tools);

//footer
require XOOPS_ROOT_PATH . '/footer.php';

function index()
{
    $form = '';

}

/**
 * @todo move language string to language file
 */
function colours()
{
    global $xoopsTpl, $femaleTextColour;
    $form = 'This will be the wizard to create and modify the website colourscheme.<hr>';
    $form .= '<form name="myForm" action=\'savecolors.php\' method=\'POST\'>';
    $form .= $GLOBALS['xoopsSecurity']->getTokenHTML();
    $form .= '<input type="text" id="ftxtcolor" name="ftxtcolor" value="#' . $femaleTextColour . '" size="11" maxlength="7">';
    $form .= '<a href="javascript:TCP.popup(document.forms[\'myForm\'].elements[\'ftxtcolor\'])">';
    $form .= '<img width="15" height="13" border="0" alt="Click here to pick the color" src="img/sel.gif"></a>';
    $form .= '</form>';
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo move language string to language file
 */
function userfields()
{
    global $xoopsTpl;
    $form = 'This will be the wizard to create and modify the custom userfields.<hr>';
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo move language string to language file
 */
function credits()
{
    global $xoopsTpl;
    $form = 'Pedigree database module<br><br><li>Programming : James Cotton<br><li>Design & Layout : Ton van der Hagen<br><br>Technical support :<br><li><a href="mailto:[email protected]">[email protected]<br><li><a href="http://www.animalpedigree.com">www.animalpedigree.com</a><hr>';
    $xoopsTpl->assign('form', $form);
}

function database()
{
    global $xoopsTpl;
    $form = _MA_PEDIGREE_QUERY_EXPLAN;
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo move language string to language file
 */
function database_oa()
{
    global $xoopsTpl;
    $form   = _AM_PEDIGREE_DATABASE_CHECK_ANCESTORS;
    $sql    = 'SELECT d.id AS d_id, d.pname AS d_pname
            FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' d
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' m ON m.id = d.mother
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' f ON f.id = d.father
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' mm ON mm.id = m.mother
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' mf ON mf.id = m.father
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' fm ON fm.id = f.mother
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' ff ON ff.id = f.father
            WHERE
            d.mother = d.id
            OR d.father = d.id
            OR m.mother = d.id
            OR m.father = d.id
            OR f.mother = d.id
            OR f.father = d.id
            OR mm.mother = d.id
            OR mm.father = d.id
            OR mf.mother = d.id
            OR mf.father = d.id
            OR fm.mother = d.id
            OR fm.father = d.id
            OR ff.mother = d.id
            OR ff.father = d.id
            ';
    $result = $GLOBALS['xoopsDB']->query($sql);
    while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) {
        $form .= '<li><a href="pedigree.php?pedid=' . $row['d_id'] . '">' . $row['d_pname'] . '</a> [own parent or grandparent]<br>';
    }
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo move language string to language file
 */
function database_fp()
{
    global $xoopsTpl;
    $form   = _AM_PEDIGREE_DATABASE_CHECK_GENDER;
    $sql    = 'SELECT d.id AS d_id, d.pname AS d_pname, m.roft AS m_roft
            FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' d
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . " m ON m.id = d.mother
            WHERE
            d.mother = m.id
            AND m.roft = '0' ";
    $result = $GLOBALS['xoopsDB']->query($sql);
    while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) {
        $form .= '<li><a href="dog.php?id=' . $row['d_id'] . '">' . $row['d_pname'] . '</a> [mother seems to be male]<br>';
    }
    $sql    = 'SELECT d.id AS d_id, d.pname AS d_pname, f.roft AS f_roft
            FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' d
            LEFT JOIN ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . " f ON f.id = d.father
            WHERE
            d.father = f.id
            AND f.roft = '1' ";
    $result = $GLOBALS['xoopsDB']->query($sql);
    while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) {
        $form .= '<li><a href="dog.php?id=' . $row['d_id'] . '">' . $row['d_pname'] . '</a> [father seems to be female]<br>';
    }
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo move language string to language file
 */
function pro()
{
    global $xoopsTpl;
    $form = 'Pro version settings go here.<hr>';
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo refactor using {@see Pedigree\Trash} class
 */
function deleted()
{
    global $xoopsTpl;
    $helper = Helper::getInstance();
    $form   = "Below the line are the animals which have been deleted from your database.<br><br>By clicking on the name you can reinsert them into the database.<br>By clicking on the 'X' in front of the name you can permanently delete the animal.<hr>";
    $sql    = 'SELECT id, pname  FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_trash');
    $result = $GLOBALS['xoopsDB']->query($sql);
    while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) {
        $form .= '<a href="tools.php?op=delperm&id=' . $row['id'] . '"><img src="assets/images/delete.png"></a>&nbsp;<a href="tools.php?op=restore&id=' . $row['id'] . '">' . $row['pname'] . '</a><br>';
    }
    if ($GLOBALS['xoopsDB']->getRowsNum($result) > 0) {
        $form .= '<hr><a href="tools.php?op=delall">Click here</a> to remove all these ' . $helper->getConfig('animalTypes') . ' permenantly ';
    }
    $xoopsTpl->assign('form', $form);
}

/**
 * @param $id
 * @todo refactor using {@see Pedigree\Trash} class
 */
function delperm($id)
{
    global $xoopsTpl;
    $sql = 'DELETE FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_trash') . ' WHERE id = ' . $id;
    $GLOBALS['xoopsDB']->queryF($sql);
    deleted();
}

/**
 * @todo refactor using {@see Pedigree\Trash} class
 */
function delall()
{
    global $xoopsTpl;
    $sql = 'DELETE FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_trash');
    $GLOBALS['xoopsDB']->queryF($sql);
    deleted();
}

/**
 * @param $id
 */
function restore($id)
{
    global $xoopsTpl;
    $sql    = 'SELECT * FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_trash') . ' WHERE id = ' . $id;
    $result = $GLOBALS['xoopsDB']->query($sql);
    while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) {
        foreach ($row as $key => $values) {
            //          $queryvalues .= "'" . $values . "',";
            $queryvalues .= "'" . $GLOBALS['xoopsDB']->escape($values) . "',";
        }
        $outgoing = substr_replace($queryvalues, '', -1);
        $query    = 'INSERT INTO ' . $GLOBALS['xoopsDB']->prefix('pedigree_registry') . ' VALUES (' . $outgoing . ')';
        $GLOBALS['xoopsDB']->queryF($query);
        $delquery = 'DELETE FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_trash') . ' WHERE id = ' . $id;
        $GLOBALS['xoopsDB']->queryF($delquery);
        $form .= '<li><a href="pedigree.php?pedid=' . $row['id'] . '">' . $row['pname'] . '</a> has been restored into the database.<hr>';
    }
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo move language strings to language file
 */
function settings()
{
    global $xoopsTpl;
    $helper = Helper::getInstance();
    require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
    $form = new \XoopsThemeForm('General settings', 'settings', 'tools.php?op=settingssave', 'POST', 1);
    $form->addElement(new \XoopsFormHiddenToken($name = 'XOOPS_TOKEN_REQUEST', $timeout = 360));
    $select  = new \XoopsFormSelect('<b>Number of results per page</b>', 'perpage', $value = $helper->getConfig('perpage'), $size = 1, $multiple = false);
    $options = [
        '50'    => 50,
        '100'   => 100,
        '250'   => 250,
        '500'   => 500,
        '1000'  => 1000,
        '2000'  => 2000,
        '5000'  => 5000,
        '10000' => 10000,
    ];
    foreach ($options as $key => $values) {
        $select->addOption($key, $name = $values);
    }
    unset($options);
    $form->addElement($select);
    $form->addElement(
        new \XoopsFormLabel(
            _MA_PEDIGREE_EXPLAIN, 'This field is used to set the number of results a page will return from a search. If more results are returned extra pages will be created for easy browsing.<br>Set this number higher as your database grows and the number of pages increase.'
        )
    );
    $radio = new \XoopsFormRadio('<b>Use owner/breeder fields</b>', 'ownerbreeder', $value = $helper->getConfig('ownerbreeder'));
    $radio->addOption(1, $name = 'yes');
    $radio->addOption(0, $name = 'no');
    $form->addElement($radio);
    $form->addElement(
        new \XoopsFormLabel(
            _MA_PEDIGREE_EXPLAIN,
            'Use this field to set if you would like to use the owner/breeder fields of the database.<br>As the name suggests the owner/breeder fields let you record and display information about the owner and or breeder.<br>The owner/breeder menu items will also be affected by this setting.'
        )
    );
    $radiobr = new \XoopsFormRadio('<b>Show brother & sister field</b>', 'brothers', $value = $helper->getConfig('brothers'));
    $radiobr->addOption(1, $name = 'yes');
    $radiobr->addOption(0, $name = 'no');
    $form->addElement($radiobr);
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set if you would like to use the add a ' . $helper->getConfig('litter') . 'feature.<br>If your chosen animal only has one offspring at a time this feature will not be useful to you.'));
    $radiolit = new \XoopsFormRadio('<b>Use add a ' . $helper->getConfig('litter') . ' feature</b>', 'uselitter', $value = $helper->getConfig('uselitter'));
    $radiolit->addOption(1, $name = 'yes');
    $radiolit->addOption(0, $name = 'no');
    $form->addElement($radiolit);
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set if you would like to display the brothers & sisters field on the detailed ' . $helper->getConfig('animalType') . ' information page.'));
    $radioch = new \XoopsFormRadio('<b>Show ' . $helper->getConfig('children') . ' field</b>', 'pups', $value = $helper->getConfig('pups'));
    $radioch->addOption(1, $name = 'yes');
    $radioch->addOption(0, $name = 'no');
    $form->addElement($radioch);
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set if you would like to display the ' . $helper->getConfig('children') . ' field on the detailed ' . $helper->getConfig('animalType') . ' information page.'));
    $form->addElement(new \XoopsFormButton('', 'button_id', 'Submit', 'submit'));
    $xoopsTpl->assign('form', $form->render());
}

/**
 * @todo move language string to language file
 */
function settingssave()
{
    global $xoopsTpl;
    $form     = '';
    $settings = ['perpage', 'ownerbreeder', 'brothers', 'uselitter', 'pups'];
    foreach ($_POST as $key => $values) {
        if (in_array($key, $settings)) {
            //          $query = 'UPDATE ' . $GLOBALS['xoopsDB']->prefix('config') . " SET conf_value = '" . $values . "' WHERE conf_name = '" . $key . "'";
            $query = 'UPDATE ' . $GLOBALS['xoopsDB']->prefix('config') . " SET conf_value = '" . $GLOBALS['xoopsDB']->escape($values) . "' WHERE conf_name = '" . $GLOBALS['xoopsDB']->escape($key) . "'";
            $GLOBALS['xoopsDB']->query($query);
        }
    }
    $form .= 'Your settings have been saved.<hr>';
    $xoopsTpl->assign('form', $form);
}

/**
 * @todo move language string to language file
 */
function lang()
{
    global $xoopsTpl;
    $helper = Helper::getInstance();
    require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
    $form = new \XoopsThemeForm('Language options', 'language', 'tools.php?op=langsave', 'post', true);
    $form->addElement(new \XoopsFormHiddenToken($name = 'XOOPS_TOKEN_REQUEST', $timeout = 360));
    $form->addElement(new \XoopsFormText('<b>type of animal</b>', 'animalType', $size = 50, $maxsize = 255, $value = $helper->getConfig('animalType')));
    $form->addElement(
        new \XoopsFormLabel(
            _MA_PEDIGREE_EXPLAIN,
            'Use this field to set the animal type which will be used in the application.<br><i>example : </i>snake, pigeon, dog, owl<br><br>The value should fit in the sentences below.<br>Please add optional information for this <b>'
            . $helper->getConfig('animalType')
            . '</b>.<br>Select the first letter of the <b>'
            . $helper->getConfig('animalType')
            . '</b>.'
        )
    );
    $form->addElement(new \XoopsFormText('<b>type of animal</b>', 'animalTypes', $size = 50, $maxsize = 255, $value = $value = $helper->getConfig('animalTypes')));

    $form->addElement(
        new \XoopsFormLabel(
            _MA_PEDIGREE_EXPLAIN,
            'Use this field to set the animal type which will be used in the application.<br>This field is the plural of the previous field<br><i>example : </i>snakes, pigeons, dogs, owls<br><br>The value should fit in the sentence below.<br>No <b>'
            . $helper->getConfig('animalTypes')
            . '</b> meeting your query have been found.'
        )
    );
    $form->addElement(new \XoopsFormText('<b>male</b>', 'male', $size = 50, $maxsize = 255, $value = $helper->getConfig('male')));
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set the name used for the male animal.<br><i>example : </i>male, buck, sire etc.'));
    $form->addElement(new \XoopsFormText('<b>female</b>', 'female', $size = 50, $maxsize = 255, $value = $helper->getConfig('female')));
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set the name used for the female animal.<br><i>example : </i>female, vixen, dam etc.'));
    $form->addElement(new \XoopsFormText('<b>children</b>', 'children', $size = 50, $maxsize = 255, $value = $helper->getConfig('children')));
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set the name used for children of this type of animal (' . $helper->getConfig('animalTypes') . ').<br><i>example : </i>pups, cubs, kittens etc.'));
    $form->addElement(new \XoopsFormText('<b>mother</b>', 'mother', $size = 50, $maxsize = 255, $value = $helper->getConfig('mother')));
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set the name used for mother of this type of animal (' . $helper->getConfig('animalTypes') . ').<br><i>example : </i>dam, mare etc.'));
    $form->addElement(new \XoopsFormText('<b>father</b>', 'father', $size = 50, $maxsize = 255, $value = $helper->getConfig('father')));
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set the name used for father of this type of animal (' . $helper->getConfig('animalTypes') . ').<br><i>example : </i>sire, stallion etc.'));
    $form->addElement(new \XoopsFormText('<b>litter</b>', 'litter', $size = 50, $maxsize = 255, $value = $helper->getConfig('litter')));
    $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_EXPLAIN, 'Use this field to set the name used for a collection of newborn animals.<br><i>example : </i>litter, nest etc.'));
    $form->addElement(new \XoopsFormTextArea('<b>Welcome text</b>', 'welcome', $value = $helper->getConfig('welcome'), $rows = 15, $cols = 50));

    $form->addElement(
        new \XoopsFormLabel(
            _MA_PEDIGREE_EXPLAIN,
            'Use this field to set the text you would like to display for the welcome page.<br><br>You may use the follwing variables :<br>[animalType] = ' . $helper->getConfig('animalType') . '<br>[animalTypes] =' . $helper->getConfig('animalTypes') . '<br>[numanimals] = number of animals in the database.'
        )
    );
    $form->addElement(new \XoopsFormButton('', 'button_id', 'Submit', 'submit'));
    $xoopsTpl->assign('form', $form->render());
}

/**
 * @todo move language string to language file
 */
function langsave()
{
    global $xoopsTpl;
    $form     = '';
    $settings = [
        'animalType',
        'animalTypes',
        'male',
        'female',
        'children',
        'mother',
        'father',
        'litter',
        'welcome',
    ];
    foreach ($_POST as $key => $values) {
        if (in_array($key, $settings)) {
            //          $query = 'UPDATE ' . $GLOBALS['xoopsDB']->prefix('config') . " SET conf_value = '" . $values . "' WHERE conf_name = '" . $key . "'";
            $query = 'UPDATE ' . $GLOBALS['xoopsDB']->prefix('config') . " SET conf_value = '" . $GLOBALS['xoopsDB']->escape($values) . "' WHERE conf_name = '" . $GLOBALS['xoopsDB']->escape($key) . "'";
            $GLOBALS['xoopsDB']->query($query);
        }
    }
    $form .= 'Your settings have been saved.<hr>';
    $xoopsTpl->assign('form', $form);
}


mambax7 / pedigree

Issues (838)

Security Analysis not enabled

admin/tools.php (2 issues)

Labels

Severity

Introduced By

Duplication Side-by-Side

Filter issues like