This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||
2 | /* |
||
3 | You may not change or alter any portion of this comment or credits of |
||
4 | supporting developers from this source code or any supporting source code |
||
5 | which is considered copyrighted (c) material of the original comment or credit |
||
6 | authors. |
||
7 | |||
8 | This program is distributed in the hope that it will be useful, but |
||
9 | WITHOUT ANY WARRANTY; without even the implied warranty of |
||
10 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
11 | */ |
||
12 | |||
13 | /** |
||
14 | * Module: Pedigree |
||
15 | * |
||
16 | * @package XoopsModules\Pedigree |
||
17 | * @author XOOPS Module Development Team |
||
18 | * @copyright Copyright (c) 2001-2019 {@link https://xoops.org XOOPS Project} |
||
19 | * @license https://www.gnu.org/licenses/gpl-2.0.html GNU Public License |
||
20 | */ |
||
21 | |||
22 | use Xmf\Request; |
||
23 | use XoopsModules\Pedigree\{ |
||
24 | Helper, |
||
25 | OwnerHandler |
||
26 | }; |
||
27 | /** @var Helper $helper */ |
||
28 | /** @var OwnerHandler $ownerHandler */ |
||
29 | |||
30 | require_once __DIR__ . '/header.php'; |
||
31 | |||
32 | $helper->loadLanguage('main'); |
||
33 | |||
34 | // Include any common code for this module. |
||
35 | require_once $helper->path('include/common.php'); |
||
36 | |||
37 | // Get all HTTP post or get parameters into global variables that are prefixed with "param_" |
||
38 | //import_request_variables("gp", "param_"); |
||
39 | //extract($_GET, EXTR_PREFIX_ALL, 'param'); |
||
40 | //extract($_POST, EXTR_PREFIX_ALL, 'param'); |
||
41 | |||
42 | $GLOBALS['xoopsOption']['template_main'] = 'pedigree_owner.tpl'; |
||
43 | |||
44 | include $GLOBALS['xoops']->path('/header.php'); |
||
45 | |||
46 | $GLOBALS['xoTheme']->addScript('browse.php?Frameworks/jquery/jquery.js'); |
||
47 | $GLOBALS['xoTheme']->addScript('browse.php?' . $helper->url('assets/js/jquery.magnific-popup.min.js')); |
||
48 | $GLOBALS['xoTheme']->addStylesheet('browse.php?' . $helper->url('assets/css/style.css')); |
||
49 | $GLOBALS['xoTheme']->addStylesheet('browse.php?' . $helper->url('assets/css/magnific-popup.css')); |
||
50 | |||
51 | //@todo this js script doesn't exist - should it use XOOPS spectrum.js instead? |
||
52 | // Commented out in v1.32 Alpha 1 since it's not used in the template |
||
53 | /* |
||
54 | if (isset($GLOBALS['xoTheme'])) { |
||
55 | $GLOBALS['xoTheme']->addScript('include/color-picker.js'); |
||
56 | } else { |
||
57 | echo "<script type=\"text/javascript\" src=\"" . XOOPS_URL . "/include/color-picker.js\"></script>\n"; |
||
58 | } |
||
59 | */ |
||
60 | $GLOBALS['xoopsTpl']->assign('page_title', _MA_PEDIGREE_OWNER_PAGETITLE); |
||
61 | |||
62 | $pathIcon16 = \Xmf\Module\Admin::iconUrl('', 16); |
||
63 | |||
64 | xoops_load('XoopsUserUtility'); |
||
65 | |||
66 | $ownId = Request::getInt('ownid', 0, 'GET'); |
||
67 | $items = []; |
||
68 | |||
69 | //query |
||
70 | $ownerHandler = $helper->getHandler('Owner'); |
||
71 | $criteria = new \Criteria('id', $ownId); |
||
72 | $ownObjArray = $ownerHandler->getAll($criteria); |
||
73 | |||
74 | foreach ($ownObjArray as $ownObj) { |
||
75 | $pnamef = $ownObj->getVar('firstname'); //first name |
||
76 | $pnamel = $ownObj->getVar('lastname'); // last name |
||
77 | $pname = ucwords($pnamef . ' ' . $pnamel); // whole name |
||
78 | $email = $ownObj->getVar('emailadres'); // email address |
||
79 | //homepage - changed to be regular expression check for http or https (case insensitive) |
||
80 | $homepage = $ownObj->getVar('website'); //website home page |
||
81 | if (!empty($homepage) && !preg_match('/^(https?:\/\/)/i', $homepage)) { |
||
82 | $homepage = "https://{$homepage}"; //defaults to use https: |
||
83 | } |
||
84 | |||
85 | //check for edit rights |
||
86 | $access = 0; |
||
87 | if ((!empty($GLOBALS['xoopsUser']) && ($GLOBALS['xoopsUser'] instanceof \XoopsUser)) |
||
88 | && ($helper->isUserAdmin() || ($ownObj->getVar('user') == $GLOBALS['xoopsUser']->getVar('uid')))) { |
||
89 | $access = 1; |
||
90 | } |
||
91 | |||
92 | //lastname |
||
93 | $items[] = [ |
||
94 | 'header' => _MA_PEDIGREE_OWN_LNAME, |
||
95 | 'data' => "<a href=\"owner.php?ownid={$ownId}\">{$pnamel}</a>", |
||
96 | 'edit' => '<a href="' . $helper->url("updateowner.php?id={$ownId}&fld=nl") . "\">{$icons['edit']}</a>", |
||
97 | ]; |
||
98 | //firstname |
||
99 | $items[] = [ |
||
100 | 'header' => _MA_PEDIGREE_OWN_FNAME, |
||
101 | 'data' => '<a href="' . $helper->url("owner.php?ownid={$ownId}") . "\">{$pnamef}</a>", |
||
102 | 'edit' => '<a href="' . $helper->url("updateowner.php?id={$ownId}&fld=nf") . "\">{$icons['edit']}</a>", |
||
103 | ]; |
||
104 | |||
105 | $items[] = [ |
||
106 | 'header' => _MA_PEDIGREE_FLD_OWN_EMAIL, |
||
107 | 'data' => "<a href=\"mailto:{$email}\">{$email}</a>", |
||
108 | 'edit' => '<a href="' . $helper->url("updateowner.php?id={$ownId}&fld=em") . "\">{$icons['edit']}</a>", |
||
109 | ]; |
||
110 | //homepage |
||
111 | $items[] = [ |
||
112 | 'header' => _MA_PEDIGREE_FLD_OWN_WEB, |
||
113 | 'data' => "<a href=\"{$homepage}\" target=\"_blank\">{$homepage}</a>", |
||
114 | 'edit' => '<a href="' . $helper->url("updateowner.php?id={$ownId}&fld=we") . "\">{$icons['edit']}</a>", |
||
115 | ]; |
||
116 | //owner of |
||
117 | $items[] = [ |
||
118 | 'header' => _MA_PEDIGREE_OWN_OWN, |
||
119 | 'data' => Pedigree\Utility::breederof($ownId, 0), |
||
0 ignored issues
–
show
|
|||
120 | 'edit' => '', |
||
121 | ]; |
||
122 | //breeder of |
||
123 | $items[] = [ |
||
124 | 'header' => _MA_PEDIGREE_OWN_BRE, |
||
125 | 'data' => Pedigree\Utility::breederof($ownId, 1), |
||
126 | 'edit' => '', |
||
127 | ]; |
||
128 | //database user who entered the data into the dB |
||
129 | $items[] = [ |
||
130 | 'header' => _MA_PEDIGREE_FLD_DBUS, |
||
131 | 'data' => \XoopsUserUtility::getUnameFromId($ownObj->getVar('user')), |
||
132 | 'edit' => '', |
||
133 | ]; |
||
134 | /* |
||
135 | $sql = 'SELECT * FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_owner') . ' WHERE id=' . $ownId; |
||
136 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
137 | |||
138 | while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||
139 | //id |
||
140 | $id = $row['id']; |
||
141 | |||
142 | //name |
||
143 | $pname = stripslashes($row['firstname']) . ' ' . stripslashes($row['lastname']); |
||
144 | |||
145 | //lastname |
||
146 | $pnamel = stripslashes($row['lastname']); |
||
147 | |||
148 | //firstname |
||
149 | $pnamef = stripslashes($row['firstname']); |
||
150 | |||
151 | |||
152 | $email = $row['emailadres']; |
||
153 | |||
154 | //homepage - changed to be regular expression check for http or https (case insensitive) |
||
155 | $homepage = $row['website']; |
||
156 | if (!empty($homepage) && !preg_match('/^(https?:\/\/)/i', $homepage)) { |
||
157 | $homepage = "https://{$homepage}"; //defaults to use https: |
||
158 | } |
||
159 | |||
160 | global $xoopsTpl; |
||
161 | |||
162 | $check = substr($homepage, 0, 7); |
||
163 | if ('http://' !== $check) { |
||
164 | $homepage = 'http://' . $homepage; |
||
165 | } |
||
166 | |||
167 | //Owner of |
||
168 | $owner = Pedigree\Utility::breederof($row['id'], 0); |
||
169 | |||
170 | //Breeder of |
||
171 | $breeder = Pedigree\Utility::breederof($row['id'], 1); |
||
172 | |||
173 | //entered into the database by |
||
174 | $dbuser = \XoopsUserUtility::getUnameFromId($row['user']); |
||
175 | |||
176 | //check for edit rights |
||
177 | $access = 0; |
||
178 | if ((!empty($GLOBALS['xoopsUser']) && ($GLOBALS['xoopsUser'] instanceof \XoopsUser)) |
||
179 | && ($helper->isUserAdmin() || ($row['user'] == $GLOBALS['xoopsUser']->getVar('uid')))) |
||
180 | { |
||
181 | $access = 1; |
||
182 | } |
||
183 | |||
184 | //lastname |
||
185 | $items[] = [ |
||
186 | 'header' => _MA_PEDIGREE_OWN_LNAME, |
||
187 | 'data' => "<a href=\"owner.php?ownid={$row['id']}\">{$pnamel}</a>", |
||
188 | 'edit' => "<a href=\"" . $helper->url("updateowner.php?id={$row['id']}&fld=nl") . "\"><img src=\"{$pathIcon16}/edit.png\" border=\"0\" alt=\"_EDIT\" title=\"_EDIT\"></a>" |
||
189 | ]; |
||
190 | |||
191 | //firstname |
||
192 | $items[] = [ |
||
193 | 'header' => _MA_PEDIGREE_OWN_FNAME, |
||
194 | 'data' => "<a href=\"" . $helper->url("owner.php?ownid={$row['id']}") . "\">{$pnamef}</a>", |
||
195 | 'edit' => "<a href=\"" . $helper->url("updateowner.php?id={$row['id']}&fld=nf") . "\"><img src=\"{$pathIcon16}/edit.png\" border=\"0\" alt=\"_EDIT\" title=\"_EDIT\"></a>" |
||
196 | ]; |
||
197 | |||
198 | |||
199 | $items[] = [ |
||
200 | 'header' => _MA_PEDIGREE_FLD_OWN_EMAIL, |
||
201 | 'data' => "<a href=\"mailto:{$email}\">{$email}</a>", |
||
202 | 'edit' => "<a href=\"" . $helper->url("updateowner.php?id={$row['id']}&fld=em") . "\"><img src=\"{$pathIcon16}/edit.png\" border=\"0\" alt=\"_EDIT\" title=\"_EDIT\"></a>" |
||
203 | ]; |
||
204 | //homepage |
||
205 | $items[] = [ |
||
206 | 'header' => _MA_PEDIGREE_FLD_OWN_WEB, |
||
207 | 'data' => "<a href=\"{$homepage}\" target=\"_blank\">{$homepage}</a>", |
||
208 | 'edit' => "<a href=\"" . $helper->url("updateowner.php?id={$row['id']}&fld=we") . "\"><img src=\"{$pathIcon16}/edit.png\" border=\"0\" alt=\"_EDIT\" title=\"_EDIT\"></a>" |
||
209 | ]; |
||
210 | //owner of |
||
211 | $items[] = [ |
||
212 | 'header' => _MA_PEDIGREE_OWN_OWN, |
||
213 | 'data' => $owner, |
||
214 | 'edit' => '' |
||
215 | ]; |
||
216 | //breeder of |
||
217 | $items[] = [ |
||
218 | 'header' => _MA_PEDIGREE_OWN_BRE, |
||
219 | 'data' => $breeder, |
||
220 | 'edit' => '' |
||
221 | ]; |
||
222 | //database user |
||
223 | $items[] = [ |
||
224 | 'header' => _MA_PEDIGREE_FLD_DBUS, |
||
225 | 'data' => $dbuser, |
||
226 | 'edit' => '' |
||
227 | ]; |
||
228 | */ |
||
229 | //add dog/owner/breeder to smarty template |
||
230 | $GLOBALS['xoopsTpl']->assign(['access' => $access, 'dogs' => $items, 'name' => $pname, 'id' => $ownId]); |
||
231 | } |
||
232 | |||
233 | //add data to smarty template |
||
234 | $GLOBALS['xoopsTpl']->assign(['delete' => $icons['delete']]); |
||
235 | |||
236 | //comments and footer |
||
237 | require XOOPS_ROOT_PATH . '/footer.php'; |
||
238 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"]
, you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths