mambax7 /
pedigree
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||
| 2 | /* |
||
| 3 | You may not change or alter any portion of this comment or credits of |
||
| 4 | supporting developers from this source code or any supporting source code |
||
| 5 | which is considered copyrighted (c) material of the original comment or credit |
||
| 6 | authors. |
||
| 7 | |||
| 8 | This program is distributed in the hope that it will be useful, but |
||
| 9 | WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 10 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
| 11 | */ |
||
| 12 | |||
| 13 | /** |
||
| 14 | * Module: Pedigree |
||
| 15 | * |
||
| 16 | * @package XoopsModules\Pedigree |
||
| 17 | * @author XOOPS Module Development Team |
||
| 18 | * @copyright Copyright (c) 2001-2019 {@link https://xoops.org XOOPS Project} |
||
| 19 | * @license https://www.gnu.org/licenses/gpl-2.0.html GNU Public License |
||
| 20 | */ |
||
| 21 | |||
| 22 | use Xmf\Request; |
||
|
0 ignored issues
–
show
|
|||
| 23 | use XoopsModules\Pedigree; |
||
| 24 | use XoopsModules\Pedigree\Constants; |
||
| 25 | |||
| 26 | require_once __DIR__ . '/header.php'; |
||
| 27 | /** @var XoopsModules\Pedigree\Helper $helper */ |
||
| 28 | $helper->loadLanguage('main'); |
||
| 29 | |||
| 30 | // Include any common code for this module. |
||
| 31 | require_once $helper->path('include/common.php'); |
||
| 32 | |||
| 33 | $GLOBALS['xoopsOption']['template_main'] = 'pedigree_update.tpl'; |
||
| 34 | require XOOPS_ROOT_PATH . '/header.php'; |
||
| 35 | |||
| 36 | $GLOBALS['xoopsTpl']->assign('page_title', _MA_PEDIGREE_UPDATE); |
||
| 37 | |||
| 38 | //check for access |
||
| 39 | if (empty($GLOBALS['xoopsUser']) || !($GLOBALS['xoopsUser'] instanceof \XoopsUser)) { |
||
| 40 | redirect_header('javascript:history.go(-1)', Constants::REDIRECT_DELAY_MEDIUM, _NOPERM . '<br>' . _MA_PEDIGREE_REGIST); |
||
| 41 | } |
||
| 42 | |||
| 43 | $fld = Request::getWord('fld', '', 'GET'); |
||
| 44 | $id = Request::getInt('id', 0, 'GET'); |
||
| 45 | |||
| 46 | //query (find values for this owner/breeder (and format them)) |
||
| 47 | $ownerHandler = $helper->getHandler('Owner'); |
||
| 48 | $thisOwner = $ownerHandler->get($id); |
||
| 49 | |||
| 50 | if ($thisOwner && $thisOwner instanceof Pedigree\Owner) { |
||
| 51 | //get owner's name |
||
| 52 | $ownerVals = $thisOwner->getValues(['housenumber', 'streetname', 'postcode', 'city', 'phonenumber', 'emailadres', 'website', 'user']); |
||
| 53 | /* |
||
| 54 | $pnamel = $thisOwner->getVar('lastname'); |
||
| 55 | $pnamef = $thisOwner->getVar('firstname'); |
||
| 56 | $pname = $pnamel . ', ' . $pnamef; |
||
| 57 | */ |
||
| 58 | $pname = $thisOwner->getFullName(true); |
||
| 59 | $namelink = "<a href=\"" . $helper->url("dog.php?id={$id}") . "\">{$pname}</a>"; |
||
| 60 | //street |
||
| 61 | [$housenumber, $street, $postcode, $city, $phonenumber, $email, $web, $dbuser] = $ownerVals; |
||
| 62 | } |
||
| 63 | /* |
||
| 64 | $sql = 'SELECT * FROM ' . $GLOBALS['xoopsDB']->prefix('pedigree_owner') . ' WHERE id=' . $id; |
||
| 65 | $result = $GLOBALS['xoopsDB']->query($sql); |
||
| 66 | |||
| 67 | while (false !== ($row = $GLOBALS['xoopsDB']->fetchArray($result))) { |
||
| 68 | //ID |
||
| 69 | $id = $row['id']; |
||
| 70 | //name |
||
| 71 | $pnamel = htmlentities(stripslashes($row['lastname']), ENT_QUOTES); |
||
| 72 | $pnamef = htmlentities(stripslashes($row['firstname']), ENT_QUOTES); |
||
| 73 | $pname = $pnamel . ', ' . $pnamef; |
||
| 74 | $namelink = '<a href="dog.php?id=' . $row['id'] . '">' . stripslashes($row['pname']) . '</a>'; |
||
| 75 | //street |
||
| 76 | $street = stripslashes($row['streetname']); |
||
| 77 | //housenumber |
||
| 78 | $housenumber = $row['housenumber']; |
||
| 79 | //postcode |
||
| 80 | $postcode = $row['postcode']; |
||
| 81 | //city |
||
| 82 | $city = stripslashes($row['city']); |
||
| 83 | //phonenumber |
||
| 84 | $phonenumber = stripslashes($row['phonenumber']); |
||
| 85 | |||
| 86 | $email = stripslashes($row['emailadres']); |
||
| 87 | //website |
||
| 88 | $web = stripslashes($row['website']); |
||
| 89 | |||
| 90 | //user who entered the info |
||
| 91 | $dbuser = $row['user']; |
||
| 92 | } |
||
| 93 | */ |
||
| 94 | //create form |
||
| 95 | require XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||
| 96 | $form = new \XoopsThemeForm($pname, 'updatedata', 'updatepage.php', 'post', true); |
||
| 97 | //hidden value current record owner |
||
| 98 | $form->addElement(new \XoopsFormHidden('dbuser', $dbuser)); |
||
| 99 | //hidden value dog ID |
||
| 100 | $form->addElement(new \XoopsFormHidden('ownerid', $id)); |
||
| 101 | $form->addElement(new \XoopsFormHidden('curname', $pname)); |
||
| 102 | $form->addElement(new \XoopsFormHiddenToken($name = 'XOOPS_TOKEN_REQUEST', $timeout = 360)); |
||
| 103 | //name last |
||
| 104 | if ('nl' === $fld || 'all' === $fld) { |
||
| 105 | $form->addElement(new \XoopsFormText('<span style="font-weight: bold;">' . _MA_PEDIGREE_OWN_LNAME . '</span>', 'pnamel', $size = 50, $maxsize = 255, $value = $pnamel)); |
||
| 106 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 107 | $form->addElement(new \XoopsFormHidden('dbfield', 'lastname')); |
||
| 108 | $form->addElement(new \XoopsFormHidden('curvalnamel', $pnamel)); |
||
| 109 | } else { |
||
| 110 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_OWN_LNAME, $pnamel)); |
||
| 111 | } |
||
| 112 | //name first |
||
| 113 | if ('nf' === $fld || 'all' === $fld) { |
||
| 114 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_OWN_FNAME . '</b>', 'pnamef', $size = 50, $maxsize = 255, $value = $pnamef)); |
||
| 115 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 116 | $form->addElement(new \XoopsFormHidden('dbfield', 'firstname')); |
||
| 117 | $form->addElement(new \XoopsFormHidden('curvalnamef', $pnamef)); |
||
| 118 | } else { |
||
| 119 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_OWN_FNAME, $pnamef)); |
||
| 120 | } |
||
| 121 | //street |
||
| 122 | if ('st' === $fld || 'all' === $fld) { |
||
| 123 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_FLD_OWN_STR . '</b>', 'street', $size = 50, $maxsize = 255, $value = $street)); |
||
| 124 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 125 | $form->addElement(new \XoopsFormHidden('dbfield', 'streetname')); |
||
| 126 | $form->addElement(new \XoopsFormHidden('curvalstreet', $street)); |
||
| 127 | } else { |
||
| 128 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_FLD_OWN_STR, $street)); |
||
| 129 | } |
||
| 130 | //housenumber |
||
| 131 | if ('hn' === $fld || 'all' === $fld) { |
||
| 132 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_FLD_OWN_HN . '</b>', 'housenumber', $size = 50, $maxsize = 255, $value = $housenumber)); |
||
| 133 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 134 | $form->addElement(new \XoopsFormHidden('dbfield', 'housenumber')); |
||
| 135 | $form->addElement(new \XoopsFormHidden('curvalhousenumber', $housenumber)); |
||
| 136 | } else { |
||
| 137 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_FLD_OWN_HN, $housenumber)); |
||
| 138 | } |
||
| 139 | //postcode |
||
| 140 | if ('pc' === $fld || 'all' === $fld) { |
||
| 141 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_FLD_OWN_PC . '</b>', 'postcode', $size = 50, $maxsize = 255, $value = $postcode)); |
||
| 142 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 143 | $form->addElement(new \XoopsFormHidden('dbfield', 'postcode')); |
||
| 144 | $form->addElement(new \XoopsFormHidden('curvalpostcode', $postcode)); |
||
| 145 | } else { |
||
| 146 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_FLD_OWN_PC, $postcode)); |
||
| 147 | } |
||
| 148 | //city |
||
| 149 | if ('ct' === $fld || 'all' === $fld) { |
||
| 150 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_FLD_OWN_CITY . '</b>', 'city', $size = 50, $maxsize = 255, $value = $city)); |
||
| 151 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 152 | $form->addElement(new \XoopsFormHidden('dbfield', 'city')); |
||
| 153 | $form->addElement(new \XoopsFormHidden('curvalcity', $city)); |
||
| 154 | } else { |
||
| 155 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_FLD_OWN_CITY, $city)); |
||
| 156 | } |
||
| 157 | //phonenumber |
||
| 158 | if ('pn' === $fld || 'all' === $fld) { |
||
| 159 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_FLD_OWN_PN . '</b>', 'phonenumber', $size = 50, $maxsize = 255, $value = $phonenumber)); |
||
| 160 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 161 | $form->addElement(new \XoopsFormHidden('dbfield', 'phonenumber')); |
||
| 162 | $form->addElement(new \XoopsFormHidden('curvalphonenumber', $phonenumber)); |
||
| 163 | } else { |
||
| 164 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_FLD_OWN_PN, $phonenumber)); |
||
| 165 | } |
||
| 166 | |||
| 167 | if ('em' === $fld || 'all' === $fld) { |
||
| 168 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_FLD_OWN_EMAIL . '</b>', 'email', $size = 50, $maxsize = 255, $value = $email)); |
||
| 169 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 170 | $form->addElement(new \XoopsFormHidden('dbfield', 'emailadres')); |
||
| 171 | $form->addElement(new \XoopsFormHidden('curvalemail', $email)); |
||
| 172 | } else { |
||
| 173 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_FLD_OWN_EMAIL, $email)); |
||
| 174 | } |
||
| 175 | //website |
||
| 176 | if ('we' === $fld || 'all' === $fld) { |
||
| 177 | $form->addElement(new \XoopsFormText('<b>' . _MA_PEDIGREE_FLD_OWN_WEB . '</b>', 'web', $size = 50, $maxsize = 255, $value = $web)); |
||
| 178 | $form->addElement(new \XoopsFormHidden('dbtable', 'pedigree_owner')); |
||
| 179 | $form->addElement(new \XoopsFormHidden('dbfield', 'website')); |
||
| 180 | $form->addElement(new \XoopsFormHidden('curvalweb', $web)); |
||
| 181 | } else { |
||
| 182 | $form->addElement(new \XoopsFormLabel(_MA_PEDIGREE_FLD_OWN_WEB, $web)); |
||
| 183 | } |
||
| 184 | |||
| 185 | //submit button |
||
| 186 | if ($fld) { |
||
| 187 | $form->addElement(new \XoopsFormButton('', 'button_id', _MA_PEDIGREE_BUT_SUB, 'submit')); |
||
| 188 | } |
||
| 189 | //add data (form) to smarty template |
||
| 190 | $GLOBALS['xoopsTpl']->assign('form', $form->render()); |
||
| 191 | |||
| 192 | //footer |
||
| 193 | require XOOPS_ROOT_PATH . '/footer.php'; |
||
| 194 |
Let?s assume that you have a directory layout like this:
. |-- OtherDir | |-- Bar.php | `-- Foo.php `-- SomeDir `-- Foo.phpand let?s assume the following content of
Bar.php:If both files
OtherDir/Foo.phpandSomeDir/Foo.phpare loaded in the same runtime, you will see a PHP error such as the following:PHP Fatal error: Cannot use SomeDir\Foo as Foo because the name is already in use in OtherDir/Foo.phpHowever, as
OtherDir/Foo.phpdoes not necessarily have to be loaded and the error is only triggered if it is loaded beforeOtherDir/Bar.php, this problem might go unnoticed for a while. In order to prevent this error from surfacing, you must import the namespace with a different alias: