This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | // |
||
3 | // ------------------------------------------------------------------------ // |
||
4 | // This program is free software; you can redistribute it and/or modify // |
||
5 | // it under the terms of the GNU General Public License as published by // |
||
6 | // the Free Software Foundation; either version 2 of the License, or // |
||
7 | // (at your option) any later version. // |
||
8 | // // |
||
9 | // You may not change or alter any portion of this comment or credits // |
||
10 | // of supporting developers from this source code or any supporting // |
||
11 | // source code which is considered copyrighted (c) material of the // |
||
12 | // original comment or credit authors. // |
||
13 | // // |
||
14 | // This program is distributed in the hope that it will be useful, // |
||
15 | // but WITHOUT ANY WARRANTY; without even the implied warranty of // |
||
16 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // |
||
17 | // GNU General Public License for more details. // |
||
18 | // // |
||
19 | // You should have received a copy of the GNU General Public License // |
||
20 | // along with this program; if not, write to the Free Software // |
||
21 | // Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA // |
||
22 | // ------------------------------------------------------------------------ // |
||
23 | // Author: phppp (D.J., [email protected]) // |
||
24 | // URL: https://xoops.org // |
||
25 | // Project: Article Project // |
||
26 | // ------------------------------------------------------------------------ // |
||
27 | use Xmf\Request; |
||
28 | use XoopsModules\Planet; |
||
29 | /** @var Planet\Helper $helper */ |
||
30 | $helper = Planet\Helper::getInstance(); |
||
31 | |||
32 | include __DIR__ . '/header.php'; |
||
33 | |||
34 | // trackback is done by a POST |
||
35 | $art_id = explode('/', Request::getString('REQUEST_URI', '', 'SERVER')); |
||
36 | $article_id = (int)$art_id[count($art_id) - 1]; |
||
37 | $url = Request::getString('url', '', 'POST');//$_POST['url']; |
||
38 | $title = Request::getString('title', '', 'POST');//$_POST['title']; |
||
39 | $excerpt = Request::getString('excerpt', '', 'POST');//$_POST['excerpt']; |
||
40 | $blog_name = Request::getString('blog_name', '', 'POST');//$_POST['blog_name']; |
||
41 | $charset = trim(Request::getString('charset', '', 'POST'));//trim($_POST['charset']); |
||
42 | |||
43 | if (empty($helper->getConfig('trackback_option'))) { |
||
44 | PlanetUtility::planetRespondToTrackback(1, 'Trackback is closed'); |
||
45 | } |
||
46 | if (!strlen($title . $url . $blog_name)) { |
||
47 | PlanetUtility::planetRespondToTrackback(1, planet_constant('MD_INVALID')); |
||
48 | } |
||
49 | |||
50 | if (!empty($article_id) && !empty($url)) { |
||
51 | $trackbackHandler = xoops_getModuleHandler('trackback', $GLOBALS['moddirname']); |
||
52 | $criteria = new \CriteriaCompo(new \Criteria('art_id', $article_id)); |
||
53 | $criteria->add(new \Criteria('tb_url', $url)); |
||
54 | if ($trackbackHandler->getCount($criteria) > 0) { |
||
55 | PlanetUtility::planetRespondToTrackback(1, 'We already have a ping from that URI for this article.'); |
||
56 | } |
||
57 | |||
58 | $charset = empty($charset) ? 'utf-8' : $charset; |
||
59 | $title = XoopsLocal::convert_encoding($title, _CHARSET, $charset); |
||
60 | $excerpt = XoopsLocal::convert_encoding($excerpt, _CHARSET, $charset); |
||
61 | $blog_name = XoopsLocal::convert_encoding($blog_name, _CHARSET, $charset); |
||
62 | $tb_status = (int)$helper->getConfig('trackback_option'); |
||
63 | |||
64 | $com_pid = 0; |
||
65 | $com_itemid = $article_id; |
||
66 | $com_rootid = 0; |
||
67 | $com_title = $title; |
||
68 | $com_text = $excerpt; |
||
69 | $com_text .= "\n\n[TRACKBACK]" . _POSTEDBY . ': '; |
||
70 | if (!empty($url)) { |
||
71 | $com_text .= '[url=' . $url . ']' . $blog_name . '[/url]'; |
||
72 | } else { |
||
73 | $com_text .= $blog_name; |
||
74 | } |
||
75 | $com_modid = $xoopsModule->getVar('mid'); |
||
76 | |||
77 | $commentHandler = xoops_getHandler('comment'); |
||
78 | $comment = $commentHandler->create(); |
||
79 | $comment->setVar('com_created', time()); |
||
80 | $comment->setVar('com_pid', $com_pid); |
||
81 | $comment->setVar('com_itemid', $com_itemid); |
||
82 | $comment->setVar('com_rootid', $com_rootid); |
||
83 | $comment->setVar('com_ip', xoops_getenv('REMOTE_ADDR')); |
||
84 | switch ($tb_status) { |
||
85 | case 2: |
||
86 | $comment->setVar('com_status', 2); |
||
87 | $call_approvefunc = true; |
||
88 | $call_updatefunc = true; |
||
89 | $notify_event = 'comment'; |
||
90 | break; |
||
91 | case 1: |
||
92 | default: |
||
93 | $comment->setVar('com_status', 1); |
||
94 | $notify_event = 'comment_submit'; |
||
95 | break; |
||
96 | } |
||
97 | $comment->setVar('com_uid', 0); |
||
98 | $com_title = xoops_trim($com_title); |
||
99 | $com_title = empty($com_title) ? _NOTITLE : $com_title; |
||
100 | $comment->setVar('com_title', $com_title); |
||
101 | $comment->setVar('com_text', $com_text); |
||
102 | $comment->setVar('dohtml', 0); |
||
103 | $comment->setVar('dosmiley', 0); |
||
104 | $comment->setVar('doxcode', 1); |
||
105 | $comment->setVar('doimage', 0); |
||
106 | $comment->setVar('dobr', 1); |
||
107 | $comment->setVar('com_icon', ''); |
||
108 | $comment->setVar('com_modified', time()); |
||
109 | $comment->setVar('com_modid', $com_modid); |
||
110 | if (false != $commentHandler->insert($comment)) { |
||
111 | $newcid = $comment->getVar('com_id'); |
||
112 | |||
113 | // set own id as root id |
||
114 | $com_rootid = $newcid; |
||
115 | if (!$commentHandler->updateByField($comment, 'com_rootid', $com_rootid)) { |
||
116 | $commentHandler->delete($comment); |
||
117 | PlanetUtility::planetRespondToTrackback(1, xoops_error()); |
||
118 | } |
||
119 | |||
120 | // call custom approve function if any |
||
121 | if (false != $call_approvefunc && isset($comment_config['callback']['approve']) |
||
0 ignored issues
–
show
|
|||
122 | && '' != trim($comment_config['callback']['approve'])) { |
||
123 | $skip = false; |
||
124 | View Code Duplication | if (!function_exists($comment_config['callback']['approve'])) { |
|
125 | if (isset($comment_config['callbackFile'])) { |
||
126 | $callbackfile = trim($comment_config['callbackFile']); |
||
127 | if ('' != $callbackfile |
||
128 | && file_exists(XOOPS_ROOT_PATH . '/modules/' . $moddir . '/' . $callbackfile)) { |
||
129 | require_once XOOPS_ROOT_PATH . '/modules/' . $moddir . '/' . $callbackfile; |
||
130 | } |
||
131 | if (!function_exists($comment_config['callback']['approve'])) { |
||
132 | $skip = true; |
||
133 | } |
||
134 | } else { |
||
135 | $skip = true; |
||
136 | } |
||
137 | } |
||
138 | if (!$skip) { |
||
139 | $comment_config['callback']['approve']($comment); |
||
140 | } |
||
141 | } |
||
142 | |||
143 | // call custom update function if any |
||
144 | if (false != $call_updatefunc && isset($comment_config['callback']['update']) |
||
0 ignored issues
–
show
|
|||
145 | && '' != trim($comment_config['callback']['update'])) { |
||
146 | $skip = false; |
||
147 | View Code Duplication | if (!function_exists($comment_config['callback']['update'])) { |
|
148 | if (isset($comment_config['callbackFile'])) { |
||
149 | $callbackfile = trim($comment_config['callbackFile']); |
||
150 | if ('' != $callbackfile |
||
151 | && file_exists(XOOPS_ROOT_PATH . '/modules/' . $moddir . '/' . $callbackfile)) { |
||
152 | require_once XOOPS_ROOT_PATH . '/modules/' . $moddir . '/' . $callbackfile; |
||
153 | } |
||
154 | if (!function_exists($comment_config['callback']['update'])) { |
||
155 | $skip = true; |
||
156 | } |
||
157 | } else { |
||
158 | $skip = true; |
||
159 | } |
||
160 | } |
||
161 | if (!$skip) { |
||
162 | $criteria = new \CriteriaCompo(new \Criteria('com_modid', $com_modid)); |
||
163 | $criteria->add(new \Criteria('com_itemid', $com_itemid)); |
||
164 | $criteria->add(new \Criteria('com_status', XOOPS_COMMENT_ACTIVE)); |
||
165 | $comment_count = $commentHandler->getCount($criteria); |
||
166 | $func = $comment_config['callback']['update']; |
||
167 | call_user_func_array($func, [$com_itemid, $comment_count, $comment->getVar('com_id')]); |
||
168 | } |
||
169 | } |
||
170 | |||
171 | // RMV-NOTIFY |
||
172 | // trigger notification event if necessary |
||
173 | if ($notify_event) { |
||
174 | $not_modid = $com_modid; |
||
175 | // require_once XOOPS_ROOT_PATH . '/include/notification_functions.php'; |
||
176 | $not_catinfo = notificationCommentCategoryInfo($not_modid); |
||
177 | $not_category = $not_catinfo['name']; |
||
178 | $not_itemid = $com_itemid; |
||
179 | $not_event = $notify_event; |
||
180 | // Build an ABSOLUTE URL to view the comment. Make sure we |
||
181 | // point to a viewable page (i.e. not the system administration |
||
182 | // module). |
||
183 | $comment_tags = []; |
||
184 | $not_module = $xoopsModule; |
||
185 | if (!isset($comment_url)) { |
||
186 | $com_config = $not_module->getInfo('comments'); |
||
187 | $comment_url = $com_config['pageName'] . '?'; |
||
188 | $comment_url .= $com_config['itemName']; |
||
189 | } |
||
190 | $comment_tags['X_COMMENT_URL'] = XOOPS_URL . '/modules/' . $not_module->getVar('dirname') . '/' . $comment_url . '=' . $com_itemid . '&com_id=' . $newcid . '&com_rootid=' . $com_rootid . '&com_mode=' . $com_mode . '&com_order=' . $com_order . '#comment' . $newcid; |
||
191 | $notificationHandler = xoops_getHandler('notification'); |
||
192 | $notificationHandler->triggerEvent($not_category, $not_itemid, $not_event, $comment_tags, false, $not_modid); |
||
193 | } |
||
194 | |||
195 | PlanetUtility::planetRespondToTrackback(0); |
||
196 | } else { |
||
197 | PlanetUtility::planetRespondToTrackback(1, xoops_error($comment->getHtmlErrors())); |
||
198 | } |
||
199 | } |
||
200 |
When comparing two booleans, it is generally considered safer to use the strict comparison operator.