Issues (351)

Security Analysis    no vulnerabilities found

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Form/ItemForm.php (1 issue)

1
<?php declare(strict_types=1);
2
3
namespace XoopsModules\Publisher\Form;
4
5
/*
6
 You may not change or alter any portion of this comment or credits
7
 of supporting developers from this source code or any supporting source code
8
 which is considered copyrighted (c) material of the original comment or credit authors.
9
10
 This program is distributed in the hope that it will be useful,
11
 but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
 */
14
15
/**
16
 *  Publisher form class
17
 *
18
 * @copyright       XOOPS Project (https://xoops.org)
19
 * @license         https://www.fsf.org/copyleft/gpl.html GNU public license
20
 * @since           1.0
21
 * @author          trabis <[email protected]>
22
 */
23
24
use Xmf\Request;
25
use XoopsModules\Publisher\Common\Configurator;
26
use XoopsModules\Publisher\Constants;
27
use XoopsModules\Publisher\FormDateTime;
28
use XoopsModules\Publisher\Helper;
29
use XoopsModules\Publisher\Item;
30
use XoopsModules\Publisher\Utility;
31
32
require_once \dirname(__DIR__, 2) . '/include/common.php';
33
34
\xoops_load('XoopsFormLoader');
35
\xoops_load('XoopsLists');
36
require_once $GLOBALS['xoops']->path('class/tree.php');
37
//require_once PUBLISHER_ROOT_PATH . '/class/formdatetime.php';
38
//require_once PUBLISHER_ROOT_PATH . '/class/themetabform.php';
39
40
/**
41
 * Class ItemForm
42
 */
43
class ItemForm extends ThemeTabForm
44
{
45
    public $checkperm = true;
46
    public $tabs      = [
47
        \_CO_PUBLISHER_TAB_MAIN   => 'mainTab',
48
        \_CO_PUBLISHER_TAB_IMAGES => 'imagesTab',
49
        \_CO_PUBLISHER_TAB_FILES  => 'filesTab',
50
        \_CO_PUBLISHER_TAB_OTHERS => 'othersTab',
51
    ];
52
    public $mainTab   = [
53
        Constants::PUBLISHER_SUBTITLE,
54
        Constants::PUBLISHER_ITEM_SHORT_URL,
55
        Constants::PUBLISHER_ITEM_TAG,
56
        Constants::PUBLISHER_SUMMARY,
57
        Constants::PUBLISHER_DOHTML,
58
        Constants::PUBLISHER_DOSMILEY,
59
        Constants::PUBLISHER_DOXCODE,
60
        Constants::PUBLISHER_DOIMAGE,
61
        Constants::PUBLISHER_DOLINEBREAK,
62
        Constants::PUBLISHER_DATESUB,
63
        Constants::PUBLISHER_STATUS,
64
        Constants::PUBLISHER_AUTHOR_ALIAS,
65
        Constants::PUBLISHER_NOTIFY,
66
        Constants::PUBLISHER_AVAILABLE_PAGE_WRAP,
67
        Constants::PUBLISHER_UID,
68
        Constants::PUBLISHER_VOTETYPE,
69
    ];
70
    public $imagesTab = [
71
        Constants::PUBLISHER_IMAGE_ITEM,
72
    ];
73
    public $filesTab  = [
74
        Constants::PUBLISHER_ITEM_UPLOAD_FILE,
75
    ];
76
    public $othersTab = [
77
        Constants::PUBLISHER_ITEM_META_KEYWORDS,
78
        Constants::PUBLISHER_ITEM_META_DESCRIPTION,
79
        Constants::PUBLISHER_WEIGHT,
80
        Constants::PUBLISHER_ALLOWCOMMENTS,
81
    ];
82
83
    /**
84
     * @param $checkperm
85
     */
86
    public function setCheckPermissions($checkperm): void
87
    {
88
        $this->checkperm = (bool)$checkperm;
89
    }
90
91
    /**
92
     * @param $item
93
     *
94
     * @return bool
95
     */
96
    public function isGranted($item)
97
    {
98
        $helper = Helper::getInstance();
99
        $ret    = false;
100
        if (!$this->checkperm
101
            || $helper->getHandler('Permission')
102
                      ->isGranted('form_view', $item)) {
103
            $ret = true;
104
        }
105
106
        return $ret;
107
    }
108
109
    /**
110
     * @param $tab
111
     *
112
     * @return bool
113
     */
114
    public function hasTab($tab)
115
    {
116
        if (!isset($tab, $this->tabs[$tab])) {
117
            return false;
118
        }
119
120
        $tabRef = $this->tabs[$tab];
121
        $items  = $this->$tabRef;
122
        foreach ($items as $item) {
123
            if ($this->isGranted($item)) {
124
                return true;
125
            }
126
        }
127
128
        return false;
129
    }
130
131
    /**
132
     * @param Item $obj
133
     *
134
     * @return $this
135
     */
136
    public function createElements($obj)
137
    {
138
        $helper       = Helper::getInstance();
139
        $timeoffset   = null;
140
        $configurator = new Configurator();
141
        $icons        = $configurator->icons;
142
143
        $allowedEditors = Utility::getEditors(
144
            $helper->getHandler('Permission')
145
                   ->getGrantedItems('editors')
146
        );
147
148
        if (\is_object($GLOBALS['xoopsUser'])) {
149
            $group      = $GLOBALS['xoopsUser']->getGroups();
150
            $currentUid = $GLOBALS['xoopsUser']->uid();
151
            $timeoffset = $GLOBALS['xoopsUser']->getVar('timezone_offset');
152
        } else {
153
            $group      = [XOOPS_GROUP_ANONYMOUS];
154
            $currentUid = 0;
155
        }
156
157
        $this->setExtra('enctype="multipart/form-data"');
158
159
        $this->startTab(\_CO_PUBLISHER_TAB_MAIN);
160
161
        // Category
162
        $categoryFormSelect = new \XoopsFormSelect(\_CO_PUBLISHER_CATEGORY, 'categoryid', $obj->getVar('categoryid', 'e'));
163
        $categoryFormSelect->setDescription(\_CO_PUBLISHER_CATEGORY_DSC);
164
        $categoryFormSelect->addOptionArray(
165
            $helper->getHandler('Category')
166
                   ->getCategoriesForSubmit()
167
        );
168
        $this->addElement($categoryFormSelect);
169
170
        // ITEM TITLE
171
        $this->addElement(new \XoopsFormText(\_CO_PUBLISHER_TITLE, 'title', 50, 255, $obj->getVar('title', 'e')), true);
172
173
        // SUBTITLE
174
        if ($this->isGranted(Constants::PUBLISHER_SUBTITLE)) {
175
            $this->addElement(new \XoopsFormText(\_CO_PUBLISHER_SUBTITLE, 'subtitle', 50, 255, $obj->getVar('subtitle', 'e')));
176
        }
177
178
        // SHORT URL
179
        if ($this->isGranted(Constants::PUBLISHER_ITEM_SHORT_URL)) {
180
            $textShortUrl = new \XoopsFormText(\_CO_PUBLISHER_ITEM_SHORT_URL, 'item_short_url', 50, 255, $obj->short_url('e'));
181
            $textShortUrl->setDescription(\_CO_PUBLISHER_ITEM_SHORT_URL_DSC);
182
            $this->addElement($textShortUrl);
183
        }
184
185
        // TAGS
186
        if (\xoops_isActiveModule('tag') && \class_exists(\XoopsModules\Tag\FormTag::class) && $this->isGranted(Constants::PUBLISHER_ITEM_TAG)) {
187
            $textTags = new \XoopsModules\Tag\FormTag('item_tag', 60, 255, $obj->getVar('item_tag', 'e'), 0);
188
            $textTags->setClass('form-control');
189
            $this->addElement($textTags);
190
        }
191
192
        // SELECT EDITOR
193
        $nohtml = !$obj->dohtml();
194
        if (1 === \count($allowedEditors)) {
195
            $editor = $allowedEditors[0];
196
        } elseif (\count($allowedEditors) > 0) {
197
            $editor = Request::getString('editor', '', 'POST');
198
            if (!empty($editor)) {
199
                Utility::setCookieVar('publisher_editor', $editor);
200
            } else {
201
                $editor = Utility::getCookieVar('publisher_editor');
202
                if (empty($editor) && \is_object($GLOBALS['xoopsUser'])) {
203
                    //                    $editor = @ $GLOBALS['xoopsUser']->getVar('publisher_editor'); // Need set through user profile
204
                    $editor = $GLOBALS['xoopsUser']->getVar('publisher_editor') ?? ''; // Need set through user profile
205
                }
206
            }
207
            $editor = (empty($editor) || !\in_array($editor, $allowedEditors, true)) ? $helper->getConfig('submit_editor') : $editor;
208
209
            $formEditor = new \XoopsFormSelectEditor($this, 'editor', $editor, $nohtml, $allowedEditors);
210
            $this->addElement($formEditor);
211
        } else {
212
            $editor = $helper->getConfig('submit_editor');
213
        }
214
215
        $editorConfigs           = [];
216
        $editorConfigs['rows']   = !$helper->getConfig('submit_editor_rows') ? 35 : $helper->getConfig('submit_editor_rows');
217
        $editorConfigs['cols']   = !$helper->getConfig('submit_editor_cols') ? 60 : $helper->getConfig('submit_editor_cols');
218
        $editorConfigs['width']  = !$helper->getConfig('submit_editor_width') ? '100%' : $helper->getConfig('submit_editor_width');
219
        $editorConfigs['height'] = !$helper->getConfig('submit_editor_height') ? '400px' : $helper->getConfig('submit_editor_height');
220
221
        // SUMMARY
222
        if ($this->isGranted(Constants::PUBLISHER_SUMMARY)) {
223
            // Description
224
            //$summaryText = new \XoopsFormTextArea(_CO_PUBLISHER_SUMMARY, 'summary', $obj->getVar('summary', 'e'), 7, 60);
225
            $editorConfigs['name']  = 'summary';
226
            $editorConfigs['value'] = $obj->getVar('summary', 'e');
227
            $summaryText            = new \XoopsFormEditor(\_CO_PUBLISHER_SUMMARY, $editor, $editorConfigs, $nohtml, $onfailure = null);
228
            $summaryText->setDescription(\_CO_PUBLISHER_SUMMARY_DSC);
229
            $this->addElement($summaryText);
230
        }
231
232
        // BODY
233
        $editorConfigs['name']  = 'body';
234
        $editorConfigs['value'] = $obj->getVar('body', 'e');
235
        $bodyText               = new \XoopsFormEditor(\_CO_PUBLISHER_BODY, $editor, $editorConfigs, $nohtml, $onfailure = null);
236
        $bodyText->setDescription(\_CO_PUBLISHER_BODY_DSC);
237
        $this->addElement($bodyText);
238
239
        // VARIOUS OPTIONS
240
        if ($this->isGranted(Constants::PUBLISHER_DOHTML)
241
            || $this->isGranted(Constants::PUBLISHER_DOSMILEY)
242
            || $this->isGranted(Constants::PUBLISHER_DOXCODE)
243
            || $this->isGranted(Constants::PUBLISHER_DOIMAGE)
244
            || $this->isGranted(Constants::PUBLISHER_DOLINEBREAK)) {
245
            if ($this->isGranted(Constants::PUBLISHER_DOHTML)) {
246
                $htmlRadio = new \XoopsFormRadioYN(\_CO_PUBLISHER_DOHTML, 'dohtml', $obj->dohtml(), _YES, _NO);
247
                $this->addElement($htmlRadio);
248
            }
249
            if ($this->isGranted(Constants::PUBLISHER_DOSMILEY)) {
250
                $smiley_radio = new \XoopsFormRadioYN(\_CO_PUBLISHER_DOSMILEY, 'dosmiley', $obj->dosmiley(), _YES, _NO);
251
                $this->addElement($smiley_radio);
252
            }
253
            if ($this->isGranted(Constants::PUBLISHER_DOXCODE)) {
254
                $xcode_radio = new \XoopsFormRadioYN(\_CO_PUBLISHER_DOXCODE, 'doxcode', $obj->doxcode(), _YES, _NO);
255
                $this->addElement($xcode_radio);
256
            }
257
            if ($this->isGranted(Constants::PUBLISHER_DOIMAGE)) {
258
                $image_radio = new \XoopsFormRadioYN(\_CO_PUBLISHER_DOIMAGE, 'doimage', $obj->doimage(), _YES, _NO);
259
                $this->addElement($image_radio);
260
            }
261
            if ($this->isGranted(Constants::PUBLISHER_DOLINEBREAK)) {
262
                $linebreak_radio = new \XoopsFormRadioYN(\_CO_PUBLISHER_DOLINEBREAK, 'dolinebreak', $obj->dobr(), _YES, _NO);
263
                $this->addElement($linebreak_radio);
264
            }
265
        }
266
267
        // Available pages to wrap
268
        if ($this->isGranted(Constants::PUBLISHER_AVAILABLE_PAGE_WRAP)) {
269
            $wrapPages              = \XoopsLists::getHtmlListAsArray(Utility::getUploadDir(true, 'content'));
270
            $availableWrapPagesText = [];
271
            foreach ($wrapPages as $page) {
272
                $availableWrapPagesText[] = "<span onclick='publisherPageWrap(\"body\", \"[pagewrap=$page] \");' onmouseover='style.cursor=\"pointer\"'>$page</span>";
273
            }
274
            $availableWrapPages = new \XoopsFormLabel(\_CO_PUBLISHER_AVAILABLE_PAGE_WRAP, \implode(', ', $availableWrapPagesText));
275
            $availableWrapPages->setDescription(\_CO_PUBLISHER_AVAILABLE_PAGE_WRAP_DSC);
276
            $this->addElement($availableWrapPages);
277
        }
278
279
        //VOTING TYPE =====================================
280
        //        if ($this->isGranted(Constants::PUBLISHER_VOTETYPE)) {
281
        $groups = $GLOBALS['xoopsUser'] ? $GLOBALS['xoopsUser']->getGroups() : XOOPS_GROUP_ANONYMOUS;
282
        /** @var \XoopsGroupPermHandler $grouppermHandler */
283
        $grouppermHandler = $helper->getHandler('GroupPerm');
284
        $moduleId         = $helper->getModule()
285
                                   ->getVar('mid');
286
        if ($helper->getConfig('perm_rating') && $grouppermHandler->checkRight('global', \_PUBLISHER_RATE, $groups, $moduleId)) {
287
            $options = [
288
                Constants::RATING_NONE     => \_MI_PUBLISHER_RATING_NONE,
289
                Constants::RATING_5STARS   => \_MI_PUBLISHER_RATING_5STARS,
290
                Constants::RATING_10STARS  => \_MI_PUBLISHER_RATING_10STARS,
291
                Constants::RATING_LIKES    => \_MI_PUBLISHER_RATING_LIKES,
292
                Constants::RATING_10NUM    => \_MI_PUBLISHER_RATING_10NUM,
293
                Constants::RATING_REACTION => \_MI_PUBLISHER_RATING_REACTION,
294
            ];
295
296
            $votetypeSelect = new \XoopsFormSelect(\_MI_PUBLISHER_RATINGBARS, 'votetype', $obj->getVar('votetype'));
297
            $votetypeSelect->addOptionArray($options);
298
            //                $votetypeSelect->setDescription(\_MI_PUBLISHER_RATINGBARS_DESC);
299
            $this->addElement($votetypeSelect);
300
            unset($votetypeSelect);
301
        }
302
        //        }
303
        //VOTING TYPE END =====================================
304
305
        $userUid = $obj->getVar('itemid') > 0 ? $obj->uid() : $currentUid;
306
        if ($this->isGranted(Constants::PUBLISHER_UID)) {
307
            $this->addElement(new \XoopsFormSelectUser(\_CO_PUBLISHER_UID, 'uid', false, $userUid, 1, false), false);
308
        }
309
310
        // Uid
311
        /*  We need to retreive the users manually because for some reason, on the frxoops.org server,
312
         the method users::getobjects encounters a memory error
313
         */ // Trabis : well, maybe is because you are getting 6000 objects into memory , no??? LOL
314
        /*
315
        if ($this->isGranted(Constants::PUBLISHER_UID)) {
316
            $uidSelect = new \XoopsFormSelect(_CO_PUBLISHER_UID, 'uid', $obj->uid(), 1, false);
317
            $uidSelect->setDescription(_CO_PUBLISHER_UID_DSC);
318
            $sql           = 'SELECT uid, uname FROM ' . $obj->db->prefix('users') . ' ORDER BY uname ASC';
319
            $result        = $obj->db->query($sql);
320
            $usersArray     = [];
321
            $usersArray[0] = $GLOBALS['xoopsConfig']['anonymous'];
322
            while (($myrow = $obj->db->fetchArray($result)) !== false) {
323
                $usersArray[$myrow['uid']] = $myrow['uname'];
324
            }
325
            $uidSelect->addOptionArray($usersArray);
326
            $this->addElement($uidSelect);
327
        }
328
        */
329
330
        /* else {
331
        $hidden = new \XoopsFormHidden('uid', $obj->uid());
332
        $this->addElement($hidden);
333
        unset($hidden);
334
        }*/
335
336
        // Author ALias
337
        if ($this->isGranted(Constants::PUBLISHER_AUTHOR_ALIAS)) {
338
            $element = new \XoopsFormText(\_CO_PUBLISHER_AUTHOR_ALIAS, 'author_alias', 50, 255, $obj->getVar('author_alias', 'e'));
339
            $element->setDescription(\_CO_PUBLISHER_AUTHOR_ALIAS_DSC);
340
            $this->addElement($element);
341
            unset($element);
342
        }
343
344
        // STATUS
345
        if ($this->isGranted(Constants::PUBLISHER_STATUS)) {
346
            $options      = [
347
                Constants::PUBLISHER_STATUS_SUBMITTED => \_CO_PUBLISHER_SUBMITTED,
348
                Constants::PUBLISHER_STATUS_PUBLISHED => \_CO_PUBLISHER_PUBLISHED,
349
                Constants::PUBLISHER_STATUS_OFFLINE   => \_CO_PUBLISHER_OFFLINE,
350
                Constants::PUBLISHER_STATUS_REJECTED  => \_CO_PUBLISHER_REJECTED,
351
            ];
352
            $statusSelect = new \XoopsFormSelect(\_CO_PUBLISHER_STATUS, 'status', $obj->getVar('status'));
353
            $statusSelect->addOptionArray($options);
354
            $statusSelect->setDescription(\_CO_PUBLISHER_STATUS_DSC);
355
            $this->addElement($statusSelect);
356
            unset($statusSelect);
357
        }
358
359
        // Datesub
360
        if ($this->isGranted(Constants::PUBLISHER_DATESUB)) {
361
            if ($obj->isNew()) {
362
                $datesub = \time();
363
            } else {
364
                $datesub = (0 == $obj->getVar('datesub')) ? \time() : $obj->getVar('datesub');
365
            }
366
            $datesub_datetime = new FormDateTime(\_CO_PUBLISHER_DATESUB, 'datesub', $size = 15, $datesub, true, true);
367
            // $datesub_datetime = new \XoopsFormDateTime(_CO_PUBLISHER_DATESUB, 'datesub', $size = 15, $datesub, true, true);
368
369
            $datesub_datetime->setDescription(\_CO_PUBLISHER_DATESUB_DSC);
370
            $this->addElement($datesub_datetime);
371
        }
372
373
        // Date expire
374
        if ($this->isGranted(Constants::PUBLISHER_DATEEXPIRE)) {
375
            if ($obj->isNew()) {
376
                $dateexpire     = \time();
377
                $dateexpire_opt = 0;
378
            } elseif (0 == $obj->getVar('dateexpire')) {
379
                $dateexpire_opt = 0;
380
                $dateexpire     = \time();
381
            } else {
382
                $dateexpire_opt = 1;
383
                $dateexpire     = $obj->getVar('dateexpire');
384
            }
385
386
            $dateExpireYesNo     = new \XoopsFormRadioYN('', 'use_expire_yn', $dateexpire_opt);
387
            $dateexpire          = (int)\formatTimestamp($dateexpire, 'U', $timeoffset); //set to user timezone
388
            $dateexpire_datetime = new \XoopsFormDateTime('', 'dateexpire', $size = 15, $dateexpire, true);
389
            if (0 == $dateexpire_opt) {
390
                $dateexpire_datetime->setExtra('disabled="disabled"');
391
            }
392
393
            $dateExpireTray = new \XoopsFormElementTray(\_CO_PUBLISHER_DATEEXPIRE, '');
394
            $dateExpireTray->setDescription(\_CO_PUBLISHER_DATEEXPIRE_DSC);
395
            $dateExpireTray->addElement($dateExpireYesNo);
396
            $dateExpireTray->addElement($dateexpire_datetime);
397
            $this->addElement($dateExpireTray);
398
        }
399
400
        // NOTIFY ON PUBLISH
401
        if ($this->isGranted(Constants::PUBLISHER_NOTIFY)) {
402
            $notify_radio = new \XoopsFormRadioYN(\_CO_PUBLISHER_NOTIFY, 'notify', $obj->notifypub(), _YES, _NO);
403
            $this->addElement($notify_radio);
404
        }
405
406
        if ($this->hasTab(\_CO_PUBLISHER_TAB_IMAGES)) {
407
            $this->startTab(\_CO_PUBLISHER_TAB_IMAGES);
408
        }
409
410
        // IMAGE ---------------------------------------
411
        if ($this->isGranted(Constants::PUBLISHER_IMAGE_ITEM)) {
412
            $objimages      = $obj->getImages();
413
            $mainarray      = \is_object($objimages['main']) ? [$objimages['main']] : [];
414
            $mergedimages   = \array_merge($mainarray, $objimages['others']);
415
            $objimage_array = [];
416
            foreach ($mergedimages as $imageObj) {
417
                $objimage_array[$imageObj->getVar('image_name')] = $imageObj->getVar('image_nicename');
418
            }
419
420
            /** @var \XoopsImagecategoryHandler $imgcatHandler */
421
            $imgcatHandler = \xoops_getHandler('imagecategory');
422
            if (\method_exists($imgcatHandler, 'getListByPermission')) {
423
                $catlist = $imgcatHandler->getListByPermission($group, 'imgcat_read', 1);
424
            } else {
425
                $catlist = $imgcatHandler->getList($group, 'imgcat_read', 1);
426
            }
427
            $imgcatConfig = $helper->getConfig('submit_imgcat');
428
            if (\in_array(Constants::PUBLISHER_IMGCAT_ALL, $imgcatConfig, true)) {
0 ignored issues
show
It seems like $imgcatConfig can also be of type null; however, parameter $haystack of in_array() does only seem to accept array, maybe add an additional type check? ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

428
            if (\in_array(Constants::PUBLISHER_IMGCAT_ALL, /** @scrutinizer ignore-type */ $imgcatConfig, true)) {
Loading history...
429
                $catids = \array_keys($catlist);
430
            } else {
431
                // compare selected in options with readable of user
432
                $catlist = \array_intersect($catlist, $imgcatConfig);
433
                $catids  = \array_keys($catlist);
434
            }
435
436
            $imageObjs = [];
437
            if (!empty($catids)) {
438
                /** @var \XoopsImageHandler $imageHandler */
439
                $imageHandler = \xoops_getHandler('image');
440
                $criteria     = new \CriteriaCompo(new \Criteria('imgcat_id', '(' . \implode(',', $catids) . ')', 'IN'));
441
                $criteria->add(new \Criteria('image_display', 1));
442
                $criteria->setSort('image_nicename');
443
                $criteria->order = 'ASC'; // patch for XOOPS <= 2.5.10, does not set order correctly using setOrder() method
444
                $imageObjs       = $imageHandler->getObjects($criteria, true);
445
                unset($criteria);
446
            }
447
            $image_array = [];
448
            foreach ($imageObjs as $imageObj) {
449
                $image_array[$imageObj->getVar('image_name')] = $imageObj->getVar('image_nicename');
450
            }
451
452
            $image_array = \array_diff($image_array, $objimage_array);
453
454
            $imageSelect = new \XoopsFormSelect('', 'image_notused', '', 5);
455
            $imageSelect->addOptionArray($image_array);
456
            $imageSelect->setExtra("onchange='showImgSelected(\"image_display\", \"image_notused\", \"uploads/\", \"\", \"" . XOOPS_URL . "\")'");
457
            //$imageSelect->setExtra( "onchange='appendMySelectOption(\"image_notused\", \"image_item\")'");
458
            unset($image_array);
459
460
            $imageSelect2 = new \XoopsFormSelect('', 'image_item', '', 5, true);
461
            $imageSelect2->addOptionArray($objimage_array);
462
            $imageSelect2->setExtra("onchange='publisher_updateSelectOption(\"image_item\", \"image_featured\"), showImgSelected(\"image_display\", \"image_item\", \"uploads/\", \"\", \"" . XOOPS_URL . "\")'");
463
464
            $buttonadd = new \XoopsFormButton('', 'buttonadd', \_CO_PUBLISHER_ADD);
465
            $buttonadd->setExtra("onclick='publisher_appendSelectOption(\"image_notused\", \"image_item\"), publisher_updateSelectOption(\"image_item\", \"image_featured\")'");
466
467
            $buttonremove = new \XoopsFormButton('', 'buttonremove', \_CO_PUBLISHER_REMOVE);
468
            $buttonremove->setExtra("onclick='publisher_appendSelectOption(\"image_item\", \"image_notused\"), publisher_updateSelectOption(\"image_item\", \"image_featured\")'");
469
470
            $opentable  = new \XoopsFormLabel('', '<table><tr><td>');
471
            $addcol     = new \XoopsFormLabel('', '</td><td>');
472
            $addbreak   = new \XoopsFormLabel('', '<br>');
473
            $closetable = new \XoopsFormLabel('', '</td></tr></table>');
474
475
            $GLOBALS['xoTheme']->addScript(PUBLISHER_URL . '/assets/js/ajaxupload.3.9.js');
476
            $js_data  = new \XoopsFormLabel(
477
                '', '
478
479
<script type= "text/javascript">
480
$publisher(document).ready(function () {
481
    var button = $publisher("#publisher_upload_button"), interval;
482
    new AjaxUpload(button,{
483
        action: "' . PUBLISHER_URL . '/include/ajax_upload.php", // I disabled uploads in this example for security reasons
484
        responseType: "text/html",
485
        name: "publisher_upload_file",
486
        onSubmit : function (file, ext) {
487
            // change button text, when user selects file
488
            $publisher("#publisher_upload_message").html(" ");
489
            button.html("<img src=\'' . PUBLISHER_URL . '/assets/images/loadingbar.gif\'>"); this.setData({
490
                "image_nicename": $publisher("#image_nicename").val(),
491
                "imgcat_id" : $publisher("#imgcat_id").val()
492
            });
493
            // If you want to allow uploading only 1 file at time,
494
            // you can disable upload button
495
            //this.disable();
496
            interval = window.setInterval(function () {
497
            }, 200);
498
        },
499
        onComplete: function (file, response) {
500
            button.text("' . \_CO_PUBLISHER_IMAGE_UPLOAD_NEW . '");
501
            window.clearInterval(interval);
502
            // enable upload button
503
            this.enable();
504
            // add file to the list
505
            var result = eval(response);
506
            if ("success" == result[0]) {
507
                 $publisher("#image_item").append("<option value=\'" + result[1] + "\' selected=\'selected\'>" + result[2] + "</option>");
508
                 publisher_updateSelectOption(\'image_item\', \'image_featured\');
509
                 showImgSelected(\'image_display\', \'image_item\', \'uploads/\', \'\', \'' . XOOPS_URL . '\')
510
            } else {
511
                 $publisher("#publisher_upload_message").html("<div class=\'errorMsg\'>" + result[1] + "</div>");
512
            }
513
        }
514
    });
515
});
516
</script>
517
518
'
519
            );
520
            $messages = new \XoopsFormLabel('', "<div id='publisher_upload_message'></div>");
521
            $button   = new \XoopsFormLabel('', "<div id='publisher_upload_button'>" . \_CO_PUBLISHER_IMAGE_UPLOAD_NEW . '</div>');
522
            $nicename = new \XoopsFormText('', 'image_nicename', 30, 30, \_CO_PUBLISHER_IMAGE_NICENAME);
523
524
            // $imgcatHandler = xoops_getHandler('imagecategory');
525
            // if (method_exists($imgcatHandler, 'getListByPermission')) {
526
            // $catlist = $imgcatHandler->getListByPermission($group, 'imgcat_read', 1);
527
            // } else {
528
            // $catlist = $imgcatHandler->getList($group, 'imgcat_read', 1);
529
            // }
530
            $imagecat = new \XoopsFormSelect('', 'imgcat_id', '', 1);
531
            $imagecat->addOptionArray($catlist);
532
533
            $imageUploadTray = new \XoopsFormElementTray(\_CO_PUBLISHER_IMAGE_UPLOAD, '');
534
            $imageUploadTray->addElement($js_data);
535
            $imageUploadTray->addElement($messages);
536
            $imageUploadTray->addElement($opentable);
537
            $imageUploadTray->addElement($imagecat);
538
            $imageUploadTray->addElement($addbreak);
539
            $imageUploadTray->addElement($nicename);
540
            $imageUploadTray->addElement($addbreak);
541
            $imageUploadTray->addElement($button);
542
            $imageUploadTray->addElement($closetable);
543
            $this->addElement($imageUploadTray);
544
545
            $imageTray = new \XoopsFormElementTray(\_CO_PUBLISHER_IMAGE_ITEMS, '');
546
            $imageTray->addElement($opentable);
547
548
            $imageTray->addElement($imageSelect);
549
            $imageTray->addElement($addbreak);
550
            $imageTray->addElement($buttonadd);
551
552
            $imageTray->addElement($addcol);
553
554
            $imageTray->addElement($imageSelect2);
555
            $imageTray->addElement($addbreak);
556
            $imageTray->addElement($buttonremove);
557
558
            $imageTray->addElement($closetable);
559
            $imageTray->setDescription(\_CO_PUBLISHER_IMAGE_ITEMS_DSC);
560
            $this->addElement($imageTray);
561
562
            $imagename    = \is_object($objimages['main']) ? $objimages['main']->getVar('image_name') : '';
563
            $imageforpath = ('' != $imagename) ? $imagename : 'blank.gif';
564
565
            $imageSelect3 = new \XoopsFormSelect(\_CO_PUBLISHER_IMAGE_ITEM, 'image_featured', $imagename, 1);
566
            $imageSelect3->addOptionArray($objimage_array);
567
            $imageSelect3->setExtra("onchange='showImgSelected(\"image_display\", \"image_featured\", \"uploads/\", \"\", \"" . XOOPS_URL . "\")'");
568
            $imageSelect3->setDescription(\_CO_PUBLISHER_IMAGE_ITEM_DSC);
569
            $this->addElement($imageSelect3);
570
571
            $image_preview = new \XoopsFormLabel(\_CO_PUBLISHER_IMAGE_PREVIEW, "<img src='" . XOOPS_URL . '/uploads/' . $imageforpath . "' name='image_display' id='image_display' alt=''>");
572
            $this->addElement($image_preview);
573
        }
574
575
        // FILES -----------------------------------
576
        if ($this->hasTab(\_CO_PUBLISHER_TAB_FILES)) {
577
            $this->startTab(\_CO_PUBLISHER_TAB_FILES);
578
        }
579
        // File upload UPLOAD
580
        if ($this->isGranted(Constants::PUBLISHER_ITEM_UPLOAD_FILE)) {
581
            // NAME
582
            $nameText = new \XoopsFormText(\_CO_PUBLISHER_FILENAME, 'item_file_name', 50, 255, '');
583
            $nameText->setDescription(\_CO_PUBLISHER_FILE_NAME_DSC);
584
            $this->addElement($nameText);
585
            unset($nameText);
586
587
            // DESCRIPTION
588
            $descriptionText = new \XoopsFormTextArea(\_CO_PUBLISHER_FILE_DESCRIPTION, 'item_file_description', '');
589
            $descriptionText->setDescription(\_CO_PUBLISHER_FILE_DESCRIPTION_DSC);
590
            $this->addElement($descriptionText);
591
            unset($descriptionText);
592
593
            $statusSelect = new \XoopsFormRadioYN(\_CO_PUBLISHER_FILE_STATUS, 'item_file_status', 1); //1 - active
594
            $statusSelect->setDescription(\_CO_PUBLISHER_FILE_STATUS_DSC);
595
            $this->addElement($statusSelect);
596
            unset($statusSelect);
597
598
            $fileBox = new \XoopsFormFile(\_CO_PUBLISHER_ITEM_UPLOAD_FILE, 'item_upload_file', 0);
599
            $fileBox->setDescription(\_CO_PUBLISHER_ITEM_UPLOAD_FILE_DSC);
600
            $fileBox->setExtra("size ='50'");
601
            $this->addElement($fileBox);
602
            unset($fileBox);
603
604
            if (!$obj->isNew()) {
605
                $filesObj = $helper->getHandler('File')
606
                                   ->getAllFiles($obj->itemid());
607
                if (\count($filesObj) > 0) {
608
                    $table = '';
609
                    $table .= "<table width='100%' cellspacing=1 cellpadding=3 border=0 class = outer>";
610
                    $table .= '<tr>';
611
                    $table .= "<td width='50' class='bg3' align='center'><strong>ID</strong></td>";
612
                    $table .= "<td width='150' class='bg3' align='left'><strong>" . \_AM_PUBLISHER_FILENAME . '</strong></td>';
613
                    $table .= "<td class='bg3' align='left'><strong>" . \_AM_PUBLISHER_DESCRIPTION . '</strong></td>';
614
                    $table .= "<td width='60' class='bg3' align='center'><strong>" . \_AM_PUBLISHER_HITS . '</strong></td>';
615
                    $table .= "<td width='100' class='bg3' align='center'><strong>" . \_AM_PUBLISHER_UPLOADED_DATE . '</strong></td>';
616
                    $table .= "<td width='60' class='bg3' align='center'><strong>" . \_AM_PUBLISHER_ACTION . '</strong></td>';
617
                    $table .= '</tr>';
618
619
                    foreach ($filesObj as $fileObj) {
620
                        $modify      = "<a href='file.php?op=mod&fileid=" . $fileObj->fileid() . "'>" . $icons['edit'] . '</a>';
621
                        $delete      = "<a href='file.php?op=del&fileid=" . $fileObj->fileid() . "'>" . $icons['delete'] . '</a>';
622
                        $not_visible = '';
623
                        if (0 == $fileObj->status()) {
624
                            $not_visible = "<img src='" . PUBLISHER_URL . "/assets/images/no.gif'>";
625
                        }
626
                        $table .= '<tr>';
627
                        $table .= "<td class='head' align='center'>" . $fileObj->getVar('fileid') . '</td>';
628
                        $table .= "<td class='odd' align='left'>" . $not_visible . $fileObj->getFileLink() . '</td>';
629
                        $table .= "<td class='even' align='left'>" . $fileObj->description() . '</td>';
630
                        $table .= "<td class='even' align='center'>" . $fileObj->counter() . '';
631
                        $table .= "<td class='even' align='center'>" . $fileObj->getDatesub() . '</td>';
632
                        $table .= "<td class='even' align='center'> $modify $delete </td>";
633
                        $table .= '</tr>';
634
                    }
635
                    $table .= '</table>';
636
637
                    $files_box = new \XoopsFormLabel(\_CO_PUBLISHER_FILES_LINKED, $table);
638
                    $this->addElement($files_box);
639
                    unset($files_box, $filesObj, $fileObj);
640
                }
641
            }
642
        }
643
644
        // OTHERS -----------------------------------
645
        if ($this->hasTab(\_CO_PUBLISHER_TAB_OTHERS)) {
646
            $this->startTab(\_CO_PUBLISHER_TAB_OTHERS);
647
        }
648
        //$this->startTab(_CO_PUBLISHER_TAB_META);
649
        // Meta Keywords
650
        if ($this->isGranted(Constants::PUBLISHER_ITEM_META_KEYWORDS)) {
651
            $text_meta_keywords = new \XoopsFormTextArea(\_CO_PUBLISHER_ITEM_META_KEYWORDS, 'item_meta_keywords', $obj->meta_keywords('e'), 7, 60);
652
            $text_meta_keywords->setDescription(\_CO_PUBLISHER_ITEM_META_KEYWORDS_DSC);
653
            $this->addElement($text_meta_keywords);
654
        }
655
656
        // Meta Description
657
        if ($this->isGranted(Constants::PUBLISHER_ITEM_META_DESCRIPTION)) {
658
            $text_meta_description = new \XoopsFormTextArea(\_CO_PUBLISHER_ITEM_META_DESCRIPTION, 'item_meta_description', $obj->meta_description('e'), 7, 60);
659
            $text_meta_description->setDescription(\_CO_PUBLISHER_ITEM_META_DESCRIPTION_DSC);
660
            $this->addElement($text_meta_description);
661
        }
662
663
        //$this->startTab(_CO_PUBLISHER_TAB_PERMISSIONS);
664
665
        // COMMENTS
666
        if ($this->isGranted(Constants::PUBLISHER_ALLOWCOMMENTS)) {
667
            $addcomments_radio = new \XoopsFormRadioYN(\_CO_PUBLISHER_ALLOWCOMMENTS, 'allowcomments', $obj->cancomment(), _YES, _NO);
668
            $this->addElement($addcomments_radio);
669
        }
670
671
        // WEIGHT
672
        if ($this->isGranted(Constants::PUBLISHER_WEIGHT)) {
673
            $this->addElement(new \XoopsFormText(\_CO_PUBLISHER_WEIGHT, 'weight', 5, 5, $obj->weight()));
674
        }
675
676
        $this->endTabs();
677
678
        //COMMON TO ALL TABS
679
680
        $buttonTray = new \XoopsFormElementTray('', '');
681
682
        if ($obj->isNew()) {
683
            $buttonTray->addElement(new \XoopsFormButton('', 'additem', \_CO_PUBLISHER_CREATE, 'submit'));
684
            $buttonTray->addElement(new \XoopsFormButton('', '', \_CO_PUBLISHER_CLEAR, 'reset'));
685
        } else {
686
            $buttonTray->addElement(new \XoopsFormButton('', 'additem', _SUBMIT, 'submit')); //orclone
687
        }
688
689
        $buttonTray->addElement(new \XoopsFormButton('', 'preview', \_CO_PUBLISHER_PREVIEW, 'submit'));
690
691
        $butt_cancel = new \XoopsFormButton('', '', \_CO_PUBLISHER_CANCEL, 'button');
692
        $butt_cancel->setExtra('onclick="history.go(-1)"');
693
        $buttonTray->addElement($butt_cancel);
694
695
        $this->addElement($buttonTray);
696
697
        $hidden = new \XoopsFormHidden('itemid', $obj->itemid());
698
        $this->addElement($hidden);
699
        unset($hidden);
700
701
        return $this;
702
    }
703
}
704