This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||
2 | |||
3 | /** |
||
4 | * File : makepdf.php for publisher |
||
5 | * For tcpdf_for_xoops 2.01 and higher |
||
6 | * Created by montuy337513 / philodenelle - https://www.chg-web.org |
||
7 | */ |
||
8 | |||
9 | use Xmf\Request; |
||
10 | use XoopsModules\Publisher\{ |
||
11 | Helper, |
||
12 | Utility |
||
13 | }; |
||
14 | |||
15 | /** @var Helper $helper */ |
||
16 | error_reporting(E_ALL); |
||
17 | |||
18 | require_once __DIR__ . '/header.php'; |
||
19 | |||
20 | $itemId = Request::getInt('itemid', 0, 'GET'); |
||
21 | $itemPageId = Request::getInt('page', -1, 'GET'); |
||
22 | if (0 == $itemId) { |
||
23 | redirect_header('<script>javascript:history.go(-1)</script>', 1, _MD_PUBLISHER_NOITEMSELECTED); |
||
24 | } |
||
25 | |||
26 | //2.5.8 |
||
27 | require_once XOOPS_ROOT_PATH . '/class/libraries/vendor/tecnickcom/tcpdf/tcpdf.php'; |
||
28 | |||
29 | // Creating the item object for the selected item |
||
30 | $itemObj = $helper->getHandler('Item') |
||
31 | ->get($itemId); |
||
32 | |||
33 | // if the selected item was not found, exit |
||
34 | if (!$itemObj) { |
||
35 | redirect_header('<script>javascript:history.go(-1)</script>', 1, _MD_PUBLISHER_NOITEMSELECTED); |
||
36 | } |
||
37 | |||
38 | // Creating the category object that holds the selected item |
||
39 | $categoryObj = $helper->getHandler('Category') |
||
40 | ->get($itemObj->categoryid()); |
||
41 | |||
42 | // Check user permissions to access that category of the selected item |
||
43 | if (!$itemObj->accessGranted()) { |
||
44 | redirect_header('<script>javascript:history.go(-1)</script>', 1, _NOPERM); |
||
45 | } |
||
46 | |||
47 | $helper->loadLanguage('main'); |
||
48 | |||
49 | $dateformat = $itemObj->getDatesub(); |
||
50 | $sender_inform = sprintf(_MD_PUBLISHER_WHO_WHEN, $itemObj->posterName(), $itemObj->getDatesub()); |
||
51 | $mainImage = $itemObj->getMainImage(); |
||
52 | |||
53 | $content = ''; |
||
54 | if (empty($mainImage['image_path'])) { |
||
55 | $content .= '<img src="' . PUBLISHER_URL . '/assets/images/default_image.jpg" alt="' . $myts->undoHtmlSpecialChars($mainImage['image_name']) . '"><br>'; |
||
56 | } |
||
57 | if ('' != $mainImage['image_path']) { |
||
58 | $content .= '<img src="' . $mainImage['image_path'] . '" alt="' . $myts->undoHtmlSpecialChars($mainImage['image_name']) . '"><br>'; |
||
59 | } |
||
60 | $content .= '<a href="' . PUBLISHER_URL . '/item.php?itemid=' . $itemId . '" style="text-decoration: none; color: #000000; font-size: 120%;" title="' . $myts->undoHtmlSpecialChars($itemObj->getTitle()) . '">' . $myts->undoHtmlSpecialChars($itemObj->getTitle()) . '</a>'; |
||
61 | $content .= '<br><span style="color: #CCCCCC; font-weight: bold; font-size: 80%;">' |
||
62 | . _CO_PUBLISHER_CATEGORY |
||
63 | . ' : </span><a href="' |
||
64 | . PUBLISHER_URL |
||
65 | . '/category.php?categoryid=' |
||
66 | . $itemObj->categoryid() |
||
67 | . '" style="color: #CCCCCC; font-weight: bold; font-size: 80%;" title="' |
||
68 | . $myts->undoHtmlSpecialChars($categoryObj->name()) |
||
69 | . '">' |
||
70 | . $myts->undoHtmlSpecialChars($categoryObj->name()) |
||
71 | . '</a>'; |
||
72 | $content .= '<br><span style="font-size: 80%; font-style: italic;">' . $sender_inform . '</span><br>'; |
||
73 | $content .= $itemObj->getBody(); |
||
74 | $content = str_replace('[pagebreak]', '', $content); |
||
75 | |||
76 | // Configuration for TCPDF_for_XOOPS |
||
77 | $pdf_data = [ |
||
78 | 'author' => $itemObj->posterName(), |
||
79 | 'title' => $myts->undoHtmlSpecialChars($categoryObj->name()), |
||
80 | 'page_format' => 'A4', |
||
81 | 'page_orientation' => 'P', |
||
82 | 'unit' => 'mm', |
||
83 | 'rtl' => false, //true if right to left |
||
84 | ]; |
||
85 | |||
86 | $pdf = new \TCPDF(PDF_PAGE_ORIENTATION, PDF_UNIT, PDF_PAGE_FORMAT, true, _CHARSET, false); |
||
0 ignored issues
–
show
|
|||
87 | |||
88 | $doc_title = Utility::convertCharset($myts->undoHtmlSpecialChars($itemObj->getTitle())); |
||
89 | $docSubject = $myts->undoHtmlSpecialChars($categoryObj->name()); |
||
90 | |||
91 | $docKeywords = $myts->undoHtmlSpecialChars($itemObj->meta_keywords()); |
||
92 | if (array_key_exists('rtl', $pdf_data)) { |
||
93 | $pdf->setRTL($pdf_data['rtl']); |
||
94 | } |
||
95 | // set document information |
||
96 | $pdf->SetCreator(PDF_CREATOR); |
||
0 ignored issues
–
show
|
|||
97 | $pdf->SetAuthor(PDF_AUTHOR); |
||
0 ignored issues
–
show
|
|||
98 | $pdf->SetTitle($doc_title); |
||
99 | $pdf->SetSubject($docSubject); |
||
100 | //$pdf->SetKeywords(XOOPS_URL . ', '.' by TCPDF_for_XOOPS (chg-web.org), '.$doc_title); |
||
101 | $pdf->SetKeywords($docKeywords); |
||
102 | |||
103 | $firstLine = Utility::convertCharset($GLOBALS['xoopsConfig']['sitename']) . ' (' . XOOPS_URL . ')'; |
||
104 | $secondLine = Utility::convertCharset($GLOBALS['xoopsConfig']['slogan']); |
||
105 | |||
106 | $PDF_HEADER_LOGO = '_blank.png'; |
||
107 | $PDF_HEADER_LOGO_WIDTH = ''; |
||
108 | |||
109 | //$pdf->SetHeaderData(PDF_HEADER_LOGO, PDF_HEADER_LOGO_WIDTH, $firstLine, $secondLine); |
||
110 | $pdf->setHeaderData($PDF_HEADER_LOGO, $PDF_HEADER_LOGO_WIDTH, $firstLine, $secondLine); |
||
111 | //$pdf->SetHeaderData(PDF_HEADER_LOGO, PDF_HEADER_LOGO_WIDTH, PDF_HEADER_TITLE, PDF_HEADER_STRING); |
||
112 | |||
113 | //print : disable the possibility to print the PDF from any PDF viewer. |
||
114 | //modify : prevent the modification of contents of the document by operations other than those controlled by 'fill-forms', 'extract' and 'assemble'; |
||
115 | //copy : prevent the copy or otherwise extract text and graphics from the document; |
||
116 | //annot-forms : Add or modify text annotations, fill in interactive form fields, and, if 'modify' is also set, create or modify interactive form fields (including signature fields); |
||
117 | //fill-forms : Fill in existing interactive form fields (including signature fields), even if 'annot-forms' is not specified; |
||
118 | //extract : Extract text and graphics (in support of accessibility to users with disabilities or for other purposes); |
||
119 | //assemble : Assemble the document (insert, rotate, or delete pages and create bookmarks or thumbnail images), even if 'modify' is not set; |
||
120 | //print-high : Print the document to a representation from which a faithful digital copy of the PDF content could be generated. When this is not set, printing is limited to a low-level representation of the appearance, possibly of degraded quality. |
||
121 | //owner : (inverted logic - only for public-key) when set permits change of encryption and enables all other permissions. |
||
122 | |||
123 | $pdf->SetProtection(['modify', 'copy', 'annot-forms', 'fill-forms', 'extract', 'assemble']); |
||
124 | |||
125 | //set margins |
||
126 | $pdf->SetMargins(PDF_MARGIN_LEFT, PDF_MARGIN_TOP, PDF_MARGIN_RIGHT); |
||
0 ignored issues
–
show
|
|||
127 | $pdf->setFooterMargin(PDF_MARGIN_FOOTER); |
||
0 ignored issues
–
show
|
|||
128 | //set auto page breaks |
||
129 | $pdf->SetAutoPageBreak(true, PDF_MARGIN_BOTTOM); |
||
0 ignored issues
–
show
|
|||
130 | |||
131 | $pdf->setHeaderMargin(PDF_MARGIN_HEADER); |
||
0 ignored issues
–
show
|
|||
132 | $pdf->setImageScale(PDF_IMAGE_SCALE_RATIO); //set image scale factor |
||
0 ignored issues
–
show
|
|||
133 | |||
134 | //2.5.8 |
||
135 | $pdf->setHeaderFont([PDF_FONT_NAME_MAIN, '', PDF_FONT_SIZE_MAIN]); |
||
0 ignored issues
–
show
|
|||
136 | $pdf->setFooterFont([PDF_FONT_NAME_DATA, '', PDF_FONT_SIZE_DATA]); |
||
0 ignored issues
–
show
|
|||
137 | |||
138 | $pdf->setFooterData($tc = [0, 64, 0], $lc = [0, 64, 128]); |
||
139 | |||
140 | //initialize document |
||
141 | $pdf->Open(); |
||
142 | $pdf->AddPage(); |
||
143 | $pdf->writeHTML($content, true, 0, true, 0); |
||
144 | $pdf->Output(); |
||
145 |
The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g.
excluded_paths: ["lib/*"]
, you can move it to the dependency path list as follows:For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths