Issues (407)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/main.php (2 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * ****************************************************************************
4
 * references - MODULE FOR XOOPS
5
 * Copyright (c) Herv?? Thouzard of Instant Zero (http://www.instant-zero.com)
6
 *
7
 * You may not change or alter any portion of this comment or credits
8
 * of supporting developers from this source code or any supporting source code
9
 * which is considered copyrighted (c) material of the original comment or credit authors.
10
 * This program is distributed in the hope that it will be useful,
11
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
13
 *
14
 * @copyright       Herv?? Thouzard of Instant Zero (http://www.instant-zero.com)
15
 * @license         http://www.fsf.org/copyleft/gpl.html GNU public license
16
 * @package         references
17
 * @author          Herv?? Thouzard of Instant Zero (http://www.instant-zero.com)
18
 *
19
 * ****************************************************************************
20
 */
21
22
include_once __DIR__ . '/admin_header.php';
23
require_once __DIR__ . '/../../../include/cp_header.php';
24
require_once __DIR__ . '/../include/common.php';
25
26
require_once REFERENCES_PATH . 'admin/functions.php';
27
require_once XOOPS_ROOT_PATH . '/class/pagenav.php';
28
require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php';
29
require_once REFERENCES_PATH . 'class/references_listFilter.php';
30
require_once REFERENCES_PATH . 'admin/dbupdate.php';
31
32
if (!isset($op)) {
33
    $op = 'default';
34
}
35
36
if (isset($_POST['op'])) {
37
    $op = $_POST['op'];
38
} else {
39
    if (isset($_GET['op'])) {
40
        $op = $_GET['op'];
41
    }
42
}
43
44
// V???rification de l'existence et de l'???tat d'???criture des diff???rents r???pertoire de stockage et de cache
45
references_utils::prepareFolder(REFERENCES_CACHE_PATH);
46
references_utils::prepareFolder(references_utils::getModuleOption('attached_path'));
47
references_utils::prepareFolder(references_utils::getModuleOption('images_path'));
48
49
// Lecture de certains param???tres de l'application ********************************************************************
50
$limit            = references_utils::getModuleOption('items_admin_page');    // Nombre maximum d'???l???ments ??? afficher
51
$baseurl          = REFERENCES_URL . 'admin/' . basename(__FILE__);    // URL de ce script
52
$conf_msg         = references_utils::javascriptLinkConfirm(_AM_REFERENCES_CONF_DELITEM);
53
$defaultSortField = references_utils::getModuleOption('admin_sort_field');
54
$defaultSortOrder = references_utils::getModuleOption('admin_sort_order');
55
56
$thumbs_width  = references_utils::getModuleOption('thumbs_width');
57
$thumbs_height = references_utils::getModuleOption('thumbs_height');
58
$destname      = '';
59
$handlers      = references_handler::getInstance();
60
61
/**
62
 * Affichage du pied de page de l'administration
63
 *
64
 * PLEASE, KEEP THIS COPYRIGHT *INTACT* !
65
 */
66
function show_footer()
67
{
68
    echo "<br><br><div align='center'><a href='http://www.instant-zero.com' target='_blank' title='Instant Zero'><img src='../assets/images/instantzero.gif' alt='Instant Zero' /></a></div>";
69
}
70
71
references_utils::loadLanguageFile('modinfo.php');
72
references_utils::loadLanguageFile('main.php');
73
74
// ******************************************************************************************************************************************
75
// **** Main ********************************************************************************************************************************
76
// ******************************************************************************************************************************************
77
switch ($op) {
78
79
    // ****************************************************************************************************************
80
    case 'default':    // Gestion des articles
81
    case 'articles':
82
        // ****************************************************************************************************************
83
        xoops_cp_header();
84
        // references_adminMenu(0);
85
        $objet = 'articles';
86
        $items = array();
87
        if (isset($_GET['move'])) {
88
            $id    = isset($_GET['id']) ? (int)$_GET['id'] : 0;
89
            $ordre = isset($_GET['ordre']) ? (int)$_GET['ordre'] : 0;
90
            if ($_GET['move'] === 'up' && $id > 0) {
91
                $handlers->h_references_articles->moveUp($id, $ordre);
92
            }
93
            if ($_GET['move'] === 'down' && $id > 0) {
94
                $handlers->h_references_articles->moveDown($id, $ordre);
95
            }
96
        }
97
        $form = "<form method='post' action='$baseurl' name='frmadd$objet' id='frmadd$objet'><input type='hidden' name='op' id='op' value='add$objet' /><input type='submit' name='btngo' id='btngo' value='" . _AM_REFERENCES_ADD_ITEM . "' /></form>";
98
        echo $form;
99
        $categoriesList = $h_references_categories->getListArray();
100
        $upText         = _AM_REFERENCES_UP;
101
        $downText       = _AM_REFERENCES_DOWN;
102
        $upImg          = "<a href='$baseurl?op=articles&move=up&id=%d&ordre=%d' title=\"$upText\"><img src='" . REFERENCES_IMAGES_URL . "up.png' alt=\"$upText\" /></a>";
103
        $downImg        = "<a href='$baseurl?op=articles&move=down&id=%d&ordre=%d' title=\"$downText\"><img src='" . REFERENCES_IMAGES_URL . "down.png' alt=\"$downText\" /></a>";
104
105
        $referencesFilter = new references_listFilter($h_references_articles, 'op', 'articles', 'start', $limit, $baseurl, $defaultSortField, $defaultSortOrder, true, REFERENCES_JS_URL);
106
        $referencesFilter->initFilter('article_id', array('dataType' => references_listFilter::FILTER_DATA_NUMERIC, 'fieldType' => references_listFilter::FILTER_FIELD_TEXT, 'size' => 5, 'maxLength' => 10));
107
        $referencesFilter->initFilter('article_title', array('dataType' => references_listFilter::FILTER_DATA_TEXT, 'fieldType' => references_listFilter::FILTER_FIELD_TEXT, 'size' => 35, 'maxLength' => 255, 'autoComplete' => true));
108
        $referencesFilter->initFilter('article_weight', array('dataType' => references_listFilter::FILTER_DATA_NUMERIC, 'fieldType' => references_listFilter::FILTER_FIELD_TEXT, 'size' => 5, 'maxLength' => 10));
109
110
        $referencesFilter->initFilter('article_category_id', array('dataType' => references_listFilter::FILTER_DATA_NUMERIC, 'fieldType' => references_listFilter::FILTER_FIELD_SELECT, 'values' => $categoriesList, 'withNull' => true, 'style' => 'width: 170px; max-width: 170px;'));
111
        $referencesFilter->initFilter('article_online', array('dataType' => references_listFilter::FILTER_DATA_NUMERIC, 'fieldType' => references_listFilter::FILTER_FIELD_SELECT, 'values' => array(2 => _YES, 1 => _NO), 'withNull' => true, 'minusOne' => true));
112
        $sortFields = array('article_id' => _AM_REFERENCES_ID, 'article_title' => _AM_REFERENCES_TITLE, 'article_weight' => _AM_REFERENCES_WEIGHT, 'article_category_id' => _AM_REFERENCES_CATEGORY, 'article_online' => _AM_REFERENCES_ONLINE);
113
        $referencesFilter->setSortFields($sortFields);
114
115
        $referencesFilter->filter();
116
        $itemsCount = $referencesFilter->getCount();
117
        references_utils::htitle(_MI_REFERENCES_ADMENU0 . ' (' . $itemsCount . ')', 4);
118
119
        if ($itemsCount > $limit) {
120
            $pagenav = $referencesFilter->getPager();
121
        }
122
123
        $items             = $referencesFilter->getObjects();
124
        $visibleCountItems = count($items);
125
        $counter           = 0;
126
        $categories        = $h_references_categories->getListArray();
127
        echo "<table width='100%' cellspacing='1' cellpadding='3' border='0' class='outer'>";
128
        echo "<tr>\n";
129
        echo "<form method='post' action='$baseurl'>\n";
130
        echo "<td colspan='4' align='right'>" . $referencesFilter->getSortPlaceHolderHtmlCode();
131
        echo $referencesFilter->getClearFilterbutton();
132
        echo "</td>\n";
133
        echo "<td colspan='2' align='right'>";
134
        if (isset($pagenav) && is_object($pagenav)) {
135
            echo $pagenav->renderNav();
136
        }
137
        echo "</td>\n</tr>\n";
138
139
        echo "<th align='center'>" . _AM_REFERENCES_ID . "</th><th align='center'>" . _AM_REFERENCES_TITLE . "</th><th align='center'>" . _AM_REFERENCES_WEIGHT . "</th><th align='center'>" . _AM_REFERENCES_CATEGORY . "</th><th align='center'>" . _AM_REFERENCES_ONLINE . "</th><th align='center'>"
140
             . _AM_REFERENCES_MANUAL_DATE . "</th><th align='center'>" . _AM_REFERENCES_ACTION . '</th></tr>';
141
        // Filtres ****************************************
142
        echo "<tr>\n";
143
        echo "<th align='center'>" . $referencesFilter->getFilterField('article_id') . "</th>\n";
144
        echo "<th align='center'>" . $referencesFilter->getFilterField('article_title') . "</th>\n";
145
        echo "<th align='center'>" . $referencesFilter->getFilterField('article_weight') . "</th>\n";
146
        echo "<th align='center'>" . $referencesFilter->getFilterField('article_category_id') . "</th>\n";
147
        echo "<th align='center'>" . $referencesFilter->getFilterField('article_online') . "</th>\n";
148
        echo "<th align='center'>&nbsp;</th>\n";
149
        echo "<th align='center'>" . $referencesFilter->getGoButton() . "</th></form></tr>\n";
150
        // ************************************************
151
        $class = '';
152
        foreach ($items as $item) {
153
            ++$counter;
154
            $class         = ($class === 'even') ? 'odd' : 'even';
155
            $id            = $item->getVar('article_id');
156
            $action_edit   = "<a href='$baseurl?op=edit" . $objet . '&id=' . $id . "' title='" . _EDIT . "'>" . $icones['edit'] . '</a>';
157
            $action_delete = "<a href='$baseurl?op=delete" . $objet . '&id=' . $id . "' title='" . _DELETE . "'" . $conf_msg . '>' . $icones['delete'] . '</a>';
158
            $category      = isset($categories[$item->getVar('article_category_id')]) ? $categories[$item->getVar('article_category_id')] : '';
159
            $up            = $down = '';
160
            echo "<tr class='" . $class . "'>\n";
161
            $ordre = $item->getVar('article_weight');
162
            if ($counter == 1 && $visibleCountItems > 1) { // Premier ???l???ment
163
                $down = sprintf($downImg, $id, $ordre);
164
            }
165
            if ($counter == $visibleCountItems && $visibleCountItems > 1) { // Dernier ???l???ment
166
                $up = sprintf($upImg, $id, $ordre);
167
            }
168
            if ($counter > 1 & $counter < $visibleCountItems && $visibleCountItems > 1) { // Element dans le milieu
169
                $up   = sprintf($upImg, $id, $ordre);
170
                $down = sprintf($downImg, $id, $ordre);
171
            }
172
173
            echo "<td align='center'>" . $id . '</td>';
174
            echo "<td align='left'><a target='_blank' href='" . $item->getUrl() . "'>" . $item->getVar('article_title') . '</a></td>';
175
            echo "<td align='center'>" . $item->getVar('article_weight') . " $up $down</td>";
176
            echo "<td align='center'>" . $category . '</td>';
177
            if ($item->isArticleOnline()) {
178
                $statusLink = "<a href='$baseurl?op=offline&id=$id' title='" . _AM_REFERENCES_GO_OFFLINE . "'><img src='" . REFERENCES_IMAGES_URL . "status_online.png' alt='" . _AM_REFERENCES_GO_OFFLINE . "' /></a>";
179
            } else {
180
                $statusLink = "<a href='$baseurl?op=online&id=$id' title='" . _AM_REFERENCES_GO_ONLINE . "'><img src='" . REFERENCES_IMAGES_URL . "status_offline.png' alt='" . _AM_REFERENCES_GO_ONLINE . "' /></a>";
181
            }
182
            echo "<td align='center'>" . $statusLink . '</td>';
183
            echo "<td align='center'>" . $item->getVar('article_date') . '</td>';
184
            echo "<td align='center'>" . $action_edit . ' ' . $action_delete . "</td>\n";
185
            echo "<tr>\n";
186
        }
187
        $class = ($class === 'even') ? 'odd' : 'even';
188
        echo "<tr class='" . $class . "'>\n";
189
        echo "<td colspan='7' align='center'>" . $form . "</td>\n";
190
        echo "</tr>\n";
191
        echo "</table>\n";
192
        echo $referencesFilter->getJavascriptInitCode();
193
        if (isset($pagenav) && is_object($pagenav)) {
194
            echo "<div align='center'>" . $pagenav->renderNav() . '</div>';
195
        }
196
        echo "<br><br>\n";
197
        include_once __DIR__ . '/admin_footer.php';  //show_footer();
198
        break;
199
200
    // ****************************************************************************************************************
201
    case 'addarticles':        // Ajout d'un article
202
    case 'editarticles':    // Edition d'un article
203
        // ****************************************************************************************************************
204
        xoops_cp_header();
205
        // references_adminMenu(0);
206
        $object = 'articles';
207
        if ($op == 'edit' . $object) {
208
            $title = _AM_REFERENCES_EDIT_ARTICLE;
209
            $id    = isset($_GET['id']) ? (int)$_GET['id'] : 0;
210
            if (empty($id)) {
211
                references_utils::redirect(_AM_REFERENCES_ERROR_1, $baseurl, 5);
212
            }
213
            // Item exits ?
214
            $item = null;
215
            $item = $h_references_articles->get($id);
216
            if (!is_object($item)) {
217
                references_utils::redirect(_AM_REFERENCES_NOT_FOUND, $baseurl, 5);
218
            }
219
            $edit         = true;
220
            $label_submit = _AM_REFERENCES_MODIFY;
221
        } else {
222
            $title = _AM_REFERENCES_ADD_ARTICLE;
223
            $item  = $h_references_articles->create(true);
224
            $item->setVar('article_online', true);
225
            if (REFERENCES_AUTO_FILL_MANUAL_DATE) {
226
                $item->setVar('article_date', formatTimestamp(time(), 's'));
227
            }
228
            $label_submit = _AM_REFERENCES_ADD;
229
            $edit         = false;
230
        }
231
        $sform = new XoopsThemeForm($title, 'frmadd' . $object, $baseurl);
232
        $sform->setExtra('enctype="multipart/form-data"');
233
        $sform->addElement(new XoopsFormHidden('op', 'saveedit' . $object));
234
        $sform->addElement(new XoopsFormHidden('article_id', $item->getVar('article_id')));
235
        $categories     = $h_references_categories->getListArray();
236
        $categoriesList = new XoopsFormSelect(_AM_REFERENCES_CATEGORY, 'article_category_id', $item->getVar('article_category_id', 'e'));
237
        $categoriesList->addOptionArray($categories);
238
        $sform->addElement($categoriesList, true);
239
240
        $sform->addElement(new XoopsFormText(_AM_REFERENCES_TITLE, 'article_title', 50, 255, $item->getVar('article_title', 'e')), true);
241
        $sform->addElement(new XoopsFormRadioYN(_AM_REFERENCES_ONLINE, 'article_online', $item->getVar('article_online', 'e')), true);
242
        $sform->addElement(new XoopsFormText(_AM_REFERENCES_MANUAL_DATE, 'article_date', 30, 30, $item->getVar('article_date', 'e')), false);
243
        $sform->addElement(new XoopsFormTextDateSelect(_AM_REFERENCES_DATE, 'article_timestamp', 15, $item->getVar('article_timestamp', 'e')));
244
        $sform->addElement(new XoopsFormText(_AM_REFERENCES_WEIGHT, 'article_weight', 5, 5, $item->getVar('article_weight', 'e')), false);
245
        $sform->addElement(new XoopsFormText(_AM_REFERENCES_URL, 'article_externalurl', 50, 255, $item->getVar('article_externalurl', 'e')), false);
246
247
        $editor = references_utils::getWysiwygForm(_AM_REFERENCES_TEXT, 'article_text', $item->getVar('article_text', 'e'), 15, 60, 'article_text_hidden');
248
        if ($editor) {
249
            $sform->addElement($editor, false);
250
        }
251
252
        $editor1 = references_utils::getWysiwygForm(_AM_REFERENCES_TEXT_MORE, 'article_readmore', $item->getVar('article_readmore', 'e'), 15, 60, 'article_readmore_hidden');
253
        if ($editor1) {
254
            $sform->addElement($editor1, false);
255
        }
256
257
        if (references_utils::getModuleOption('use_tags') && references_utils::tagModuleExists()) {
258
            require_once XOOPS_ROOT_PATH . '/modules/tag/include/formtag.php';
259
            $sform->addElement(new XoopsFormTag('item_tag', 60, 255, $item->getVar('article_id'), 0));
260
        }
261
        // Images
262
        for ($i = 1; $i <= 10; ++$i) {
263
            if ($op == 'edit' . $object && $item->pictureExists($i)) {
264
                $pictureTray = new XoopsFormElementTray(_AM_REFERENCES_CURRENT_PICTURE . ' ' . $i, '<br>');
265
                $pictureTray->addElement(new XoopsFormLabel('', "<img src='" . $item->getPictureUrl($i) . "' alt='' border='0' />"));
266
                $deleteCheckbox = new XoopsFormCheckBox('', 'delpicture' . $i);
267
                $deleteCheckbox->addOption(1, _DELETE);
268
                $pictureTray->addElement($deleteCheckbox);
269
                $sform->addElement($pictureTray);
270
                unset($pictureTray, $deleteCheckbox);
271
            }
272
            $sform->addElement(new XoopsFormFile(_AM_REFERENCES_IMAGE . ' ' . $i, 'attachedfile' . $i, references_utils::getModuleOption('maxuploadsize')), false);
273
            $fieldName = 'article_picture' . $i . '_text';
274
            $sform->addElement(new XoopsFormText(_AM_REFERENCES_PICTURE_TEXT . ' ' . $i, $fieldName, 50, 255, $item->getVar($fieldName)), false);
275
        }
276
277
        // Fichier attach???
278
        if ($op == 'edit' . $object && $item->attachmentExists()) {
279
            $attachedTray = new XoopsFormElementTray(_AM_REFERENCES_ATTACHED_FILE, '<br>');
280
            $attachedTray->addElement(new XoopsFormLabel('', "<a href='" . $item->getAttachmentUrl() . "' target='_blank'>" . $item->getVar('article_attached_file') . '</a>'));
281
            $deleteCheckbox = new XoopsFormCheckBox('', 'delattach');
282
            $deleteCheckbox->addOption(1, _DELETE);
283
            $attachedTray->addElement($deleteCheckbox);
284
            $sform->addElement($attachedTray);
285
            unset($attachedTray, $deleteCheckbox);
286
        }
287
        $sform->addElement(new XoopsFormFile(_AM_REFERENCES_ATTACHED_FILE, 'article_attached_file', references_utils::getModuleOption('maxuploadsize')), false);
288
289
        $button_tray = new XoopsFormElementTray('', '');
290
        $submit_btn  = new XoopsFormButton('', 'post', $label_submit, 'submit');
291
        $button_tray->addElement($submit_btn);
292
        $sform->addElement($button_tray);
293
        $sform = references_utils::formMarkRequiredFields($sform);
294
        $sform->display();
295
        include_once __DIR__ . '/admin_footer.php';  //show_footer();
296
        break;
297
298
    // ****************************************************************************************************************
299
    case 'saveeditarticles':    // Sauvegarde d'un article
300
        // ****************************************************************************************************************
301
        xoops_cp_header();
302
        $id         = isset($_POST['article_id']) ? (int)$_POST['article_id'] : 0;
303
        $opRedirect = 'articles';
304 View Code Duplication
        if (!empty($id)) {
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
305
            $edit = true;
306
            $item = $h_references_articles->get($id);
307
            if (!is_object($item)) {
308
                references_utils::redirect(_AM_REFERENCES_NOT_FOUND, $baseurl, 5);
309
            }
310
            $item->unsetNew();
311
        } else {
312
            $edit = false;
313
            $item = $h_references_articles->create(true);
314
        }
315
316
        $item->setVars($_POST);
317
318
        // Images
319
        for ($i = 1; $i <= 10; ++$i) {
320
            if (isset($_POST['delpicture' . $i]) && (int)$_POST['delpicture' . $i] == 1) {
321
                $item->deletePicture($i);
322
                $item->setVar('article_picture' . $i, '');
323
            }
324
325
            // Upload de l'image et cr???ation de la vignette
326
            $destname = '';
327
            $return   = references_utils::uploadFile($i - 1, references_utils::getModuleOption('images_path'));
328
            if ($return === true) {
329
                if (references_utils::getModuleOption('images_width') > 0 && references_utils::getModuleOption('images_height') > 0) {
330
                    references_utils::createThumb(references_utils::getModuleOption('images_path') . '/' . basename($destname), references_utils::getModuleOption('images_path') . '/' . basename($destname), references_utils::getModuleOption('images_width'),
331
                                                  references_utils::getModuleOption('images_height'), true);
332
                }
333
                $newDestName = references_utils::getModuleOption('images_path') . DIRECTORY_SEPARATOR . REFERENCES_THUMBS_PREFIX . basename($destname);
334
                $retval      = references_utils::resizePicture(references_utils::getModuleOption('images_path') . '/' . basename($destname), $newDestName, $thumbs_width, $thumbs_height, true);
335
                if ($retval == 1 || $retval == 3) {
336
                    $item->setVar('article_picture' . $i, $destname);
337
                }
338
            } else {
339
                if ($return !== false) {
340
                    echo $return;
341
                }
342
            }
343
        }
344
345
        $timestamp = mktime(0, 0, 0, (int)substr($_POST['article_timestamp'], 5, 2), (int)substr($_POST['article_timestamp'], 8, 2), (int)substr($_POST['article_timestamp'], 0, 4));
346
        $item->setVar('article_timestamp', $timestamp);
347
348
        if (!$edit) {
349
            $item->setVar('article_author', references_utils::getCurrentUserID());
350
        }
351
352
        // Suppression ???ventuelle du fichier attach???
353
        if (isset($_POST['delattach']) && (int)$_POST['delattach'] == 1) {
354
            $item->deleteAttachment();
355
        }
356
357
        $destname = '';
358
        // Upload de la pi???ce jointe
359
        $return = references_utils::uploadFile(10, references_utils::getModuleOption('attached_path'));
360
        if ($return === true) {
361
            $item->setVar('article_attached_file', $destname);
362
        } else {
363
            if ($return !== false) {
364
                echo $return;
365
            }
366
        }
367
368
        $res = $h_references_articles->insert($item);
369
        if ($res) {
370
            if (references_utils::getModuleOption('use_tags') && references_utils::tagModuleExists()) {
371
                $tag_handler = xoops_getModuleHandler('tag', 'tag');
372
                $tag_handler->updateByItem($_POST['item_tag'], $item->getVar('article_id'), $xoopsModule->getVar('dirname'), 0);
373
            }
374
            if (!$edit) {
375
                $h_references_articles->notifyNewArticle($item);
376
            }
377
            references_utils::updateCache();
378
            references_utils::redirect(_AM_REFERENCES_SAVE_OK, $baseurl . '?op=' . $opRedirect, 2);
379
        } else {
380
            references_utils::redirect(_AM_REFERENCES_SAVE_PB, $baseurl . '?op=' . $opRedirect, 5);
381
        }
382
        break;
383
384
    // ****************************************************************************************************************
385
    case 'offline':    // Mise hors ligne d'un article
386
    case 'online':    // Mise en ligne d'un article
387
        // ****************************************************************************************************************
388
        xoops_cp_header();
389
        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
390
        if (empty($id)) {
391
            references_utils::redirect(_AM_REFERENCES_ERROR_1, $baseurl, 5);
392
        }
393
        $opRedirect = 'articles';
394
        $item       = null;
395
        $item       = $h_references_articles->get($id);
396
        if (is_object($item)) {
397
            if ($op === 'offline') {
398
                $res = $h_references_articles->offlineArticle($item);
399
            } else {
400
                $res = $h_references_articles->onlineArticle($item);
401
            }
402
            if ($res) {
403
                references_utils::updateCache();
404
                references_utils::redirect(_AM_REFERENCES_SAVE_OK, $baseurl . '?op=' . $opRedirect, 2);
405
            }
406
        }
407
        references_utils::redirect(_AM_REFERENCES_NOT_FOUND, $baseurl . '?op=' . $opRedirect, 5);
408
        break;
409
410
    // ****************************************************************************************************************
411 View Code Duplication
    case 'deletearticles':    // Suppression d'un article
412
        // ****************************************************************************************************************
413
        xoops_cp_header();
414
        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
415
        if (empty($id)) {
416
            references_utils::redirect(_AM_REFERENCES_ERROR_1, $baseurl, 5);
417
        }
418
        $opRedirect = 'articles';
419
        $item       = null;
420
        $item       = $h_references_articles->get($id);
421
        if (is_object($item)) {
422
            $res = $h_references_articles->deleteArticle($item, true);
423
            if ($res) {
424
                references_utils::updateCache();
425
                references_utils::redirect(_AM_REFERENCES_SAVE_OK, $baseurl . '?op=' . $opRedirect, 2);
426
            }
427
        }
428
        references_utils::redirect(_AM_REFERENCES_NOT_FOUND, $baseurl . '?op=' . $opRedirect, 5);
429
        break;
430
431
    // ****************************************************************************************************************
432
    case 'instant-zero';    // Publicit???
433
        // ****************************************************************************************************************
434
        xoops_cp_header();
435
        // references_adminMenu(4);
436
        echo "<iframe src='http://www.instant-zero.com/modules/liaise/?form_id=2' width='100%' height='600' frameborder='0'></iframe>";
437
        include_once __DIR__ . '/admin_footer.php';  //show_footer();
438
        break;
439
440
    // ****************************************************************************************************************
441
    case 'perms';    // Permissions
442
        // ****************************************************************************************************************
443
        xoops_cp_header();
444
        // references_adminMenu(3);
445
        require_once XOOPS_ROOT_PATH . '/class/xoopsform/grouppermform.php';
446
        $categories      = $handlers->h_references_categories->getCategories();
447
        $permissionsForm = new XoopsGroupPermForm(_AM_REFERENCES_VIEWFORM, $xoopsModule->getVar('mid'), REFERENCES_PERM_READ, _AM_REFERENCES_VIEWFORM_DESC, 'admin/index.php?op=perms', 'true');
448
        foreach ($categories as $category) {
449
            $permissionsForm->addItem($category->category_id, $category->category_title, 0);
450
        }
451
        echo $permissionsForm->render();
452
        echo "<br><br><br><br>\n";
453
        unset($permissionsForm);
454
        include_once __DIR__ . '/admin_footer.php';  //show_footer();
455
        break;
456
457
    // ****************************************************************************************************************
458
    case 'texts':    // Gestion des textes
459
        // ****************************************************************************************************************
460
        xoops_cp_header();
461
        // references_adminMenu(2);
462
        require_once REFERENCES_PATH . 'class/registryfile.php';
463
        $registry = new references_registryfile();
464
465
        $sform = new XoopsThemeForm(_MI_REFERENCES_ADMENU1, 'frmatxt', $baseurl);
466
        $sform->addElement(new XoopsFormHidden('op', 'savetexts'));
467
        // Texte ??? afficher sur la page d'index du module
468
        $editor1 = references_utils::getWysiwygForm(_AM_REFERENCES_TEXT1, 'text1', $registry->getfile(REFERENCES_TEXTFILE1), 5, 60, 'hometext1_hidden');
469
        if ($editor1) {
470
            $sform->addElement($editor1, false);
471
        }
472
        $button_tray = new XoopsFormElementTray('', '');
473
        $submit_btn  = new XoopsFormButton('', 'post', _AM_REFERENCES_MODIFY, 'submit');
474
        $button_tray->addElement($submit_btn);
475
        $sform->addElement($button_tray);
476
        $sform = references_utils::formMarkRequiredFields($sform);
477
        $sform->display();
478
        include_once __DIR__ . '/admin_footer.php';  //show_footer();
479
        break;
480
481
    // ****************************************************************************************************************
482
    case 'savetexts':        // Sauvegarde des textes
483
        // ****************************************************************************************************************
484
        xoops_cp_header();
485
        require_once REFERENCES_PATH . 'class/registryfile.php';
486
        $registry = new references_registryfile();
487
        $myts     = MyTextSanitizer::getInstance();
488
        $registry->savefile($myts->stripSlashesGPC($_POST['text1']), REFERENCES_TEXTFILE1);
489
        references_utils::updateCache();
490
        references_utils::redirect(_AM_REFERENCES_SAVE_OK, $baseurl . '?op=texts', 2);
491
        break;
492
493
    // ****************************************************************************************************************
494
    case 'maintain':    // Maintenance des tables
495
        // ****************************************************************************************************************
496
        xoops_cp_header();
497
        // references_adminMenu();
498
        references_utils::maintainTablesCache();
499
        references_utils::redirect(_AM_REFERENCES_SAVE_OK, $baseurl, 2);
500
        break;
501
502
    // ****************************************************************************************************************
503
    case 'categories':    // Gestion des cat???gories
504
        // ****************************************************************************************************************
505
        xoops_cp_header();
506
        // references_adminMenu(1);
507
        $start = isset($_GET['start']) ? (int)$_GET['start'] : 0;
508
        $objet = 'categories';
509
        $items = array();
510
        $form  = "<form method='post' action='$baseurl' name='frmadd$objet' id='frmadd$objet'><input type='hidden' name='op' id='op' value='add$objet' /><input type='submit' name='btngo' id='btngo' value='" . _AM_REFERENCES_ADD_ITEM . "' /></form>";
511
        echo $form;
512
        references_utils::htitle(_MI_REFERENCES_ADMENU2, 4);
513
514
        $itemsCount = $h_references_categories->getCount();
515
        if ($itemsCount > $limit) {
516
            $pagenav = new XoopsPageNav($itemsCount, $limit, $start, 'start');
517
        }
518
519
        $items = $h_references_categories->getCategories($start, $limit);
520
        if (isset($pagenav) && is_object($pagenav)) {
521
            echo "<div align='right'>" . $pagenav->renderNav() . '</div>';
522
        }
523
        echo "<table width='100%' cellspacing='1' cellpadding='3' border='0' class='outer'>";
524
525
        echo "<tr><th align='center'>" . _AM_REFERENCES_ID . "</th><th align='center'>" . _AM_REFERENCES_TITLE . "</th><th align='center'>" . _AM_REFERENCES_CATEGORY_WEIGHT . "</th><th align='center'>" . _AM_REFERENCES_ACTION . '</th></tr>';
526
527
        $class = '';
528
        foreach ($items as $item) {
529
            $class         = ($class === 'even') ? 'odd' : 'even';
530
            $id            = $item->getVar('category_id');
531
            $action_edit   = "<a href='$baseurl?op=edit" . $objet . '&id=' . $id . "' title='" . _EDIT . "'>" . $icones['edit'] . '</a>';
532
            $action_delete = "<a href='$baseurl?op=delete" . $objet . '&id=' . $id . "' title='" . _DELETE . "'" . $conf_msg . '>' . $icones['delete'] . '</a>';
533
534
            echo "<tr class='" . $class . "'>\n";
535
            echo "<td align='center'>" . $id . '</td>';
536
            echo "<td align='left'><a target='_blank' href='" . $item->getUrl() . "'>" . $item->getVar('category_title') . '</a></td>';
537
            echo "<td align='right'>" . $item->getVar('category_weight') . '</td>';
538
            echo "<td align='center'>" . $action_edit . ' ' . $action_delete . "</td>\n";
539
            echo "<tr>\n";
540
        }
541
        $class = ($class === 'even') ? 'odd' : 'even';
542
        echo "<tr class='" . $class . "'>\n";
543
        echo "<td colspan='4' align='center'>" . $form . "</td>\n";
544
        echo "</tr>\n";
545
        echo "</table>\n";
546
        if (isset($pagenav) && is_object($pagenav)) {
547
            echo "<div align='center'>" . $pagenav->renderNav() . '</div>';
548
        }
549
        echo "<br><br>\n";
550
        include_once __DIR__ . '/admin_footer.php';  //show_footer();
551
        break;
552
553
    // ****************************************************************************************************************
554
    case 'addcategories':        // Ajout d'une cat???gorie
555
    case 'editcategories':        // Edition d'une categories
556
        // ****************************************************************************************************************
557
        xoops_cp_header();
558
        // references_adminMenu(1);
559
        $object = 'categories';
560
        if ($op == 'edit' . $object) {
561
            $title = _AM_REFERENCES_EDIT_CATEGORY;
562
            $id    = isset($_GET['id']) ? (int)$_GET['id'] : 0;
563
            if (empty($id)) {
564
                references_utils::redirect(_AM_REFERENCES_ERROR_1, $baseurl, 5);
565
            }
566
            // Item exits ?
567
            $item = null;
568
            $item = $h_references_categories->get($id);
569
            if (!is_object($item)) {
570
                references_utils::redirect(_AM_REFERENCES_NOT_FOUND, $baseurl, 5);
571
            }
572
            $edit         = true;
573
            $label_submit = _AM_REFERENCES_MODIFY;
574
        } else {
575
            $title        = _AM_REFERENCES_ADD_CATEGORY;
576
            $item         = $h_references_categories->create(true);
577
            $label_submit = _AM_REFERENCES_ADD;
578
            $edit         = false;
579
        }
580
        $sform = new XoopsThemeForm($title, 'frmadd' . $object, $baseurl);
581
        $sform->addElement(new XoopsFormHidden('op', 'saveedit' . $object));
582
        $sform->addElement(new XoopsFormHidden('category_id', $item->getVar('category_id')));
583
        $sform->addElement(new XoopsFormText(_AM_REFERENCES_TITLE, 'category_title', 50, 255, $item->getVar('category_title', 'e')), true);
584
        $sform->addElement(new XoopsFormText(_AM_REFERENCES_CATEGORY_WEIGHT, 'category_weight', 10, 10, $item->getVar('category_weight', 'e')), true);
585
        $editor = references_utils::getWysiwygForm(_AM_REFERENCES_DESCRIPTION, 'category_description', $item->getVar('category_description', 'e'), 15, 60, 'category_description_hidden');
586
        if ($editor) {
587
            $sform->addElement($editor, false);
588
        }
589
590
        // Permissions
591
        $membersHandler = xoops_getHandler('member');
592
        $allGroupsList  = $membersHandler->getGroupList();
593
        $permHandler    = xoops_getHandler('groupperm');
594
        $allGroupsIds   = array_keys($allGroupsList);
595
596
        $groupsIds = array();
597
        if ($edit) {
598
            $groupsIds                 = $permHandler->getGroupIds(REFERENCES_PERM_READ, $item->getVar('category_id'), $xoopsModule->getVar('mid'));
599
            $groupsIds                 = array_values($groupsIds);
600
            $groupsThatCanViewCheckbox = new XoopsFormCheckBox(_AM_REFERENCES_VIEWFORM, 'groups_references_can_view[]', $groupsIds);
601
        } else {
602
            $groupsThatCanViewCheckbox = new XoopsFormCheckBox(_AM_REFERENCES_VIEWFORM, 'groups_references_can_view[]', $allGroupsIds);
603
        }
604
        $groupsThatCanViewCheckbox->addOptionArray($allGroupsList);
605
        $sform->addElement($groupsThatCanViewCheckbox);
606
        // *****
607
608
        $button_tray = new XoopsFormElementTray('', '');
609
        $submit_btn  = new XoopsFormButton('', 'post', $label_submit, 'submit');
610
        $button_tray->addElement($submit_btn);
611
        $sform->addElement($button_tray);
612
        $sform = references_utils::formMarkRequiredFields($sform);
613
        $sform->display();
614
        include_once __DIR__ . '/admin_footer.php';  //show_footer();
615
        break;
616
617
    // ****************************************************************************************************************
618
    case 'saveeditcategories':    // Sauvegarde d'une cat???gorie
619
        // ****************************************************************************************************************
620
        xoops_cp_header();
621
        $id         = isset($_POST['category_id']) ? (int)$_POST['category_id'] : 0;
622
        $opRedirect = 'categories';
623 View Code Duplication
        if (!empty($id)) {
624
            $edit = true;
625
            $item = $h_references_categories->get($id);
626
            if (!is_object($item)) {
627
                references_utils::redirect(_AM_REFERENCES_NOT_FOUND, $baseurl, 5);
628
            }
629
            $item->unsetNew();
630
        } else {
631
            $edit = false;
632
            $item = $h_references_categories->create(true);
633
        }
634
635
        $item->setVars($_POST);
636
637
        $res = $h_references_categories->insert($item);
638
        if ($res) {
639
            // Permissions
640
            // Suppression des permissions actuelles
641
            $gperm_handler = xoops_getHandler('groupperm');
642
            $criteria      = new CriteriaCompo();
643
            $criteria->add(new Criteria('gperm_itemid', $item->category_id, '='));
644
            $criteria->add(new Criteria('gperm_modid', $xoopsModule->getVar('mid'), '='));
645
            $criteria->add(new Criteria('gperm_name', REFERENCES_PERM_READ, '='));
646
            $gperm_handler->deleteAll($criteria);
647
            // Sauvegarde des nouvelles permissions, si elles existente
648
            if (isset($_POST['groups_references_can_view'])) {
649
                foreach ($_POST['groups_references_can_view'] as $groupId) {
650
                    $gperm_handler->addRight(REFERENCES_PERM_READ, $item->category_id, $groupId, $xoopsModule->getVar('mid'));
651
                }
652
            }
653
            // ****
654
            if (!$edit) {
655
                $h_references_categories->notifyNewCategory($item);
656
            }
657
            references_utils::updateCache();
658
            references_utils::redirect(_AM_REFERENCES_SAVE_OK, $baseurl . '?op=' . $opRedirect, 2);
659
        } else {
660
            references_utils::redirect(_AM_REFERENCES_SAVE_PB, $baseurl . '?op=' . $opRedirect, 5);
661
        }
662
        break;
663
664
    // ****************************************************************************************************************
665 View Code Duplication
    case 'deletecategories':    // Suppression d'une cat???gorie
0 ignored issues
show
This code seems to be duplicated across your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
666
        // ****************************************************************************************************************
667
        xoops_cp_header();
668
        $id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
669
        if (empty($id)) {
670
            references_utils::redirect(_AM_REFERENCES_ERROR_1, $baseurl, 5);
671
        }
672
        $opRedirect = 'categories';
673
        $item       = null;
674
        $item       = $h_references_categories->get($id);
675
        if (is_object($item)) {
676
            $res = $h_references_categories->delete($item, true);
677
            if ($res) {
678
                references_utils::updateCache();
679
                references_utils::redirect(_AM_REFERENCES_SAVE_OK, $baseurl . '?op=' . $opRedirect, 2);
680
            }
681
        }
682
        references_utils::redirect(_AM_REFERENCES_NOT_FOUND, $baseurl . '?op=' . $opRedirect, 5);
683
        break;
684
685
    // ****************************************************************************************************************
686
    case 'autocomplete':    // Ajax, autocompl???tion
687
        // ****************************************************************************************************************
688
        if (!isset($xoopsUser) || !is_object($xoopsUser)) {
689
            exit;
690
        }
691
        if (!references_utils::isAdmin()) {
692
            exit;
693
        }
694
        error_reporting(0);
695
        @$xoopsLogger->activated = false;
696
        $handler = isset($_REQUEST['handler']) ? $_REQUEST['handler'] : '';
697
        if ($handler != '') {
698
            switch ($handler) {
699
                case 'references_articles':
700
                    $referencesFilter = new references_listFilter($h_references_articles, 'op', 'articles', 'start', $limit, $baseurl, 'article_title', 'ASC', true, REFERENCES_JS_URL);
701
                    $referencesFilter->initFilter('article_title', array('dataType' => references_listFilter::FILTER_DATA_TEXT, 'fieldType' => references_listFilter::FILTER_FIELD_TEXT, 'size' => 35, 'maxLength' => 255, 'autoComplete' => true));
702
                    echo utf8_encode($referencesFilter->autoComplete($_REQUEST['q'], $_REQUEST['limit'], $_REQUEST['field']));
703
                    break;
704
            }
705
        }
706
        exit;
707
        break;
708
}
709
xoops_cp_footer();
710