This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||||
2 | |||||
3 | /** |
||||
4 | * Module: SmartFAQ |
||||
5 | * Author: The SmartFactory <www.smartfactory.ca> |
||||
6 | * Licence: GNU |
||||
7 | */ |
||||
8 | |||||
9 | use Xmf\Module\Admin; |
||||
10 | use Xmf\Request; |
||||
11 | use XoopsModules\Smartfaq; |
||||
12 | use XoopsModules\Smartfaq\Constants; |
||||
13 | |||||
14 | require_once __DIR__ . '/admin_header.php'; |
||||
15 | |||||
16 | /** @var Smartfaq\Helper $helper */ |
||||
17 | $helper = Smartfaq\Helper::getInstance(); |
||||
18 | $smartModuleConfig = $helper->getConfig(); |
||||
19 | |||||
20 | global $xoopsUser; |
||||
21 | |||||
22 | // Creating the faq handler object |
||||
23 | /** @var Smartfaq\FaqHandler $faqHandler */ |
||||
24 | $faqHandler = Smartfaq\Helper::getInstance()->getHandler('Faq'); |
||||
25 | |||||
26 | // Creating the category handler object |
||||
27 | /** @var Smartfaq\CategoryHandler $categoryHandler */ |
||||
28 | $categoryHandler = Smartfaq\Helper::getInstance()->getHandler('Category'); |
||||
29 | |||||
30 | $op = ''; |
||||
31 | if (Request::hasVar('op', 'GET')) { |
||||
32 | $op = $_GET['op']; |
||||
33 | } |
||||
34 | if (Request::hasVar('op', 'POST')) { |
||||
35 | $op = $_POST['op']; |
||||
36 | } |
||||
37 | |||||
38 | // Where shall we start? |
||||
39 | $startfaq = Request::getInt('startfaq', 0, 'GET'); |
||||
40 | |||||
41 | /** |
||||
42 | * @param bool $showmenu |
||||
43 | * @param int $faqid |
||||
44 | */ |
||||
45 | function editfaq($showmenu = false, $faqid = -1): void |
||||
0 ignored issues
–
show
|
|||||
46 | { |
||||
47 | global $faqHandler, $categoryHandler, $xoopsUser, $xoopsConfig, $xoopsDB, $modify, $xoopsModule, $XOOPS_URL, $myts; |
||||
48 | /** @var Smartfaq\Helper $helper */ |
||||
49 | $helper = Smartfaq\Helper::getInstance(); |
||||
50 | |||||
51 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||||
52 | // If there is a parameter, and the id exists, retrieve data: we're editing a faq |
||||
53 | if (-1 != $faqid) { |
||||
54 | // Creating the FAQ object |
||||
55 | $faqObj = new Smartfaq\Faq($faqid); |
||||
0 ignored issues
–
show
It seems like
$faqid can also be of type integer ; however, parameter $id of XoopsModules\Smartfaq\Faq::__construct() does only seem to accept null , maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
![]() |
|||||
56 | |||||
57 | if ($faqObj->notLoaded()) { |
||||
58 | redirect_header('faq.php', 1, _AM_SF_NOARTTOEDIT); |
||||
59 | } |
||||
60 | switch ($faqObj->status()) { |
||||
61 | case Constants::SF_STATUS_ASKED: |
||||
62 | $breadcrumb_action = _AM_SF_APPROVING; |
||||
0 ignored issues
–
show
|
|||||
63 | $collapsableBar_title = _AM_SF_QUESTION_APPROVING; |
||||
64 | $collapsableBar_info = _AM_SF_QUESTION_APPROVING_INFO; |
||||
65 | $button_caption = _AM_SF_QUEUE; |
||||
66 | break; |
||||
67 | case 'default': |
||||
68 | default: |
||||
69 | $breadcrumb_action = _AM_SF_EDITING; |
||||
70 | $collapsableBar_title = _AM_SF_EDITQUES; |
||||
71 | $collapsableBar_info = _AM_SF_EDITING_INFO; |
||||
72 | $button_caption = _AM_SF_MODIFY; |
||||
73 | break; |
||||
74 | } |
||||
75 | |||||
76 | // Creating the category of this FAQ |
||||
77 | $categoryObj = $categoryHandler->get($faqObj->categoryid()); |
||||
78 | |||||
79 | echo "<br>\n"; |
||||
80 | Smartfaq\Utility::collapsableBar('bottomtable', 'bottomtableicon'); |
||||
81 | echo "<img id='bottomtableicon' src=" . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . "/assets/images/icon/close12.gif alt=''></a> " . $collapsableBar_title . '</h3>'; |
||||
82 | echo "<div id='bottomtable'>"; |
||||
83 | echo '<span style="color: #567; margin: 3px 0 12px 0; font-size: small; display: block; ">' . $collapsableBar_info . '</span>'; |
||||
84 | } else { |
||||
85 | // there's no parameter, so we're adding a faq |
||||
86 | $faqObj = $faqHandler->create(); |
||||
87 | $faqObj->setVar('uid', $xoopsUser->getVar('uid')); |
||||
88 | $categoryObj = $categoryHandler->create(); |
||||
89 | |||||
90 | $breadcrumb_action = _AM_SF_CREATINGNEW; |
||||
91 | $button_caption = _AM_SF_CREATE; |
||||
92 | |||||
93 | Smartfaq\Utility::collapsableBar('bottomtable', 'bottomtableicon'); |
||||
94 | echo "<img id='bottomtableicon' src=" . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . "/assets/images/icon/close12.gif alt=''></a> " . _AM_SF_CREATEQUESTION . '</h3>'; |
||||
95 | echo "<div id='bottomtable'>"; |
||||
96 | } |
||||
97 | $sform = new \XoopsThemeForm(_AM_SF_OPEN_QUESTION, 'op', xoops_getenv('SCRIPT_NAME'), 'post', true); |
||||
98 | $sform->setExtra('enctype="multipart/form-data"'); |
||||
99 | |||||
100 | // faq requester |
||||
101 | $sform->addElement(new \XoopsFormLabel(_AM_SF_REQUESTED_BY, Smartfaq\Utility::getLinkedUnameFromId($faqObj->uid(), $helper->getConfig('userealname')))); |
||||
102 | |||||
103 | // CATEGORY |
||||
104 | /* |
||||
105 | * Get information for pulldown menu using XoopsTree. |
||||
106 | * First var is the database table |
||||
107 | * Second var is the unique field ID for the categories |
||||
108 | * Last one is not set as we do not have sub menus in Smartfaq |
||||
109 | */ |
||||
110 | |||||
111 | $mytree = new Smartfaq\Tree($xoopsDB->prefix('smartfaq_categories'), 'categoryid', 'parentid'); |
||||
112 | ob_start(); |
||||
113 | $mytree->makeMySelBox('name', 'weight', $categoryObj->categoryid()); |
||||
114 | $sform->addElement(new \XoopsFormLabel(_AM_SF_CATEGORY_QUESTION, ob_get_clean())); |
||||
115 | |||||
116 | // faq QUESTION |
||||
117 | $sform->addElement(new \XoopsFormTextArea(_AM_SF_QUESTION, 'question', $faqObj->question(), 7, 60)); |
||||
118 | |||||
119 | // PER ITEM PERMISSIONS |
||||
120 | /** @var \XoopsMemberHandler $memberHandler */ |
||||
121 | $memberHandler = xoops_getHandler('member'); |
||||
122 | $group_list = $memberHandler->getGroupList(); |
||||
123 | $groups_checkbox = new \XoopsFormCheckBox(_AM_SF_PERMISSIONS_QUESTION, 'groups[]', $faqObj->getGroups_read()); |
||||
124 | foreach ($group_list as $group_id => $group_name) { |
||||
125 | if (XOOPS_GROUP_ADMIN != $group_id) { |
||||
126 | $groups_checkbox->addOption($group_id, $group_name); |
||||
127 | } |
||||
128 | } |
||||
129 | $sform->addElement($groups_checkbox); |
||||
130 | |||||
131 | // faq ID |
||||
132 | $sform->addElement(new \XoopsFormHidden('faqid', $faqObj->faqid())); |
||||
133 | |||||
134 | $buttonTray = new \XoopsFormElementTray('', ''); |
||||
135 | $hidden = new \XoopsFormHidden('op', 'addfaq'); |
||||
136 | $buttonTray->addElement($hidden); |
||||
137 | |||||
138 | $sform->addElement(new \XoopsFormHidden('status', $faqObj->status())); |
||||
139 | // Setting the FAQ Status |
||||
140 | /* $status_select = new \XoopsFormSelect('', 'status', $status); |
||||
141 | $status_select->addOptionArray(Smartfaq\Utility::getStatusArray()); |
||||
142 | $status_tray = new \XoopsFormElementTray(_AM_SF_STATUS_EXP , ' '); |
||||
143 | $status_tray->addElement($status_select); |
||||
144 | $sform->addElement($status_tray); |
||||
145 | */ |
||||
146 | if (-1 == $faqid) { |
||||
147 | // there's no faqid? Then it's a new faq |
||||
148 | // $buttonTray -> addElement( new \XoopsFormButton( '', 'mod', _AM_SF_CREATE, 'submit' ) ); |
||||
149 | $butt_create = new \XoopsFormButton('', '', _AM_SF_CREATE, 'submit'); |
||||
150 | $butt_create->setExtra('onclick="this.form.elements.op.value=\'addfaq\'"'); |
||||
151 | $buttonTray->addElement($butt_create); |
||||
152 | |||||
153 | $butt_clear = new \XoopsFormButton('', '', _AM_SF_CLEAR, 'reset'); |
||||
154 | $buttonTray->addElement($butt_clear); |
||||
155 | |||||
156 | $butt_cancel = new \XoopsFormButton('', '', _AM_SF_CANCEL, 'button'); |
||||
157 | $butt_cancel->setExtra('onclick="history.go(-1)"'); |
||||
158 | $buttonTray->addElement($butt_cancel); |
||||
159 | } else { |
||||
160 | // else, we're editing an existing faq |
||||
161 | // $buttonTray -> addElement( new \XoopsFormButton( '', 'mod', _AM_SF_MODIFY, 'submit' ) ); |
||||
162 | $butt_create = new \XoopsFormButton('', '', $button_caption, 'submit'); |
||||
163 | $butt_create->setExtra('onclick="this.form.elements.op.value=\'addfaq\'"'); |
||||
164 | $buttonTray->addElement($butt_create); |
||||
165 | |||||
166 | $butt_edit = new \XoopsFormButton('', '', _AM_SF_OPEN_QUESTION_EDIT, 'button'); |
||||
167 | $butt_edit->setExtra("onclick=\"location='faq.php?op=mod&faqid=" . $faqid . "'\""); |
||||
168 | $buttonTray->addElement($butt_edit); |
||||
169 | |||||
170 | $butt_cancel = new \XoopsFormButton('', '', _AM_SF_CANCEL, 'button'); |
||||
171 | $butt_cancel->setExtra('onclick="history.go(-1)"'); |
||||
172 | $buttonTray->addElement($butt_cancel); |
||||
173 | } |
||||
174 | |||||
175 | $sform->addElement($buttonTray); |
||||
176 | $sform->display(); |
||||
177 | echo '</div>'; |
||||
178 | unset($hidden); |
||||
179 | } |
||||
180 | |||||
181 | /* -- Available operations -- */ |
||||
182 | switch ($op) { |
||||
183 | case 'mod': |
||||
184 | global $xoopsConfig, $xoopsDB, $xoopsModule, $modify, $myts; |
||||
185 | $faqid = $_GET['faqid'] ?? -1; |
||||
186 | |||||
187 | if (-1 == $faqid) { |
||||
188 | $totalcategories = $categoryHandler->getCategoriesCount(-1); |
||||
189 | if (0 == $totalcategories) { |
||||
190 | redirect_header('category.php?op=mod', 3, _AM_SF_NEED_CATEGORY_QUESTION); |
||||
191 | } |
||||
192 | } |
||||
193 | |||||
194 | $adminObject = Admin::getInstance(); |
||||
195 | xoops_cp_header(); |
||||
196 | |||||
197 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
198 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||||
199 | |||||
200 | editfaq(true, $faqid); |
||||
201 | break; |
||||
202 | case 'addfaq': |
||||
203 | if ($xoopsUser) { |
||||
204 | $uid = $xoopsUser->uid(); |
||||
205 | } else { |
||||
206 | if (1 == $helper->getConfig('anonpost')) { |
||||
207 | $uid = 0; |
||||
208 | } else { |
||||
209 | redirect_header('index.php', 3, _NOPERM); |
||||
210 | } |
||||
211 | } |
||||
212 | |||||
213 | $faqid = Request::getInt('faqid', -1, 'POST'); |
||||
214 | |||||
215 | // Creating the FAQ |
||||
216 | if (-1 != $faqid) { |
||||
217 | $faqObj = new Smartfaq\Faq($faqid); |
||||
218 | } else { |
||||
219 | $faqObj = $faqHandler->create(); |
||||
220 | } |
||||
221 | |||||
222 | // Putting the values in the FAQ object |
||||
223 | $faqObj->setGroups_read($_POST['groups'] ?? []); |
||||
224 | $faqObj->setVar('categoryid', Request::getInt('categoryid', 0, 'POST')); |
||||
225 | $faqObj->setVar('question', $_POST['question']); |
||||
226 | $faqObj->setVar('status', Request::getInt('status', Constants::SF_STATUS_ASKED, 'POST')); |
||||
227 | |||||
228 | $notifToDo = null; |
||||
229 | |||||
230 | switch ($faqObj->status()) { |
||||
231 | case Constants::SF_STATUS_NOTSET: |
||||
232 | $redirect_msg = _AM_SF_QUESTIONCREATEDOK; |
||||
233 | // Setting the new status |
||||
234 | $status = Constants::SF_STATUS_OPENED; |
||||
235 | $notifToDo = [Constants::SF_NOT_QUESTION_PUBLISHED]; |
||||
236 | $faqObj->setVar('uid', $uid); |
||||
237 | break; |
||||
238 | case Constants::SF_STATUS_ASKED: |
||||
239 | $redirect_msg = _AM_SF_QUESTIONPUBLISHED; |
||||
240 | // Setting the new status |
||||
241 | $status = Constants::SF_STATUS_OPENED; |
||||
242 | $notifToDo = [Constants::SF_NOT_QUESTION_PUBLISHED]; |
||||
243 | break; |
||||
244 | case 'default': |
||||
245 | default: |
||||
246 | $redirect_msg = _AM_SF_QUESTIONMODIFIED; |
||||
247 | // Setting the new status |
||||
248 | $status = $faqObj->status(); |
||||
249 | break; |
||||
250 | } |
||||
251 | $faqObj->setVar('status', $status); |
||||
252 | |||||
253 | // Storing the FAQ |
||||
254 | if (!$faqObj->store()) { |
||||
255 | redirect_header('<script>javascript:history.go(-1)</script>', 3, _AM_SF_ERROR . Smartfaq\Utility::formatErrors($faqObj->getErrors())); |
||||
256 | } |
||||
257 | |||||
258 | // Send notifications |
||||
259 | if (!empty($notifToDo)) { |
||||
260 | $faqObj->sendNotifications($notifToDo); |
||||
261 | } |
||||
262 | |||||
263 | redirect_header('question.php', 2, $redirect_msg); |
||||
264 | |||||
265 | break; |
||||
266 | case 'del': |
||||
267 | global $xoopsConfig, $xoopsDB; |
||||
268 | |||||
269 | $module_id = $xoopsModule->getVar('mid'); |
||||
270 | /** @var \XoopsGroupPermHandler $grouppermHandler */ |
||||
271 | $grouppermHandler = xoops_getHandler('groupperm'); |
||||
272 | |||||
273 | $faqid = Request::getInt('faqid', 0, 'POST'); |
||||
274 | $faqid = Request::getInt('faqid', $faqid, 'GET'); |
||||
275 | |||||
276 | $faqObj = new Smartfaq\Faq($faqid); |
||||
277 | |||||
278 | $confirm = Request::getInt('confirm', 0, 'POST'); |
||||
279 | $question = Request::getString('question', '', 'POST'); |
||||
280 | |||||
281 | if ($confirm) { |
||||
282 | if (!$faqHandler->delete($faqObj)) { |
||||
283 | redirect_header('question.php', 2, _AM_SF_FAQ_DELETE_ERROR); |
||||
284 | } |
||||
285 | |||||
286 | redirect_header('question.php', 2, sprintf(_AM_SF_QUESTIONISDELETED, $faqObj->question())); |
||||
287 | } else { |
||||
288 | // no confirm: show deletion condition |
||||
289 | $faqid = Request::getInt('faqid', 0, 'GET'); |
||||
290 | xoops_cp_header(); |
||||
291 | xoops_confirm( |
||||
292 | [ |
||||
293 | 'op' => 'del', |
||||
294 | 'faqid' => $faqObj->faqid(), |
||||
295 | 'confirm' => 1, |
||||
296 | 'name' => $faqObj->question(), |
||||
297 | ], |
||||
298 | 'question.php', |
||||
299 | _AM_SF_DELETETHISQUESTION . " <br>'" . $faqObj->question() . "'. <br> <br>", |
||||
300 | _AM_SF_DELETE |
||||
301 | ); |
||||
302 | xoops_cp_footer(); |
||||
303 | } |
||||
304 | |||||
305 | exit(); |
||||
306 | case 'default': |
||||
307 | default: |
||||
308 | $adminObject = Admin::getInstance(); |
||||
309 | xoops_cp_header(); |
||||
310 | $adminObject->displayNavigation(basename(__FILE__)); |
||||
311 | |||||
312 | require_once XOOPS_ROOT_PATH . '/class/xoopsformloader.php'; |
||||
313 | require_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||||
314 | |||||
315 | global $xoopsConfig, $xoopsDB, $xoopsModule; |
||||
316 | |||||
317 | echo "<br>\n"; |
||||
318 | |||||
319 | Smartfaq\Utility::collapsableBar('toptable', 'toptableicon'); |
||||
320 | |||||
321 | echo "<img id='toptableicon' src=" . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . "/assets/images/icon/close12.gif alt=''></a> " . _AM_SF_OPENED_TITLE . '</h3>'; |
||||
322 | echo "<div id='toptable'>"; |
||||
323 | echo '<span style="color: #567; margin: 3px 0 12px 0; font-size: small; display: block; ">' . _AM_SF_OPENED_DSC . '</span>'; |
||||
324 | |||||
325 | // Get the total number of published FAQs |
||||
326 | $totalfaqs = $faqHandler->getFaqsCount(-1, [Constants::SF_STATUS_OPENED]); |
||||
327 | // creating the FAQ objects that are published |
||||
328 | $faqsObj = $faqHandler->getFaqs($helper->getConfig('perpage'), $startfaq, Constants::SF_STATUS_OPENED); |
||||
329 | // $totalFaqsOnPage = count($faqsObj); |
||||
330 | $allCats = $categoryHandler->getObjects(null, true); |
||||
331 | echo "<table width='100%' cellspacing=1 cellpadding=3 border=0 class = outer>"; |
||||
332 | echo '<tr>'; |
||||
333 | echo "<th width='40' class='bg3' align='center'><b>" . _AM_SF_ARTID . '</b></td>'; |
||||
334 | echo "<th width='20%' class='bg3' align='left'><b>" . _AM_SF_ARTCOLNAME . '</b></td>'; |
||||
335 | echo "<th class='bg3' align='left'><b>" . _AM_SF_QUESTION . '</b></td>'; |
||||
336 | |||||
337 | echo "<th width='90' class='bg3' align='center'><b>" . _AM_SF_ASKED . '</b></td>'; |
||||
338 | |||||
339 | echo "<th width='90' class='bg3' align='center'><b>" . _AM_SF_CREATED . '</b></td>'; |
||||
340 | echo "<th width='60' class='bg3' align='center'><b>" . _AM_SF_ACTION . '</b></td>'; |
||||
341 | echo '</tr>'; |
||||
342 | //var_dump( $faqsObj); |
||||
343 | if ($totalfaqs > 0) { |
||||
344 | global $pathIcon16; |
||||
345 | foreach (array_keys($faqsObj) as $i) { |
||||
346 | $categoryObj = $allCats[$faqsObj[$i]->categoryid()]; |
||||
347 | |||||
348 | $modify = "<a href='question.php?op=mod&faqid=" . $faqsObj[$i]->faqid() . "'><img src='" . $pathIcon16 . '/edit.png' . "' title='" . _AM_SF_EDITART . "' alt='" . _AM_SF_EDITART . "'></a>"; |
||||
349 | $delete = "<a href='question.php?op=del&faqid=" . $faqsObj[$i]->faqid() . "'><img src='" . $pathIcon16 . '/delete.png' . "' title='" . _AM_SF_DELETEART . "' alt='" . _AM_SF_DELETEART . "'></a>"; |
||||
350 | |||||
351 | $requester = Smartfaq\Utility::getLinkedUnameFromId($faqsObj[$i]->uid(), $smartModuleConfig['userealname']); |
||||
352 | |||||
353 | echo '<tr>'; |
||||
354 | echo "<td class='head' align='center'>" . $faqsObj[$i]->faqid() . '</td>'; |
||||
355 | echo "<td class='even' align='left'>" . $categoryObj->name() . '</td>'; |
||||
356 | echo "<td class='even' align='left'><a href='" . XOOPS_URL . '/modules/' . $xoopsModule->dirname() . '/answer.php?faqid=' . $faqsObj[$i]->faqid() . "'>" . $faqsObj[$i]->question(100) . '</a></td>'; |
||||
357 | |||||
358 | echo "<td class='even' align='center'>" . $requester . '</td>'; |
||||
359 | |||||
360 | echo "<td class='even' align='center'>" . $faqsObj[$i]->datesub('s') . '</td>'; |
||||
361 | echo "<td class='even' align='center'> $modify $delete </td>"; |
||||
362 | echo '</tr>'; |
||||
363 | } |
||||
364 | } else { |
||||
365 | $faqid = -1; |
||||
366 | echo '<tr>'; |
||||
367 | echo "<td class='head' align='center' colspan= '7'>" . _AM_SF_NOQUEUED . '</td>'; |
||||
368 | echo '</tr>'; |
||||
369 | } |
||||
370 | echo "</table>\n"; |
||||
371 | echo "<br>\n"; |
||||
372 | |||||
373 | $pagenav = new \XoopsPageNav($totalfaqs, $helper->getConfig('perpage'), $startfaq, 'startfaq'); |
||||
374 | echo '<div style="text-align:right;">' . $pagenav->renderNav() . '</div>'; |
||||
375 | echo '</div>'; |
||||
376 | |||||
377 | $totalcategories = $categoryHandler->getCategoriesCount(-1); |
||||
378 | if ($totalcategories > 0) { |
||||
379 | editfaq(); |
||||
380 | } |
||||
381 | |||||
382 | break; |
||||
383 | } |
||||
384 | |||||
385 | require_once __DIR__ . '/admin_footer.php'; |
||||
386 |
This check looks for parameters that have been defined for a function or method, but which are not used in the method body.