This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php declare(strict_types=1); |
||
2 | /* |
||
3 | * You may not change or alter any portion of this comment or credits |
||
4 | * of supporting developers from this source code or any supporting source code |
||
5 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
6 | * |
||
7 | * This program is distributed in the hope that it will be useful, |
||
8 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
9 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
10 | */ |
||
11 | |||
12 | /** |
||
13 | * @copyright {@link https://xoops.org/ XOOPS Project} |
||
14 | * @license {@link https://www.gnu.org/licenses/gpl-2.0.html GNU GPL 2 or later} |
||
15 | * @author XOOPS Development Team, phppp (D.J., [email protected]) |
||
16 | */ |
||
17 | |||
18 | use XoopsModules\Smartfaq; |
||
19 | |||
20 | if (!defined('NEWBB_FUNCTIONS_IMAGE')) : |
||
21 | define('NEWBB_FUNCTIONS_IMAGE', true); |
||
22 | |||
23 | /** |
||
24 | * @param $source |
||
25 | * @return string |
||
26 | */ |
||
27 | function sf_attachmentImage($source) |
||
28 | { |
||
29 | /** @var Smartfaq\Helper $helper */ |
||
30 | $helper = Smartfaq\Helper::getInstance(); |
||
31 | |||
32 | $img_path = XOOPS_ROOT_PATH . '/' . $helper->getConfig('dir_attachments'); |
||
33 | $img_url = XOOPS_URL . '/' . $helper->getConfig('dir_attachments'); |
||
34 | $thumb_path = $img_path . '/thumbs'; |
||
35 | $thumb_url = $img_url . '/thumbs'; |
||
36 | |||
37 | $thumb = $thumb_path . '/' . $source; |
||
38 | $image = $img_path . '/' . $source; |
||
39 | $thumb_url = $thumb_url . '/' . $source; |
||
40 | $image_url = $img_url . '/' . $source; |
||
41 | |||
42 | $imginfo = @getimagesize($image); |
||
43 | $img_info = (count($imginfo) > 0) ? $imginfo[0] . 'X' . $imginfo[1] . ' px' : ''; |
||
44 | |||
45 | if ($helper->getConfig('max_image_width') > 0 && $helper->getConfig('max_image_height') > 0) { |
||
46 | if ($imginfo[0] > $helper->getConfig('max_image_width') |
||
47 | || $imginfo[1] > $helper->getConfig('max_image_height')) { |
||
48 | //if (!file_exists($thumb_path.'/'.$source) && $imginfo[0] > $helper->getConfig('max_img_width')) { |
||
49 | if (!file_exists($thumb_path . '/' . $source)) { |
||
50 | sf_createThumbnail($source, $helper->getConfig('max_image_width')); |
||
51 | } |
||
52 | } |
||
53 | |||
54 | if ($imginfo[0] > $helper->getConfig('max_image_width') |
||
55 | || $imginfo[1] > $helper->getConfig('max_image_height')) { |
||
56 | $pseudo_width = $helper->getConfig('max_image_width'); |
||
57 | $pseudo_height = $helper->getConfig('max_image_width') * ($imginfo[1] / $imginfo[0]); |
||
58 | $pseudo_size = "width='" . $pseudo_width . "px' height='" . $pseudo_height . "px'"; |
||
59 | } |
||
60 | // irmtfan to fix Undefined variable: pseudo_height |
||
61 | if (!empty($pseudo_height) && $helper->getConfig('max_image_height') > 0 |
||
62 | && $pseudo_height > $helper->getConfig('max_image_height')) { |
||
63 | $pseudo_height = $helper->getConfig('max_image_height'); |
||
64 | $pseudo_width = $helper->getConfig('max_image_height') * ($imginfo[0] / $imginfo[1]); |
||
65 | $pseudo_size = "width='" . $pseudo_width . "px' height='" . $pseudo_height . "px'"; |
||
66 | } |
||
67 | } |
||
68 | |||
69 | if (file_exists($thumb)) { |
||
70 | $attachmentImage = '<a href="' . $image_url . '" title="' . $source . ' ' . $img_info . '" target="_blank">'; |
||
71 | $attachmentImage .= '<img src="' . $thumb_url . '" alt="' . $source . ' ' . $img_info . '">'; |
||
72 | $attachmentImage .= '</a>'; |
||
73 | } elseif (!empty($pseudo_size)) { |
||
74 | $attachmentImage = '<a href="' . $image_url . '" title="' . $source . ' ' . $img_info . '" target="_blank">'; |
||
75 | $attachmentImage .= '<img src="' . $image_url . '" ' . $pseudo_size . ' alt="' . $source . ' ' . $img_info . '">'; |
||
76 | $attachmentImage .= '</a>'; |
||
77 | } elseif (file_exists($image)) { |
||
78 | $attachmentImage = '<img src="' . $image_url . '" alt="' . $source . ' ' . $img_info . '">'; |
||
79 | } else { |
||
80 | $attachmentImage = ''; |
||
81 | } |
||
82 | |||
83 | return $attachmentImage; |
||
84 | } |
||
85 | |||
86 | /** |
||
87 | * @param $source |
||
88 | * @param $thumb_width |
||
89 | * @return bool |
||
90 | */ |
||
91 | function sf_createThumbnail($source, $thumb_width) |
||
92 | { |
||
93 | /** @var Smartfaq\Helper $helper */ |
||
94 | $helper = Smartfaq\Helper::getInstance(); |
||
95 | |||
96 | $img_path = XOOPS_ROOT_PATH . '/' . $helper->getConfig('dir_attachments'); |
||
97 | $thumb_path = $img_path . '/thumbs'; |
||
98 | $src_file = $img_path . '/' . $source; |
||
99 | $new_file = $thumb_path . '/' . $source; |
||
100 | //$imageLibs = sf_getImageLibs(); |
||
101 | |||
102 | if (!filesize($src_file) || !is_readable($src_file)) { |
||
103 | return false; |
||
104 | } |
||
105 | |||
106 | if (!is_dir($thumb_path) || !is_writable($thumb_path)) { |
||
107 | return false; |
||
108 | } |
||
109 | |||
110 | $imginfo = @getimagesize($src_file); |
||
111 | |||
112 | if (null === $imginfo) { |
||
113 | return false; |
||
114 | } |
||
115 | if ($imginfo[0] < $thumb_width) { |
||
116 | return false; |
||
117 | } |
||
118 | |||
119 | $newWidth = (int)min($imginfo[0], $thumb_width); |
||
120 | $newHeight = (int)($imginfo[1] * $newWidth / $imginfo[0]); |
||
121 | |||
122 | if (1 == $helper->getConfig('image_lib') || 0 == $helper->getConfig('image_lib')) { |
||
123 | if (preg_match('#[A-Z]:|\\\\#Ai', __FILE__)) { |
||
124 | $cur_dir = __DIR__; |
||
125 | $src_file_im = '"' . $cur_dir . '\\' . str_replace('/', '\\', $src_file) . '"'; |
||
126 | $new_file_im = '"' . $cur_dir . '\\' . str_replace('/', '\\', $new_file) . '"'; |
||
127 | } else { |
||
128 | $src_file_im = @escapeshellarg($src_file); |
||
129 | $new_file_im = @escapeshellarg($new_file); |
||
130 | } |
||
131 | $path = empty($helper->getConfig('path_magick')) ? '' : $helper->getConfig('path_magick') . '/'; |
||
132 | $magick_command = $path . 'convert -auto-orient -quality 85 -antialias -sample ' . $newWidth . 'x' . $newHeight . ' ' . $src_file_im . ' +profile "*" ' . str_replace('\\', '/', $new_file_im); |
||
133 | |||
134 | @passthru($magick_command); |
||
135 | if (file_exists($new_file)) { |
||
136 | return true; |
||
137 | } |
||
138 | } |
||
139 | |||
140 | if (2 == $helper->getConfig('image_lib') || 0 == $helper->getConfig('image_lib')) { |
||
141 | $path = empty($helper->getConfig('path_netpbm')) ? '' : $helper->getConfig('path_netpbm') . '/'; |
||
142 | if (preg_match('/\.png$/i', $source)) { |
||
143 | $cmd = $path . "pngtopnm $src_file | " . $path . "pnmscale -xysize $newWidth $newHeight | " . $path . "pnmtopng > $new_file"; |
||
144 | } elseif (preg_match('/\.(jpg|jpeg)$/i', $source)) { |
||
145 | $cmd = $path . "jpegtopnm $src_file | " . $path . "pnmscale -xysize $newWidth $newHeight | " . $path . "ppmtojpeg -quality=90 > $new_file"; |
||
146 | } elseif (preg_match('/\.gif$/i', $source)) { |
||
147 | $cmd = $path . "giftopnm $src_file | " . $path . "pnmscale -xysize $newWidth $newHeight | ppmquant 256 | " . $path . "ppmtogif > $new_file"; |
||
148 | } |
||
149 | |||
150 | @exec($cmd, $output, $retval); |
||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
![]() |
|||
151 | if (file_exists($new_file)) { |
||
152 | return true; |
||
153 | } |
||
154 | } |
||
155 | |||
156 | $type = $imginfo[2]; |
||
157 | $supported_types = []; |
||
158 | |||
159 | if (!extension_loaded('gd')) { |
||
160 | return false; |
||
161 | } |
||
162 | if (function_exists('imagegif')) { |
||
163 | $supported_types[] = 1; |
||
164 | } |
||
165 | if (function_exists('imagejpeg')) { |
||
166 | $supported_types[] = 2; |
||
167 | } |
||
168 | if (function_exists('imagepng')) { |
||
169 | $supported_types[] = 3; |
||
170 | } |
||
171 | |||
172 | $imageCreateFunction = function_exists('imagecreatetruecolor') ? 'imagecreatetruecolor' : 'imagecreate'; |
||
173 | |||
174 | if (in_array($type, $supported_types, true)) { |
||
175 | switch ($type) { |
||
176 | case 1: |
||
177 | if (!function_exists('imagecreatefromgif')) { |
||
178 | return false; |
||
179 | } |
||
180 | $im = imagecreatefromgif($src_file); |
||
181 | $new_im = imagecreate($newWidth, $newHeight); |
||
182 | imagecopyresized($new_im, $im, 0, 0, 0, 0, $newWidth, $newHeight, $imginfo[0], $imginfo[1]); |
||
183 | imagegif($new_im, $new_file); |
||
184 | imagedestroy($im); |
||
185 | imagedestroy($new_im); |
||
186 | break; |
||
187 | case 2: |
||
188 | $im = imagecreatefromjpeg($src_file); |
||
189 | $new_im = $imageCreateFunction($newWidth, $newHeight); |
||
190 | imagecopyresized($new_im, $im, 0, 0, 0, 0, $newWidth, $newHeight, $imginfo[0], $imginfo[1]); |
||
191 | imagejpeg($new_im, $new_file, 90); |
||
192 | imagedestroy($im); |
||
193 | imagedestroy($new_im); |
||
194 | break; |
||
195 | case 3: |
||
196 | $im = imagecreatefrompng($src_file); |
||
197 | $new_im = $imageCreateFunction($newWidth, $newHeight); |
||
198 | imagecopyresized($new_im, $im, 0, 0, 0, 0, $newWidth, $newHeight, $imginfo[0], $imginfo[1]); |
||
199 | imagepng($new_im, $new_file); |
||
200 | imagedestroy($im); |
||
201 | imagedestroy($new_im); |
||
202 | break; |
||
203 | } |
||
204 | } |
||
205 | |||
206 | if (file_exists($new_file)) { |
||
207 | return true; |
||
208 | } |
||
209 | |||
210 | return false; |
||
211 | } |
||
212 | |||
213 | endif; |
||
214 |