This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php namespace XoopsModules\Smartobject; |
||
2 | |||
3 | /* |
||
4 | * You may not change or alter any portion of this comment or credits |
||
5 | * of supporting developers from this source code or any supporting source code |
||
6 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
7 | * |
||
8 | * This program is distributed in the hope that it will be useful, |
||
9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
11 | */ |
||
12 | |||
13 | /** |
||
14 | * @copyright XOOPS Project https://xoops.org/ |
||
15 | * @license GNU GPL 2 or later (http://www.gnu.org/licenses/gpl-2.0.html) |
||
16 | * @package |
||
17 | * @since |
||
18 | * @author XOOPS Development Team |
||
19 | */ |
||
20 | |||
21 | use XoopsModules\Smartobject; |
||
22 | |||
23 | // defined('XOOPS_ROOT_PATH') || die('Restricted access'); |
||
24 | require_once XOOPS_ROOT_PATH . '/kernel/user.php'; |
||
25 | require_once XOOPS_ROOT_PATH . '/kernel/group.php'; |
||
26 | require_once XOOPS_ROOT_PATH . '/kernel/member.php'; |
||
27 | |||
28 | /** |
||
29 | * XOOPS member handler class. |
||
30 | * This class provides simple interface (a facade class) for handling groups/users/ |
||
31 | * membership data. |
||
32 | * |
||
33 | * |
||
34 | * @author Kazumi Ono <[email protected]> |
||
35 | * @copyright copyright (c) 2000-2003 XOOPS.org |
||
36 | * @package kernel |
||
37 | */ |
||
38 | class MemberHandler extends \XoopsMemberHandler |
||
39 | { |
||
40 | /** |
||
41 | * constructor |
||
42 | * @param \XoopsDatabase $db |
||
43 | */ |
||
44 | public function __construct(\XoopsDatabase $db) |
||
45 | { |
||
46 | parent::__construct($db); |
||
47 | $this->_uHandler = Smartobject\Helper::getInstance()->getHandler('User'); |
||
48 | } |
||
49 | |||
50 | /** |
||
51 | * @param $userObj |
||
52 | * @param bool $groups |
||
53 | * @param bool $notifyUser |
||
54 | * @param bool $password |
||
55 | * @return bool |
||
56 | */ |
||
57 | public function addAndActivateUser($userObj, $groups = false, $notifyUser = true, &$password = false) |
||
58 | { |
||
59 | $email = $userObj->getVar('email'); |
||
60 | if (!$userObj->getVar('email') || '' === $email) { |
||
61 | $userObj->setErrors(_CO_SOBJECT_USER_NEED_EMAIL); |
||
62 | |||
63 | return false; |
||
64 | } |
||
65 | |||
66 | $password = $userObj->getVar('pass'); |
||
67 | // randomly generating the password if not already set |
||
68 | if ('' === $password) { |
||
69 | $password = substr(md5(uniqid(mt_rand(), 1)), 0, 6); |
||
70 | } |
||
71 | $userObj->setVar('pass', md5($password)); |
||
72 | |||
73 | // if no username is set, let's generate one |
||
74 | $unamecount = 20; |
||
75 | $uname = $userObj->getVar('uname'); |
||
76 | if (!$uname || '' === $uname) { |
||
77 | $usernames = $this->genUserNames($email, $unamecount); |
||
78 | $newuser = false; |
||
79 | $i = 0; |
||
80 | while (false === $newuser) { |
||
81 | $crit = new \Criteria('uname', $usernames[$i]); |
||
82 | $count = $this->getUserCount($crit); |
||
83 | if (0 == $count) { |
||
84 | $newuser = true; |
||
85 | } else { |
||
86 | //Move to next username |
||
87 | ++$i; |
||
88 | if ($i == $unamecount) { |
||
89 | //Get next batch of usernames to try, reset counter |
||
90 | $usernames = $this->genUserNames($email, $unamecount); |
||
91 | $i = 0; |
||
92 | } |
||
93 | } |
||
94 | } |
||
95 | } |
||
96 | |||
97 | global $xoopsConfig; |
||
98 | |||
99 | $configHandler = xoops_getHandler('config'); |
||
100 | $xoopsConfigUser = $configHandler->getConfigsByCat(XOOPS_CONF_USER); |
||
101 | switch ($xoopsConfigUser['activation_type']) { |
||
102 | case 0: |
||
103 | $level = 0; |
||
0 ignored issues
–
show
|
|||
104 | $mailtemplate = 'smartmail_activate_user.tpl'; |
||
0 ignored issues
–
show
$mailtemplate is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
105 | $aInfoMessages[] = sprintf(_NL_MA_NEW_USER_NEED_ACT, $user_email); |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$aInfoMessages was never initialized. Although not strictly required by PHP, it is generally a good practice to add $aInfoMessages = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
106 | break; |
||
107 | case 1: |
||
108 | $level = 1; |
||
0 ignored issues
–
show
$level is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
109 | $mailtemplate = 'smartmail_auto_activate_user.tpl'; |
||
0 ignored issues
–
show
$mailtemplate is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
110 | $aInfoMessages[] = sprintf(_NL_MA_NEW_USER_AUTO_ACT, $user_email); |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$aInfoMessages was never initialized. Although not strictly required by PHP, it is generally a good practice to add $aInfoMessages = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
111 | break; |
||
112 | case 2: |
||
113 | default: |
||
114 | $level = 0; |
||
0 ignored issues
–
show
$level is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
115 | $mailtemplate = 'smartmail_admin_activate_user.tpl'; |
||
0 ignored issues
–
show
$mailtemplate is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
116 | $aInfoMessages[] = sprintf(_NL_MA_NEW_USER_ADMIN_ACT, $user_email); |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$aInfoMessages was never initialized. Although not strictly required by PHP, it is generally a good practice to add $aInfoMessages = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
117 | } |
||
118 | |||
119 | $userObj->setVar('uname', $usernames[$i]); |
||
0 ignored issues
–
show
The variable
$usernames does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() The variable
$i does not seem to be defined for all execution paths leading up to this point.
If you define a variable conditionally, it can happen that it is not defined for all execution paths. Let’s take a look at an example: function myFunction($a) {
switch ($a) {
case 'foo':
$x = 1;
break;
case 'bar':
$x = 2;
break;
}
// $x is potentially undefined here.
echo $x;
}
In the above example, the variable $x is defined if you pass “foo” or “bar” as argument for $a. However, since the switch statement has no default case statement, if you pass any other value, the variable $x would be undefined. Available Fixes
![]() |
|||
120 | $userObj->setVar('user_avatar', 'blank.gif'); |
||
121 | $userObj->setVar('user_regdate', time()); |
||
122 | $userObj->setVar('timezone_offset', $xoopsConfig['default_TZ']); |
||
123 | $actkey = substr(md5(uniqid(mt_rand(), 1)), 0, 8); |
||
124 | $userObj->setVar('actkey', $actkey); |
||
125 | $userObj->setVar('email', $email); |
||
126 | $userObj->setVar('notify_method', 2); |
||
127 | $userObj->setVar('level', $userObj); |
||
128 | |||
129 | if ($this->insertUser($userObj)) { |
||
130 | |||
131 | // if $groups=false, Add the user to Registered Users group |
||
132 | if (!$groups) { |
||
133 | $this->addUserToGroup(XOOPS_GROUP_USERS, $userObj->getVar('uid')); |
||
134 | } else { |
||
135 | foreach ($groups as $groupid) { |
||
0 ignored issues
–
show
|
|||
136 | $this->addUserToGroup($groupid, $userObj->getVar('uid')); |
||
137 | } |
||
138 | } |
||
139 | } else { |
||
140 | return false; |
||
141 | } |
||
142 | |||
143 | if ($notifyUser) { |
||
144 | // send some notifications |
||
145 | $xoopsMailer = xoops_getMailer(); |
||
146 | $xoopsMailer->useMail(); |
||
147 | $xoopsMailer->setTemplateDir(SMARTOBJECT_ROOT_PATH . 'language/' . $xoopsConfig['language'] . '/mail_template'); |
||
148 | $xoopsMailer->setTemplate('smartobject_notify_user_added_by_admin.tpl'); |
||
149 | $xoopsMailer->assign('XOOPS_USER_PASSWORD', $password); |
||
150 | $xoopsMailer->assign('SITENAME', $xoopsConfig['sitename']); |
||
151 | $xoopsMailer->assign('ADMINMAIL', $xoopsConfig['adminmail']); |
||
152 | $xoopsMailer->assign('SITEURL', XOOPS_URL . '/'); |
||
153 | $xoopsMailer->assign('NAME', $userObj->getVar('name')); |
||
154 | $xoopsMailer->assign('UNAME', $userObj->getVar('uname')); |
||
155 | $xoopsMailer->setToUsers($userObj); |
||
156 | $xoopsMailer->setFromEmail($xoopsConfig['adminmail']); |
||
157 | $xoopsMailer->setFromName($xoopsConfig['sitename']); |
||
158 | $xoopsMailer->setSubject(sprintf(_CO_SOBJECT_NEW_USER_NOTIFICATION_SUBJECT, $xoopsConfig['sitename'])); |
||
159 | |||
160 | if (!$xoopsMailer->send(true)) { |
||
161 | /** |
||
162 | * @todo trap error if email was not sent |
||
163 | */ |
||
164 | $xoopsMailer->getErrors(true); |
||
165 | } |
||
166 | } |
||
167 | |||
168 | return true; |
||
169 | } |
||
170 | |||
171 | /** |
||
172 | * Generates an array of usernames |
||
173 | * |
||
174 | * @param string $email email of user |
||
175 | * @param int $count number of names to generate |
||
176 | * @return array $names |
||
177 | * @internal param string $name name of user |
||
178 | * @author xHelp Team |
||
179 | * |
||
180 | * @access public |
||
181 | */ |
||
182 | public function genUserNames($email, $count = 20) |
||
183 | { |
||
184 | $name = substr($email, 0, strpos($email, '@')); //Take the email adress without domain as username |
||
185 | |||
186 | $names = []; |
||
187 | $userid = explode('@', $email); |
||
188 | |||
189 | $basename = ''; |
||
190 | $hasbasename = false; |
||
191 | $emailname = $userid[0]; |
||
192 | |||
193 | $names[] = $emailname; |
||
194 | |||
195 | if (strlen($name) > 0) { |
||
196 | $name = explode(' ', trim($name)); |
||
197 | if (count($name) > 1) { |
||
198 | $basename = strtolower(substr($name[0], 0, 1) . $name[count($name) - 1]); |
||
199 | } else { |
||
200 | $basename = strtolower($name[0]); |
||
201 | } |
||
202 | $basename = xoops_substr($basename, 0, 60, ''); |
||
203 | //Prevent Duplication of Email Username and Name |
||
204 | if (!in_array($basename, $names)) { |
||
205 | $names[] = $basename; |
||
206 | $hasbasename = true; |
||
207 | } |
||
208 | } |
||
209 | |||
210 | $i = count($names); |
||
211 | $onbasename = 1; |
||
212 | while ($i < $count) { |
||
213 | $num = $this->genRandNumber(); |
||
214 | if ($onbasename < 0 && $hasbasename) { |
||
215 | $names[] = xoops_substr($basename, 0, 58, '') . $num; |
||
216 | } else { |
||
217 | $names[] = xoops_substr($emailname, 0, 58, '') . $num; |
||
218 | } |
||
219 | $i = count($names); |
||
220 | $onbasename = ~$onbasename; |
||
221 | $num = ''; |
||
0 ignored issues
–
show
$num is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
222 | } |
||
223 | |||
224 | return $names; |
||
225 | } |
||
226 | |||
227 | /** |
||
228 | * Creates a random number with a specified number of $digits |
||
229 | * |
||
230 | * @param int $digits number of digits |
||
231 | * @return int random number |
||
232 | * @author xHelp Team |
||
233 | * |
||
234 | * @access public |
||
235 | */ |
||
236 | public function genRandNumber($digits = 2) |
||
237 | { |
||
238 | $this->initRand(); |
||
239 | $tmp = []; |
||
240 | |||
241 | for ($i = 0; $i < $digits; ++$i) { |
||
242 | $tmp[$i] = (mt_rand() % 9); |
||
243 | } |
||
244 | |||
245 | return implode('', $tmp); |
||
246 | } |
||
247 | |||
248 | /** |
||
249 | * Gives the random number generator a seed to start from |
||
250 | * |
||
251 | * @return void |
||
252 | * |
||
253 | * @access public |
||
254 | */ |
||
255 | public function initRand() |
||
256 | { |
||
257 | static $randCalled = false; |
||
258 | if (!$randCalled) { |
||
259 | mt_srand((double)microtime() * 1000000); |
||
260 | $randCalled = true; |
||
261 | } |
||
262 | } |
||
263 | } |
||
264 |
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.
Both the
$myVar
assignment in line 1 and the$higher
assignment in line 2 are dead. The first because$myVar
is never used and the second because$higher
is always overwritten for every possible time line.