This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php namespace XoopsModules\Smartobject; |
||
2 | |||
3 | /* |
||
4 | * You may not change or alter any portion of this comment or credits |
||
5 | * of supporting developers from this source code or any supporting source code |
||
6 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||
7 | * |
||
8 | * This program is distributed in the hope that it will be useful, |
||
9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||
11 | */ |
||
12 | |||
13 | /** |
||
14 | * @copyright XOOPS Project https://xoops.org/ |
||
15 | * @license GNU GPL 2 or later (http://www.gnu.org/licenses/gpl-2.0.html) |
||
16 | * @package |
||
17 | * @since |
||
18 | * @author XOOPS Development Team |
||
19 | */ |
||
20 | |||
21 | use XoopsModules\Smartobject; |
||
22 | |||
23 | // defined('XOOPS_ROOT_PATH') || die('Restricted access'); |
||
24 | require_once XOOPS_ROOT_PATH . '/kernel/user.php'; |
||
25 | require_once XOOPS_ROOT_PATH . '/kernel/group.php'; |
||
26 | require_once XOOPS_ROOT_PATH . '/kernel/member.php'; |
||
27 | |||
28 | /** |
||
29 | * XOOPS member handler class. |
||
30 | * This class provides simple interface (a facade class) for handling groups/users/ |
||
31 | * membership data. |
||
32 | * |
||
33 | * |
||
34 | * @author Kazumi Ono <[email protected]> |
||
35 | * @copyright copyright (c) 2000-2003 XOOPS.org |
||
36 | * @package kernel |
||
37 | */ |
||
38 | class MemberHandler extends \XoopsMemberHandler |
||
39 | { |
||
40 | /** |
||
41 | * constructor |
||
42 | * @param \XoopsDatabase $db |
||
43 | */ |
||
44 | public function __construct(\XoopsDatabase $db) |
||
45 | { |
||
46 | parent::__construct($db); |
||
47 | $this->_uHandler = Smartobject\Helper::getInstance()->getHandler('User'); |
||
48 | } |
||
49 | |||
50 | /** |
||
51 | * @param $userObj |
||
52 | * @param bool $groups |
||
53 | * @param bool $notifyUser |
||
54 | * @param bool $password |
||
55 | * @return bool |
||
56 | */ |
||
57 | public function addAndActivateUser($userObj, $groups = false, $notifyUser = true, &$password = false) |
||
58 | { |
||
59 | $email = $userObj->getVar('email'); |
||
60 | if (!$userObj->getVar('email') || '' === $email) { |
||
61 | $userObj->setErrors(_CO_SOBJECT_USER_NEED_EMAIL); |
||
62 | |||
63 | return false; |
||
64 | } |
||
65 | |||
66 | $password = $userObj->getVar('pass'); |
||
67 | // randomly generating the password if not already set |
||
68 | if ('' === $password) { |
||
69 | $password = substr(md5(uniqid(mt_rand(), 1)), 0, 6); |
||
70 | } |
||
71 | $userObj->setVar('pass', md5($password)); |
||
72 | |||
73 | // if no username is set, let's generate one |
||
74 | $unamecount = 20; |
||
75 | $uname = $userObj->getVar('uname'); |
||
76 | if (!$uname || '' === $uname) { |
||
77 | $usernames = $this->genUserNames($email, $unamecount); |
||
78 | $newuser = false; |
||
79 | $i = 0; |
||
80 | while (false === $newuser) { |
||
81 | $crit = new \Criteria('uname', $usernames[$i]); |
||
82 | $count = $this->getUserCount($crit); |
||
83 | if (0 == $count) { |
||
84 | $newuser = true; |
||
85 | } else { |
||
86 | //Move to next username |
||
87 | ++$i; |
||
88 | if ($i == $unamecount) { |
||
89 | //Get next batch of usernames to try, reset counter |
||
90 | $usernames = $this->genUserNames($email, $unamecount); |
||
91 | $i = 0; |
||
92 | } |
||
93 | } |
||
94 | } |
||
95 | } |
||
96 | |||
97 | global $xoopsConfig; |
||
98 | |||
99 | $configHandler = xoops_getHandler('config'); |
||
100 | $xoopsConfigUser = $configHandler->getConfigsByCat(XOOPS_CONF_USER); |
||
101 | switch ($xoopsConfigUser['activation_type']) { |
||
102 | case 0: |
||
103 | $level = 0; |
||
104 | $mailtemplate = 'smartmail_activate_user.tpl'; |
||
105 | $aInfoMessages[] = sprintf(_NL_MA_NEW_USER_NEED_ACT, $user_email); |
||
0 ignored issues
–
show
|
|||
106 | break; |
||
107 | case 1: |
||
108 | $level = 1; |
||
109 | $mailtemplate = 'smartmail_auto_activate_user.tpl'; |
||
110 | $aInfoMessages[] = sprintf(_NL_MA_NEW_USER_AUTO_ACT, $user_email); |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$aInfoMessages was never initialized. Although not strictly required by PHP, it is generally a good practice to add $aInfoMessages = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
111 | break; |
||
112 | case 2: |
||
113 | default: |
||
114 | $level = 0; |
||
115 | $mailtemplate = 'smartmail_admin_activate_user.tpl'; |
||
116 | $aInfoMessages[] = sprintf(_NL_MA_NEW_USER_ADMIN_ACT, $user_email); |
||
0 ignored issues
–
show
Coding Style
Comprehensibility
introduced
by
$aInfoMessages was never initialized. Although not strictly required by PHP, it is generally a good practice to add $aInfoMessages = array(); before regardless.
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) {
$myArray['foo'] = $item->getFoo();
if ($item->hasBar()) {
$myArray['bar'] = $item->getBar();
}
// do something with $myArray
}
As you can see in this example, the array This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop. ![]() |
|||
117 | } |
||
118 | |||
119 | $userObj->setVar('uname', $usernames[$i]); |
||
120 | $userObj->setVar('user_avatar', 'blank.gif'); |
||
121 | $userObj->setVar('user_regdate', time()); |
||
122 | $userObj->setVar('timezone_offset', $xoopsConfig['default_TZ']); |
||
123 | $actkey = substr(md5(uniqid(mt_rand(), 1)), 0, 8); |
||
124 | $userObj->setVar('actkey', $actkey); |
||
125 | $userObj->setVar('email', $email); |
||
126 | $userObj->setVar('notify_method', 2); |
||
127 | $userObj->setVar('level', $userObj); |
||
128 | |||
129 | if ($this->insertUser($userObj)) { |
||
130 | |||
131 | // if $groups=false, Add the user to Registered Users group |
||
132 | if (!$groups) { |
||
133 | $this->addUserToGroup(XOOPS_GROUP_USERS, $userObj->getVar('uid')); |
||
134 | } else { |
||
135 | foreach ($groups as $groupid) { |
||
136 | $this->addUserToGroup($groupid, $userObj->getVar('uid')); |
||
137 | } |
||
138 | } |
||
139 | } else { |
||
140 | return false; |
||
141 | } |
||
142 | |||
143 | if ($notifyUser) { |
||
144 | // send some notifications |
||
145 | $xoopsMailer = xoops_getMailer(); |
||
146 | $xoopsMailer->useMail(); |
||
147 | $xoopsMailer->setTemplateDir(SMARTOBJECT_ROOT_PATH . 'language/' . $xoopsConfig['language'] . '/mail_template'); |
||
148 | $xoopsMailer->setTemplate('smartobject_notify_user_added_by_admin.tpl'); |
||
149 | $xoopsMailer->assign('XOOPS_USER_PASSWORD', $password); |
||
150 | $xoopsMailer->assign('SITENAME', $xoopsConfig['sitename']); |
||
151 | $xoopsMailer->assign('ADMINMAIL', $xoopsConfig['adminmail']); |
||
152 | $xoopsMailer->assign('SITEURL', XOOPS_URL . '/'); |
||
153 | $xoopsMailer->assign('NAME', $userObj->getVar('name')); |
||
154 | $xoopsMailer->assign('UNAME', $userObj->getVar('uname')); |
||
155 | $xoopsMailer->setToUsers($userObj); |
||
156 | $xoopsMailer->setFromEmail($xoopsConfig['adminmail']); |
||
157 | $xoopsMailer->setFromName($xoopsConfig['sitename']); |
||
158 | $xoopsMailer->setSubject(sprintf(_CO_SOBJECT_NEW_USER_NOTIFICATION_SUBJECT, $xoopsConfig['sitename'])); |
||
159 | |||
160 | if (!$xoopsMailer->send(true)) { |
||
161 | /** |
||
162 | * @todo trap error if email was not sent |
||
163 | */ |
||
164 | $xoopsMailer->getErrors(true); |
||
165 | } |
||
166 | } |
||
167 | |||
168 | return true; |
||
169 | } |
||
170 | |||
171 | /** |
||
172 | * Generates an array of usernames |
||
173 | * |
||
174 | * @param string $email email of user |
||
175 | * @param int $count number of names to generate |
||
176 | * @return array $names |
||
177 | * @internal param string $name name of user |
||
178 | * @author xHelp Team |
||
179 | * |
||
180 | * @access public |
||
181 | */ |
||
182 | public function genUserNames($email, $count = 20) |
||
183 | { |
||
184 | $name = substr($email, 0, strpos($email, '@')); //Take the email adress without domain as username |
||
185 | |||
186 | $names = []; |
||
187 | $userid = explode('@', $email); |
||
188 | |||
189 | $basename = ''; |
||
190 | $hasbasename = false; |
||
191 | $emailname = $userid[0]; |
||
192 | |||
193 | $names[] = $emailname; |
||
194 | |||
195 | if (strlen($name) > 0) { |
||
196 | $name = explode(' ', trim($name)); |
||
197 | if (count($name) > 1) { |
||
198 | $basename = strtolower(substr($name[0], 0, 1) . $name[count($name) - 1]); |
||
199 | } else { |
||
200 | $basename = strtolower($name[0]); |
||
201 | } |
||
202 | $basename = xoops_substr($basename, 0, 60, ''); |
||
203 | //Prevent Duplication of Email Username and Name |
||
204 | if (!in_array($basename, $names)) { |
||
205 | $names[] = $basename; |
||
206 | $hasbasename = true; |
||
207 | } |
||
208 | } |
||
209 | |||
210 | $i = count($names); |
||
211 | $onbasename = 1; |
||
212 | while ($i < $count) { |
||
213 | $num = $this->genRandNumber(); |
||
214 | if ($onbasename < 0 && $hasbasename) { |
||
215 | $names[] = xoops_substr($basename, 0, 58, '') . $num; |
||
216 | } else { |
||
217 | $names[] = xoops_substr($emailname, 0, 58, '') . $num; |
||
218 | } |
||
219 | $i = count($names); |
||
220 | $onbasename = ~$onbasename; |
||
221 | $num = ''; |
||
222 | } |
||
223 | |||
224 | return $names; |
||
225 | } |
||
226 | |||
227 | /** |
||
228 | * Creates a random number with a specified number of $digits |
||
229 | * |
||
230 | * @param int $digits number of digits |
||
231 | * @return int random number |
||
232 | * @author xHelp Team |
||
233 | * |
||
234 | * @access public |
||
235 | */ |
||
236 | public function genRandNumber($digits = 2) |
||
237 | { |
||
238 | $this->initRand(); |
||
239 | $tmp = []; |
||
240 | |||
241 | for ($i = 0; $i < $digits; ++$i) { |
||
242 | $tmp[$i] = (mt_rand() % 9); |
||
243 | } |
||
244 | |||
245 | return implode('', $tmp); |
||
246 | } |
||
247 | |||
248 | /** |
||
249 | * Gives the random number generator a seed to start from |
||
250 | * |
||
251 | * @return void |
||
252 | * |
||
253 | * @access public |
||
254 | */ |
||
255 | public function initRand() |
||
256 | { |
||
257 | static $randCalled = false; |
||
258 | if (!$randCalled) { |
||
259 | mt_srand((double)microtime() * 1000000); |
||
260 | $randCalled = true; |
||
261 | } |
||
262 | } |
||
263 | } |
||
264 |
Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.
Let’s take a look at an example:
As you can see in this example, the array
$myArray
is initialized the first time when the foreach loop is entered. You can also see that the value of thebar
key is only written conditionally; thus, its value might result from a previous iteration.This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.