Issues in ObjectController.php (master) - Issues in master - mambax7/smartobject - Measure and Improve Code Quality continuously with Scrutinizer

Issues (496)

Security Analysis not enabled

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Header Injection

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/ObjectController.php (1 issue)

Labels

Severity

Informational 1

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

<?php namespace XoopsModules\Smartobject;

/**
 * Contains the basis classes for managing any objects derived from SmartObjects
 *
 * @license    GNU
 * @author     marcan <[email protected]>
 * @link       http://smartfactory.ca The SmartFactory
 * @package    SmartObject
 * @subpackage SmartObjectCore
 */

use XoopsModules\Smartobject;

// defined('XOOPS_ROOT_PATH') || die('Restricted access');

/**
 * Persistable SmartObject Controller class.
 *
 * This class is responsible for providing operations to an object
 * for managing the object's manipulation
 *
 * @package SmartObject
 * @author  marcan <[email protected]>
 * @credit  Jan Keller Pedersen <[email protected]> - IDG Danmark A/S <www.idg.dk>
 * @link    http://smartfactory.ca The SmartFactory
 */
//require_once XOOPS_ROOT_PATH . '/modules/smartobject/class/smartobject.php';
//require_once XOOPS_ROOT_PATH . '/modules/smartobject/class/smartobjecthandler.php';

/**
 * Class SmartObjectController
 */
class ObjectController
{
    public $handler;

    /**
     * SmartObjectController constructor.
     * @param $handler
     */
    public function __construct($handler)
    {
        $this->handler = $handler;
    }

    /**
     * @param $smartObj
     */
    public function postDataToObject(&$smartObj)
    {
        foreach (array_keys($smartObj->vars) as $key) {
            switch ($smartObj->vars[$key]['data_type']) {
                case XOBJ_DTYPE_IMAGE:
                    if (isset($_POST['url_' . $key]) && '' !== $_POST['url_' . $key]) {
                        $oldFile = $smartObj->getUploadDir(true) . $smartObj->getVar($key, 'e');
                        $smartObj->setVar($key, $_POST['url_' . $key]);
                        if (file_exists($oldFile)) {
                            unlink($oldFile);
                        }
                    }
                    if (isset($_POST['delete_' . $key]) && '1' == $_POST['delete_' . $key]) {
                        $oldFile = $smartObj->getUploadDir(true) . $smartObj->getVar($key, 'e');
                        $smartObj->setVar($key, '');
                        if (file_exists($oldFile)) {
                            unlink($oldFile);
                        }
                    }
                    break;

                case XOBJ_DTYPE_URLLINK:
                    $linkObj = $smartObj->getUrlLinkObj($key);
                    $linkObj->setVar('caption', $_POST['caption_' . $key]);
                    $linkObj->setVar('description', $_POST['desc_' . $key]);
                    $linkObj->setVar('target', $_POST['target_' . $key]);
                    $linkObj->setVar('url', $_POST['url_' . $key]);
                    if ('' !== $linkObj->getVar('url')) {
                        $smartObj->storeUrlLinkObj($linkObj);
                    }
                    //todo: catch errors
                    $smartObj->setVar($key, $linkObj->getVar('urllinkid'));
                    break;

                case XOBJ_DTYPE_FILE:
                    if (!isset($_FILES['upload_' . $key]['name']) || '' === $_FILES['upload_' . $key]['name']) {
                        $fileObj = $smartObj->getFileObj($key);
                        $fileObj->setVar('caption', $_POST['caption_' . $key]);
                        $fileObj->setVar('description', $_POST['desc_' . $key]);
                        $fileObj->setVar('url', $_POST['url_' . $key]);
                        if (!('' === $fileObj->getVar('url') && '' === $fileObj->getVar('url')
                              && '' === $fileObj->getVar('url'))) {
                            $res = $smartObj->storeFileObj($fileObj);
                            if ($res) {
                                $smartObj->setVar($key, $fileObj->getVar('fileid'));
                            } else {
                                //error setted, but no error message (to be improved)
                                $smartObj->setErrors($fileObj->getErrors());
                            }
                        }
                    }
                    break;

                case XOBJ_DTYPE_STIME:
                case XOBJ_DTYPE_MTIME:
                case XOBJ_DTYPE_LTIME:
                    // check if this field's value is available in the POST array
                    if (is_array($_POST[$key]) && isset($_POST[$key]['date'])) {
                        $value = strtotime($_POST[$key]['date']) + $_POST[$key]['time'];
                    } else {
                        $value = strtotime($_POST[$key]);
                        //if strtotime returns false, the value is already a time stamp
                        if (!$value) {
                            $value = (int)$_POST[$key];
                        }
                    }
                    $smartObj->setVar($key, $value);

                    break;

                default:
                    $smartObj->setVar($key, $_POST[$key]);
                    break;
            }
        }
    }

    /**
     * @param        $smartObj
     * @param        $objectid
     * @param        $created_success_msg
     * @param        $modified_success_msg
     * @param  bool  $redirect_page
     * @param  bool  $debug
     * @return mixed
     */
    public function doStoreFromDefaultForm(
        &$smartObj,
        $objectid,
        $created_success_msg,
        $modified_success_msg,
        $redirect_page = false,
        $debug = false
    ) {
        global $smart_previous_page;

        $this->postDataToObject($smartObj);

        if ($smartObj->isNew()) {
            $redirect_msg = $created_success_msg;
        } else {
            $redirect_msg = $modified_success_msg;
        }

        // Check if there were uploaded files
        if (isset($_POST['smart_upload_image']) || isset($_POST['smart_upload_file'])) {
//            require_once XOOPS_ROOT_PATH . '/modules/smartobject/class/smartuploader.php';
            $uploaderObj = new Uploader($smartObj->getImageDir(true), $this->handler->_allowedMimeTypes, $this->handler->_maxFileSize, $this->handler->_maxWidth, $this->handler->_maxHeight);
            foreach ($_FILES as $name => $file_array) {
                if (isset($file_array['name']) && '' !== $file_array['name']
                    && in_array(str_replace('upload_', '', $name), array_keys($smartObj->vars))) {
                    if ($uploaderObj->fetchMedia($name)) {
                        $uploaderObj->setTargetFileName(time() . '_' . $uploaderObj->getMediaName());
                        if ($uploaderObj->upload()) {
                            // Find the related field in the SmartObject
                            $related_field   = str_replace('upload_', '', $name);
                            $uploadedArray[] = $related_field;
foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}
                            //si c'est un fichier Rich
                            if (XOBJ_DTYPE_FILE === $smartObj->vars[$related_field]['data_type']) {
                                $object_fileurl = $smartObj->getUploadDir();
                                $fileObj        = $smartObj->getFileObj($related_field);
                                $fileObj->setVar('url', $object_fileurl . $uploaderObj->getSavedFileName());
                                $fileObj->setVar('caption', $_POST['caption_' . $related_field]);
                                $fileObj->setVar('description', $_POST['desc_' . $related_field]);
                                $smartObj->storeFileObj($fileObj);
                                //todo: catch errors
                                $smartObj->setVar($related_field, $fileObj->getVar('fileid'));
                            } else {
                                $old_file = $smartObj->getUploadDir(true) . $smartObj->getVar($related_field);
                                unlink($old_file);
                                $smartObj->setVar($related_field, $uploaderObj->getSavedFileName());
                            }
                        } else {
                            $smartObj->setErrors($uploaderObj->getErrors(false));
                        }
                    } else {
                        $smartObj->setErrors($uploaderObj->getErrors(false));
                    }
                }
            }
        }

        if ($debug) {
            $storeResult = $this->handler->insertD($smartObj);
        } else {
            $storeResult = $this->handler->insert($smartObj);
        }

        if ($storeResult) {
            if ($this->handler->getPermissions()) {
                $smartPermissionsHandler = new PermissionHandler($this->handler);
                $smartPermissionsHandler->storeAllPermissionsForId($smartObj->id());
            }
        }

        if (null === $redirect_page) {
            return $smartObj;
        } else {
            if (!$storeResult) {
                redirect_header($smart_previous_page, 3, _CO_SOBJECT_SAVE_ERROR . $smartObj->getHtmlErrors());
            }

            $redirect_page = $redirect_page ?: Smartobject\Utility::getPageBeforeForm();

            redirect_header($redirect_page, 2, $redirect_msg);
        }
    }

    /**
     * Store the object in the database autmatically from a form sending POST data
     *
     * @param  string      $created_success_msg  message to display if new object was created
     * @param  string      $modified_success_msg message to display if object was successfully edited
     * @param  bool|string $redirect_page        redirect page, if not set, then we backup once
     * @param  bool        $debug
     * @param  bool        $x_param
     * @return bool
     * @internal param string $created_redir_page redirect page after creating the object
     * @internal param string $modified_redir_page redirect page after editing the object
     * @internal param bool $exit if set to TRUE then the script ends
     */
    public function storeFromDefaultForm(
        $created_success_msg,
        $modified_success_msg,
        $redirect_page = false,
        $debug = false,
        $x_param = false
    ) {
        $objectid = isset($_POST[$this->handler->keyName]) ? (int)$_POST[$this->handler->keyName] : 0;
        if ($debug) {
            if ($x_param) {
                $smartObj = $this->handler->getD($objectid, true, $x_param);
            } else {
                $smartObj = $this->handler->getD($objectid);
            }
        } else {
            if ($x_param) {
                $smartObj = $this->handler->get($objectid, true, false, false, $x_param);
            } else {
                $smartObj = $this->handler->get($objectid);
            }
        }

        // if handler is the Multilanguage handler, we will need to treat this for multilanguage
        if (is_subclass_of($this->handler, 'smartpersistablemlobjecthandler')) {
            if ($smartObj->isNew()) {
                // This is a new object. We need to store the meta data and then the language data
                // First, we will get rid of the multilanguage data to only store the meta data
                $smartObj->stripMultilanguageFields();
                $newObject = $this->doStoreFromDefaultForm($smartObj, $objectid, $created_success_msg, $modified_success_msg, $redirect_page, $debug);
                /**
                 * @todo we need to trap potential errors here
                 */

                // ok, the meta daa is stored. Let's recreate the object and then
                // get rid of anything not multilanguage
                unset($smartObj);
                $smartObj = $this->handler->get($objectid);
                $smartObj->stripNonMultilanguageFields();

                $smartObj->setVar($this->handler->keyName, $newObject->getVar($this->handler->keyName));
                $this->handler->changeTableNameForML();
                $ret = $this->doStoreFromDefaultForm($smartObj, $objectid, $created_success_msg, $modified_success_msg, $redirect_page, $debug);

                return $ret;
            }
        } else {
            return $this->doStoreFromDefaultForm($smartObj, $objectid, $created_success_msg, $modified_success_msg, $redirect_page, $debug);
        }
    }

    /**
     * @return bool
     */
    public function storeSmartObjectD()
    {
        return $this->storeSmartObject(true);
    }

    /**
     * @param  bool $debug
     * @param  bool $xparam
     * @return bool
     */
    public function storeSmartObject($debug = false, $xparam = false)
    {
        $ret = $this->storeFromDefaultForm('', '', null, $debug, $xparam);

        return $ret;
    }

    /**
     * Handles deletion of an object which keyid is passed as a GET param
     *
     * @param  bool   $confirm_msg
     * @param  string $op
     * @param  bool   $userSide
     * @return void
     * @internal param string $redir_page redirect page after deleting the object
     */
    public function handleObjectDeletion($confirm_msg = false, $op = 'del', $userSide = false)
    {
        global $smart_previous_page;

        $objectid = isset($_REQUEST[$this->handler->keyName]) ? (int)$_REQUEST[$this->handler->keyName] : 0;
        $smartObj = $this->handler->get($objectid);

        if ($smartObj->isNew()) {
            redirect_header('javascript:history.go(-1)', 3, _CO_SOBJECT_NOT_SELECTED);
        }

        $confirm = \Xmf\Request::getInt('confirm', 0, POST);
        if ($confirm) {
            if (!$this->handler->delete($smartObj)) {
                redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_ERROR . $smartObj->getHtmlErrors());
            }

            redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_SUCCESS);
        } else {
            // no confirm: show deletion condition

            xoops_cp_header();

            if (!$confirm_msg) {
                $confirm_msg = _CO_SOBJECT_DELETE_CONFIRM;
            }

            xoops_confirm([
                              'op'                    => $op,
                              $this->handler->keyName => $smartObj->getVar($this->handler->keyName),
                              'confirm'               => 1,
                              'redirect_page'         => $smart_previous_page
                          ], xoops_getenv('PHP_SELF'), sprintf($confirm_msg, $smartObj->getVar($this->handler->identifierName)), _CO_SOBJECT_DELETE);

            xoops_cp_footer();
        }
        exit();
    }

    /**
     * @param bool   $confirm_msg
     * @param string $op
     */
    public function handleObjectDeletionFromUserSide($confirm_msg = false, $op = 'del')
    {
        global $smart_previous_page, $xoopsTpl;

        $objectid = isset($_REQUEST[$this->handler->keyName]) ? (int)$_REQUEST[$this->handler->keyName] : 0;
        $smartObj = $this->handler->get($objectid);

        if ($smartObj->isNew()) {
            redirect_header('javascript:history.go(-1)', 3, _CO_SOBJECT_NOT_SELECTED);
        }

        $confirm = \Xmf\Request::getInt('confirm', 0, POST);
        if ($confirm) {
            if (!$this->handler->delete($smartObj)) {
                redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_ERROR . $smartObj->getHtmlErrors());
            }

            redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_SUCCESS);
        } else {
            // no confirm: show deletion condition
            if (!$confirm_msg) {
                $confirm_msg = _CO_SOBJECT_DELETE_CONFIRM;
            }

            ob_start();
            xoops_confirm([
                              'op'                    => $op,
                              $this->handler->keyName => $smartObj->getVar($this->handler->keyName),
                              'confirm'               => 1,
                              'redirect_page'         => $smart_previous_page
                          ], xoops_getenv('PHP_SELF'), sprintf($confirm_msg, $smartObj->getVar($this->handler->identifierName)), _CO_SOBJECT_DELETE);
            $smartobjectDeleteConfirm = ob_get_clean();
            $xoopsTpl->assign('smartobject_delete_confirm', $smartobjectDeleteConfirm);
        }
    }

    /**
     * Retreive the object admin side link for a {@link SmartObjectSingleView} page
     *
     * @param  SmartObject $smartObj reference to the object from which we want the user side link
     * @param  bool        $onlyUrl  wether or not to return a simple URL or a full <a> link
     * @param  bool        $withimage
     * @return string      admin side link to the object
     */
    public function getAdminViewItemLink(SmartObject $smartObj, $onlyUrl = false, $withimage = false)
    {
        $ret = $this->handler->_moduleUrl . 'admin/' . $this->handler->_page . '?op=view&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
        if ($onlyUrl) {
            return $ret;
        } elseif ($withimage) {
            return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "viewmag.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_ADMIN_VIEW . "'  title='" . _CO_SOBJECT_ADMIN_VIEW . "'></a>";
        }

        return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
    }

    /**
     * Retreive the object user side link
     *
     * @param  SmartObject $smartObj reference to the object from which we want the user side link
     * @param  bool        $onlyUrl  wether or not to return a simple URL or a full <a> link
     * @return string      user side link to the object
     */
    public function getItemLink(SmartObject $smartObj, $onlyUrl = false)
    {
        $seoMode       = Smartobject\Utility::getModuleModeSEO($this->handler->_moduleName);
        $seoModuleName = Smartobject\Utility::getModuleNameForSEO($this->handler->_moduleName);

        /**
         * $seoIncludeId feature is not finished yet, so let's put it always to true
         */
        //$seoIncludeId = Smartobject\Utility::getModuleIncludeIdSEO($this->handler->_moduleName);
        $seoIncludeId = true;

        if ('rewrite' === $seoMode) {
            $ret = XOOPS_URL . '/' . $seoModuleName . '.' . $this->handler->_itemname . ($seoIncludeId ? '.' . $smartObj->getVar($this->handler->keyName) : '') . '/' . $smartObj->getVar('short_url') . '.html';
        } elseif ('pathinfo' === $seoMode) {
            $ret = SMARTOBJECT_URL . 'seo.php/' . $seoModuleName . '.' . $this->handler->_itemname . ($seoIncludeId ? '.' . $smartObj->getVar($this->handler->keyName) : '') . '/' . $smartObj->getVar('short_url') . '.html';
        } else {
            $ret = $this->handler->_moduleUrl . $this->handler->_page . '?' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
        }

        if (!$onlyUrl) {
            $ret = "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
        }

        return $ret;
    }

    /**
     * @param         $smartObj
     * @param  bool   $onlyUrl
     * @param  bool   $withimage
     * @return string
     */
    public function getEditLanguageLink($smartObj, $onlyUrl = false, $withimage = true)
    {
        $ret = $this->handler->_moduleUrl . 'admin/' . $this->handler->_page . '?op=mod&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName) . '&language=' . $smartObj->getVar('language');
        if ($onlyUrl) {
            return $ret;
        } elseif ($withimage) {
            return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "wizard.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_LANGUAGE_MODIFY . "'  title='" . _CO_SOBJECT_LANGUAGE_MODIFY . "'></a>";
        }

        return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
    }

    /**
     * @param         $smartObj
     * @param  bool   $onlyUrl
     * @param  bool   $withimage
     * @param  bool   $userSide
     * @return string
     */
    public function getEditItemLink($smartObj, $onlyUrl = false, $withimage = true, $userSide = false)
    {
        $admin_side = $userSide ? '' : 'admin/';
        $ret        = $this->handler->_moduleUrl . $admin_side . $this->handler->_page . '?op=mod&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
        if ($onlyUrl) {
            return $ret;
        } elseif ($withimage) {
            return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "edit.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_MODIFY . "'  title='" . _CO_SOBJECT_MODIFY . "'></a>";
        }

        return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
    }

    /**
     * @param         $smartObj
     * @param  bool   $onlyUrl
     * @param  bool   $withimage
     * @param  bool   $userSide
     * @return string
     */
    public function getDeleteItemLink($smartObj, $onlyUrl = false, $withimage = true, $userSide = false)
    {
        $admin_side = $userSide ? '' : 'admin/';
        $ret        = $this->handler->_moduleUrl . $admin_side . $this->handler->_page . '?op=del&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
        if ($onlyUrl) {
            return $ret;
        } elseif ($withimage) {
            return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "editdelete.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_DELETE . "'  title='" . _CO_SOBJECT_DELETE . "'></a>";
        }

        return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
    }

    /**
     * @param $smartObj
     * @return string
     */
    public function getPrintAndMailLink($smartObj)
    {
        global $xoopsConfig;

        $printlink = $this->handler->_moduleUrl . 'print.php?' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
        $js        = "javascript:openWithSelfMain('" . $printlink . "', 'smartpopup', 700, 519);";
        $printlink = '<a href="' . $js . '"><img  src="' . SMARTOBJECT_IMAGES_ACTIONS_URL . 'fileprint.png" alt="" style="vertical-align: middle;"></a>';

        $smartModule = Smartobject\Utility::getModuleInfo($smartObj->handler->_moduleName);
        $link        = Smartobject\Utility::getCurrentPage();
        $mid         = $smartModule->getVar('mid');
        $friendlink  = "<a href=\"javascript:openWithSelfMain('"
                       . SMARTOBJECT_URL
                       . 'sendlink.php?link='
                       . $link
                       . '&amp;mid='
                       . $mid
                       . "', ',',',',',','sendmessage', 674, 500);\"><img src=\""
                       . SMARTOBJECT_IMAGES_ACTIONS_URL
                       . 'mail_send.png"  alt="'
                       . _CO_SOBJECT_EMAIL
                       . '" title="'
                       . _CO_SOBJECT_EMAIL
                       . '" style="vertical-align: middle;"></a>';

        $ret = '<span id="smartobject_print_button">' . $printlink . '&nbsp;</span>' . '<span id="smartobject_mail_button">' . $friendlink . '</span>';

        return $ret;
    }

    /**
     * @return string
     */
    public function getModuleItemString()
    {
        $ret = $this->handler->_moduleName . '_' . $this->handler->_itemname;

        return $ret;
    }
}


1		<?php namespace XoopsModules\Smartobject;
2
3		/**
4		* Contains the basis classes for managing any objects derived from SmartObjects
5		*
6		* @license GNU
7		* @author marcan <[email protected]>
8		* @link http://smartfactory.ca The SmartFactory
9		* @package SmartObject
10		* @subpackage SmartObjectCore
11		*/
12
13		use XoopsModules\Smartobject;
14
15		// defined('XOOPS_ROOT_PATH') \|\| die('Restricted access');
16
17		/**
18		* Persistable SmartObject Controller class.
19		*
20		* This class is responsible for providing operations to an object
21		* for managing the object's manipulation
22		*
23		* @package SmartObject
24		* @author marcan <[email protected]>
25		* @credit Jan Keller Pedersen <[email protected]> - IDG Danmark A/S <www.idg.dk>
26		* @link http://smartfactory.ca The SmartFactory
27		*/
28		//require_once XOOPS_ROOT_PATH . '/modules/smartobject/class/smartobject.php';
29		//require_once XOOPS_ROOT_PATH . '/modules/smartobject/class/smartobjecthandler.php';
30
31		/**
32		* Class SmartObjectController
33		*/
34		class ObjectController
35		{
36		public $handler;
37
38		/**
39		* SmartObjectController constructor.
40		* @param $handler
41		*/
42		public function __construct($handler)
43		{
44		$this->handler = $handler;
45		}
46
47		/**
48		* @param $smartObj
49		*/
50		public function postDataToObject(&$smartObj)
51		{
52		foreach (array_keys($smartObj->vars) as $key) {
53		switch ($smartObj->vars[$key]['data_type']) {
54		case XOBJ_DTYPE_IMAGE:
55	View Code Duplication	if (isset($_POST['url_' . $key]) && '' !== $_POST['url_' . $key]) {
56		$oldFile = $smartObj->getUploadDir(true) . $smartObj->getVar($key, 'e');
57		$smartObj->setVar($key, $_POST['url_' . $key]);
58		if (file_exists($oldFile)) {
59		unlink($oldFile);
60		}
61		}
62	View Code Duplication	if (isset($_POST['delete_' . $key]) && '1' == $_POST['delete_' . $key]) {
63		$oldFile = $smartObj->getUploadDir(true) . $smartObj->getVar($key, 'e');
64		$smartObj->setVar($key, '');
65		if (file_exists($oldFile)) {
66		unlink($oldFile);
67		}
68		}
69		break;
70
71		case XOBJ_DTYPE_URLLINK:
72		$linkObj = $smartObj->getUrlLinkObj($key);
73		$linkObj->setVar('caption', $_POST['caption_' . $key]);
74		$linkObj->setVar('description', $_POST['desc_' . $key]);
75		$linkObj->setVar('target', $_POST['target_' . $key]);
76		$linkObj->setVar('url', $_POST['url_' . $key]);
77		if ('' !== $linkObj->getVar('url')) {
78		$smartObj->storeUrlLinkObj($linkObj);
79		}
80		//todo: catch errors
81		$smartObj->setVar($key, $linkObj->getVar('urllinkid'));
82		break;
83
84		case XOBJ_DTYPE_FILE:
85		if (!isset($_FILES['upload_' . $key]['name']) \|\| '' === $_FILES['upload_' . $key]['name']) {
86		$fileObj = $smartObj->getFileObj($key);
87		$fileObj->setVar('caption', $_POST['caption_' . $key]);
88		$fileObj->setVar('description', $_POST['desc_' . $key]);
89		$fileObj->setVar('url', $_POST['url_' . $key]);
90		if (!('' === $fileObj->getVar('url') && '' === $fileObj->getVar('url')
91		&& '' === $fileObj->getVar('url'))) {
92		$res = $smartObj->storeFileObj($fileObj);
93		if ($res) {
94		$smartObj->setVar($key, $fileObj->getVar('fileid'));
95		} else {
96		//error setted, but no error message (to be improved)
97		$smartObj->setErrors($fileObj->getErrors());
98		}
99		}
100		}
101		break;
102
103		case XOBJ_DTYPE_STIME:
104		case XOBJ_DTYPE_MTIME:
105		case XOBJ_DTYPE_LTIME:
106		// check if this field's value is available in the POST array
107		if (is_array($_POST[$key]) && isset($_POST[$key]['date'])) {
108		$value = strtotime($_POST[$key]['date']) + $_POST[$key]['time'];
109		} else {
110		$value = strtotime($_POST[$key]);
111		//if strtotime returns false, the value is already a time stamp
112		if (!$value) {
113		$value = (int)$_POST[$key];
114		}
115		}
116		$smartObj->setVar($key, $value);
117
118		break;
119
120		default:
121		$smartObj->setVar($key, $_POST[$key]);
122		break;
123		}
124		}
125		}
126
127		/**
128		* @param $smartObj
129		* @param $objectid
130		* @param $created_success_msg
131		* @param $modified_success_msg
132		* @param bool $redirect_page
133		* @param bool $debug
134		* @return mixed
135		*/
136		public function doStoreFromDefaultForm(
137		&$smartObj,
138		$objectid,
139		$created_success_msg,
140		$modified_success_msg,
141		$redirect_page = false,
142		$debug = false
143		) {
144		global $smart_previous_page;
145
146		$this->postDataToObject($smartObj);
147
148		if ($smartObj->isNew()) {
149		$redirect_msg = $created_success_msg;
150		} else {
151		$redirect_msg = $modified_success_msg;
152		}
153
154		// Check if there were uploaded files
155		if (isset($_POST['smart_upload_image']) \|\| isset($_POST['smart_upload_file'])) {
156		// require_once XOOPS_ROOT_PATH . '/modules/smartobject/class/smartuploader.php';
157		$uploaderObj = new Uploader($smartObj->getImageDir(true), $this->handler->_allowedMimeTypes, $this->handler->_maxFileSize, $this->handler->_maxWidth, $this->handler->_maxHeight);
158		foreach ($_FILES as $name => $file_array) {
159		if (isset($file_array['name']) && '' !== $file_array['name']
160		&& in_array(str_replace('upload_', '', $name), array_keys($smartObj->vars))) {
161		if ($uploaderObj->fetchMedia($name)) {
162		$uploaderObj->setTargetFileName(time() . '_' . $uploaderObj->getMediaName());
163		if ($uploaderObj->upload()) {
164		// Find the related field in the SmartObject
165		$related_field = str_replace('upload_', '', $name);
166		$uploadedArray[] = $related_field;
		0 ignored issues – show Coding Style Comprehensibility introduced 2016-04-01 10:59 UTC by Report Bug Copy Issue Report Show Similar Issues like this `$uploadedArray` was never initialized. Although not strictly required by PHP, it is generally a good practice to add `$uploadedArray = array();` before regardless. Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code. Let’s take a look at an example: foreach ($collection as $item) { $myArray['foo'] = $item->getFoo(); if ($item->hasBar()) { $myArray['bar'] = $item->getBar(); } // do something with $myArray } As you can see in this example, the array `$myArray` is initialized the first time when the foreach loop is entered. You can also see that the value of the `bar` key is only written conditionally; thus, its value might result from a previous iteration. This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization `$myArray = array()` either outside or inside the foreach loop. Loading history...
167		//si c'est un fichier Rich
168		if (XOBJ_DTYPE_FILE === $smartObj->vars[$related_field]['data_type']) {
169		$object_fileurl = $smartObj->getUploadDir();
170		$fileObj = $smartObj->getFileObj($related_field);
171		$fileObj->setVar('url', $object_fileurl . $uploaderObj->getSavedFileName());
172		$fileObj->setVar('caption', $_POST['caption_' . $related_field]);
173		$fileObj->setVar('description', $_POST['desc_' . $related_field]);
174		$smartObj->storeFileObj($fileObj);
175		//todo: catch errors
176		$smartObj->setVar($related_field, $fileObj->getVar('fileid'));
177		} else {
178		$old_file = $smartObj->getUploadDir(true) . $smartObj->getVar($related_field);
179		unlink($old_file);
180		$smartObj->setVar($related_field, $uploaderObj->getSavedFileName());
181		}
182		} else {
183		$smartObj->setErrors($uploaderObj->getErrors(false));
184		}
185		} else {
186		$smartObj->setErrors($uploaderObj->getErrors(false));
187		}
188		}
189		}
190		}
191
192		if ($debug) {
193		$storeResult = $this->handler->insertD($smartObj);
194		} else {
195		$storeResult = $this->handler->insert($smartObj);
196		}
197
198		if ($storeResult) {
199		if ($this->handler->getPermissions()) {
200		$smartPermissionsHandler = new PermissionHandler($this->handler);
201		$smartPermissionsHandler->storeAllPermissionsForId($smartObj->id());
202		}
203		}
204
205		if (null === $redirect_page) {
206		return $smartObj;
207		} else {
208		if (!$storeResult) {
209		redirect_header($smart_previous_page, 3, _CO_SOBJECT_SAVE_ERROR . $smartObj->getHtmlErrors());
210		}
211
212		$redirect_page = $redirect_page ?: Smartobject\Utility::getPageBeforeForm();
213
214		redirect_header($redirect_page, 2, $redirect_msg);
215		}
216		}
217
218		/**
219		* Store the object in the database autmatically from a form sending POST data
220		*
221		* @param string $created_success_msg message to display if new object was created
222		* @param string $modified_success_msg message to display if object was successfully edited
223		* @param bool\|string $redirect_page redirect page, if not set, then we backup once
224		* @param bool $debug
225		* @param bool $x_param
226		* @return bool
227		* @internal param string $created_redir_page redirect page after creating the object
228		* @internal param string $modified_redir_page redirect page after editing the object
229		* @internal param bool $exit if set to TRUE then the script ends
230		*/
231		public function storeFromDefaultForm(
232		$created_success_msg,
233		$modified_success_msg,
234		$redirect_page = false,
235		$debug = false,
236		$x_param = false
237		) {
238		$objectid = isset($_POST[$this->handler->keyName]) ? (int)$_POST[$this->handler->keyName] : 0;
239		if ($debug) {
240	View Code Duplication	if ($x_param) {
241		$smartObj = $this->handler->getD($objectid, true, $x_param);
242		} else {
243		$smartObj = $this->handler->getD($objectid);
244		}
245	View Code Duplication	} else {
246		if ($x_param) {
247		$smartObj = $this->handler->get($objectid, true, false, false, $x_param);
248		} else {
249		$smartObj = $this->handler->get($objectid);
250		}
251		}
252
253		// if handler is the Multilanguage handler, we will need to treat this for multilanguage
254		if (is_subclass_of($this->handler, 'smartpersistablemlobjecthandler')) {
255		if ($smartObj->isNew()) {
256		// This is a new object. We need to store the meta data and then the language data
257		// First, we will get rid of the multilanguage data to only store the meta data
258		$smartObj->stripMultilanguageFields();
259		$newObject = $this->doStoreFromDefaultForm($smartObj, $objectid, $created_success_msg, $modified_success_msg, $redirect_page, $debug);
260		/**
261		* @todo we need to trap potential errors here
262		*/
263
264		// ok, the meta daa is stored. Let's recreate the object and then
265		// get rid of anything not multilanguage
266		unset($smartObj);
267		$smartObj = $this->handler->get($objectid);
268		$smartObj->stripNonMultilanguageFields();
269
270		$smartObj->setVar($this->handler->keyName, $newObject->getVar($this->handler->keyName));
271		$this->handler->changeTableNameForML();
272		$ret = $this->doStoreFromDefaultForm($smartObj, $objectid, $created_success_msg, $modified_success_msg, $redirect_page, $debug);
273
274		return $ret;
275		}
276		} else {
277		return $this->doStoreFromDefaultForm($smartObj, $objectid, $created_success_msg, $modified_success_msg, $redirect_page, $debug);
278		}
279		}
280
281		/**
282		* @return bool
283		*/
284		public function storeSmartObjectD()
285		{
286		return $this->storeSmartObject(true);
287		}
288
289		/**
290		* @param bool $debug
291		* @param bool $xparam
292		* @return bool
293		*/
294		public function storeSmartObject($debug = false, $xparam = false)
295		{
296		$ret = $this->storeFromDefaultForm('', '', null, $debug, $xparam);
297
298		return $ret;
299		}
300
301		/**
302		* Handles deletion of an object which keyid is passed as a GET param
303		*
304		* @param bool $confirm_msg
305		* @param string $op
306		* @param bool $userSide
307		* @return void
308		* @internal param string $redir_page redirect page after deleting the object
309		*/
310		public function handleObjectDeletion($confirm_msg = false, $op = 'del', $userSide = false)
311		{
312		global $smart_previous_page;
313
314		$objectid = isset($_REQUEST[$this->handler->keyName]) ? (int)$_REQUEST[$this->handler->keyName] : 0;
315		$smartObj = $this->handler->get($objectid);
316
317		if ($smartObj->isNew()) {
318		redirect_header('javascript:history.go(-1)', 3, _CO_SOBJECT_NOT_SELECTED);
319		}
320
321		$confirm = \Xmf\Request::getInt('confirm', 0, POST);
322		if ($confirm) {
323	View Code Duplication	if (!$this->handler->delete($smartObj)) {
324		redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_ERROR . $smartObj->getHtmlErrors());
325		}
326
327		redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_SUCCESS);
328		} else {
329		// no confirm: show deletion condition
330
331		xoops_cp_header();
332
333		if (!$confirm_msg) {
334		$confirm_msg = _CO_SOBJECT_DELETE_CONFIRM;
335		}
336
337		xoops_confirm([
338		'op' => $op,
339		$this->handler->keyName => $smartObj->getVar($this->handler->keyName),
340		'confirm' => 1,
341		'redirect_page' => $smart_previous_page
342		], xoops_getenv('PHP_SELF'), sprintf($confirm_msg, $smartObj->getVar($this->handler->identifierName)), _CO_SOBJECT_DELETE);
343
344		xoops_cp_footer();
345		}
346		exit();
347		}
348
349		/**
350		* @param bool $confirm_msg
351		* @param string $op
352		*/
353		public function handleObjectDeletionFromUserSide($confirm_msg = false, $op = 'del')
354		{
355		global $smart_previous_page, $xoopsTpl;
356
357		$objectid = isset($_REQUEST[$this->handler->keyName]) ? (int)$_REQUEST[$this->handler->keyName] : 0;
358		$smartObj = $this->handler->get($objectid);
359
360		if ($smartObj->isNew()) {
361		redirect_header('javascript:history.go(-1)', 3, _CO_SOBJECT_NOT_SELECTED);
362		}
363
364		$confirm = \Xmf\Request::getInt('confirm', 0, POST);
365		if ($confirm) {
366	View Code Duplication	if (!$this->handler->delete($smartObj)) {
367		redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_ERROR . $smartObj->getHtmlErrors());
368		}
369
370		redirect_header($_POST['redirect_page'], 3, _CO_SOBJECT_DELETE_SUCCESS);
371		} else {
372		// no confirm: show deletion condition
373		if (!$confirm_msg) {
374		$confirm_msg = _CO_SOBJECT_DELETE_CONFIRM;
375		}
376
377		ob_start();
378		xoops_confirm([
379		'op' => $op,
380		$this->handler->keyName => $smartObj->getVar($this->handler->keyName),
381		'confirm' => 1,
382		'redirect_page' => $smart_previous_page
383		], xoops_getenv('PHP_SELF'), sprintf($confirm_msg, $smartObj->getVar($this->handler->identifierName)), _CO_SOBJECT_DELETE);
384		$smartobjectDeleteConfirm = ob_get_clean();
385		$xoopsTpl->assign('smartobject_delete_confirm', $smartobjectDeleteConfirm);
386		}
387		}
388
389		/**
390		* Retreive the object admin side link for a {@link SmartObjectSingleView} page
391		*
392		* @param SmartObject $smartObj reference to the object from which we want the user side link
393		* @param bool $onlyUrl wether or not to return a simple URL or a full <a> link
394		* @param bool $withimage
395		* @return string admin side link to the object
396		*/
397		public function getAdminViewItemLink(SmartObject $smartObj, $onlyUrl = false, $withimage = false)
398		{
399		$ret = $this->handler->_moduleUrl . 'admin/' . $this->handler->_page . '?op=view&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
400		if ($onlyUrl) {
401		return $ret;
402		} elseif ($withimage) {
403		return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "viewmag.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_ADMIN_VIEW . "' title='" . _CO_SOBJECT_ADMIN_VIEW . "'></a>";
404		}
405
406		return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
407		}
408
409		/**
410		* Retreive the object user side link
411		*
412		* @param SmartObject $smartObj reference to the object from which we want the user side link
413		* @param bool $onlyUrl wether or not to return a simple URL or a full <a> link
414		* @return string user side link to the object
415		*/
416		public function getItemLink(SmartObject $smartObj, $onlyUrl = false)
417		{
418		$seoMode = Smartobject\Utility::getModuleModeSEO($this->handler->_moduleName);
419		$seoModuleName = Smartobject\Utility::getModuleNameForSEO($this->handler->_moduleName);
420
421		/**
422		* $seoIncludeId feature is not finished yet, so let's put it always to true
423		*/
424		//$seoIncludeId = Smartobject\Utility::getModuleIncludeIdSEO($this->handler->_moduleName);
425		$seoIncludeId = true;
426
427		if ('rewrite' === $seoMode) {
428		$ret = XOOPS_URL . '/' . $seoModuleName . '.' . $this->handler->_itemname . ($seoIncludeId ? '.' . $smartObj->getVar($this->handler->keyName) : '') . '/' . $smartObj->getVar('short_url') . '.html';
429		} elseif ('pathinfo' === $seoMode) {
430		$ret = SMARTOBJECT_URL . 'seo.php/' . $seoModuleName . '.' . $this->handler->_itemname . ($seoIncludeId ? '.' . $smartObj->getVar($this->handler->keyName) : '') . '/' . $smartObj->getVar('short_url') . '.html';
431		} else {
432		$ret = $this->handler->_moduleUrl . $this->handler->_page . '?' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
433		}
434
435		if (!$onlyUrl) {
436		$ret = "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
437		}
438
439		return $ret;
440		}
441
442		/**
443		* @param $smartObj
444		* @param bool $onlyUrl
445		* @param bool $withimage
446		* @return string
447		*/
448		public function getEditLanguageLink($smartObj, $onlyUrl = false, $withimage = true)
449		{
450		$ret = $this->handler->_moduleUrl . 'admin/' . $this->handler->_page . '?op=mod&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName) . '&language=' . $smartObj->getVar('language');
451		if ($onlyUrl) {
452		return $ret;
453		} elseif ($withimage) {
454		return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "wizard.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_LANGUAGE_MODIFY . "' title='" . _CO_SOBJECT_LANGUAGE_MODIFY . "'></a>";
455		}
456
457		return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
458		}
459
460		/**
461		* @param $smartObj
462		* @param bool $onlyUrl
463		* @param bool $withimage
464		* @param bool $userSide
465		* @return string
466		*/
467	View Code Duplication	public function getEditItemLink($smartObj, $onlyUrl = false, $withimage = true, $userSide = false)
468		{
469		$admin_side = $userSide ? '' : 'admin/';
470		$ret = $this->handler->_moduleUrl . $admin_side . $this->handler->_page . '?op=mod&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
471		if ($onlyUrl) {
472		return $ret;
473		} elseif ($withimage) {
474		return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "edit.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_MODIFY . "' title='" . _CO_SOBJECT_MODIFY . "'></a>";
475		}
476
477		return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
478		}
479
480		/**
481		* @param $smartObj
482		* @param bool $onlyUrl
483		* @param bool $withimage
484		* @param bool $userSide
485		* @return string
486		*/
487	View Code Duplication	public function getDeleteItemLink($smartObj, $onlyUrl = false, $withimage = true, $userSide = false)
488		{
489		$admin_side = $userSide ? '' : 'admin/';
490		$ret = $this->handler->_moduleUrl . $admin_side . $this->handler->_page . '?op=del&' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
491		if ($onlyUrl) {
492		return $ret;
493		} elseif ($withimage) {
494		return "<a href='" . $ret . "'><img src='" . SMARTOBJECT_IMAGES_ACTIONS_URL . "editdelete.png' style='vertical-align: middle;' alt='" . _CO_SOBJECT_DELETE . "' title='" . _CO_SOBJECT_DELETE . "'></a>";
495		}
496
497		return "<a href='" . $ret . "'>" . $smartObj->getVar($this->handler->identifierName) . '</a>';
498		}
499
500		/**
501		* @param $smartObj
502		* @return string
503		*/
504		public function getPrintAndMailLink($smartObj)
505		{
506		global $xoopsConfig;
507
508		$printlink = $this->handler->_moduleUrl . 'print.php?' . $this->handler->keyName . '=' . $smartObj->getVar($this->handler->keyName);
509		$js = "javascript:openWithSelfMain('" . $printlink . "', 'smartpopup', 700, 519);";
510		$printlink = '<a href="' . $js . '"><img src="' . SMARTOBJECT_IMAGES_ACTIONS_URL . 'fileprint.png" alt="" style="vertical-align: middle;"></a>';
511
512		$smartModule = Smartobject\Utility::getModuleInfo($smartObj->handler->_moduleName);
513		$link = Smartobject\Utility::getCurrentPage();
514		$mid = $smartModule->getVar('mid');
515		$friendlink = "<a href=\"javascript:openWithSelfMain('"
516		. SMARTOBJECT_URL
517		. 'sendlink.php?link='
518		. $link
519		. '&mid='
520		. $mid
521		. "', ',',',',',','sendmessage', 674, 500);\"><img src=\""
522		. SMARTOBJECT_IMAGES_ACTIONS_URL
523		. 'mail_send.png" alt="'
524		. _CO_SOBJECT_EMAIL
525		. '" title="'
526		. _CO_SOBJECT_EMAIL
527		. '" style="vertical-align: middle;"></a>';
528
529		$ret = '<span id="smartobject_print_button">' . $printlink . ' </span>' . '<span id="smartobject_mail_button">' . $friendlink . '</span>';
530
531		return $ret;
532		}
533
534		/**
535		* @return string
536		*/
537		public function getModuleItemString()
538		{
539		$ret = $this->handler->_moduleName . '_' . $this->handler->_itemname;
540
541		return $ret;
542		}
543		}
544

mambax7 / smartobject

Issues (496)

Security Analysis not enabled

class/ObjectController.php (1 issue)

Labels

Severity

Introduced By

Upgrade to new PHP Analysis Engine

Duplication Side-by-Side

Filter issues like