Issues (519)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  Header Injection
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Files/Includes/IncludeFunctions.php (2 issues)

1
<?php namespace XoopsModules\Tdmcreate\Files\Includes;
2
3
use XoopsModules\Tdmcreate;
4
use XoopsModules\Tdmcreate\Files;
5
6
/*
7
 You may not change or alter any portion of this comment or credits
8
 of supporting developers from this source code or any supporting source code
9
 which is considered copyrighted (c) material of the original comment or credit authors.
10
11
 This program is distributed in the hope that it will be useful,
12
 but WITHOUT ANY WARRANTY; without even the implied warranty of
13
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14
 */
15
/**
16
 * tdmcreate module.
17
 *
18
 * @copyright       XOOPS Project (https://xoops.org)
19
 * @license         GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
20
 *
21
 * @since           2.5.0
22
 *
23
 * @author          Txmod Xoops http://www.txmodxoops.org
24
 *
25
 * @version         $Id: 1.91 IncludeFunctions.php 12258 2014-01-02 09:33:29Z timgno $
26
 */
27
28
/**
29
 * Class IncludeFunctions.
30
 */
31
class IncludeFunctions extends Files\CreateFile
32
{
33
    /**
34
     *  @public function constructor
35
     *  @param null
36
     */
37
    public function __construct()
38
    {
39
        parent::__construct();
40
    }
41
42
    /**
43
     *  @static function getInstance
44
     *  @param null
45
     * @return IncludeFunctions
46
     */
47
    public static function getInstance()
48
    {
49
        static $instance = false;
50
        if (!$instance) {
51
            $instance = new self();
52
        }
53
54
        return $instance;
55
    }
56
57
    /**
58
     * @public function write
59
     *
60
     * @param $module
61
     * @param $filename
62
     */
63
    public function write($module, $filename)
64
    {
65
        $this->setModule($module);
66
        $this->setFileName($filename);
67
    }
68
69
    /**
70
     *  @private function getFunctionBlock
71
     *  @param string $moduleDirname
72
     *
73
     * @return string
74
     */
75
    private function getFunctionBlock($moduleDirname)
76
    {
77
        $ret = <<<EOT
78
\n/***************Blocks***************/
79
\n/**
80
 * add selected cats
81
 * @param \$cats
82
 * @return string
83
 */
84
function {$moduleDirname}_block_addCatSelect(\$cats) {
85
    if(is_array(\$cats))
86
    {
87
        \$cat_sql = '('.current(\$cats);
88
        array_shift(\$cats);
89
        foreach(\$cats as \$cat)
90
        {
91
            \$cat_sql .= ','.\$cat;
92
        }
93
        \$cat_sql .= ')';
94
    }
95
    return \$cat_sql;
96
}\n
97
EOT;
98
99
        return $ret;
100
    }
101
102
    /**
103
     *  @private function getFunctionGetMyItemIds
104
     *  @param string $moduleDirname
105
     * @param $tableName
106
     *
107
     * @return string
108
     */
109
    private function getFunctionGetMyItemIds($moduleDirname, $tableName)
110
    {
111
        $ret = <<<EOT
112
\n/**
113
 * Get the permissions ids
114
 * @param \$permtype
115
 * @param \$dirname
116
 * @return mixed \${$tableName}
117
 */
118
function {$moduleDirname}GetMyItemIds(\$permtype, \$dirname)
119
{
120
    global \$xoopsUser;
121
    static \$permissions = array();
122
    if(is_array(\$permissions) && array_key_exists(\$permtype, \$permissions)) {
123
        return \$permissions[\$permtype];
124
    }
125
	\$moduleHandler = xoops_getHandler('module');
126
	\${$moduleDirname}Module = \$moduleHandler->getByDirname(\$dirname);
127
	\$groups = is_object(\$xoopsUser) ? \$xoopsUser->getGroups() : XOOPS_GROUP_ANONYMOUS;
128
	\$gpermHandler = xoops_getHandler('groupperm');
129
	\${$tableName} = \$gpermHandler->getItemIds(\$permtype, \$groups, \${$moduleDirname}Module->getVar('mid'));
130
    return \${$tableName};
131
}\n
132
EOT;
133
134
        return $ret;
135
    }
136
137
    /**
138
     *  @private function getFunctionNumbersOfEntries
139
     *
140
     *  @param string $moduleDirname
141
     * @param $tableMid
142
     * @param $tableId
143
     * @param $tableName
144
     *
145
     * @return string
146
     */
147
    private function getFunctionNumbersOfEntries($moduleDirname, $tableMid, $tableId, $tableName)
148
    {
149
        $fields = $this->getTableFields($tableMid, $tableId);
150
        foreach (array_keys($fields) as $f) {
151
            $fieldName = $fields[$f]->getVar('field_name');
152
            if (0 == $f) {
153
                $fieldId = $fieldName; // fieldMain = fields parameters main field
154
            }
155
        }
156
        $ret = <<<EOT
157
\n/**
158
 * Get the number of {$tableName} from the sub categories of a category or sub topics of or topic
159
 * @param \$mytree
160
 * @param \${$tableName}
161
 * @param \$entries
162
 * @param \$cid
163
 * @return int
164
 */
165
function {$moduleDirname}NumbersOfEntries(\$mytree, \${$tableName}, \$entries, \$cid)
166
{
167
    \$count = 0;
168
    if(in_array(\$cid, \${$tableName})) {
169
        \$child = \$mytree->getAllChild(\$cid);
170
        foreach (array_keys(\$entries) as \$i) {
171
            if (\$entries[\$i]->getVar('{$fieldId}') == \$cid){
0 ignored issues
show
Comprehensibility Best Practice introduced by
The variable $fieldId does not seem to be defined for all execution paths leading up to this point.
Loading history...
172
                \$count++;
173
            }
174
            foreach (array_keys(\$child) as \$j) {
175
                if (\$entries[\$i]->getVar('{$fieldId}') == \$j){
176
                    \$count++;
177
                }
178
            }
179
        }
180
    }
181
    return \$count;
182
}\n
183
EOT;
184
185
        return $ret;
186
    }
187
188
    /**
189
     *  @private function getFunctionMetaKeywords
190
     *
191
     *  @param string $moduleDirname
192
     *
193
     * @return string
194
     */
195
    private function getFunctionMetaKeywords($moduleDirname)
196
    {
197
        $ret = <<<EOT
198
\n/**
199
 * Add content as meta tag to template
200
 * @param \$content
201
 * @return void
202
 */
203
\nfunction {$moduleDirname}MetaKeywords(\$content)
204
{
205
    global \$xoopsTpl, \$xoTheme;
206
    \$myts = MyTextSanitizer::getInstance();
207
    \$content= \$myts->undoHtmlSpecialChars(\$myts->displayTarea(\$content));
208
    if(isset(\$xoTheme) && is_object(\$xoTheme)) {
209
        \$xoTheme->addMeta( 'meta', 'keywords', strip_tags(\$content));
210
    } else {    // Compatibility for old Xoops versions
211
        \$xoopsTpl->assign('xoops_meta_keywords', strip_tags(\$content));
212
    }
213
}\n
214
EOT;
215
216
        return $ret;
217
    }
218
219
    /**
220
     *  @private function getFunctionDescription
221
     *
222
     *  @param string $moduleDirname
223
     *
224
     * @return string
225
     */
226
    private function getFunctionMetaDescription($moduleDirname)
227
    {
228
        $ret = <<<EOT
229
\n/**
230
 * Add content as meta description to template
231
 * @param \$content
232
 * @return void
233
 */
234
 \nfunction {$moduleDirname}MetaDescription(\$content)
235
{
236
    global \$xoopsTpl, \$xoTheme;
237
    \$myts = MyTextSanitizer::getInstance();
238
    \$content = \$myts->undoHtmlSpecialChars(\$myts->displayTarea(\$content));
239
    if(isset(\$xoTheme) && is_object(\$xoTheme)) {
240
        \$xoTheme->addMeta( 'meta', 'description', strip_tags(\$content));
241
    } else {    // Compatibility for old Xoops versions
242
        \$xoopsTpl->assign('xoops_meta_description', strip_tags(\$content));
243
    }
244
}\n
245
EOT;
246
247
        return $ret;
248
    }
249
250
    /**
251
     *  @private function getRewriteUrl
252
     *
253
     *  @param string $moduleDirname
254
     *  @param string $tableName
255
     *
256
     * @return string
257
     */
258
    private function getRewriteUrl($moduleDirname, $tableName)
259
    {
260
        $ucfModuleDirname = ucfirst($moduleDirname);
261
        $ret = <<<EOT
262
\n/**
263
 * Rewrite all url
264
 *
265
 * @param string  \$module  module name
266
 * @param array   \$array   array
267
 * @param string  \$type    type
268
 * @return null|string \$type    string replacement for any blank case
269
 */
270
function {$moduleDirname}_RewriteUrl(\$module, \$array, \$type = 'content')
271
{
272
    \$comment = '';
273
    \${$moduleDirname} = {$ucfModuleDirname}Helper::getInstance();
274
    \${$tableName} = \${$moduleDirname}->getHandler('{$tableName}');
275
    \$lenght_id = \${$moduleDirname}->getConfig('lenght_id');
276
    \$rewrite_url = \${$moduleDirname}->getConfig('rewrite_url');
277
278
    if (\$lenght_id != 0) {
279
        \$id = \$array['content_id'];
280
        while (strlen(\$id) < \$lenght_id) {
281
            \$id = '0' . \$id;
282
        }
283
    } else {
284
        \$id = \$array['content_id'];
285
    }
286
287
    if (isset(\$array['topic_alias']) && \$array['topic_alias']) {
288
        \$topic_name = \$array['topic_alias'];
289
    } else {
290
        \$topic_name = {$moduleDirname}_Filter(xoops_getModuleOption('static_name', \$module));
291
    }
292
293
    switch (\$rewrite_url) {
294
295
        case 'none':
296
            if(\$topic_name) {
297
                 \$topic_name = 'topic=' . \$topic_name . '&amp;';
298
            }
299
            \$rewrite_base = '/modules/';
300
            \$page = 'page=' . \$array['content_alias'];
301
            return XOOPS_URL . \$rewrite_base . \$module . '/' . \$type . '.php?' . \$topic_name . 'id=' . \$id . '&amp;' . \$page . \$comment;
302
            break;
303
304
        case 'rewrite':
305
            if(\$topic_name) {
306
                \$topic_name .= '/';
307
            }
308
            \$rewrite_base = xoops_getModuleOption('rewrite_mode', \$module);
309
            \$rewrite_ext = xoops_getModuleOption('rewrite_ext', \$module);
310
            \$module_name = '';
311
            if(xoops_getModuleOption('rewrite_name', \$module)) {
312
                \$module_name = xoops_getModuleOption('rewrite_name', \$module) . '/';
313
            }
314
            \$page = \$array['content_alias'];
315
            \$type .= '/';
316
            \$id .= '/';
317
            if (\$type === 'content/') {
318
                \$type = '';
319
            }
320
            if (\$type === 'comment-edit/' || \$type === 'comment-reply/' || \$type === 'comment-delete/') {
321
                return XOOPS_URL . \$rewrite_base . \$module_name . \$type . \$id . '/';
322
            }
323
324
            return XOOPS_URL . \$rewrite_base . \$module_name . \$type . \$topic_name  . \$id . \$page . \$rewrite_ext;
325
            break;
326
327
         case 'short':
328
            if(\$topic_name) {
329
                \$topic_name .= '/';
330
            }
331
            \$rewrite_base = xoops_getModuleOption('rewrite_mode', \$module);
332
            \$rewrite_ext = xoops_getModuleOption('rewrite_ext', \$module);
333
            \$module_name = '';
334
            if(xoops_getModuleOption('rewrite_name', \$module)) {
335
                \$module_name = xoops_getModuleOption('rewrite_name', \$module) . '/';
336
            }
337
            \$page = \$array['content_alias'];
338
            \$type .= '/';
339
            if (\$type === 'content/') {
340
                \$type = '';
341
            }
342
            if (\$type === 'comment-edit/' || \$type === 'comment-reply/' || \$type === 'comment-delete/') {
343
                return XOOPS_URL . \$rewrite_base . \$module_name . \$type . \$id . '/';
344
            }
345
346
            return XOOPS_URL . \$rewrite_base . \$module_name . \$type . \$topic_name . \$page . \$rewrite_ext;
347
            break;
348
    }
349
    return null;
350
}
351
EOT;
352
353
        return $ret;
354
    }
355
356
    /**
357
     *  @private function getRewriteFilter
358
     *
359
     *  @param string $moduleDirname
360
     *  @param string $tableName
361
     *
362
     * @return string
363
     */
364
    private function getRewriteFilter($moduleDirname, $tableName)
365
    {
366
        $ucfModuleDirname = ucfirst($moduleDirname);
367
        $ret = <<<EOT
368
\n/**
369
 * Replace all escape, character, ... for display a correct url
370
 *
371
 * @param string \$url      string to transform
372
 * @param string \$type     string replacement for any blank case
373
 * @return string \$url
374
 */
375
function {$moduleDirname}_Filter(\$url, \$type = '') {
376
377
    // Get regular expression from module setting. default setting is : `[^a-z0-9]`i
378
    \${$moduleDirname} = {$ucfModuleDirname}Helper::getInstance();
379
    \${$tableName} = \${$moduleDirname}->getHandler('{$tableName}');
380
    \$regular_expression = \${$moduleDirname}->getConfig('regular_expression');
381
382
    \$url = strip_tags(\$url);
383
    \$url .= preg_replace("`\[.*\]`U", '', \$url);
384
    \$url .= preg_replace('`&(amp;)?#?[a-z0-9]+;`i', '-', \$url);
385
    \$url .= htmlentities(\$url, ENT_COMPAT, 'utf-8');
386
    \$url .= preg_replace("`&([a-z])(acute|uml|circ|grave|ring|cedil|slash|tilde|caron|lig);`i", "\\1", \$url);
387
    \$url .= preg_replace(array(\$regular_expression, "`[-]+`"), '-', \$url);
388
    \$url = (\$url == '') ? \$type : strtolower(trim(\$url, '-'));
389
    return \$url;
390
}
391
EOT;
392
393
        return $ret;
394
    }
395
396
    /**
397
     *  @public function render
398
     *
399
     *  @param null
400
     *
401
     * @return bool|string
402
     */
403
    public function render()
404
    {
405
        $module = $this->getModule();
406
        $tables = $this->getTableTables($module->getVar('mod_id'), 'table_order');
407
        $tableId = null;
408
        $tableMid = null;
409
        $tableName = null;
410
        $tableBlocks = null;
411
        $tablePermissions = null;
412
        $tableCategory = null;
413
        foreach (array_keys($tables) as $i) {
414
            $tableId = $tables[$i]->getVar('table_id');
415
            $tableMid = $tables[$i]->getVar('table_mid');
416
            $tableName = $tables[$i]->getVar('table_name');
417
            $tableBlocks[] = $tables[$i]->getVar('table_blocks');
418
            $tablePermissions[] = $tables[$i]->getVar('table_permissions');
419
            $tableCategory[] = $tables[$i]->getVar('table_category');
420
        }
421
        $filename = $this->getFileName();
422
        $moduleDirname = $module->getVar('mod_dirname');
423
        $content = $this->getHeaderFilesComments($module, $filename);
424
        if (in_array(1, $tableBlocks)) {
0 ignored issues
show
$tableBlocks of type null is incompatible with the type array expected by parameter $haystack of in_array(). ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-type  annotation

424
        if (in_array(1, /** @scrutinizer ignore-type */ $tableBlocks)) {
Loading history...
425
            $content .= $this->getFunctionBlock($moduleDirname);
426
        }
427
        if (in_array(1, $tablePermissions)) {
428
            $content .= $this->getFunctionGetMyItemIds($moduleDirname, $tableName);
429
        }
430
        if (in_array(1, $tableCategory)) {
431
            $content .= $this->getFunctionNumbersOfEntries($moduleDirname, $tableMid, $tableId, $tableName);
432
        }
433
        $content .= $this->getFunctionMetaKeywords($moduleDirname);
434
        $content .= $this->getFunctionMetaDescription($moduleDirname);
435
        $content .= $this->getRewriteUrl($moduleDirname, $tableName);
436
        $content .= $this->getRewriteFilter($moduleDirname, $tableName);
437
438
        $this->create($moduleDirname, 'include', $filename, $content, _AM_TDMCREATE_FILE_CREATED, _AM_TDMCREATE_FILE_NOTCREATED);
439
440
        return $this->renderFile();
441
    }
442
}
443