Issues in UserObjects.php (master) - Issues in master - mambax7/tdmcreate-1.91 - Measure and Improve Code Quality continuously with Scrutinizer

Issues (519)

Security Analysis not enabled

File Inclusion

File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.

Regex Injection

Regex Injection enables an attacker to execute arbitrary code in your PHP process.

SQL Injection

SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.

Response Splitting

Response Splitting can be used to send arbitrary responses.

File Manipulation

File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.

Object Injection

Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.

File Exposure

File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.

XML Injection

XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.

Code Injection

Code Injection enables an attacker to execute arbitrary code on the server.

Variable Injection

Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.

XPath Injection

XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.

Other Vulnerability

This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.

Command Injection

Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.

LDAP Injection

LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.

Cross-Site Scripting

Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.

Header Injection

Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

class/Files/User/UserObjects.php (3 issues)

Labels

Severity

Minor 3

<?php namespace XoopsModules\Tdmcreate\Files\User;

use XoopsModules\Tdmcreate;
use XoopsModules\Tdmcreate\Files;

/*
 You may not change or alter any portion of this comment or credits
 of supporting developers from this source code or any supporting source code
 which is considered copyrighted (c) material of the original comment or credit authors.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 */
/**
 * tdmcreate module.
 *
 * @copyright       XOOPS Project (https://xoops.org)
 * @license         GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
 *
 * @since           2.5.0
 *
 * @author          Txmod Xoops http://www.txmodxoops.org
 *
 * @version         $Id: objects.php 12258 2014-01-02 09:33:29Z timgno $
 */
defined('XOOPS_ROOT_PATH') || die('Restricted access');

/**
 * Class UserObjects.
 */
class UserObjects extends Files\CreateFile
{
    /**
     *  @public function constructor
     *  @param null
     */
    public function __construct()
    {
        parent::__construct();
    }

    /**
     *  @static function getInstance
     *  @param null
     * @return UserObjects
     */
    public static function getInstance()
    {
        static $instance = false;
        if (!$instance) {
            $instance = new self();
        }

        return $instance;
    }

    /**
     *  @public function getUserHeaderTpl
     *  @param string $moduleDirname
     *  @param string $tableName
     *  @return string
     */
    public function getUserHeaderTpl($moduleDirname, $tableName)
    {
        $ret = <<<EOT
include  __DIR__ . '/header.php';
\$GLOBALS['xoopsOption']['template_main'] = '{$moduleDirname}_{$tableName}.tpl';
include_once XOOPS_ROOT_PATH.'/header.php';\n
EOT;

        return $ret;
    }

    /**
     *  @public function getUserIndex
     *  @param string $moduleDirname
     *  @return string
     */
    public function getUserIndex($moduleDirname)
    {
        $ret = <<<EOT
include  __DIR__ . '/header.php';
\$GLOBALS['xoopsOption']['template_main'] = '{$moduleDirname}_index.tpl';
include_once XOOPS_ROOT_PATH.'/header.php';\n
EOT;

        return $ret;
    }

    /**
     *  @public function getUserFooter
     *  @param null
     * @return string
     */
    public function getUserFooter()
    {
        $ret = <<<'EOT'
include  __DIR__ . '/footer.php';
EOT;

        return $ret;
    }

    /**
     *  @public function getSimpleSetVar
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getSimpleSetVar($tableName, $fieldName)
    {
        $ret = <<<EOT
        // Set Var {$fieldName}
        \${$tableName}Obj->setVar('{$fieldName}', \$_POST['{$fieldName}']);\n
EOT;

        return $ret;
    }

    /**
     *  @public function getTextDateSelectSetVar
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getTextDateSelectSetVar($tableName, $fieldName)
    {
        $ret = <<<EOT
        // Set Var {$fieldName}
        \${$tableName}Obj->setVar('{$fieldName}', strtotime(\$_POST['{$fieldName}']));\n
EOT;

        return $ret;
    }

    /**
     *  @public function getCheckBoxOrRadioYNSetVar
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getCheckBoxOrRadioYNSetVar($tableName, $fieldName)
    {
        $ret = <<<EOT
        // Set Var {$fieldName}
        \${$tableName}Obj->setVar('{$fieldName}', ((1 == \$_REQUEST['{$fieldName}']) ? '1' : '0'));\n
EOT;

        return $ret;
    }

    /**
     *  @public function getUrlFileSetVar
     *  @param $moduleDirname
     *  @param $tableName
     *  @param $fieldName
     *  @return string
     */
    public function getUrlFileSetVar($moduleDirname, $tableName, $fieldName)
    {
        $stuModuleDirname = mb_strtoupper($moduleDirname);
        $ret = <<<EOT
        // Set Var {$fieldName}
        \${$tableName}Obj->setVar('{$fieldName}', formatUrl(\$_REQUEST['{$fieldName}']));\n
		// Set Var {$fieldName}
        include_once XOOPS_ROOT_PATH.'/class/uploader.php';
        \$uploaddir = {$stuModuleDirname}_UPLOAD_PATH.'/files/{$tableName}';
        \$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
                                                         \${$moduleDirname}->getConfig('maxsize'), null, null);
        if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][])) {
            \$uploader->fetchMedia(\$_POST['xoops_upload_file'][]);
            if (!\$uploader->upload()) {
                \$errors = \$uploader->getErrors();
                redirect_header('javascript:history.go(-1)', 3, \$errors);
            } else {
                \${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
            }
        }\n
EOT;

        return $ret;
    }

    /**
     *  @public function getImageListSetVar
     *  @param string $moduleDirname
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getImageListSetVar($moduleDirname, $tableName, $fieldName)
    {
        $ret = <<<EOT
        // Set Var {$fieldName}
        include_once XOOPS_ROOT_PATH.'/class/uploader.php';
        \$uploaddir = XOOPS_ROOT_PATH . '/Frameworks/moduleclasses/icons/32';
        \$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
                                                         \${$moduleDirname}->getConfig('maxsize'), null, null);
        if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][])) {
            //\$uploader->setPrefix('{$fieldName}_');
            //\$uploader->fetchMedia(\$_POST['xoops_upload_file'][]);
            if (!\$uploader->upload()) {
                \$errors = \$uploader->getErrors();
                redirect_header('javascript:history.go(-1)', 3, \$errors);
            } else {
                \${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
            }
        } else {
            \${$tableName}Obj->setVar('{$fieldName}', \$_POST['{$fieldName}']);
        }\n
EOT;

        return $ret;
    }

    /**
     * @public function getUploadImageSetVar
     * @param string $moduleDirname
     * @param string $tableName
     * @param string $fieldName
     * @param        $fpmf
     * @return string
     */
    public function getUploadImageSetVar($moduleDirname, $tableName, $fieldName, $fpmf)
    {
        $stuModuleDirname = mb_strtoupper($moduleDirname);
        $ret = <<<EOT
        // Set Var {$fieldName}
        include_once XOOPS_ROOT_PATH.'/class/uploader.php';
        \$uploaddir = {$stuModuleDirname}_UPLOAD_PATH.'/images/{$tableName}';
        \$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
                                                         \${$moduleDirname}->getConfig('maxsize'), null, null);
        if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][0])) {
			\$extension = preg_replace( '/^.+\.([^.]+)$/sU' , '' , \$_FILES['attachedfile']['name']);
            \$imgName = str_replace(' ', '', \$_POST['{$fpmf}']).'.'.\$extension;
			\$uploader->setPrefix(\$imgName);
            \$uploader->fetchMedia(\$_POST['xoops_upload_file'][0]);
            if (!\$uploader->upload()) {
                \$errors = \$uploader->getErrors();
                redirect_header('javascript:history.go(-1)', 3, \$errors);
            } else {
                \${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
            }
        } else {
            \${$tableName}Obj->setVar('{$fieldName}', \$_POST['{$fieldName}']);
        }\n
EOT;

        return $ret;
    }

    /**
     *  @public function getUploadFileSetVar
     *  @param string $moduleDirname
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getUploadFileSetVar($moduleDirname, $tableName, $fieldName)
    {
        $stuModuleDirname = mb_strtoupper($moduleDirname);
        $ret = <<<EOT
        // Set Var {$fieldName}
        include_once XOOPS_ROOT_PATH.'/class/uploader.php';
        \$uploaddir = {$stuModuleDirname}_UPLOAD_PATH.'/files/{$tableName}';
        \$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
                                                         \${$moduleDirname}->getConfig('maxsize'), null, null);
        if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][])) {
            //\$uploader->setPrefix('{$fieldName}_') ;
            //\$uploader->fetchMedia(\$_POST['xoops_upload_file'][]);
            if (!\$uploader->upload()) {
                \$errors = \$uploader->getErrors();
                redirect_header('javascript:history.go(-1)', 3, \$errors);
            } else {
                \${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
            }
        }\n
EOT;

        return $ret;
    }

    /**
     *  @public function getUserSaveFieldId
     *  @param $fields
     *
     *  @return string
     */
    public function getUserSaveFieldId($fields)
    {
        foreach (array_keys($fields) as $f) {
            if (0 == $f) {
                $fieldId = $fields[$f]->getVar('field_name');
            }
        }

        return $fieldId;

    }

    /**
     *  @public function getUserSaveFieldMain
     *  @param $fields
     *
     *  @return string
     */
    public function getUserSaveFieldMain($fields)
    {
        foreach (array_keys($fields) as $f) {
            if (1 == $fields[$f]->getVar('field_main')) {
                $fieldMain = $fields[$f]->getVar('field_name');
            }
        }

        return $fieldMain;

    }

    /**
     *  @public function getUserSaveElements
     *  @param $moduleDirname
     *  @param $tableName
     *  @param $fields
     *
     *  @return string
     */
    public function getUserSaveElements($moduleDirname, $tableName, $fields)
    {
        $ret = '';
        foreach (array_keys($fields) as $f) {
            $fieldName = $fields[$f]->getVar('field_name');
            $fieldElement = $fields[$f]->getVar('field_element');
            if (1 == $fields[$f]->getVar('field_main')) {
                $fieldMain = $fieldName;
            }
            if ((5 == $fieldElement) || (6 == $fieldElement)) {
                $ret .= $this->getCheckBoxOrRadioYNSetVar($tableName, $fieldName);
            } elseif (13 == $fieldElement) {
                $ret .= $this->getUploadImageSetVar($moduleDirname, $tableName, $fieldName, $fieldMain);

            } elseif (14 == $fieldElement) {
                $ret .= $this->getUploadFileSetVar($moduleDirname, $tableName, $fieldName);
            } elseif (15 == $fieldElement) {
                $ret .= $this->getTextDateSelectSetVar($tableName, $fieldName);
            } else {
                $ret .= $this->getSimpleSetVar($tableName, $fieldName);
            }
        }

        return $ret;
    }

    /**
     *  @public function getSimpleGetVar
     *  @param string $lpFieldName
     *  @param string $rpFieldName
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getSimpleGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
    {
        $ret = <<<EOT
\t\t// Get Var {$fieldName}
\t\t\${$lpFieldName}['{$rpFieldName}'] = \${$tableName}All[\$i]->getVar('{$fieldName}');\n
EOT;

        return $ret;
    }

    /**
     *  @public function getTopicGetVar
     *  @param string $lpFieldName
     *  @param string $rpFieldName
     *  @param string $tableName
     *  @param string $tableNameTopic
     *  @param string $fieldNameParent
     *  @param string $fieldNameTopic
     *  @return string
     */
    public function getTopicGetVar($lpFieldName, $rpFieldName, $tableName, $tableNameTopic, $fieldNameParent, $fieldNameTopic)
    {
        $ret = <<<EOT
\t\t// Get Var {$fieldNameParent}
\t\t\${$rpFieldName} =& \${$tableNameTopic}Handler->get(\${$tableName}All[\$i]->getVar('{$fieldNameParent}'));
\t\t\${$lpFieldName}['{$rpFieldName}'] = \${$rpFieldName}->getVar('{$fieldNameTopic}');\n
EOT;

        return $ret;
    }

    /**
     *  @public function getUploadImageGetVar
     *  @param string $lpFieldName
     *  @param string $rpFieldName
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getUploadImageGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
    {
        $ret = <<<EOT
\t\t// Get Var {$fieldName}
\t\t\${$fieldName} = \${$tableName}All[\$i]->getVar('{$fieldName}');
\t\t\$upload_image = \${$fieldName} ? \${$fieldName} : 'blank.gif';
\t\t\${$lpFieldName}['{$rpFieldName}'] = \$upload_image;\n
EOT;

        return $ret;
    }

    /**
     *  @public function getUrlFileGetVar
     *  @param string $lpFieldName
     *  @param string $rpFieldName
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getUrlFileGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
    {
        $ret = <<<EOT
\t\t\t\t// Get Var {$fieldName}
\t\t\t\t\${$lpFieldName}['{$rpFieldName}'] = \${$tableName}All[\$i]->getVar('{$fieldName}');\n
EOT;

        return $ret;
    }

    /**
     *  @public function getTextAreaGetVar
     *  @param string $lpFieldName
     *  @param string $rpFieldName
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getTextAreaGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
    {
        $ret = <<<EOT
\t\t// Get Var {$fieldName}
\t\t\${$lpFieldName}['{$rpFieldName}'] = strip_tags(\${$tableName}All[\$i]->getVar('{$fieldName}'));\n
EOT;

        return $ret;
    }

    /**
     *  @public function getSelectUserGetVar
     *  @param string $lpFieldName
     *  @param string $rpFieldName
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getSelectUserGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
    {
        $ret = <<<EOT
\t\t// Get Var {$fieldName}
\t\t\${$lpFieldName}['{$rpFieldName}'] = \XoopsUser::getUnameFromId(\${$tableName}All[\$i]->getVar('{$fieldName}'), 's');\n
EOT;

        return $ret;
    }

    /**
     *  @public function getTextDateSelectGetVar
     *  @param string $lpFieldName
     *  @param string $rpFieldName
     *  @param string $tableName
     *  @param string $fieldName
     *  @return string
     */
    public function getTextDateSelectGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
    {
        $ret = <<<EOT
\t\t// Get Var {$fieldName}
\t\t\${$lpFieldName}['{$rpFieldName}'] = formatTimeStamp(\${$tableName}All[\$i]->getVar('{$fieldName}'), 's');\n
EOT;

        return $ret;
    }
}


1			<?php namespace XoopsModules\Tdmcreate\Files\User;
2
3			use XoopsModules\Tdmcreate;
4			use XoopsModules\Tdmcreate\Files;
5
6			/*
7			You may not change or alter any portion of this comment or credits
8			of supporting developers from this source code or any supporting source code
9			which is considered copyrighted (c) material of the original comment or credit authors.
10
11			This program is distributed in the hope that it will be useful,
12			but WITHOUT ANY WARRANTY; without even the implied warranty of
13			MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14			*/
15			/**
16			* tdmcreate module.
17			*
18			* @copyright XOOPS Project (https://xoops.org)
19			* @license GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html)
20			*
21			* @since 2.5.0
22			*
23			* @author Txmod Xoops http://www.txmodxoops.org
24			*
25			* @version $Id: objects.php 12258 2014-01-02 09:33:29Z timgno $
26			*/
27			defined('XOOPS_ROOT_PATH') \|\| die('Restricted access');
28
29			/**
30			* Class UserObjects.
31			*/
32			class UserObjects extends Files\CreateFile
33			{
34			/**
35			* @public function constructor
36			* @param null
37			*/
38			public function __construct()
39			{
40			parent::__construct();
41			}
42
43			/**
44			* @static function getInstance
45			* @param null
46			* @return UserObjects
47			*/
48			public static function getInstance()
49			{
50			static $instance = false;
51			if (!$instance) {
52			$instance = new self();
53			}
54
55			return $instance;
56			}
57
58			/**
59			* @public function getUserHeaderTpl
60			* @param string $moduleDirname
61			* @param string $tableName
62			* @return string
63			*/
64			public function getUserHeaderTpl($moduleDirname, $tableName)
65			{
66			$ret = <<<EOT
67			include __DIR__ . '/header.php';
68			\$GLOBALS['xoopsOption']['template_main'] = '{$moduleDirname}_{$tableName}.tpl';
69			include_once XOOPS_ROOT_PATH.'/header.php';\n
70			EOT;
71
72			return $ret;
73			}
74
75			/**
76			* @public function getUserIndex
77			* @param string $moduleDirname
78			* @return string
79			*/
80			public function getUserIndex($moduleDirname)
81			{
82			$ret = <<<EOT
83			include __DIR__ . '/header.php';
84			\$GLOBALS['xoopsOption']['template_main'] = '{$moduleDirname}_index.tpl';
85			include_once XOOPS_ROOT_PATH.'/header.php';\n
86			EOT;
87
88			return $ret;
89			}
90
91			/**
92			* @public function getUserFooter
93			* @param null
94			* @return string
95			*/
96			public function getUserFooter()
97			{
98			$ret = <<<'EOT'
99			include __DIR__ . '/footer.php';
100			EOT;
101
102			return $ret;
103			}
104
105			/**
106			* @public function getSimpleSetVar
107			* @param string $tableName
108			* @param string $fieldName
109			* @return string
110			*/
111			public function getSimpleSetVar($tableName, $fieldName)
112			{
113			$ret = <<<EOT
114			// Set Var {$fieldName}
115			\${$tableName}Obj->setVar('{$fieldName}', \$_POST['{$fieldName}']);\n
116			EOT;
117
118			return $ret;
119			}
120
121			/**
122			* @public function getTextDateSelectSetVar
123			* @param string $tableName
124			* @param string $fieldName
125			* @return string
126			*/
127			public function getTextDateSelectSetVar($tableName, $fieldName)
128			{
129			$ret = <<<EOT
130			// Set Var {$fieldName}
131			\${$tableName}Obj->setVar('{$fieldName}', strtotime(\$_POST['{$fieldName}']));\n
132			EOT;
133
134			return $ret;
135			}
136
137			/**
138			* @public function getCheckBoxOrRadioYNSetVar
139			* @param string $tableName
140			* @param string $fieldName
141			* @return string
142			*/
143			public function getCheckBoxOrRadioYNSetVar($tableName, $fieldName)
144			{
145			$ret = <<<EOT
146			// Set Var {$fieldName}
147			\${$tableName}Obj->setVar('{$fieldName}', ((1 == \$_REQUEST['{$fieldName}']) ? '1' : '0'));\n
148			EOT;
149
150			return $ret;
151			}
152
153			/**
154			* @public function getUrlFileSetVar
155			* @param $moduleDirname
156			* @param $tableName
157			* @param $fieldName
158			* @return string
159			*/
160			public function getUrlFileSetVar($moduleDirname, $tableName, $fieldName)
161			{
162			$stuModuleDirname = mb_strtoupper($moduleDirname);
163			$ret = <<<EOT
164			// Set Var {$fieldName}
165			\${$tableName}Obj->setVar('{$fieldName}', formatUrl(\$_REQUEST['{$fieldName}']));\n
166			// Set Var {$fieldName}
167			include_once XOOPS_ROOT_PATH.'/class/uploader.php';
168			\$uploaddir = {$stuModuleDirname}_UPLOAD_PATH.'/files/{$tableName}';
169			\$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
170			\${$moduleDirname}->getConfig('maxsize'), null, null);
171			if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][])) {
172			\$uploader->fetchMedia(\$_POST['xoops_upload_file'][]);
173			if (!\$uploader->upload()) {
174			\$errors = \$uploader->getErrors();
175			redirect_header('javascript:history.go(-1)', 3, \$errors);
176			} else {
177			\${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
178			}
179			}\n
180			EOT;
181
182			return $ret;
183			}
184
185			/**
186			* @public function getImageListSetVar
187			* @param string $moduleDirname
188			* @param string $tableName
189			* @param string $fieldName
190			* @return string
191			*/
192			public function getImageListSetVar($moduleDirname, $tableName, $fieldName)
193			{
194			$ret = <<<EOT
195			// Set Var {$fieldName}
196			include_once XOOPS_ROOT_PATH.'/class/uploader.php';
197			\$uploaddir = XOOPS_ROOT_PATH . '/Frameworks/moduleclasses/icons/32';
198			\$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
199			\${$moduleDirname}->getConfig('maxsize'), null, null);
200			if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][])) {
201			//\$uploader->setPrefix('{$fieldName}_');
202			//\$uploader->fetchMedia(\$_POST['xoops_upload_file'][]);
203			if (!\$uploader->upload()) {
204			\$errors = \$uploader->getErrors();
205			redirect_header('javascript:history.go(-1)', 3, \$errors);
206			} else {
207			\${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
208			}
209			} else {
210			\${$tableName}Obj->setVar('{$fieldName}', \$_POST['{$fieldName}']);
211			}\n
212			EOT;
213
214			return $ret;
215			}
216
217			/**
218			* @public function getUploadImageSetVar
219			* @param string $moduleDirname
220			* @param string $tableName
221			* @param string $fieldName
222			* @param $fpmf
223			* @return string
224			*/
225			public function getUploadImageSetVar($moduleDirname, $tableName, $fieldName, $fpmf)
226			{
227			$stuModuleDirname = mb_strtoupper($moduleDirname);
228			$ret = <<<EOT
229			// Set Var {$fieldName}
230			include_once XOOPS_ROOT_PATH.'/class/uploader.php';
231			\$uploaddir = {$stuModuleDirname}_UPLOAD_PATH.'/images/{$tableName}';
232			\$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
233			\${$moduleDirname}->getConfig('maxsize'), null, null);
234			if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][0])) {
235			\$extension = preg_replace( '/^.+\.([^.]+)$/sU' , '' , \$_FILES['attachedfile']['name']);
236			\$imgName = str_replace(' ', '', \$_POST['{$fpmf}']).'.'.\$extension;
237			\$uploader->setPrefix(\$imgName);
238			\$uploader->fetchMedia(\$_POST['xoops_upload_file'][0]);
239			if (!\$uploader->upload()) {
240			\$errors = \$uploader->getErrors();
241			redirect_header('javascript:history.go(-1)', 3, \$errors);
242			} else {
243			\${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
244			}
245			} else {
246			\${$tableName}Obj->setVar('{$fieldName}', \$_POST['{$fieldName}']);
247			}\n
248			EOT;
249
250			return $ret;
251			}
252
253			/**
254			* @public function getUploadFileSetVar
255			* @param string $moduleDirname
256			* @param string $tableName
257			* @param string $fieldName
258			* @return string
259			*/
260			public function getUploadFileSetVar($moduleDirname, $tableName, $fieldName)
261			{
262			$stuModuleDirname = mb_strtoupper($moduleDirname);
263			$ret = <<<EOT
264			// Set Var {$fieldName}
265			include_once XOOPS_ROOT_PATH.'/class/uploader.php';
266			\$uploaddir = {$stuModuleDirname}_UPLOAD_PATH.'/files/{$tableName}';
267			\$uploader = new \XoopsMediaUploader(\$uploaddir, \${$moduleDirname}->getConfig('mimetypes'),
268			\${$moduleDirname}->getConfig('maxsize'), null, null);
269			if (\$uploader->fetchMedia(\$_POST['xoops_upload_file'][])) {
270			//\$uploader->setPrefix('{$fieldName}_') ;
271			//\$uploader->fetchMedia(\$_POST['xoops_upload_file'][]);
272			if (!\$uploader->upload()) {
273			\$errors = \$uploader->getErrors();
274			redirect_header('javascript:history.go(-1)', 3, \$errors);
275			} else {
276			\${$tableName}Obj->setVar('{$fieldName}', \$uploader->getSavedFileName());
277			}
278			}\n
279			EOT;
280
281			return $ret;
282			}
283
284			/**
285			* @public function getUserSaveFieldId
286			* @param $fields
287			*
288			* @return string
289			*/
290			public function getUserSaveFieldId($fields)
291			{
292			foreach (array_keys($fields) as $f) {
293			if (0 == $f) {
294			$fieldId = $fields[$f]->getVar('field_name');
295			}
296			}
297
298			return $fieldId;
			0 ignored issues – show Comprehensibility Best Practice introduced 2020-01-02 01:34 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$fieldId` does not seem to be defined for all execution paths leading up to this point. Loading history...
299			}
300
301			/**
302			* @public function getUserSaveFieldMain
303			* @param $fields
304			*
305			* @return string
306			*/
307			public function getUserSaveFieldMain($fields)
308			{
309			foreach (array_keys($fields) as $f) {
310			if (1 == $fields[$f]->getVar('field_main')) {
311			$fieldMain = $fields[$f]->getVar('field_name');
312			}
313			}
314
315			return $fieldMain;
			0 ignored issues – show Comprehensibility Best Practice introduced 2020-01-02 01:34 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$fieldMain` does not seem to be defined for all execution paths leading up to this point. Loading history...
316			}
317
318			/**
319			* @public function getUserSaveElements
320			* @param $moduleDirname
321			* @param $tableName
322			* @param $fields
323			*
324			* @return string
325			*/
326			public function getUserSaveElements($moduleDirname, $tableName, $fields)
327			{
328			$ret = '';
329			foreach (array_keys($fields) as $f) {
330			$fieldName = $fields[$f]->getVar('field_name');
331			$fieldElement = $fields[$f]->getVar('field_element');
332			if (1 == $fields[$f]->getVar('field_main')) {
333			$fieldMain = $fieldName;
334			}
335			if ((5 == $fieldElement) \|\| (6 == $fieldElement)) {
336			$ret .= $this->getCheckBoxOrRadioYNSetVar($tableName, $fieldName);
337			} elseif (13 == $fieldElement) {
338			$ret .= $this->getUploadImageSetVar($moduleDirname, $tableName, $fieldName, $fieldMain);
			0 ignored issues – show Comprehensibility Best Practice introduced 2020-01-02 01:34 UTC by Report Bug Copy Issue Report Show Similar Issues like this The variable `$fieldMain` does not seem to be defined for all execution paths leading up to this point. Loading history...
339			} elseif (14 == $fieldElement) {
340			$ret .= $this->getUploadFileSetVar($moduleDirname, $tableName, $fieldName);
341			} elseif (15 == $fieldElement) {
342			$ret .= $this->getTextDateSelectSetVar($tableName, $fieldName);
343			} else {
344			$ret .= $this->getSimpleSetVar($tableName, $fieldName);
345			}
346			}
347
348			return $ret;
349			}
350
351			/**
352			* @public function getSimpleGetVar
353			* @param string $lpFieldName
354			* @param string $rpFieldName
355			* @param string $tableName
356			* @param string $fieldName
357			* @return string
358			*/
359			public function getSimpleGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
360			{
361			$ret = <<<EOT
362			\t\t// Get Var {$fieldName}
363			\t\t\${$lpFieldName}['{$rpFieldName}'] = \${$tableName}All[\$i]->getVar('{$fieldName}');\n
364			EOT;
365
366			return $ret;
367			}
368
369			/**
370			* @public function getTopicGetVar
371			* @param string $lpFieldName
372			* @param string $rpFieldName
373			* @param string $tableName
374			* @param string $tableNameTopic
375			* @param string $fieldNameParent
376			* @param string $fieldNameTopic
377			* @return string
378			*/
379			public function getTopicGetVar($lpFieldName, $rpFieldName, $tableName, $tableNameTopic, $fieldNameParent, $fieldNameTopic)
380			{
381			$ret = <<<EOT
382			\t\t// Get Var {$fieldNameParent}
383			\t\t\${$rpFieldName} =& \${$tableNameTopic}Handler->get(\${$tableName}All[\$i]->getVar('{$fieldNameParent}'));
384			\t\t\${$lpFieldName}['{$rpFieldName}'] = \${$rpFieldName}->getVar('{$fieldNameTopic}');\n
385			EOT;
386
387			return $ret;
388			}
389
390			/**
391			* @public function getUploadImageGetVar
392			* @param string $lpFieldName
393			* @param string $rpFieldName
394			* @param string $tableName
395			* @param string $fieldName
396			* @return string
397			*/
398			public function getUploadImageGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
399			{
400			$ret = <<<EOT
401			\t\t// Get Var {$fieldName}
402			\t\t\${$fieldName} = \${$tableName}All[\$i]->getVar('{$fieldName}');
403			\t\t\$upload_image = \${$fieldName} ? \${$fieldName} : 'blank.gif';
404			\t\t\${$lpFieldName}['{$rpFieldName}'] = \$upload_image;\n
405			EOT;
406
407			return $ret;
408			}
409
410			/**
411			* @public function getUrlFileGetVar
412			* @param string $lpFieldName
413			* @param string $rpFieldName
414			* @param string $tableName
415			* @param string $fieldName
416			* @return string
417			*/
418			public function getUrlFileGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
419			{
420			$ret = <<<EOT
421			\t\t\t\t// Get Var {$fieldName}
422			\t\t\t\t\${$lpFieldName}['{$rpFieldName}'] = \${$tableName}All[\$i]->getVar('{$fieldName}');\n
423			EOT;
424
425			return $ret;
426			}
427
428			/**
429			* @public function getTextAreaGetVar
430			* @param string $lpFieldName
431			* @param string $rpFieldName
432			* @param string $tableName
433			* @param string $fieldName
434			* @return string
435			*/
436			public function getTextAreaGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
437			{
438			$ret = <<<EOT
439			\t\t// Get Var {$fieldName}
440			\t\t\${$lpFieldName}['{$rpFieldName}'] = strip_tags(\${$tableName}All[\$i]->getVar('{$fieldName}'));\n
441			EOT;
442
443			return $ret;
444			}
445
446			/**
447			* @public function getSelectUserGetVar
448			* @param string $lpFieldName
449			* @param string $rpFieldName
450			* @param string $tableName
451			* @param string $fieldName
452			* @return string
453			*/
454			public function getSelectUserGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
455			{
456			$ret = <<<EOT
457			\t\t// Get Var {$fieldName}
458			\t\t\${$lpFieldName}['{$rpFieldName}'] = \XoopsUser::getUnameFromId(\${$tableName}All[\$i]->getVar('{$fieldName}'), 's');\n
459			EOT;
460
461			return $ret;
462			}
463
464			/**
465			* @public function getTextDateSelectGetVar
466			* @param string $lpFieldName
467			* @param string $rpFieldName
468			* @param string $tableName
469			* @param string $fieldName
470			* @return string
471			*/
472			public function getTextDateSelectGetVar($lpFieldName, $rpFieldName, $tableName, $fieldName)
473			{
474			$ret = <<<EOT
475			\t\t// Get Var {$fieldName}
476			\t\t\${$lpFieldName}['{$rpFieldName}'] = formatTimeStamp(\${$tableName}All[\$i]->getVar('{$fieldName}'), 's');\n
477			EOT;
478
479			return $ret;
480			}
481			}
482

mambax7 / tdmcreate-1.91

Issues (519)

Security Analysis not enabled

class/Files/User/UserObjects.php (3 issues)

Labels

Severity

Introduced By

Duplication Side-by-Side

Filter issues like