mambax7 /
xooghost
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
| 1 | <?php |
||||||
| 2 | |||||||
| 3 | namespace XoopsModules\Xooghost; |
||||||
| 4 | |||||||
| 5 | /** |
||||||
| 6 | * Xooghost module |
||||||
| 7 | * |
||||||
| 8 | * You may not change or alter any portion of this comment or credits |
||||||
| 9 | * of supporting developers from this source code or any supporting source code |
||||||
| 10 | * which is considered copyrighted (c) material of the original comment or credit authors. |
||||||
| 11 | * This program is distributed in the hope that it will be useful, |
||||||
| 12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
| 13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
||||||
| 14 | * |
||||||
| 15 | * @copyright XOOPS Project (https://xoops.org) |
||||||
| 16 | * @license GNU GPL 2 (http://www.gnu.org/licenses/old-licenses/gpl-2.0.html) |
||||||
| 17 | * @package Xooghost |
||||||
| 18 | * @since 2.6.0 |
||||||
| 19 | * @author Laurent JEN (Aka DuGris) |
||||||
| 20 | */ |
||||||
| 21 | use Xoops\Core\Kernel\Handlers\XoopsUser; |
||||||
| 22 | use Xoops\Core\Request; |
||||||
| 23 | |||||||
| 24 | /** |
||||||
| 25 | * Class Page |
||||||
| 26 | */ |
||||||
| 27 | class Page extends \XoopsObject |
||||||
| 28 | { |
||||||
| 29 | private $exclude_page = [ |
||||||
| 30 | 'index', |
||||||
| 31 | 'search', |
||||||
| 32 | 'tag', |
||||||
| 33 | 'userinfo', |
||||||
| 34 | 'page_comment', |
||||||
| 35 | 'pages', |
||||||
| 36 | ]; |
||||||
| 37 | private $php_self = ''; |
||||||
| 38 | |||||||
| 39 | // constructor |
||||||
| 40 | |||||||
| 41 | public function __construct() |
||||||
| 42 | { |
||||||
| 43 | $xoops = \Xoops::getInstance(); |
||||||
| 44 | $this->php_self = basename($xoops->getEnv('PHP_SELF'), '.php'); |
||||||
| 45 | |||||||
| 46 | $this->initVar('xooghost_id', XOBJ_DTYPE_INT, 0, true, 11); |
||||||
| 47 | $this->initVar('xooghost_url', XOBJ_DTYPE_TXTBOX, '', true, 54); |
||||||
| 48 | $this->initVar('xooghost_title', XOBJ_DTYPE_TXTBOX, '', true, 255); |
||||||
| 49 | $this->initVar('xooghost_uid', XOBJ_DTYPE_INT, 0, true, 8); |
||||||
| 50 | $this->initVar('xooghost_content', XOBJ_DTYPE_TXTBOX, '', true); |
||||||
| 51 | $this->initVar('xooghost_description', XOBJ_DTYPE_TXTAREA, '', false); |
||||||
| 52 | $this->initVar('xooghost_keywords', XOBJ_DTYPE_TXTAREA, '', false); |
||||||
| 53 | $this->initVar('xooghost_image', XOBJ_DTYPE_TXTBOX, 'blank.gif', false, 100); |
||||||
| 54 | $this->initVar('xooghost_published', XOBJ_DTYPE_STIME, 0, false, 10); |
||||||
| 55 | $this->initVar('xooghost_online', XOBJ_DTYPE_INT, 1, false, 1); |
||||||
| 56 | $this->initVar('xooghost_hits', XOBJ_DTYPE_INT, 0, false, 10); |
||||||
| 57 | $this->initVar('xooghost_rates', XOBJ_DTYPE_INT, 0, false, 10); |
||||||
| 58 | $this->initVar('xooghost_like', XOBJ_DTYPE_INT, 0, false, 10); |
||||||
| 59 | $this->initVar('xooghost_dislike', XOBJ_DTYPE_INT, 0, false, 10); |
||||||
| 60 | $this->initVar('xooghost_comments', XOBJ_DTYPE_INT, 0, false, 10); |
||||||
| 61 | |||||||
| 62 | // Pour autoriser le html |
||||||
| 63 | $this->initVar('dohtml', XOBJ_DTYPE_INT, 1, false); |
||||||
| 64 | |||||||
| 65 | // Module |
||||||
| 66 | $helper = \XoopsModules\Xooghost\Helper::getInstance(); |
||||||
| 67 | $this->config = $helper->loadConfig(); |
||||||
|
0 ignored issues
–
show
Bug
Best Practice
introduced
by
Loading history...
The method
loadConfig() does not exist on Xoops\Module\Helper\HelperAbstract. It seems like you code against a sub-type of Xoops\Module\Helper\HelperAbstract such as XoopsModules\Xooghost\Helper.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 68 | $this->rldHandler = $helper->getHandler('Rld'); |
||||||
|
0 ignored issues
–
show
|
|||||||
| 69 | } |
||||||
| 70 | |||||||
| 71 | /** |
||||||
| 72 | * @param bool $addpost |
||||||
| 73 | */ |
||||||
| 74 | public function setPost($addpost = true) |
||||||
| 75 | { |
||||||
| 76 | $xoops = \Xoops::getInstance(); |
||||||
| 77 | $memberHandler = $xoops->getHandlerMember(); |
||||||
| 78 | $poster = $memberHandler->getUser($this->getVar('xooghost_uid')); |
||||||
| 79 | if ($poster instanceof XoopsUser) { |
||||||
|
0 ignored issues
–
show
|
|||||||
| 80 | if ($addpost) { |
||||||
| 81 | $memberHandler->updateUserByField($poster, 'posts', $poster->getVar('posts') + 1); |
||||||
| 82 | } else { |
||||||
| 83 | $memberHandler->updateUserByField($poster, 'posts', $poster->getVar('posts') - 1); |
||||||
| 84 | } |
||||||
| 85 | } |
||||||
| 86 | } |
||||||
| 87 | |||||||
| 88 | /** |
||||||
| 89 | * @return mixed|string |
||||||
| 90 | */ |
||||||
| 91 | public function getMetaDescription() |
||||||
| 92 | { |
||||||
| 93 | $myts = \MyTextSanitizer::getInstance(); |
||||||
| 94 | if ('' != $this->getVar('xooghost_description')) { |
||||||
| 95 | $string = $this->getVar('xooghost_description'); |
||||||
| 96 | } else { |
||||||
| 97 | $string = $myts->undoHtmlSpecialChars($this->getVar('xooghost_content')); |
||||||
| 98 | } |
||||||
| 99 | |||||||
| 100 | $string = str_replace('[breakpage]', '', $string); |
||||||
| 101 | // remove html tags |
||||||
| 102 | $string = strip_tags($string); |
||||||
| 103 | // return preg_replace(array('/&/i'), array('&'), $string); |
||||||
| 104 | return $string; |
||||||
| 105 | } |
||||||
| 106 | |||||||
| 107 | /** |
||||||
| 108 | * @param int $limit |
||||||
| 109 | * |
||||||
| 110 | * @return string |
||||||
| 111 | */ |
||||||
| 112 | public function getMetaKeywords($limit = 5) |
||||||
| 113 | { |
||||||
| 114 | if ('' != $this->getVar('xooghost_keywords')) { |
||||||
| 115 | $string = $this->getVar('xooghost_keywords'); |
||||||
| 116 | } else { |
||||||
| 117 | $string = $this->getMetaDescription() . ', ' . $this->getVar('xooghost_keywords'); |
||||||
| 118 | } |
||||||
| 119 | $string .= $this->getVar('xooghost_title'); |
||||||
| 120 | |||||||
| 121 | $string = html_entity_decode($string, ENT_QUOTES); |
||||||
| 122 | $search_pattern = ["\t", "\r\n", "\r", "\n", ',', '.', "'", ';', ':', ')', '(', '"', '?', '!', '{', '}', '[', ']', '<', '>', '/', '+', '_', '\\', '*', 'pagebreak', 'page']; |
||||||
| 123 | $replace_pattern = [' ', ' ', ' ', ' ', ' ', ' ', ' ', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '']; |
||||||
| 124 | $string = str_replace($search_pattern, $replace_pattern, $string); |
||||||
| 125 | |||||||
| 126 | $tmpkeywords = explode(' ', $string); |
||||||
| 127 | $tmpkeywords = array_count_values($tmpkeywords); |
||||||
| 128 | arsort($tmpkeywords); |
||||||
| 129 | $tmpkeywords = array_keys($tmpkeywords); |
||||||
| 130 | |||||||
| 131 | $tmpkeywords = array_unique($tmpkeywords); |
||||||
| 132 | foreach ($tmpkeywords as $keyword) { |
||||||
| 133 | if (mb_strlen(trim($keyword)) >= $limit && !is_numeric($keyword)) { |
||||||
| 134 | $keywords[] = htmlentities(trim($keyword)); |
||||||
| 135 | } |
||||||
| 136 | } |
||||||
| 137 | |||||||
| 138 | return implode(', ', $keywords); |
||||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||||
| 139 | } |
||||||
| 140 | |||||||
| 141 | /** |
||||||
| 142 | * @param null $keys |
||||||
|
0 ignored issues
–
show
|
|||||||
| 143 | * @param null $format |
||||||
|
0 ignored issues
–
show
|
|||||||
| 144 | * @param null $maxDepth |
||||||
|
0 ignored issues
–
show
|
|||||||
| 145 | * |
||||||
| 146 | * @return array |
||||||
| 147 | */ |
||||||
| 148 | public function getValues($keys = null, $format = null, $maxDepth = null) |
||||||
| 149 | { |
||||||
| 150 | $xoops = \Xoops::getInstance(); |
||||||
| 151 | $myts = \MyTextSanitizer::getInstance(); |
||||||
| 152 | $ret = parent::getValues(); |
||||||
| 153 | |||||||
| 154 | $dateformat = $this->config['xooghost_date_format']; |
||||||
| 155 | $ret['xooghost_date_day'] = date('d', $this->getVar('xooghost_published')); |
||||||
| 156 | $ret['xooghost_date_month'] = date('m', $this->getVar('xooghost_published')); |
||||||
| 157 | $ret['xooghost_date_year'] = date('Y', $this->getVar('xooghost_published')); |
||||||
| 158 | $ret['xooghost_time'] = $this->getVar('xooghost_published'); |
||||||
| 159 | $ret['xooghost_published'] = date(constant($dateformat), $this->getVar('xooghost_published')); |
||||||
| 160 | |||||||
| 161 | $ret['xooghost_link'] = \XoopsBaseConfig::get('url') . '/modules/xooghost/' . $this->getVar('xooghost_url'); |
||||||
| 162 | |||||||
| 163 | $ret['xooghost_uid_name'] = \XoopsUser::getUnameFromId($this->getVar('xooghost_uid'), true); |
||||||
| 164 | |||||||
| 165 | if ('blank.gif' !== $this->getVar('xooghost_image')) { |
||||||
| 166 | $ret['xooghost_image_link'] = $xoops_upload_url . '/xooghost/images/' . $this->getVar('xooghost_image'); |
||||||
|
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
|
|||||||
| 167 | } else { |
||||||
| 168 | $ret['xooghost_image_link'] = \XoopsBaseConfig::get('url') . '/' . $xoops->theme()->resourcePath('/modules/xooghost/assets/images/pages.png'); |
||||||
| 169 | } |
||||||
| 170 | |||||||
| 171 | if (in_array($this->php_self, $this->exclude_page, true) && false !== mb_strpos($this->getVar('xooghost_content'), '[breakpage]')) { |
||||||
|
0 ignored issues
–
show
It seems like
$this->getVar('xooghost_content') can also be of type string[]; however, parameter $haystack of mb_strpos() does only seem to accept string, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 172 | $ret['xooghost_content'] = mb_substr($this->getVar('xooghost_content'), 0, mb_strpos($this->getVar('xooghost_content'), '[breakpage]')); |
||||||
|
0 ignored issues
–
show
It seems like
$this->getVar('xooghost_content') can also be of type string[]; however, parameter $str of mb_substr() does only seem to accept string, maybe add an additional type check?
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
Loading history...
|
|||||||
| 173 | $ret['readmore'] = true; |
||||||
| 174 | } else { |
||||||
| 175 | $ret['xooghost_content'] = str_replace('[breakpage]', '', $this->getVar('xooghost_content')); |
||||||
| 176 | } |
||||||
| 177 | $ret['xooghost_content'] = $myts->undoHtmlSpecialChars($ret['xooghost_content']); |
||||||
| 178 | |||||||
| 179 | // tags |
||||||
| 180 | static $tags; |
||||||
| 181 | if (!in_array($this->php_self, $this->exclude_page, true) || 'index' === $this->php_self || 'page_print' === $this->php_self) { |
||||||
| 182 | if ($xoops->registry()->offsetExists('XOOTAGS') && $xoops->registry()->get('XOOTAGS')) { |
||||||
| 183 | $id = $this->getVar('xooghost_id'); |
||||||
|
0 ignored issues
–
show
|
|||||||
| 184 | if (!isset($tags[$this->getVar('xooghost_id')])) { |
||||||
| 185 | $xootagsHandler = \XoopsModules\Xootags\Helper::getInstance()->getHandler('Tags'); //$xoops->getModuleHandler('tags', 'xootags'); |
||||||
|
0 ignored issues
–
show
The type
XoopsModules\Xootags\Helper was not found. Maybe you did not declare it correctly or list all dependencies?
The issue could also be caused by a filter entry in the build configuration.
If the path has been excluded in your configuration, e.g. filter:
dependency_paths: ["lib/*"]
For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths Loading history...
|
|||||||
| 186 | $tags[$this->getVar('xooghost_id')] = $xootagsHandler->getbyItem($this->getVar('xooghost_id')); |
||||||
| 187 | } |
||||||
| 188 | $ret['tags'] = $tags[$this->getVar('xooghost_id')]; |
||||||
| 189 | } |
||||||
| 190 | } |
||||||
| 191 | |||||||
| 192 | return $ret; |
||||||
| 193 | } |
||||||
| 194 | |||||||
| 195 | /** |
||||||
| 196 | * @param $ret |
||||||
| 197 | * |
||||||
| 198 | * @return mixed |
||||||
| 199 | */ |
||||||
| 200 | public function getRLD($ret) |
||||||
| 201 | { |
||||||
| 202 | if (!in_array($this->php_self, $this->exclude_page, true)) { |
||||||
| 203 | if ('rate' === $this->config['xooghost_rld']['rld_mode']) { |
||||||
| 204 | $ret['xooghost_vote'] = $this->rldHandler->getVotes($this->getVar('xooghost_id')); |
||||||
|
0 ignored issues
–
show
The method
getVotes() does not exist on XoopsObjectHandler.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces. This is most likely a typographical error or the method has been renamed. Loading history...
|
|||||||
| 205 | $ret['xooghost_yourvote'] = $this->rldHandler->getbyUser($this->getVar('xooghost_id')); |
||||||
|
0 ignored issues
–
show
The method
getbyUser() does not exist on XoopsObjectHandler.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces. This is most likely a typographical error or the method has been renamed. Loading history...
|
|||||||
| 206 | } |
||||||
| 207 | } |
||||||
| 208 | |||||||
| 209 | return $ret; |
||||||
| 210 | } |
||||||
| 211 | |||||||
| 212 | /** |
||||||
| 213 | * @return bool |
||||||
| 214 | */ |
||||||
| 215 | public function createPage() |
||||||
| 216 | { |
||||||
| 217 | if (!file_exists(\XoopsBaseConfig::get('root-path') . '/modules/xooghost/' . $this->getVar('xooghost_url'))) { |
||||||
| 218 | $xoopstmp = \Xoops::getInstance(); |
||||||
| 219 | $content = $xoopstmp->tpl()->fetch('admin:xooghost/xooghost_model_page.tpl'); |
||||||
| 220 | file_put_contents(\XoopsBaseConfig::get('root-path') . '/modules/xooghost/' . $this->getVar('xooghost_url'), $content); |
||||||
| 221 | } |
||||||
| 222 | |||||||
| 223 | return true; |
||||||
| 224 | } |
||||||
| 225 | |||||||
| 226 | public function cleanVarsForDB() |
||||||
| 227 | { |
||||||
| 228 | /* |
||||||
| 229 | $request = \Xoops_Request::getInstance(); |
||||||
| 230 | $url = $request->getUrl(); |
||||||
| 231 | print_r( $request->getParam() ); |
||||||
| 232 | */ |
||||||
| 233 | $system = \System::getInstance(); |
||||||
|
0 ignored issues
–
show
|
|||||||
| 234 | foreach (parent::getValues() as $k => $v) { |
||||||
| 235 | if ('dohtml' !== $k) { |
||||||
| 236 | if (XOBJ_DTYPE_STIME == $this->vars[$k]['data_type'] || XOBJ_DTYPE_MTIME == $this->vars[$k]['data_type'] || XOBJ_DTYPE_LTIME == $this->vars[$k]['data_type']) { |
||||||
| 237 | // $value = $system->cleanVars($_POST[$k], 'date', date('Y-m-d'), 'date') + $system->cleanVars($_POST[$k], 'time', date('u'), 'int'); |
||||||
| 238 | //TODO should we use here getString?? |
||||||
| 239 | $value = Request::getArray('date', date('Y-m-d'), 'POST')[$k] + Request::getArray('time', date('u'), 'POST')[$k]; |
||||||
| 240 | $this->setVar($k, isset($_POST[$k]) ? $value : $v); |
||||||
| 241 | } elseif (XOBJ_DTYPE_INT == $this->vars[$k]['data_type']) { |
||||||
| 242 | $value = Request::getInt($k, $v, 'POST'); //$system->cleanVars($_POST, $k, $v, 'int'); |
||||||
| 243 | $this->setVar($k, $value); |
||||||
| 244 | } elseif (XOBJ_DTYPE_ARRAY == $this->vars[$k]['data_type']) { |
||||||
| 245 | $value = Request::getArray($k, $v, 'POST'); // $system->cleanVars($_POST, $k, $v, 'array'); |
||||||
| 246 | $this->setVar($k, $value); |
||||||
| 247 | } else { |
||||||
| 248 | $value = Request::getString($k, $v, 'POST'); //$system->cleanVars($_POST, $k, $v, 'string'); |
||||||
| 249 | $this->setVar($k, stripslashes($value)); |
||||||
| 250 | } |
||||||
| 251 | } |
||||||
| 252 | if ('xooghost_url' === $k) { |
||||||
| 253 | $this->setVar($k, $this->cleanURL($this->getVar($k))); |
||||||
| 254 | } |
||||||
| 255 | } |
||||||
| 256 | } |
||||||
| 257 | |||||||
| 258 | /** |
||||||
| 259 | * @param $string |
||||||
| 260 | * |
||||||
| 261 | * @return string |
||||||
| 262 | */ |
||||||
| 263 | public function cleanURL($string) |
||||||
| 264 | { |
||||||
| 265 | $string = basename($string, '.php'); |
||||||
| 266 | |||||||
| 267 | $string = str_replace('_', 'xooghost', $string); |
||||||
| 268 | $string = str_replace('-', 'xooghost', $string); |
||||||
| 269 | $string = str_replace(' ', 'xooghost', $string); |
||||||
| 270 | |||||||
| 271 | $string = preg_replace('~\p{P}~', '', $string); |
||||||
| 272 | $string = htmlentities($string, ENT_NOQUOTES, \XoopsLocale::CHARSET); |
||||||
| 273 | $string = preg_replace('~\&([A-za-z])(?:uml|circ|tilde|acute|grave|cedil|ring)\;~', '$1', $string); |
||||||
| 274 | $string = preg_replace('~\&([A-za-z]{2})(?:lig)\;~', '$1', $string); // pour les ligatures e.g. 'œ' |
||||||
| 275 | $string = preg_replace('~\&[^;]+\;~', '', $string); // supprime les autres caract�res |
||||||
| 276 | |||||||
| 277 | $string = str_replace('xooghost', '_', $string); |
||||||
| 278 | |||||||
| 279 | return $string . '.php'; |
||||||
| 280 | } |
||||||
| 281 | |||||||
| 282 | public function sendNotifications() |
||||||
| 283 | { |
||||||
| 284 | $xoops = \Xoops::getInstance(); |
||||||
| 285 | if ($xoops->isActiveModule('notifications')) { |
||||||
| 286 | $notificationHandler = \Notifications::getInstance()->getHandlerNotification(); |
||||||
| 287 | $tags = []; |
||||||
| 288 | $tags['MODULE_NAME'] = $xoops->module->getVar('name'); |
||||||
|
0 ignored issues
–
show
The method
getVar() does not exist on null.
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This check looks for calls to methods that do not seem to exist on a given type. It looks for the method on the type itself as well as in inherited classes or implemented interfaces. This is most likely a typographical error or the method has been renamed. Loading history...
|
|||||||
| 289 | $tags['ITEM_NAME'] = $this->getVar('xooghost_title'); |
||||||
| 290 | $tags['ITEM_URL'] = $xoops->url('/modules/xooghost/' . $this->getVar('xooghost_url')); |
||||||
| 291 | $tags['ITEM_BODY'] = $this->getVar('xooghost_content'); |
||||||
| 292 | $tags['DATESUB'] = $this->getVar('xooghost_published'); |
||||||
| 293 | $notificationHandler->triggerEvent('global', 0, 'newcontent', $tags); |
||||||
| 294 | } |
||||||
| 295 | } |
||||||
| 296 | } |
||||||
| 297 |