Issues (663)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

admin/martin.hotel.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
include_once __DIR__ . '/admin_header.php';
3
/*
4
 * 处理
5
 **/
6
7
//头部
8
include "martin.header.php";
9
$currentFile   = basename(__FILE__);
10
$myModuleAdmin = new ModuleAdmin();
11
echo $myModuleAdmin->addNavigation($currentFile);
12
13
//parameter 参数
14
$action        = isset($_POST['action']) ? $_POST['action'] : @$_GET['action'];
15
$action        = empty($action) ? 'list' : $action;
16
$action        = trim(strtolower($action));
17
$id            = !empty($_POST['id']) ? $_POST['id'] : @$_GET['id'];
18
$id            = (int)($id);
19
$start         = isset($_GET['start']) ? (int)($_GET['start']) : 0;
20
$hotel_city_id = isset($_GET['hotel_city_id']) ? (int)($_GET['hotel_city_id']) : 0;
21
22
$searchData = array(
23
    'hotel_city_id' => (int)($_GET['hotel_city_id']),
24
    'hotel_star'    => (int)($_GET['hotel_star']),
25
    'hotel_name'    => trim($_GET['hotel_name']));
26
//确认删除
27
$confirm = (isset($_POST['confirm'])) ? $_POST['confirm'] : 0;
28
//parameter 参数
29
30
//模块配置
31
$Ranks = GetRanks($xoopsModuleConfig);
32
//Hotels
33
$hotel_handler =& xoops_getmodulehandler('hotel', MARTIN_DIRNAME, true);
34
//城市
35
$hotelcity_handler =& xoops_getmodulehandler('hotelcity', MARTIN_DIRNAME, true);
36
//是否存在
37
if ($id > 0 && !$hotel_handler->CheckExist($id)) {
38
    redirect_header(XOOPS_URL, 3, _AM_MARTIN_UNAUTHORIZED_ACCESS);
39
}
40
$HotelCityObj = $hotelcity_handler->create();
41
//Hotels
42
$HotelObj = $id > 0 ? $hotel_handler->get($id) : $hotel_handler->create();
43
44
$TmpFilePath = '../images/hotel/tmp/';
45
$FilePath    = '../images/hotel/';
46
$FileType    = array('.jpg', '.bmp', '.png', '.gif', '.jpeg');
47
48
// martin_adminMenu(2, "订房后台 > 酒店管理");
49
50
switch ($action) {
51 View Code Duplication
    case "add":
52
        include MARTIN_ROOT_PATH . 'include/form.hotel.php';
53
        martin_collapsableBar('createtable', 'createtableicon', _AM_MARTIN_ADD_HOTEL, _AM_MARTIN_ADD_HOTEL);
54
        //Create_button(array('addcity'=>array('url'=>'mconfirmartin.hotel.city.php?action=add','value'=>_AM_MARTIN_CITY_NAME)));
55
        $form = new form_hotel($HotelObj, $HotelCityObj);
56
57
        $form->display();
58
        martin_close_collapsable('createtable', 'createtableicon');
0 ignored issues
show
The call to the function martin_close_collapsable() seems unnecessary as the function has no side-effects.
Loading history...
59
        break;
60
    case "save":
61
        $alias_url = str_replace(' ', '-', addslashes($_POST['hotel_alias']));
62
        $alias_url = ($hotel_handler->CheckAliasExist($alias_url, $id)) ? $alias_url . '-' . mt_rand(10000, 100000) : $alias_url;
63
64
        $hotel_city_id = implode(',', $_POST['hotel_city_id']);
65
66
        $HotelObj->setVar('hotel_id', $id);
67
        $HotelObj->setVar('hotel_city', (isset($_POST['hotel_city'])) ? (int)($_POST['hotel_city']) : 0);
68
        $HotelObj->setVar('hotel_city_id', $hotel_city_id);
69
        $HotelObj->setVar('hotel_environment', (isset($_POST['hotel_environment'])) ? addslashes($_POST['hotel_environment']) : '');
70
        $HotelObj->setVar('hotel_rank', (isset($_POST['hotel_rank'])) ? (int)($_POST['hotel_rank']) : 0);
71
        $HotelObj->setVar('hotel_name', (isset($_POST['hotel_name'])) ? addslashes($_POST['hotel_name']) : '');
72
        $HotelObj->setVar('hotel_enname', (isset($_POST['hotel_enname'])) ? addslashes($_POST['hotel_enname']) : '');
73
        $HotelObj->setVar('hotel_alias', (isset($_POST['hotel_alias'])) ? $alias_url : '');
74
        $HotelObj->setVar('hotel_keywords', (isset($_POST['hotel_keywords'])) ? addslashes($_POST['hotel_keywords']) : '');
75
        $HotelObj->setVar('hotel_tags', (isset($_POST['hotel_tags'])) ? addslashes($_POST['hotel_tags']) : '');
76
        $HotelObj->setVar('hotel_description', (isset($_POST['hotel_description'])) ? addslashes($_POST['hotel_description']) : '');
77
        $HotelObj->setVar('hotel_star', (isset($_POST['hotel_star'])) ? (int)($_POST['hotel_star']) : 0);
78
        $HotelObj->setVar('hotel_address', (isset($_POST['hotel_address'])) ? addslashes($_POST['hotel_address']) : '');
79
        $HotelObj->setVar('hotel_telephone', (isset($_POST['hotel_telephone'])) ? addslashes($_POST['hotel_telephone']) : '');
80
        $HotelObj->setVar('hotel_fax', (isset($_POST['hotel_fax'])) ? addslashes($_POST['hotel_fax']) : '');
81
        $HotelObj->setVar('hotel_room_count', (isset($_POST['hotel_room_count'])) ? (int)($_POST['hotel_room_count']) : 0);
82
83
        //file upload
84
        $hotel_icon = isset($_POST['hotel_icon_old']) ? $_POST['hotel_icon_old'] : null;
85
86
        include XOOPS_ROOT_PATH . '/class/uploader.php';
87
88
        if (!empty($_FILES['hotel_icon']['tmp_name'])) {
89
            $path           = MARTIN_ROOT_PATH . '/images/hotelicon/';
90
            $FileTypeUpload = array("image/jpg", "image/png", "image/gif", "image/jpeg");
91
            $uploader       = new XoopsMediaUploader($path, $FileTypeUpload, 2048 * 1024);
92
            if ($uploader->fetchMedia($_POST["xoops_upload_file"][0])) {
93
                $uploader->ext = strtolower(ltrim(strrchr($uploader->getMediaName(), '.'), '.'));
94
                $SaveFileName  = time() . mt_rand(1000, 10000) . "." . $uploader->ext;
95
                $uploader->setTargetFileName($SaveFileName);
96
                if (!$uploader->upload()) {
97
                    xoops_error($uploader->getErrors());
98
                    exit();
99
                } elseif (file_exists($uploader->getSavedDestination())) {
100
                    //delete images
101
                    if (!empty($hotel_icon)) {
102
                        unlink(MARTIN_ROOT_PATH . '/images/hotelicon/' . $hotel_icon);
103
                    }
104
                    $hotel_icon = $uploader->getSavedFileName();
105
                }
106
            } else {
107
                xoops_error($uploader->getErrors());
108
            }
109
        }
110
111
        //echo $hotel_icon;exit;
112
113
        $hotel_icon = empty($hotel_icon) ? 'hotel.jpg' : $hotel_icon;
114
        $HotelObj->setVar('hotel_icon', $hotel_icon);
115
116
        //得到图片
117
        $images = array();
118
        if (!empty($_POST['FileData']) && is_array($_POST['FileData'])) {
119
            foreach ($_POST['FileData'] as $key => $Value) {
120
                if ($id > 0 && file_exists($FilePath . $key)) {
121
                    $images[] = array('filename' => $key, 'alt' => $Value);
122
                    continue;
123
                }
124
                foreach ($FileType as $Prefix) {
125
                    $TmpFileName = $TmpFilePath . $key . $Prefix;
126
                    if (file_exists($TmpFileName)) {
127
                        $FileName = time() . mt_rand(1000, 10000) . $Prefix;
128
                        $images[] = array('filename' => $FileName, 'alt' => $Value);
129
                        copy($TmpFileName, $FilePath . $FileName);
130
                        break;
131
                    }
132
                }
133
            }
134
        }
135
        //clear dir
136
        deldir($TmpFilePath);
137
138
        $HotelObj->setVar('hotel_image', serialize($images));
139
        $HotelObj->setVar('hotel_google', serialize(array($_POST['GmapLatitude'], $_POST['GmapLongitude'])));
140
        $HotelObj->setVar('hotel_characteristic', (isset($_POST['hotel_characteristic'])) ? addslashes($_POST['hotel_characteristic']) : '');
141
        $HotelObj->setVar('hotel_reminded', (isset($_POST['hotel_reminded'])) ? addslashes($_POST['hotel_reminded']) : '');
142
        $HotelObj->setVar('hotel_facility', (isset($_POST['hotel_facility'])) ? addslashes($_POST['hotel_facility']) : '');
143
        $HotelObj->setVar('hotel_info', (isset($_POST['hotel_info'])) ? ($_POST['hotel_info']) : '');
144
        $HotelObj->setVar('hotel_status', (isset($_POST['hotel_status'])) ? (int)($_POST['hotel_status']) : 0);
145
        //$HotelObj->setVar('hotel_open_time',strtotime(trim($_POST['hotel_open_time']['date'])) + (int)(trim($_POST['hotel_open_time']['time'])) );
146
        $HotelObj->setVar('hotel_open_time', strtotime(trim($_POST['hotel_open_time'])));
147
        $HotelObj->setVar('hotel_add_time', time());
148
149
        //var_dump($HotelObj);
150
        //var_dump($_POST);
151
        if (!$id) {
152
            $HotelObj->setNew();
153
        }
154
155
        if ($HotelObj->isNew()) {
156
            $redirect_msg = _AM_MARTIN_ADDED_SUCCESSFULLY;
157
            $redirect_to  = 'martin.hotel.php';
158
        } else {
159
            $redirect_msg = _AM_MARTIN_MODIFIED_SUCCESSFULLY;
160
            $redirect_to  = 'martin.hotel.php';
161
        }
162
        if (!$hotel_handler->insert($HotelObj)) {
163
            if ($HotelObj->_errors) {
164
                xoops_error($HotelObj->error);
165
            }
166
            redirect_header('javascript:history.go(-1);', 2, _AM_MARTIN_OPERATION_FAILED);
167
            exit();
168
        }
169
170
        $hotel_id   = $HotelObj->getVar('hotel_id');
171
        $hotel_tags = $HotelObj->getVar('hotel_tags');
172
        // hotel tag
173
        if ($hotel_id > 0 && !empty($hotel_tags)) {
174
            $hotel_handler->updateTags($HotelObj);
175
        }
176
177
        redirect_header($redirect_to, 2, $redirect_msg);
178
        break;
179
    /*case "upload":
180
            include MARTIN_ROOT_PATH . "admin/upload.php";
181
        break;
182
    case "showtmpimg":
183
            include MARTIN_ROOT_PATH . "admin/thumbnail.php";
184
        break;*/
185
    case "saverank":
186
        $RankData = $_POST['Ranks'];
187
        $savemsg  = _AM_MARTIN_SAVING_FAILED;
188
        if ($hotel_handler->saveRank($RankData)) {
189
            $savemsg = _AM_MARTIN_SAVING_SUCCESSFUL;
190
        }
191
        redirect_header('martin.hotel.php', 2, $savemsg);
192
        break;
193
    case "deleteimg":
194
        $HotelImgPath = MARTIN_ROOT_PATH . 'images/hotel/';
195
        $HotelImgName = isset($_POST['img']) ? $_POST['img'] : $_GET['img'];
196
        $FullImg      = $HotelImgPath . $HotelImgName;
197
        if (file_exists($FullImg) && is_writable($FullImg)) {
198
            unlink($FullImg);
199
        }
200
        break;
201 View Code Duplication
    case "del":
202
        if (!$confirm) {
203
            xoops_confirm(array('op' => 'del', 'id' => $id, 'confirm' => 1, 'name' => $HotelObj->hotel_name()), '?action=del', _DELETE . " '" . $HotelObj->hotel_name() . "'. <br /> <br />". _AM_MARTIN_OK_TO_DELETE_HOTEL, _DELETE);
204
        } else {
205
            if ($hotel_handler->delete($HotelObj)) {
206
                $redirect_msg = _AM_MARTIN_OK_TO_DELETE_THE_ORDER;
207
                $redirect_to  = "martin.hotel.php";
208
            } else {
209
                $redirect_msg = _AM_MARTIN_DELETE_FAILED;
210
                $redirect_to  = "javascript:history.go(-1);";
211
            }
212
            redirect_header($redirect_to, 2, $redirect_msg);
213
        }
214
215
        break;
216
    case "list":
217
        martin_collapsableBar('createtable', 'createtableicon', _AM_MARTIN_HOTEL_LIST, _AM_MARTIN_HOTEL_LIST);
218
        Create_button(array('addhotel' => array('url' => 'martin.hotel.php?action=add', 'value' => _AM_MARTIN_ADD_HOTEL)));
219
220
        $HotelObjs = $hotel_handler->getHotelList($searchData, $xoopsModuleConfig['perpage'], $start);
221
        //print_r($hotel_handler->hotel_ids);
222
        $hotelRooms = $hotel_handler->GethotelRooms();
223
224
        //分页
225
        $HotelCout = $hotel_handler->getCount($searchData);
226
        include_once XOOPS_ROOT_PATH . '/class/pagenav.php';
227
        $pagenav = new XoopsPageNav($HotelCout, $xoopsModuleConfig['perpage'], $start, 'start', "hotel_city_id={$searchData['hotel_city_id']}&hotel_star={$searchData['hotel_star']}&hotel_name={$searchData['hotel_name']}&start");
228
        $pavStr  = '<div style="text-align:left;">' . $pagenav->renderNav() . '</div>';
229
230
        $StarStr = "<option value='0'>----</option>";
231
        foreach ($Ranks as $key => $Rank) {
232
            $selected = $key == $_GET['hotel_star'] ? ' selected' : '';
233
            $StarStr .= "<option value='$key' $selected>$Rank</option>";
234
        }
235
        // Creating the objects for top categories
236
        echo "$pavStr<table width='100%' cellspacing=1 cellpadding=9 border=0 class = outer>";
237
        echo "<tr><td class='bg3' align='right'>
238
            <form action='' method='get'>
239
            " . _AM_MARTIN_HOTEL_AREA . ":{$hotelcity_handler->getTree('hotel_city_id', $_GET['hotel_city_id'])}
240
            " . _AM_MARTIN_HOTEL_STARS . ":<select name='hotel_star'>$StarStr</select>
241
            " . _AM_MARTIN_HOTEL_NAME . ":<input type='text' name='hotel_name' value='{$_GET['hotel_name']}'>
242
            <input type='submit' value=" . _AM_MARTIN_SEARCH . ">
243
            </form>
244
            </td></tr>";
245
        echo "</table>";
246
        echo "<form action='martin.hotel.php?action=saverank' method='post'><div align='right'><input type='submit' value='" . _AM_MARTIN_SAVE_RANK . "'.</div><table width='100%' cellspacing=1 cellpadding=9 border=0 class = outer>";
247
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_NAME . "</b></td>";
248
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_ROOM_TYPE . "</b></td>";
249
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_AREA . "</b></td>";
250
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_STARS . "</b></td>";
251
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_PHONE . "</b></td>";
252
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_FAX . "</b></td>";
253
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_THE_NUMBER_OF_ROOMS . "</b></td>";
254
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_STATUS . "</b></td>";
255
        echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_SORTING . "</b><br></td>";
256
        echo "<td width='150' class='bg3' align='center'><b>" . _AM_MARTIN_ACTIONS . "</b></td>";
257
        echo "</tr>";
258
        $Status = array('<div style="background-color:#FF0000">' . _AM_MARTIN_DRAFT . '</div>', '<div style="background-color:#00FF00">' . _AM_MARTIN_PUBLISH . '</div>');
259
        if ($HotelCout > 0) {
260
            foreach ($HotelObjs as $hotel) {
261
                $add       = "<a href='martin.hotel.service.php?action=addhotel&hotel_id=" . $hotel['hotel_id'] . "' title='" . _AM_MARTIN_ADD_HOTEL_SERVICE . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/add.jpg'/></a>";
262
                $addroom   = "<a href='martin.room.php?action=add&hotel_id=" . $hotel['hotel_id'] . "' title='" . _AM_MARTIN_ADD_HOTEL_ROOMS . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/addroom.jpg'/></a>";
263
                $modify    = "<a href='?action=add&id=" . $hotel['hotel_id'] . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/edit.gif'/></a>";
264
                $delete    = "<a href='?action=del&id=" . $hotel['hotel_id'] . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/delete.gif'/></a>";
265
                $hotel_url = XOOPS_URL . '/hotel-' . $hotel['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix'];
266
                echo '<tr>';
267
                echo "<td class='even' align='lefet'><a href='$hotel_url'>{$hotel['hotel_name']}</a></td>";
268
                echo "<td class='even' align='lefet'><a href='martin.room.php?action=add&amp;hotel_id={$hotel['hotel_id']}'><img src='../images/icon/add_btn_icon.gif' title='" . _AM_MARTIN_NEW_ROOM_TYPES . "'></a></td>";
269
                echo "<td class='even' align='lefet'>{$hotel['city_name']}</td>";
270
                echo "<td class='even' align='lefet'>{$Ranks[$hotel['hotel_star']]}</td>";
271
                echo "<td class='even' align='lefet'>{$hotel['hotel_telephone']}</td>";
272
                echo "<td class='even' align='lefet'>{$hotel['hotel_fax']}</td>";
273
                echo "<td class='even' align='lefet'>{$hotel['hotel_room_count']}</td>";
274
                echo "<td class='even' align='lefet'>{$Status[$hotel['hotel_status']]}</td>";
275
                echo "<td class='even' align='lefet'><input type='text' name='Ranks[{$hotel['hotel_id']}]' size=5 value='{$hotel['hotel_rank']}'></td>";
276
                echo "<td class='even' align='center'> $addroom &nbsp; $add &nbsp; $modify &nbsp; $delete </td>";
277
                echo '</tr>';
278
                $rooms = isset($hotelRooms[$hotel['hotel_id']]) ? $hotelRooms[$hotel['hotel_id']] : null;
279
                if (is_array($rooms)) {
280
                    foreach ($rooms as $room) {
281
                        echo '<tr>';
282
                        echo "<td class='even' align='lefet'></td>";
283
                        echo "<td class='even' align='lefet'><a href='martin.room.php?action=add&amp;id={$room['room_id']}'>{$room['room_type_info']}</a></td>";
284
                        echo "<td class='even' align='lefet'>" . _AM_MARTIN_HOTEL_AREA . ":{$room['room_area']}</td>";
285
                        echo "<td class='even' align='lefet'>" . _AM_MARTIN_HOTEL_FLOOR . ":{$room['room_floor']}</td>";
286
                        echo "<td class='even' align='lefet'>{$Status[$room['room_status']]}</td>";
287
                        echo "<td class='even' align='lefet'><a href='martin.room.php?action=addprice&amp;room_id={$room['room_id']}'>" . _AM_MARTIN_PRICE_MANAGEMENT . "</a></td>";
288
                        echo "<td class='even' align='lefet'></td>";
289
                        echo "<td class='even' align='lefet'></td>";
290
                        echo "<td class='even' align='lefet'></td>";
291
                        echo "<td class='even' align='center'></td>";
292
                        echo '</tr>';
293
                    }
294
                }
295
            }
296
        } else {
297
            echo "<tr>";
298
            echo "<td class='head' align='center' colspan= '9'>" . MARTIN_IS_NUll . "</td>";
299
            echo "</tr>";
300
            $categoryid = '0';
301
        }
302
        echo "</table></form>\n";
303
        echo "$pavStr<br />";
304
        martin_close_collapsable('createtable', 'createtableicon');
0 ignored issues
show
The call to the function martin_close_collapsable() seems unnecessary as the function has no side-effects.
Loading history...
305
        echo "<br>";
306
307
        break;
308
309
        martin_close_collapsable('createtable', 'createtableicon');
0 ignored issues
show
The call to the function martin_close_collapsable() seems unnecessary as the function has no side-effects.
Loading history...
310
        echo "<br>";
311
        break;
312
    default:
313
        redirect_header(XOOPS_URL, 2, _AM_MARTIN_UNAUTHORIZED_ACCESS);
314
        break;
315
}
316
317
//底部
318
include_once __DIR__ . '/admin_footer.php';
319