This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @ |
||
5 | * @method: |
||
6 | * @license http://www.blags.org/ |
||
7 | * @created :2010年07月03日 21时12分 |
||
8 | * @copyright 1997-2010 The Martin Group |
||
9 | * @author Martin <[email protected]> |
||
10 | * */ |
||
11 | class MartinCart extends XoopsObject |
||
12 | { |
||
13 | public function MartinCart() |
||
14 | { |
||
15 | $this->initVar("order_id", XOBJ_DTYPE_INT, null, false); |
||
16 | $this->initVar("order_type", XOBJ_DTYPE_INT, null, false); |
||
17 | $this->initVar("order_mode", XOBJ_DTYPE_INT, null, false); |
||
18 | $this->initVar("order_uid", XOBJ_DTYPE_INT, null, false); |
||
19 | $this->initVar("order_pay_method", XOBJ_DTYPE_INT, null, false); |
||
20 | $this->initVar("order_pay", XOBJ_DTYPE_TXTBOX, null, true, 25); |
||
21 | $this->initVar("order_status", XOBJ_DTYPE_INT, null, false); |
||
22 | $this->initVar("order_total_price", XOBJ_DTYPE_INT, null, false); |
||
23 | $this->initVar("order_pay_money", XOBJ_DTYPE_INT, null, false); |
||
24 | $this->initVar("order_coupon", XOBJ_DTYPE_INT, null, false); |
||
25 | $this->initVar("order_sented_coupon", XOBJ_DTYPE_INT, null, false); |
||
26 | $this->initVar("order_real_name", XOBJ_DTYPE_TXTBOX, null, true, 45); |
||
27 | $this->initVar("order_document_type", XOBJ_DTYPE_INT, null, false); |
||
28 | $this->initVar("order_document", XOBJ_DTYPE_TXTBOX, null, true, 255); |
||
29 | $this->initVar("order_telephone", XOBJ_DTYPE_TXTBOX, null, true, 45); |
||
30 | $this->initVar("order_phone", XOBJ_DTYPE_TXTBOX, null, true, 45); |
||
31 | $this->initVar("order_extra_persons", XOBJ_DTYPE_TXTAREA, null, false); |
||
32 | $this->initVar("order_note", XOBJ_DTYPE_TXTAREA, null, false); |
||
33 | $this->initVar("order_status_time", XOBJ_DTYPE_INT, null, false); |
||
34 | $this->initVar("order_submit_time", XOBJ_DTYPE_INT, null, false); |
||
35 | } |
||
36 | } |
||
37 | |||
38 | /** |
||
39 | * @martin cart handler |
||
40 | * @method: |
||
41 | * @license http://www.blags.org/ |
||
42 | * @created :2010年07月03日 21时12分 |
||
43 | * @copyright 1997-2010 The Martin Group |
||
44 | * @author Martin <[email protected]> |
||
45 | * */ |
||
46 | class MartinCartHandler extends XoopsObjectHandler |
||
47 | { |
||
48 | /** |
||
49 | * @create cart object |
||
50 | * @license http://www.blags.org/ |
||
51 | * @created :2010年07月04日 12时59分 |
||
52 | * @copyright 1997-2010 The Martin Group |
||
53 | * @author Martin <[email protected]> |
||
54 | * */ |
||
55 | public function &create() |
||
56 | { |
||
57 | $obj =& new MartinCart; |
||
58 | |||
59 | return $obj; |
||
60 | } |
||
61 | |||
62 | /** |
||
63 | * @save cart |
||
64 | * @license http://www.blags.org/ |
||
65 | * @created :2010年07月04日 12时59分 |
||
66 | * @copyright 1997-2010 The Martin Group |
||
67 | * @author Martin <[email protected]> |
||
68 | * @param $cart |
||
69 | * @param bool $force |
||
70 | * @return bool |
||
71 | */ |
||
72 | public function saveCart($cart, $force = false) |
||
73 | { |
||
74 | if (strtolower(get_class($cart)) !== 'martincart') { |
||
75 | return false; |
||
76 | } |
||
77 | |||
78 | if (!$cart->cleanVars()) { |
||
79 | return false; |
||
80 | } |
||
81 | |||
82 | foreach ($cart->cleanVars as $k => $v) { |
||
83 | ${$k} = $v; |
||
84 | } |
||
85 | |||
86 | $sql = sprintf("INSERT INTO %s ( |
||
87 | order_id, |
||
88 | order_type, |
||
89 | order_mode, |
||
90 | order_uid, |
||
91 | order_status, |
||
92 | order_pay_method, |
||
93 | order_pay, |
||
94 | order_total_price, |
||
95 | order_pay_money, |
||
96 | order_coupon, |
||
97 | order_sented_coupon, |
||
98 | order_real_name, |
||
99 | order_document_type, |
||
100 | order_document, |
||
101 | order_telephone, |
||
102 | order_phone, |
||
103 | order_extra_persons, |
||
104 | order_note, |
||
105 | order_status_time, |
||
106 | order_submit_time |
||
107 | ) VALUES ( |
||
108 | NULL, |
||
109 | %u, |
||
110 | %u, |
||
111 | %u, |
||
112 | %s, |
||
113 | %u, |
||
114 | %u, |
||
115 | %u, |
||
116 | %u, |
||
117 | %u, |
||
118 | %u, |
||
119 | %s, |
||
120 | %u, |
||
121 | %s, |
||
122 | %s, |
||
123 | %s, |
||
124 | %s, |
||
125 | %s, |
||
126 | %u, |
||
127 | %u |
||
128 | )", $this->db->prefix('martin_order'), ($order_type), ($order_mode), ($order_uid), ($order_status), ($order_pay_method), ($order_pay), ($order_total_price), ($order_pay_money), ($order_coupon), ($order_sented_coupon), $this->db->quoteString($order_real_name), ($order_document_type), $this->db->quoteString($order_document), $this->db->quoteString($order_telephone), $this->db->quoteString($order_phone), $this->db->quoteString($order_extra_persons), $this->db->quoteString($order_note), ($order_status_time), $order_submit_time); |
||
0 ignored issues
–
show
The variable
$order_status does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_pay_method does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_total_price does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_pay_money does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_coupon does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_sented_coupon does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_real_name does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_document_type does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_document does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_telephone does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_phone does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_extra_persons does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_status_time does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() The variable
$order_submit_time does not exist. Did you forget to declare it?
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug. ![]() |
|||
129 | //echo $sql;exit; |
||
130 | if (false != $force) { |
||
0 ignored issues
–
show
|
|||
131 | $result = $this->db->queryF($sql); |
||
0 ignored issues
–
show
$result is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
132 | } else { |
||
133 | $result = $this->db->query($sql); |
||
0 ignored issues
–
show
$result is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
134 | } |
||
135 | |||
136 | return $this->db->getInsertId(); |
||
137 | } |
||
138 | |||
139 | /** |
||
140 | * @change order pay |
||
141 | * @method: |
||
142 | * @license http://www.blags.org/ |
||
143 | * @created :2010年07月05日 20时22分 |
||
144 | * @copyright 1997-2010 The Martin Group |
||
145 | * @author Martin <[email protected]> |
||
146 | * @param $order_id |
||
147 | * @param $order_pay_method |
||
148 | * @param $order_pay |
||
149 | * @return bool |
||
150 | */ |
||
151 | public function ChangeOrderPay($order_id, $order_pay_method, $order_pay) |
||
152 | { |
||
153 | global $xoopsDB; |
||
154 | if (!$order_id || !$order_pay_method || !$order_pay) { |
||
155 | return false; |
||
156 | } |
||
157 | $sql = "UPDATE " . $xoopsDB->prefix("martin_order") . " SET order_pay_method = $order_pay_method ,order_pay = '$order_pay' |
||
158 | WHERE order_id = $order_id "; |
||
159 | |||
160 | return $xoopsDB->query($sql); |
||
161 | } |
||
162 | |||
163 | /** |
||
164 | * @check order if close |
||
165 | * @method: |
||
166 | * @license http://www.blags.org/ |
||
167 | * @created :2010年07月05日 22时43分 |
||
168 | * @copyright 1997-2010 The Martin Group |
||
169 | * @author Martin <[email protected]> |
||
170 | * @param $order_id |
||
171 | * @return bool |
||
172 | */ |
||
173 | public function CheckOrderClose($order_id) |
||
174 | { |
||
175 | if (!$order_id) { |
||
176 | return false; |
||
177 | } |
||
178 | global $xoopsDB; |
||
179 | $order_status = getModuleArray('order_status', 'order_status', true); |
||
0 ignored issues
–
show
$order_status is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
180 | $sql = "SELECT * FROM " . $xoopsDB->prefix("martin_order") . " WHERE order_id = $order_id AND order_status > 6 ";//"= ".count($order_status); |
||
181 | $row = $xoopsDB->fetchRow($xoopsDB->query($sql)); |
||
182 | |||
183 | return is_array($row); |
||
184 | } |
||
185 | |||
186 | /** |
||
187 | * @Insert order room |
||
188 | * @license http://www.blags.org/ |
||
189 | * @created :2010年07月04日 12时59分 |
||
190 | * @copyright 1997-2010 The Martin Group |
||
191 | * @author Martin <[email protected]> |
||
192 | * @param $order_id |
||
193 | * @param $room_id |
||
194 | * @param $room_date_count |
||
195 | * @return bool |
||
196 | */ |
||
197 | public function InsertOrderRoom($order_id, $room_id, $room_date_count) |
||
198 | { |
||
199 | global $xoopsDB; |
||
200 | $result = true; |
||
201 | if (!$order_id || !$room_id || !$room_date_count) { |
||
202 | return false; |
||
203 | } |
||
204 | $sql = "INSERT INTO " . $xoopsDB->prefix("martin_order_room") . " (order_id,room_id,room_date,room_count) VALUES "; |
||
205 | if (is_array($room_id)) { |
||
206 | foreach ($room_id as $key => $id) { |
||
207 | $prefix = ''; |
||
208 | foreach ($room_date_count as $k => $v) { |
||
209 | $sql .= $prefix . "($order_id,$id,$k,$v)"; |
||
210 | $prefix = ','; |
||
211 | } |
||
212 | //echo $sql;exit; |
||
213 | if (!$xoopsDB->queryF($sql)) { |
||
214 | $result = false; |
||
215 | } |
||
216 | } |
||
217 | } |
||
218 | |||
219 | return $result; |
||
220 | } |
||
221 | |||
222 | /** |
||
223 | * @insert order service |
||
224 | * @method: |
||
225 | * @license http://www.blags.org/ |
||
226 | * @created :2010年07月04日 12时59分 |
||
227 | * @copyright 1997-2010 The Martin Group |
||
228 | * @author Martin <[email protected]> |
||
229 | * @param $order_id |
||
230 | * @param $service_date_count |
||
231 | * @return bool |
||
232 | */ |
||
233 | public function InsertOrderService($order_id, $service_date_count) |
||
234 | { |
||
235 | global $xoopsDB; |
||
236 | $result = true; |
||
237 | if (!$order_id || !$service_date_count) { |
||
238 | return false; |
||
239 | } |
||
240 | $sql = "INSERT INTO " . $xoopsDB->prefix("martin_order_service") . " (order_id,service_id,service_date,service_count) VALUES "; |
||
241 | if (is_array($service_date_count)) { |
||
242 | $prefix = ''; |
||
243 | foreach ($service_date_count as $k => $v) { |
||
244 | $sql .= $prefix . "($order_id,$k,0,$v)"; |
||
245 | $prefix = ','; |
||
246 | } |
||
247 | //echo $sql;exit; |
||
248 | if (!$xoopsDB->queryF($sql)) { |
||
249 | $result = false; |
||
250 | } |
||
251 | } |
||
252 | |||
253 | return $result; |
||
254 | } |
||
255 | |||
256 | /** |
||
257 | * @get order info |
||
258 | * @method: |
||
259 | * @license http://www.blags.org/ |
||
260 | * @created :2010年07月05日 20时22分 |
||
261 | * @copyright 1997-2010 The Martin Group |
||
262 | * @author Martin <[email protected]> |
||
263 | * @param $order_id |
||
264 | * @return |
||
265 | */ |
||
266 | public function GetOrderInfo($order_id) |
||
0 ignored issues
–
show
The return type could not be reliably inferred; please add a
@return annotation.
Our type inference engine in quite powerful, but sometimes the code does not
provide enough clues to go by. In these cases we request you to add a ![]() |
|||
267 | { |
||
268 | if (!$order_id || !is_int($order_id)) { |
||
269 | return $order_id; |
||
270 | } |
||
271 | global $xoopsDB, $xoopsModuleConfig; |
||
272 | $sql = "SELECT * FROM " . $xoopsDB->prefix("martin_order") . " WHERE order_id = " . $order_id; |
||
273 | $row = $xoopsDB->fetchArray($xoopsDB->query($sql)); |
||
274 | if (empty($row)) { |
||
275 | return $row; |
||
276 | } |
||
277 | $order_pay_method = getModuleArray('order_pay_method', 'order_pay_method', true); |
||
278 | $row['order_pay_method'] = (int)($row['order_pay_method']); |
||
279 | $pays = (int)$row['order_pay_method'] == 2 ? getModuleArray('line_pays', 'line_pays', true) : getModuleArray('online_pays', 'online_pays', true); |
||
280 | //var_dump($pays); |
||
281 | $row['order_pay_str'] = isset($pays[$row['order_pay']]) ? $pays[$row['order_pay']] : null; |
||
282 | $row['order_pay_method'] = isset($order_pay_method['order_pay_method']) ? $order_pay_method['order_pay_method'] : null; |
||
283 | //var_dump($row); |
||
284 | $sql = "SELECT r.room_name,r.room_bed_info,h.hotel_name,h.hotel_alias FROM " . $xoopsDB->prefix("martin_room") . " r |
||
285 | INNER JOIN " . $xoopsDB->prefix("martin_hotel") . " h ON (r.hotel_id = h.hotel_id) |
||
286 | INNER JOIN " . $xoopsDB->prefix("martin_order_room") . " mor ON (r.room_id = mor.room_id) WHERE mor.order_id = $order_id LIMIT 1"; |
||
287 | $row_room = $xoopsDB->fetchArray($xoopsDB->query($sql)); |
||
288 | |||
289 | $row['room_name'] = $row_room['hotel_name'] . '-' . $row_room['room_name']; |
||
290 | $row['hotel_name'] = $row_room['hotel_name']; |
||
291 | $row['room_info'] = $row_room['room_bed_info']; |
||
292 | $row['room_url'] = XOOPS_URL . "/hotel-" . $row_room['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix']; |
||
293 | unset($row_room); |
||
294 | |||
295 | return $row; |
||
296 | } |
||
297 | |||
298 | /** |
||
299 | * update order status |
||
300 | * @access public |
||
301 | * @param $order_id |
||
302 | * @param $order_status |
||
303 | * @return bool |
||
304 | * @copyright 1997-2010 The Lap Group |
||
305 | * @author Martin <[email protected]> |
||
306 | * @created time :2010-07-06 16:57:45 |
||
307 | */ |
||
308 | public function UpdateOrderStatus($order_id, $order_status) |
||
309 | { |
||
310 | if ($order_status > 0 && $order_id > 0) { |
||
311 | global $xoopsDB; |
||
312 | $sql = "UPDATE " . $xoopsDB->prefix("martin_order") . " SET order_status = $order_status WHERE order_id = " . $order_id; |
||
313 | |||
314 | return $xoopsDB->queryF($sql); |
||
315 | } |
||
316 | |||
317 | return false; |
||
318 | } |
||
319 | } |
||
320 |
This check marks access to variables or properties that have not been declared yet. While PHP has no explicit notion of declaring a variable, accessing it before a value is assigned to it is most likely a bug.