This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * @ |
||
5 | * @method: |
||
6 | * @license http://www.blags.org/ |
||
7 | * @created :2010年07月03日 21时12分 |
||
8 | * @copyright 1997-2010 The Martin Group |
||
9 | * @author Martin <[email protected]> |
||
10 | * */ |
||
11 | class MartinCart extends XoopsObject |
||
12 | { |
||
13 | public function MartinCart() |
||
14 | { |
||
15 | $this->initVar("order_id", XOBJ_DTYPE_INT, null, false); |
||
16 | $this->initVar("order_type", XOBJ_DTYPE_INT, null, false); |
||
17 | $this->initVar("order_mode", XOBJ_DTYPE_INT, null, false); |
||
18 | $this->initVar("order_uid", XOBJ_DTYPE_INT, null, false); |
||
19 | $this->initVar("order_pay_method", XOBJ_DTYPE_INT, null, false); |
||
20 | $this->initVar("order_pay", XOBJ_DTYPE_TXTBOX, null, true, 25); |
||
21 | $this->initVar("order_status", XOBJ_DTYPE_INT, null, false); |
||
22 | $this->initVar("order_total_price", XOBJ_DTYPE_INT, null, false); |
||
23 | $this->initVar("order_pay_money", XOBJ_DTYPE_INT, null, false); |
||
24 | $this->initVar("order_coupon", XOBJ_DTYPE_INT, null, false); |
||
25 | $this->initVar("order_sented_coupon", XOBJ_DTYPE_INT, null, false); |
||
26 | $this->initVar("order_real_name", XOBJ_DTYPE_TXTBOX, null, true, 45); |
||
27 | $this->initVar("order_document_type", XOBJ_DTYPE_INT, null, false); |
||
28 | $this->initVar("order_document", XOBJ_DTYPE_TXTBOX, null, true, 255); |
||
29 | $this->initVar("order_telephone", XOBJ_DTYPE_TXTBOX, null, true, 45); |
||
30 | $this->initVar("order_phone", XOBJ_DTYPE_TXTBOX, null, true, 45); |
||
31 | $this->initVar("order_extra_persons", XOBJ_DTYPE_TXTAREA, null, false); |
||
32 | $this->initVar("order_note", XOBJ_DTYPE_TXTAREA, null, false); |
||
33 | $this->initVar("order_status_time", XOBJ_DTYPE_INT, null, false); |
||
34 | $this->initVar("order_submit_time", XOBJ_DTYPE_INT, null, false); |
||
35 | } |
||
36 | } |
||
37 | |||
38 | /** |
||
39 | * @martin cart handler |
||
40 | * @method: |
||
41 | * @license http://www.blags.org/ |
||
42 | * @created :2010年07月03日 21时12分 |
||
43 | * @copyright 1997-2010 The Martin Group |
||
44 | * @author Martin <[email protected]> |
||
45 | * */ |
||
46 | class MartinCartHandler extends XoopsObjectHandler |
||
47 | { |
||
48 | /** |
||
49 | * @create cart object |
||
50 | * @license http://www.blags.org/ |
||
51 | * @created :2010年07月04日 12时59分 |
||
52 | * @copyright 1997-2010 The Martin Group |
||
53 | * @author Martin <[email protected]> |
||
54 | * */ |
||
55 | public function &create() |
||
56 | { |
||
57 | $obj =& new MartinCart; |
||
58 | |||
59 | return $obj; |
||
60 | } |
||
61 | |||
62 | /** |
||
63 | * @save cart |
||
64 | * @license http://www.blags.org/ |
||
65 | * @created :2010年07月04日 12时59分 |
||
66 | * @copyright 1997-2010 The Martin Group |
||
67 | * @author Martin <[email protected]> |
||
68 | * @param $cart |
||
69 | * @param bool $force |
||
70 | * @return bool |
||
71 | */ |
||
72 | public function saveCart($cart, $force = false) |
||
73 | { |
||
74 | if (strtolower(get_class($cart)) !== 'martincart') { |
||
75 | return false; |
||
76 | } |
||
77 | |||
78 | if (!$cart->cleanVars()) { |
||
79 | return false; |
||
80 | } |
||
81 | |||
82 | foreach ($cart->cleanVars as $k => $v) { |
||
83 | ${$k} = $v; |
||
84 | } |
||
85 | |||
86 | $sql = sprintf("INSERT INTO %s ( |
||
87 | order_id, |
||
88 | order_type, |
||
89 | order_mode, |
||
90 | order_uid, |
||
91 | order_status, |
||
92 | order_pay_method, |
||
93 | order_pay, |
||
94 | order_total_price, |
||
95 | order_pay_money, |
||
96 | order_coupon, |
||
97 | order_sented_coupon, |
||
98 | order_real_name, |
||
99 | order_document_type, |
||
100 | order_document, |
||
101 | order_telephone, |
||
102 | order_phone, |
||
103 | order_extra_persons, |
||
104 | order_note, |
||
105 | order_status_time, |
||
106 | order_submit_time |
||
107 | ) VALUES ( |
||
108 | NULL, |
||
109 | %u, |
||
110 | %u, |
||
111 | %u, |
||
112 | %s, |
||
113 | %u, |
||
114 | %u, |
||
115 | %u, |
||
116 | %u, |
||
117 | %u, |
||
118 | %u, |
||
119 | %s, |
||
120 | %u, |
||
121 | %s, |
||
122 | %s, |
||
123 | %s, |
||
124 | %s, |
||
125 | %s, |
||
126 | %u, |
||
127 | %u |
||
128 | )", $this->db->prefix('martin_order'), ($order_type), ($order_mode), ($order_uid), ($order_status), ($order_pay_method), ($order_pay), ($order_total_price), ($order_pay_money), ($order_coupon), ($order_sented_coupon), $this->db->quoteString($order_real_name), ($order_document_type), $this->db->quoteString($order_document), $this->db->quoteString($order_telephone), $this->db->quoteString($order_phone), $this->db->quoteString($order_extra_persons), $this->db->quoteString($order_note), ($order_status_time), $order_submit_time); |
||
129 | //echo $sql;exit; |
||
130 | if (false != $force) { |
||
0 ignored issues
–
show
|
|||
131 | $result = $this->db->queryF($sql); |
||
132 | } else { |
||
133 | $result = $this->db->query($sql); |
||
134 | } |
||
135 | |||
136 | return $this->db->getInsertId(); |
||
137 | } |
||
138 | |||
139 | /** |
||
140 | * @change order pay |
||
141 | * @method: |
||
142 | * @license http://www.blags.org/ |
||
143 | * @created :2010年07月05日 20时22分 |
||
144 | * @copyright 1997-2010 The Martin Group |
||
145 | * @author Martin <[email protected]> |
||
146 | * @param $order_id |
||
147 | * @param $order_pay_method |
||
148 | * @param $order_pay |
||
149 | * @return bool |
||
150 | */ |
||
151 | public function ChangeOrderPay($order_id, $order_pay_method, $order_pay) |
||
152 | { |
||
153 | global $xoopsDB; |
||
154 | if (!$order_id || !$order_pay_method || !$order_pay) { |
||
155 | return false; |
||
156 | } |
||
157 | $sql = "UPDATE " . $xoopsDB->prefix("martin_order") . " SET order_pay_method = $order_pay_method ,order_pay = '$order_pay' |
||
158 | WHERE order_id = $order_id "; |
||
159 | |||
160 | return $xoopsDB->query($sql); |
||
161 | } |
||
162 | |||
163 | /** |
||
164 | * @check order if close |
||
165 | * @method: |
||
166 | * @license http://www.blags.org/ |
||
167 | * @created :2010年07月05日 22时43分 |
||
168 | * @copyright 1997-2010 The Martin Group |
||
169 | * @author Martin <[email protected]> |
||
170 | * @param $order_id |
||
171 | * @return bool |
||
172 | */ |
||
173 | public function CheckOrderClose($order_id) |
||
174 | { |
||
175 | if (!$order_id) { |
||
176 | return false; |
||
177 | } |
||
178 | global $xoopsDB; |
||
179 | $order_status = getModuleArray('order_status', 'order_status', true); |
||
180 | $sql = "SELECT * FROM " . $xoopsDB->prefix("martin_order") . " WHERE order_id = $order_id AND order_status > 6 ";//"= ".count($order_status); |
||
181 | $row = $xoopsDB->fetchRow($xoopsDB->query($sql)); |
||
182 | |||
183 | return is_array($row); |
||
184 | } |
||
185 | |||
186 | /** |
||
187 | * @Insert order room |
||
188 | * @license http://www.blags.org/ |
||
189 | * @created :2010年07月04日 12时59分 |
||
190 | * @copyright 1997-2010 The Martin Group |
||
191 | * @author Martin <[email protected]> |
||
192 | * @param $order_id |
||
193 | * @param $room_id |
||
194 | * @param $room_date_count |
||
195 | * @return bool |
||
196 | */ |
||
197 | public function InsertOrderRoom($order_id, $room_id, $room_date_count) |
||
198 | { |
||
199 | global $xoopsDB; |
||
200 | $result = true; |
||
201 | if (!$order_id || !$room_id || !$room_date_count) { |
||
202 | return false; |
||
203 | } |
||
204 | $sql = "INSERT INTO " . $xoopsDB->prefix("martin_order_room") . " (order_id,room_id,room_date,room_count) VALUES "; |
||
205 | if (is_array($room_id)) { |
||
206 | foreach ($room_id as $key => $id) { |
||
207 | $prefix = ''; |
||
208 | foreach ($room_date_count as $k => $v) { |
||
209 | $sql .= $prefix . "($order_id,$id,$k,$v)"; |
||
210 | $prefix = ','; |
||
211 | } |
||
212 | //echo $sql;exit; |
||
213 | if (!$xoopsDB->queryF($sql)) { |
||
214 | $result = false; |
||
215 | } |
||
216 | } |
||
217 | } |
||
218 | |||
219 | return $result; |
||
220 | } |
||
221 | |||
222 | /** |
||
223 | * @insert order service |
||
224 | * @method: |
||
225 | * @license http://www.blags.org/ |
||
226 | * @created :2010年07月04日 12时59分 |
||
227 | * @copyright 1997-2010 The Martin Group |
||
228 | * @author Martin <[email protected]> |
||
229 | * @param $order_id |
||
230 | * @param $service_date_count |
||
231 | * @return bool |
||
232 | */ |
||
233 | public function InsertOrderService($order_id, $service_date_count) |
||
234 | { |
||
235 | global $xoopsDB; |
||
236 | $result = true; |
||
237 | if (!$order_id || !$service_date_count) { |
||
238 | return false; |
||
239 | } |
||
240 | $sql = "INSERT INTO " . $xoopsDB->prefix("martin_order_service") . " (order_id,service_id,service_date,service_count) VALUES "; |
||
241 | if (is_array($service_date_count)) { |
||
242 | $prefix = ''; |
||
243 | foreach ($service_date_count as $k => $v) { |
||
244 | $sql .= $prefix . "($order_id,$k,0,$v)"; |
||
245 | $prefix = ','; |
||
246 | } |
||
247 | //echo $sql;exit; |
||
248 | if (!$xoopsDB->queryF($sql)) { |
||
249 | $result = false; |
||
250 | } |
||
251 | } |
||
252 | |||
253 | return $result; |
||
254 | } |
||
255 | |||
256 | /** |
||
257 | * @get order info |
||
258 | * @method: |
||
259 | * @license http://www.blags.org/ |
||
260 | * @created :2010年07月05日 20时22分 |
||
261 | * @copyright 1997-2010 The Martin Group |
||
262 | * @author Martin <[email protected]> |
||
263 | * @param $order_id |
||
264 | * @return |
||
265 | */ |
||
266 | public function GetOrderInfo($order_id) |
||
267 | { |
||
268 | if (!$order_id || !is_int($order_id)) { |
||
269 | return $order_id; |
||
270 | } |
||
271 | global $xoopsDB, $xoopsModuleConfig; |
||
272 | $sql = "SELECT * FROM " . $xoopsDB->prefix("martin_order") . " WHERE order_id = " . $order_id; |
||
273 | $row = $xoopsDB->fetchArray($xoopsDB->query($sql)); |
||
274 | if (empty($row)) { |
||
275 | return $row; |
||
276 | } |
||
277 | $order_pay_method = getModuleArray('order_pay_method', 'order_pay_method', true); |
||
278 | $row['order_pay_method'] = (int)($row['order_pay_method']); |
||
279 | $pays = (int)$row['order_pay_method'] == 2 ? getModuleArray('line_pays', 'line_pays', true) : getModuleArray('online_pays', 'online_pays', true); |
||
280 | //var_dump($pays); |
||
281 | $row['order_pay_str'] = isset($pays[$row['order_pay']]) ? $pays[$row['order_pay']] : null; |
||
282 | $row['order_pay_method'] = isset($order_pay_method['order_pay_method']) ? $order_pay_method['order_pay_method'] : null; |
||
283 | //var_dump($row); |
||
284 | $sql = "SELECT r.room_name,r.room_bed_info,h.hotel_name,h.hotel_alias FROM " . $xoopsDB->prefix("martin_room") . " r |
||
285 | INNER JOIN " . $xoopsDB->prefix("martin_hotel") . " h ON (r.hotel_id = h.hotel_id) |
||
286 | INNER JOIN " . $xoopsDB->prefix("martin_order_room") . " mor ON (r.room_id = mor.room_id) WHERE mor.order_id = $order_id LIMIT 1"; |
||
287 | $row_room = $xoopsDB->fetchArray($xoopsDB->query($sql)); |
||
288 | |||
289 | $row['room_name'] = $row_room['hotel_name'] . '-' . $row_room['room_name']; |
||
290 | $row['hotel_name'] = $row_room['hotel_name']; |
||
291 | $row['room_info'] = $row_room['room_bed_info']; |
||
292 | $row['room_url'] = XOOPS_URL . "/hotel-" . $row_room['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix']; |
||
293 | unset($row_room); |
||
294 | |||
295 | return $row; |
||
296 | } |
||
297 | |||
298 | /** |
||
299 | * update order status |
||
300 | * @access public |
||
301 | * @param $order_id |
||
302 | * @param $order_status |
||
303 | * @return bool |
||
304 | * @copyright 1997-2010 The Lap Group |
||
305 | * @author Martin <[email protected]> |
||
306 | * @created time :2010-07-06 16:57:45 |
||
307 | */ |
||
308 | public function UpdateOrderStatus($order_id, $order_status) |
||
309 | { |
||
310 | if ($order_status > 0 && $order_id > 0) { |
||
311 | global $xoopsDB; |
||
312 | $sql = "UPDATE " . $xoopsDB->prefix("martin_order") . " SET order_status = $order_status WHERE order_id = " . $order_id; |
||
313 | |||
314 | return $xoopsDB->queryF($sql); |
||
315 | } |
||
316 | |||
317 | return false; |
||
318 | } |
||
319 | } |
||
320 |
When comparing two booleans, it is generally considered safer to use the strict comparison operator.