paul999 /
phpbb_2fa
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * |
||
| 4 | * 2FA extension for the phpBB Forum Software package. |
||
| 5 | * |
||
| 6 | * @copyright (c) 2015 Paul Sohier |
||
| 7 | * @license GNU General Public License, version 2 (GPL-2.0) |
||
| 8 | * |
||
| 9 | */ |
||
| 10 | |||
| 11 | namespace paul999\tfa\ucp; |
||
| 12 | |||
| 13 | use paul999\tfa\helper\session_helper; |
||
| 14 | use phpbb\request\request_interface; |
||
| 15 | use phpbb\template\template; |
||
| 16 | use phpbb\user; |
||
| 17 | |||
| 18 | class tfa_module |
||
| 19 | { |
||
| 20 | /** |
||
| 21 | * @var string |
||
| 22 | */ |
||
| 23 | public $u_action; |
||
| 24 | |||
| 25 | /** |
||
| 26 | * @var string |
||
| 27 | */ |
||
| 28 | public $page_title; |
||
| 29 | |||
| 30 | /** |
||
| 31 | * @var string |
||
| 32 | */ |
||
| 33 | public $tpl_name; |
||
| 34 | |||
| 35 | /** |
||
| 36 | * @var user |
||
| 37 | */ |
||
| 38 | private $user; |
||
| 39 | |||
| 40 | /** |
||
| 41 | * @var template |
||
| 42 | */ |
||
| 43 | private $template; |
||
| 44 | |||
| 45 | /** |
||
| 46 | * @var request_interface |
||
| 47 | */ |
||
| 48 | private $request; |
||
| 49 | |||
| 50 | /** |
||
| 51 | * @var session_helper |
||
| 52 | */ |
||
| 53 | private $session_helper; |
||
| 54 | |||
| 55 | /** |
||
| 56 | * @param user $user |
||
| 57 | * @param template $template |
||
| 58 | * @param request_interface $request |
||
| 59 | * @param session_helper $session_helper |
||
| 60 | */ |
||
| 61 | private function setup(user $user, template $template, request_interface $request, session_helper $session_helper) |
||
| 62 | { |
||
| 63 | $this->user = $user; |
||
| 64 | $this->template = $template; |
||
| 65 | $this->request = $request; |
||
| 66 | $this->session_helper = $session_helper; |
||
| 67 | } |
||
| 68 | |||
| 69 | /** |
||
| 70 | * @param $id |
||
| 71 | * @param $mode |
||
| 72 | */ |
||
| 73 | public function main($id, $mode) |
||
|
0 ignored issues
–
show
|
|||
| 74 | { |
||
| 75 | global $user, $template; |
||
| 76 | global $request, $phpbb_container; |
||
| 77 | |||
| 78 | $user->add_lang('posting'); |
||
| 79 | $user->add_lang_ext('paul999/tfa', array('common', 'ucp_tfa')); |
||
| 80 | |||
| 81 | $this->setup($user, $template, $request, $phpbb_container->get('paul999.tfa.session_helper')); |
||
| 82 | |||
| 83 | $this->create_page(); |
||
| 84 | } |
||
| 85 | |||
| 86 | /** |
||
| 87 | * return array |
||
| 88 | */ |
||
| 89 | private function register_security_key() |
||
| 90 | { |
||
| 91 | try |
||
| 92 | { |
||
| 93 | $error = array(); |
||
| 94 | $class = $this->request->variable('class', ''); |
||
| 95 | $module = $this->session_helper->find_module($class); |
||
| 96 | $submit = $this->request->variable('register', false, false, request_interface::POST); |
||
| 97 | |||
| 98 | if ($module != null) |
||
| 99 | { |
||
| 100 | if ($submit) |
||
| 101 | { |
||
| 102 | $module->register(); |
||
| 103 | meta_refresh(3, $this->u_action); |
||
| 104 | $message = $this->user->lang('TFA_KEY_ADDED') . '<br /><br />' . $this->user->lang('RETURN_UCP', '<a href="' . $this->u_action . '">', '</a>'); |
||
| 105 | trigger_error($message); |
||
| 106 | } |
||
| 107 | if ($module->can_register()) |
||
| 108 | { |
||
| 109 | $this->template->assign_vars(array( |
||
| 110 | 'S_HIDDEN_FIELDS' => build_hidden_fields(array('class' => $class)), |
||
| 111 | 'S_UCP_ACTION' => $this->u_action, |
||
| 112 | )); |
||
| 113 | $this->tpl_name = $module->register_start(); |
||
| 114 | } |
||
| 115 | else |
||
| 116 | { |
||
| 117 | $error[] = 'TFA_MODULE_NO_REGISTER'; |
||
| 118 | } |
||
| 119 | } |
||
| 120 | else |
||
| 121 | { |
||
| 122 | $error[] = $this->user->lang('TFA_MODULE_NOT_FOUND', $class); |
||
| 123 | } |
||
| 124 | } |
||
| 125 | catch (\Exception $e) |
||
| 126 | { |
||
| 127 | $error[] = $e->getMessage(); |
||
| 128 | } |
||
| 129 | |||
| 130 | return $error; |
||
| 131 | } |
||
| 132 | |||
| 133 | /** |
||
| 134 | * |
||
| 135 | */ |
||
| 136 | private function create_page() |
||
| 137 | { |
||
| 138 | $error = array(); |
||
| 139 | $s_hidden_fields = ''; |
||
| 140 | |||
| 141 | add_form_key('ucp_tfa_keys'); |
||
| 142 | |||
| 143 | $module_row = $this->request->variable('md', '', true, request_interface::POST); |
||
| 144 | |||
| 145 | // Set desired template |
||
| 146 | $this->tpl_name = 'ucp_tfa'; |
||
| 147 | $this->page_title = 'UCP_TFA'; |
||
| 148 | |||
| 149 | if (!empty($module_row)) |
||
| 150 | { |
||
| 151 | switch ($module_row) |
||
| 152 | { |
||
| 153 | case $this->user->lang('DELETE_MARKED'): |
||
| 154 | if (!check_form_key('ucp_tfa_keys')) |
||
| 155 | { |
||
| 156 | $error[] = 'FORM_INVALID'; |
||
| 157 | } |
||
| 158 | else |
||
| 159 | { |
||
| 160 | $this->delete_keys(); |
||
| 161 | } |
||
| 162 | break; |
||
| 163 | |||
| 164 | case $this->user->lang('TFA_NEW'): |
||
| 165 | $error = array_merge($this->register_security_key(), $error); |
||
| 166 | |||
| 167 | if (!sizeof($error)) |
||
| 168 | { |
||
| 169 | return; // register_security_key has its own template stuff, so we return here. |
||
| 170 | } |
||
| 171 | break; |
||
| 172 | |||
| 173 | } |
||
| 174 | } |
||
| 175 | |||
| 176 | // Replace "error" strings with their real, localised form |
||
| 177 | $error = array_map(array( |
||
| 178 | $this->user, |
||
| 179 | 'lang', |
||
| 180 | ), $error); |
||
| 181 | |||
| 182 | /** |
||
| 183 | * @var $module_row \paul999\tfa\modules\module_interface |
||
| 184 | */ |
||
| 185 | foreach ($this->session_helper->get_modules() as $module_row) |
||
| 186 | { |
||
| 187 | $module_row->show_ucp(); |
||
| 188 | |||
| 189 | if ($module_row->can_register()) |
||
| 190 | { |
||
| 191 | $this->template->assign_block_vars('new_keys', array( |
||
| 192 | 'CLASS' => $module_row->get_name(), |
||
| 193 | 'NAME' => $this->user->lang($module_row->get_translatable_name()), |
||
| 194 | )); |
||
| 195 | } |
||
| 196 | } |
||
| 197 | |||
| 198 | $this->template->assign_vars(array( |
||
| 199 | 'ERROR' => (sizeof($error)) ? implode('<br />', $error) : '', |
||
| 200 | 'L_TITLE' => $this->user->lang('UCP_TFA'), |
||
| 201 | 'S_HIDDEN_FIELDS' => $s_hidden_fields, |
||
| 202 | 'S_UCP_ACTION' => $this->u_action, |
||
| 203 | )); |
||
| 204 | } |
||
| 205 | |||
| 206 | /** |
||
| 207 | * |
||
| 208 | */ |
||
| 209 | private function delete_keys() |
||
| 210 | { |
||
| 211 | $keys = $this->request->variable('keys', array('')); |
||
| 212 | if (!empty($keys)) |
||
| 213 | { |
||
| 214 | foreach ($keys as $row) |
||
| 215 | { |
||
| 216 | $row = explode('-', $row); // 0 is class, 1 is ID |
||
| 217 | if (isset($row[0])) |
||
| 218 | { |
||
| 219 | $module = $this->session_helper->find_module($row[0]); |
||
| 220 | if ($module != null) |
||
| 221 | { |
||
| 222 | $module->delete(intval($row[1])); |
||
| 223 | } |
||
| 224 | } |
||
| 225 | } |
||
| 226 | } |
||
| 227 | meta_refresh(3, $this->u_action); |
||
| 228 | $message = $this->user->lang('TFA_KEYS_DELETED') . '<br /><br />' . $this->user->lang('RETURN_UCP', '<a href="' . $this->u_action . '">', '</a>'); |
||
| 229 | trigger_error($message); |
||
| 230 | } |
||
| 231 | } |
||
| 232 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.