This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * |
||
4 | * 2FA extension for the phpBB Forum Software package. |
||
5 | * |
||
6 | * @copyright (c) 2015 Paul Sohier |
||
7 | * @license GNU General Public License, version 2 (GPL-2.0) |
||
8 | * |
||
9 | */ |
||
10 | |||
11 | namespace paul999\tfa\ucp; |
||
12 | |||
13 | use paul999\tfa\helper\session_helper; |
||
14 | use phpbb\request\request_interface; |
||
15 | use phpbb\template\template; |
||
16 | use phpbb\user; |
||
17 | |||
18 | class tfa_module |
||
19 | { |
||
20 | /** |
||
21 | * @var string |
||
22 | */ |
||
23 | public $u_action; |
||
24 | |||
25 | /** |
||
26 | * @var string |
||
27 | */ |
||
28 | public $page_title; |
||
29 | |||
30 | /** |
||
31 | * @var string |
||
32 | */ |
||
33 | public $tpl_name; |
||
34 | |||
35 | /** |
||
36 | * @var user |
||
37 | */ |
||
38 | private $user; |
||
39 | |||
40 | /** |
||
41 | * @var template |
||
42 | */ |
||
43 | private $template; |
||
44 | |||
45 | /** |
||
46 | * @var request_interface |
||
47 | */ |
||
48 | private $request; |
||
49 | |||
50 | /** |
||
51 | * @var session_helper |
||
52 | */ |
||
53 | private $session_helper; |
||
54 | |||
55 | /** |
||
56 | * @param user $user |
||
57 | * @param template $template |
||
58 | * @param request_interface $request |
||
59 | * @param session_helper $session_helper |
||
60 | */ |
||
61 | private function setup(user $user, template $template, request_interface $request, session_helper $session_helper) |
||
62 | { |
||
63 | $this->user = $user; |
||
64 | $this->template = $template; |
||
65 | $this->request = $request; |
||
66 | $this->session_helper = $session_helper; |
||
67 | } |
||
68 | |||
69 | /** |
||
70 | * @param $id |
||
71 | * @param $mode |
||
72 | */ |
||
73 | public function main($id, $mode) |
||
0 ignored issues
–
show
|
|||
74 | { |
||
75 | global $user, $template; |
||
76 | global $request, $phpbb_container; |
||
77 | |||
78 | $user->add_lang('posting'); |
||
79 | $user->add_lang_ext('paul999/tfa', array('common', 'ucp_tfa')); |
||
80 | |||
81 | $this->setup($user, $template, $request, $phpbb_container->get('paul999.tfa.session_helper')); |
||
82 | |||
83 | $this->create_page(); |
||
84 | } |
||
85 | |||
86 | /** |
||
87 | * return array |
||
88 | */ |
||
89 | private function register_security_key() |
||
90 | { |
||
91 | try |
||
92 | { |
||
93 | $error = array(); |
||
94 | $class = $this->request->variable('class', ''); |
||
95 | $module = $this->session_helper->find_module($class); |
||
96 | $submit = $this->request->variable('register', false, false, request_interface::POST); |
||
97 | |||
98 | if ($module != null) |
||
99 | { |
||
100 | if ($submit) |
||
101 | { |
||
102 | $module->register(); |
||
103 | meta_refresh(3, $this->u_action); |
||
104 | $message = $this->user->lang('TFA_KEY_ADDED') . '<br /><br />' . $this->user->lang('RETURN_UCP', '<a href="' . $this->u_action . '">', '</a>'); |
||
105 | trigger_error($message); |
||
106 | } |
||
107 | if ($module->can_register()) |
||
108 | { |
||
109 | $this->template->assign_vars(array( |
||
110 | 'S_HIDDEN_FIELDS' => build_hidden_fields(array('class' => $class)), |
||
111 | 'S_UCP_ACTION' => $this->u_action, |
||
112 | )); |
||
113 | $this->tpl_name = $module->register_start(); |
||
114 | } |
||
115 | else |
||
116 | { |
||
117 | $error[] = 'TFA_MODULE_NO_REGISTER'; |
||
118 | } |
||
119 | } |
||
120 | else |
||
121 | { |
||
122 | $error[] = $this->user->lang('TFA_MODULE_NOT_FOUND', $class); |
||
123 | } |
||
124 | } |
||
125 | catch (\Exception $e) |
||
126 | { |
||
127 | $error[] = $e->getMessage(); |
||
128 | } |
||
129 | |||
130 | return $error; |
||
131 | } |
||
132 | |||
133 | /** |
||
134 | * |
||
135 | */ |
||
136 | private function create_page() |
||
137 | { |
||
138 | $error = array(); |
||
139 | $s_hidden_fields = ''; |
||
140 | |||
141 | add_form_key('ucp_tfa_keys'); |
||
142 | |||
143 | $module_row = $this->request->variable('md', '', true, request_interface::POST); |
||
144 | |||
145 | // Set desired template |
||
146 | $this->tpl_name = 'ucp_tfa'; |
||
147 | $this->page_title = 'UCP_TFA'; |
||
148 | |||
149 | if (!empty($module_row)) |
||
150 | { |
||
151 | switch ($module_row) |
||
152 | { |
||
153 | case $this->user->lang('DELETE_MARKED'): |
||
154 | if (!check_form_key('ucp_tfa_keys')) |
||
155 | { |
||
156 | $error[] = 'FORM_INVALID'; |
||
157 | } |
||
158 | else |
||
159 | { |
||
160 | $this->delete_keys(); |
||
161 | } |
||
162 | break; |
||
163 | |||
164 | case $this->user->lang('TFA_NEW'): |
||
165 | $error = array_merge($this->register_security_key(), $error); |
||
166 | |||
167 | if (!sizeof($error)) |
||
168 | { |
||
169 | return; // register_security_key has its own template stuff, so we return here. |
||
170 | } |
||
171 | break; |
||
172 | |||
173 | } |
||
174 | } |
||
175 | |||
176 | // Replace "error" strings with their real, localised form |
||
177 | $error = array_map(array( |
||
178 | $this->user, |
||
179 | 'lang', |
||
180 | ), $error); |
||
181 | |||
182 | /** |
||
183 | * @var $module_row \paul999\tfa\modules\module_interface |
||
184 | */ |
||
185 | foreach ($this->session_helper->get_modules() as $module_row) |
||
186 | { |
||
187 | $module_row->show_ucp(); |
||
188 | |||
189 | if ($module_row->can_register()) |
||
190 | { |
||
191 | $this->template->assign_block_vars('new_keys', array( |
||
192 | 'CLASS' => $module_row->get_name(), |
||
193 | 'NAME' => $this->user->lang($module_row->get_translatable_name()), |
||
194 | )); |
||
195 | } |
||
196 | } |
||
197 | |||
198 | $this->template->assign_vars(array( |
||
199 | 'ERROR' => (sizeof($error)) ? implode('<br />', $error) : '', |
||
200 | 'L_TITLE' => $this->user->lang('UCP_TFA'), |
||
201 | 'S_HIDDEN_FIELDS' => $s_hidden_fields, |
||
202 | 'S_UCP_ACTION' => $this->u_action, |
||
203 | )); |
||
204 | } |
||
205 | |||
206 | /** |
||
207 | * |
||
208 | */ |
||
209 | private function delete_keys() |
||
210 | { |
||
211 | $keys = $this->request->variable('keys', array('')); |
||
212 | if (!empty($keys)) |
||
213 | { |
||
214 | foreach ($keys as $row) |
||
215 | { |
||
216 | $row = explode('-', $row); // 0 is class, 1 is ID |
||
217 | if (isset($row[0])) |
||
218 | { |
||
219 | $module = $this->session_helper->find_module($row[0]); |
||
220 | if ($module != null) |
||
221 | { |
||
222 | $module->delete(intval($row[1])); |
||
223 | } |
||
224 | } |
||
225 | } |
||
226 | } |
||
227 | meta_refresh(3, $this->u_action); |
||
228 | $message = $this->user->lang('TFA_KEYS_DELETED') . '<br /><br />' . $this->user->lang('RETURN_UCP', '<a href="' . $this->u_action . '">', '</a>'); |
||
229 | trigger_error($message); |
||
230 | } |
||
231 | } |
||
232 |
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.