This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* |
||
3 | @ see http://code.google.com/p/swfobject/wiki/documentation |
||
4 | @ see http://www.swffix.org/swfobject/generator/ |
||
5 | */ |
||
6 | |||
7 | class FlashObject extends ViewableData |
||
8 | { |
||
9 | protected static $use_dynamic_insert = true; |
||
10 | |||
11 | protected static $title = "MyFlashObjectTitle"; |
||
12 | |||
13 | protected static $filename = "flashObject.swf"; |
||
14 | |||
15 | protected static $flash_file_div_id = "FlashObject"; |
||
16 | |||
17 | protected static $width = 200; |
||
18 | |||
19 | protected static $height = 200; |
||
20 | |||
21 | protected static $flash_version = "6.0.0"; |
||
22 | |||
23 | protected static $alternative_content = '<a href="http://www.adobe.com/go/getflashplayer">get flash player</a>'; //no image here to save bandwidth |
||
24 | |||
25 | protected static $param_array = array(); |
||
26 | |||
27 | protected static $external_flash_file = ''; |
||
28 | |||
29 | public function CreateFlashObject($Title = '', $FlashFileDivID = '', $FlashFilename = '', $AlternativeContent = '', $Width = 0, $Height = 0, $FlashVersion = '', $ParamArray = array(), $javascriptAlreadyAdded = false) |
||
30 | { |
||
31 | if (!$Title) { |
||
32 | $Title = self::$title ; |
||
33 | } |
||
34 | $Title = Convert::raw2js($Title); |
||
35 | if (!$FlashFileDivID) { |
||
36 | $FlashFileDivID = self::$flash_file_div_id ; |
||
37 | } |
||
38 | $FlashFileID = Convert::raw2js($FlashFileDivID); |
||
39 | if (!$AlternativeContent) { |
||
40 | $AlternativeContent = self::$alternative_content; |
||
41 | } |
||
42 | if (!$Width) { |
||
43 | $Width = self::$width; |
||
44 | } |
||
45 | $Width = intval($Width); |
||
46 | if (!$Height) { |
||
47 | $Height = self::$height; |
||
48 | } |
||
49 | $Height = intval($Height); |
||
50 | if (!$FlashVersion) { |
||
51 | $FlashVersion = self::$flash_version; |
||
52 | } |
||
53 | if (!$ParamArray) { |
||
0 ignored issues
–
show
|
|||
54 | $ParamArray = self::$param_array; |
||
55 | } |
||
56 | if (!$FlashFilename) { |
||
57 | $FlashFilename = self::$filename; |
||
58 | } |
||
59 | $FlashFilename = Convert::raw2js($FlashFilename); |
||
60 | $doSet = new DataObjectSet(); |
||
61 | if ($FlashFilename) { |
||
62 | $params = ''; |
||
63 | $paramsJS = ''; |
||
64 | foreach ($ParamArray as $key=>$value) { |
||
65 | $params .= '<param name="'.$key.'" value="'.Convert::Raw2ATT($value).'" />'; |
||
66 | $paramsJS .= ' |
||
67 | params.'.$key.' = "'.$value.'";'; |
||
68 | } |
||
69 | $record = array( |
||
70 | 'ID' => $FlashFileID , |
||
71 | 'FileName' => $FlashFilename, |
||
72 | 'Title' => $Title, |
||
73 | 'Width' => intval($Width), |
||
74 | 'Height' => intval($Height), |
||
75 | 'FlashVersion' => $FlashVersion, |
||
76 | 'AlternativeContent' => $AlternativeContent, |
||
77 | 'Parameters' => $params, |
||
78 | 'UseDynamicInsert' => self::$use_dynamic_insert |
||
79 | ); |
||
80 | $doSet->push(new ArrayData($record)); |
||
81 | if (!$javascriptAlreadyAdded) { |
||
82 | if (self::$use_dynamic_insert) { |
||
83 | $js = ' |
||
84 | jQuery(document).ready( |
||
85 | function () { |
||
86 | jQuery(".FlashAlternativeContent").hide(); |
||
87 | var flashvars = {}; |
||
88 | var params = {}; |
||
89 | '.$paramsJS.' |
||
90 | var attributes = {}; |
||
91 | attributes.id = "'.$FlashFileDivID.'"; |
||
92 | swfobject.embedSWF("'.$FlashFilename.'", "'.$FlashFileDivID.'", "'.$Width.'", "'.$Height.'", "'.$FlashVersion.'","flash/swfobject/expressInstall.swf", flashvars, params, attributes); |
||
93 | jQuery(".FlashAlternativeContent").fadeIn(3000); |
||
94 | } |
||
95 | );'; |
||
96 | } else { |
||
97 | $js = ' |
||
98 | jQuery(document).ready( |
||
99 | function () { |
||
100 | swfobject.registerObject("'.$FlashFileDivID.'", "'.$FlashVersion.'", "flash/swfobject/expressInstall.swf"); |
||
101 | } |
||
102 | );'; |
||
103 | } |
||
104 | Requirements::javascript(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
105 | Requirements::javascript("flash/javascript/swfobject.js"); |
||
106 | Requirements::customScript($js); |
||
107 | } |
||
108 | } |
||
109 | return $doSet; |
||
110 | } |
||
111 | |||
112 | |||
113 | public function CreateYouTubeVideo($title, $code, $width = 640, $height = 385, $fullScreen = false) |
||
114 | { |
||
115 | //important! |
||
116 | self::$use_dynamic_insert = true; |
||
117 | $code = trim($code); |
||
118 | $id = self::$flash_file_div_id.$code; |
||
119 | Requirements::javascript(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
120 | Requirements::javascript("flash/javascript/swfobject.js"); |
||
121 | Requirements::javascript("flash/javascript/YouTube.js"); |
||
122 | if ($fullScreen) { |
||
123 | self::$width = 0; |
||
124 | self::$height = 0; |
||
125 | $call = 'YouTube.loadFullScreenVideo(\''.$code.'\');'; |
||
126 | } else { |
||
127 | $call = 'YouTube.loadVideo(\''.$code.'\', '.$width.', '.$height.');'; |
||
128 | } |
||
129 | $js = ' |
||
130 | ;(function($) { |
||
131 | $(document).ready( |
||
132 | function() { |
||
133 | YouTube.setElementID(\''.$id.'\'); |
||
134 | '.$call.' |
||
135 | jQuery("#wrapperFor-'.$id.'").click( |
||
136 | function() {YouTube.loadNew("'.$code.'"); return false;} |
||
137 | ) |
||
138 | } |
||
139 | ); |
||
140 | })(jQuery);'; |
||
141 | Requirements::customScript($js, "load".$code); |
||
142 | return $this->CreateFlashObject( |
||
143 | $title, |
||
144 | $id, |
||
145 | 'http://www.youtube.com/v/'.$code.'?fs=1&hl=en_US', |
||
146 | '', |
||
147 | $width, |
||
148 | $height, |
||
149 | 0, |
||
150 | self::$param_array/*, |
||
151 | true //important!*/ |
||
152 | ); |
||
153 | } |
||
154 | |||
155 | public static function has_external_flash_file() |
||
156 | { |
||
157 | self::$external_flash_file ? true : false; |
||
158 | } |
||
159 | public static function set_use_dynamic_insert($value) |
||
160 | { |
||
161 | self::$use_dynamic_insert = $value; |
||
162 | } |
||
163 | public static function set_filename($value) |
||
164 | { |
||
165 | self::$filename = $value; |
||
166 | } |
||
167 | public static function set_default_div_id($value) |
||
168 | { |
||
169 | self::$flash_file_div_id = $value; |
||
170 | } |
||
171 | public static function set_default_width($value) |
||
172 | { |
||
173 | self::$width = $value; |
||
174 | } |
||
175 | public static function set_default_height($value) |
||
176 | { |
||
177 | self::$height = $value; |
||
178 | } |
||
179 | public static function set_default_flash_version($value) |
||
180 | { |
||
181 | self::$flash_version = $value; |
||
182 | } |
||
183 | public static function set_default_alternative_content($value) |
||
184 | { |
||
185 | self::$alternative_content = $value; |
||
186 | } |
||
187 | public static function set_default_external_flash_file($value) |
||
188 | { |
||
189 | self::$external_flash_file = $value; |
||
190 | } |
||
191 | public static function add_param($name, $value) |
||
192 | { |
||
193 | self::$param_array[$name] = $value; |
||
194 | } |
||
195 | } |
||
196 |
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)
or! empty(...)
instead.