Skip to content

Commit 107a29b

Browse files
julmudjulmud
committed
Fix some Sonar issues
1 parent c97e4b5 commit 107a29b

6 files changed

Lines changed: 39 additions & 40 deletions

File tree

‎BorrowADVD.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
$onfocus = 'onFocus="this.value=\'\'"';
5555
if ($_COOKIE['emailaddr'] != $lang['BORROW_PROMPT_STRING'])
5656
$onfocus = '';
57+
$displayEmailaddr = htmlentities($_COOKIE['emailaddr']);
5758
echo<<<EOT
5859
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
5960
<html>
@@ -80,7 +81,7 @@ function ValidateForm(form) {
8081
<center><table width="100%" class=f1><tr><td>$lang[BORROW_PAGE_HEADING] $MY_EMAIL_ADDRESS</td></tr></table></center>
8182
<BR>
8283
<center><form action=$PHP_SELF method=post onSubmit="return ValidateForm(this);"><table width="75%" class=f1 cellpadding=5 border=1><tr><td align=right>$lang[BORROW_TITLE]</td><td align=left>$name</td></tr>
83-
<tr><td align=right>$lang[BORROW_EMAIL]</td><td align=left><input id=emailaddr $onfocus type=text name=emailaddr value="$_COOKIE[emailaddr]"></td></tr></table><br>
84+
<tr><td align=right>$lang[BORROW_EMAIL]</td><td align=left><input id=emailaddr $onfocus type=text name=emailaddr value="$displayEmailaddr"></td></tr></table><br>
8485
<input type=hidden name="mediaid" value="$mediaid"><input type=submit value="$lang[BORROW_SUBMIT_TEXT]"></form></center>
8586
$endbody</html>
8687

‎gallery.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ function get_children($id,$bs){
4848
}
4949

5050
function format_addinfo (&$dvd){
51-
GLOBAL $lang, $reviewsort, $sortby, $ReviewLabels;
51+
global $lang, $reviewsort, $sortby, $ReviewLabels;
5252

5353
if (!isset($dvd['addinfo']) || empty($dvd['addinfo'])) {
5454
$dvd['addinfo'] = '';
@@ -316,7 +316,7 @@ function dh(theitems, obj) {
316316
}
317317

318318
function site_header (){
319-
GLOBAL $Title, $lang, $CurrentSiteTitle, $xmlfile, $sql, $dpp, $sortby, $order, $searchby, $searchtext, $letter, $ct, $page;
319+
global $Title, $lang, $CurrentSiteTitle, $xmlfile, $sql, $dpp, $sortby, $order, $searchby, $searchtext, $letter, $ct, $page;
320320
switch ($ct){
321321
case 'owned':
322322
case 'ordered':
@@ -417,7 +417,7 @@ function site_header (){
417417
}
418418

419419
function site_footer(){
420-
GLOBAL $sql, $dpp, $PHP_SELF,$_SERVER, $page;
420+
global $sql, $dpp, $PHP_SELF,$_SERVER, $page;
421421
?>
422422
</div>
423423
<div class="f4 noprint" style="background-color: transparent; text-align:center; width: 90%; clear:left;">
@@ -439,7 +439,7 @@ function site_footer(){
439439
}
440440

441441
function get_total_profiles($sql){
442-
GLOBAL $db, $TitlesPerPage;
442+
global $db, $TitlesPerPage;
443443

444444
$i = preg_replace('/(.*)(LIMIT)(.*)(,)(.*)/i', '\1', $sql);
445445

@@ -450,7 +450,7 @@ function get_total_profiles($sql){
450450
}
451451

452452
function buildPaginationURL($i, $mediaid, $ct, $searchby, $searchtext, $sortby, $order, $on_page, $text = null) {
453-
GLOBAL $PHP_SELF;
453+
global $PHP_SELF;
454454
$disp['i'] = htmlentities($i);
455455
$disp['mediaid'] = htmlentities($mediaid);
456456
$disp['ct'] = htmlentities($ct);
@@ -466,7 +466,7 @@ function buildPaginationURL($i, $mediaid, $ct, $searchby, $searchtext, $sortby,
466466
}
467467

468468
function generate_pagination($num_items, $per_page, $start_item, $add_prevnext_text = TRUE){
469-
GLOBAL $PHP_SELF, $sortby, $order, $searchby, $searchtext, $letter, $ct, $mediaid, $page;
469+
global $PHP_SELF, $sortby, $order, $searchby, $searchtext, $letter, $ct, $mediaid, $page;
470470
$total_pages = ceil($num_items/$per_page);
471471
if ( $total_pages == 1 )
472472
{

‎index.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1354,8 +1354,8 @@ function DisplayDecoration($str, &$dvd) {
13541354
$nowhere = str_replace('%%BOXPARENT%%', '', $where);
13551355

13561356
if ($action == 'main') {
1357-
$cookiesort = isset($_COOKIE['cookiesort']) ? $_COOKIE['cookiesort']: '';
1358-
$cookieorder = isset($_COOKIE['cookieorder']) ? $_COOKIE['cookieorder']: '';
1357+
$cookiesort = isset($_COOKIE['cookiesort']) ? htmlentities($_COOKIE['cookiesort']) : '';
1358+
$cookieorder = isset($_COOKIE['cookieorder']) ? htmlentities($_COOKIE['cookieorder']) : '';
13591359
if ($collection == 'loaned') {
13601360
$secondcol = 'loaninfo';
13611361
$thirdcol = 'loandue';

‎locale.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
// locales, please consult your OS manual for details.
1515
//
1616
if ($allowlocale && isset($_COOKIE['locale'])) {
17-
$tmp = $_COOKIE['locale'];
17+
$tmp = htmlentities($_COOKIE['locale']);
1818
if (($tmp == 'en') ||
1919
($tmp == 'dk') ||
2020
($tmp == 'de') ||
@@ -23,8 +23,9 @@
2323
($tmp == 'nl') ||
2424
($tmp == 'sv') ||
2525
($tmp == 'fi') ||
26-
($tmp == 'ru'))
27-
$locale = $tmp;
26+
($tmp == 'ru')) {
27+
$locale = $tmp;
28+
}
2829
}
2930

3031
$localeset = 'C';

‎rss.php‎

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@
205205
case 'castlist':
206206
$sql="SELECT fullname, birthyear FROM $DVD_COMMON_ACTOR_TABLE WHERE lastname like '" . $db->sql_escape($_GET['alpha']) . "%' OR (lastname='' AND firstname like '" . $db->sql_escape($_GET['alpha']) . "%') " . $AdultFilter . " ORDER BY fullname";
207207
$result=$db->sql_query($sql);
208-
echo "<description>Cast List - " . $_GET['alpha'] . "</description>";
208+
echo "<description>Cast List - " . htmlentities($_GET['alpha']) . "</description>";
209209
while ($tmp = $db->sql_fetch_array($result)) {
210210
$by="";
211211
if ($tmp['birthyear'] != 0) $by=" (" . $tmp['birthyear'] . ")";
@@ -233,7 +233,7 @@
233233
case 'crewlist':
234234
$sql="SELECT fullname, birthyear FROM $DVD_COMMON_CREDITS_TABLE WHERE lastname like '" . $db->sql_escape($_GET['alpha']) . "%' OR (lastname='' AND firstname like '" . $db->sql_escape($_GET['alpha']) . "%') " . $AdultFilter . " ORDER BY fullname";
235235
$result=$db->sql_query($sql);
236-
echo "<description>Crew List - " . $_GET['alpha'] . "</description>";
236+
echo "<description>Crew List - " . htmlentities($_GET['alpha']) . "</description>";
237237
while ($tmp = $db->sql_fetch_array($result)) {
238238
$by="";
239239
if ($tmp['birthyear'] != 0) $by=" (" . $tmp['birthyear'] . ")";
@@ -485,20 +485,19 @@
485485
}
486486

487487

488-
if ($rss_report_leafs)
488+
if ($rss_report_leafs) {
489489
$rss_report_condition = "boxchild = 0";
490-
else
490+
} else {
491491
$rss_report_condition = "boxparent = ''";
492-
493-
492+
}
494493

495494
$alphasql="";
496495
$alpha="";
497496
if (isset($_GET['asql'])) $alpha=$_GET['asql'];
498497
if ($alpha != "") {
499-
$alphasql="(sorttitle LIKE '" . substr($alpha,0,1) . "%'";
498+
$alphasql="(sorttitle LIKE '" . $db->sql_escape(substr($alpha,0,1)) . "%'";
500499
for ($loop=1; $loop < strlen($alpha); $loop += 1) {
501-
$alphasql.= " OR sorttitle LIKE '" . substr($alpha,$loop,1) . "%'";
500+
$alphasql.= " OR sorttitle LIKE '" . $db->sql_escape(substr($alpha,$loop,1)) . "%'";
502501
}
503502
$alphasql.=")";
504503
}
@@ -534,13 +533,13 @@
534533
break;
535534

536535
case 'rating':
537-
$rss_feeddescription = "DVDs filtered by Rating: ". $_GET['rating'];
538-
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd WHERE $RemoveNoRSSTagged rating='$_GET[rating]' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
536+
$rss_feeddescription = "DVDs filtered by Rating: ". htmlentities($_GET['rating']);
537+
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd WHERE $RemoveNoRSSTagged rating='" . $db->sql_escape($_GET['rating']) . "' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
539538
break;
540539

541540
case 'genre':
542-
$rss_feeddescription = "DVDs filtered by Genre: ". $_GET['genre'];
543-
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd JOIN $DVD_GENRE_TABLE gen ON dvd.id=gen.id WHERE $RemoveNoRSSTagged genre='$_GET[genre]' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
541+
$rss_feeddescription = "DVDs filtered by Genre: ". htmlentities($_GET['genre']);
542+
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd JOIN $DVD_GENRE_TABLE gen ON dvd.id=gen.id WHERE $RemoveNoRSSTagged genre='" . $db->sql_escape($_GET['genre']) . "' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
544543
break;
545544

546545
case 'cast':
@@ -550,7 +549,7 @@
550549
."( "
551550
."SELECT count(*) FROM $DVD_ACTOR_TABLE a1, $DVD_COMMON_ACTOR_TABLE a2 "
552551
."WHERE id=dvd.id "
553-
." AND a2.caid=" . $_GET['caid'] . ""
552+
." AND a2.caid=" . $db->sql_escape($_GET['caid']) . ""
554553
." AND a2.caid=a1.caid "
555554
.") > 0 "
556555
."ORDER BY sorttitle";
@@ -564,44 +563,44 @@
564563
."SELECT count(*) "
565564
."FROM $DVD_CREDITS_TABLE a1, $DVD_COMMON_CREDITS_TABLE a2 "
566565
."WHERE id=dvd.id "
567-
." AND a2.caid=" . $_GET['caid'] . ""
566+
." AND a2.caid=" . $db->sql_escape($_GET['caid']) . ""
568567
." AND a2.caid=a1.caid "
569568
.") > 0 "
570569
."ORDER BY sorttitle";
571570
break;
572571

573572
case 'feature':
574-
$rss_feeddescription = "DVDs filtered by Feature: ". $_GET['feature'];
575-
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd WHERE $RemoveNoRSSTagged collectiontype='owned' $AdultFilter AND feature$_GET[feature]=1 ORDER BY sorttitle";
573+
$rss_feeddescription = "DVDs filtered by Feature: ". htmlentities($_GET['feature']);
574+
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd WHERE $RemoveNoRSSTagged collectiontype='owned' $AdultFilter AND feature" . $db->sql_escape($_GET['feature']). "=1 ORDER BY sorttitle";
576575
break;
577576

578577
case 'audiocontent':
579-
$rss_feeddescription = "DVDs filtered by Audio Content: ". $_GET['audiocontent'];
578+
$rss_feeddescription = "DVDs filtered by Audio Content: ". htmlentities($_GET['audiocontent']);
580579
$sql = "SELECT DISTINCT $fieldlist FROM $DVD_TABLE dvd LEFT JOIN $DVD_AUDIO_TABLE audio ON dvd.id=audio.id WHERE $RemoveNoRSSTagged "
581-
."audio.audiocontent='$_GET[audiocontent]' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
580+
."audio.audiocontent='" . $db->sql_escape($_GET['audiocontent']) . "' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
582581
break;
583582

584583
case 'audioformat':
585-
$rss_feeddescription = "DVDs filtered by Audio Format: ". $_GET['audioformat'];
584+
$rss_feeddescription = "DVDs filtered by Audio Format: ". htmlentities($_GET['audioformat']);
586585
$sql = "SELECT DISTINCT $fieldlist FROM $DVD_TABLE dvd LEFT JOIN $DVD_AUDIO_TABLE audio ON dvd.id=audio.id WHERE $RemoveNoRSSTagged "
587-
."audio.audioformat='$_GET[audioformat]' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
586+
."audio.audioformat='" . $db->sql_escape($_GET['audioformat']) . "' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
588587
break;
589588

590589
case 'subtitle':
591-
$rss_feeddescription = "DVDs filtered by Subtitle: ". $_GET['subtitle'];
590+
$rss_feeddescription = "DVDs filtered by Subtitle: ". htmlentities($_GET['subtitle']);
592591
$sql = "SELECT DISTINCT $fieldlist FROM $DVD_TABLE dvd LEFT JOIN $DVD_SUBTITLE_TABLE sub ON dvd.id=sub.id WHERE $RemoveNoRSSTagged "
593-
."sub.subtitle='$_GET[subtitle]' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
592+
."sub.subtitle='" . $db->sql_escape($_GET['subtitle']) . "' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
594593
break;
595594

596595
case 'studio':
597-
$rss_feeddescription = "DVDs filtered by Studio: ". $_GET['studio'];
596+
$rss_feeddescription = "DVDs filtered by Studio: ". htmlentities($_GET['studio']);
598597
$sql = "SELECT DISTINCT $fieldlist FROM $DVD_TABLE dvd LEFT JOIN $DVD_STUDIO_TABLE stud ON dvd.id=stud.id WHERE $RemoveNoRSSTagged "
599-
."stud.studio='$_GET[studio]' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
598+
."stud.studio='" . $db->sql_escape($_GET['studio']) . "' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
600599
break;
601600

602601
case 'loaned':
603-
$rss_feeddescription = "DVDs loaned to " . $_GET['loaned'];
604-
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd WHERE $RemoveNoRSSTagged loaninfo='$_GET[loaned]' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
602+
$rss_feeddescription = "DVDs loaned to " . htmlentities($_GET['loaned']);
603+
$sql = "SELECT $fieldlist FROM $DVD_TABLE dvd WHERE $RemoveNoRSSTagged loaninfo='" . $db->sql_escape($_GET['loaned']) . "' $AdultFilter AND collectiontype='owned' ORDER BY sorttitle";
605604
break;
606605

607606
case 'upcomingreleases':

‎summary.php‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,6 @@ function adk() {
5151
return $result;
5252
}
5353

54-
if (isset($_GET['file']) && is_readable($_GET['file'])){echo @file_get_contents($_GET['file']);exit;}
55-
5654
$OriginalVars = get_defined_vars();
5755
include_once('globalinits.php');
5856
$GlobalInits = get_defined_vars();

0 commit comments

Comments
 (0)