ClicShopping #352

    } catch (Exception $e) {
      if ($secure === true) {
        throw $e;
      }
      $result = mt_rand($min, $max);
The function mt_rand() is not cryptographically secure. Use random_int() or random_bytes() instead.
Time to fix: about 2 hours
Read doc Permalink Copy Prompt

                                    Last edited Wed, 30 Aug 2023 18:17:38 +0000 by ClicShopping
                    
    }
    return $result;
  }

$llmProvider = 'openai'; // Default
if (defined('CLICSHOPPING_APP_CHATGPT_CH_MODEL')) {
    $model = CLICSHOPPING_APP_CHATGPT_CH_MODEL;
    // Determine provider from model name
    if (strpos($model, 'anth-') === 0 || strpos($model, 'claude') !== false) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Thu, 14 May 2026 14:14:51 +0000 by clicshopping
                    
        $llmProvider = 'anthropic';
    } elseif (strpos($model, 'mistral') !== false) {
        $llmProvider = 'mistral';
    } elseif (strpos($model, 'ollama:') === 0 || strpos($model, 'mistral:') === 0) {
        $llmProvider = 'ollama';

    $model = CLICSHOPPING_APP_CHATGPT_CH_MODEL;
    // Determine provider from model name
    if (strpos($model, 'anth-') === 0 || strpos($model, 'claude') !== false) {
        $llmProvider = 'anthropic';
    } elseif (strpos($model, 'mistral') !== false) {
Consider replacing strpos() with str_contains() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Thu, 14 May 2026 14:14:51 +0000 by clicshopping
                    
        $llmProvider = 'mistral';
    } elseif (strpos($model, 'ollama:') === 0 || strpos($model, 'mistral:') === 0) {
        $llmProvider = 'ollama';
    } elseif (strpos($model, 'openai/') === 0 || strpos($model, 'microsoft/') === 0 || strpos($model, 'qwen/') === 0) {
        $llmProvider = 'lmstudio';

    // Determine provider from model name
    if (strpos($model, 'anth-') === 0 || strpos($model, 'claude') !== false) {
        $llmProvider = 'anthropic';
    } elseif (strpos($model, 'mistral') !== false) {
        $llmProvider = 'mistral';
    } elseif (strpos($model, 'ollama:') === 0 || strpos($model, 'mistral:') === 0) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Thu, 14 May 2026 14:14:51 +0000 by clicshopping
                    
        $llmProvider = 'ollama';
    } elseif (strpos($model, 'openai/') === 0 || strpos($model, 'microsoft/') === 0 || strpos($model, 'qwen/') === 0) {
        $llmProvider = 'lmstudio';
    } else {
        // Default to OpenAI for gpt-* models

$llmProvider = 'openai'; // Default
if (defined('CLICSHOPPING_APP_CHATGPT_CH_MODEL')) {
    $model = CLICSHOPPING_APP_CHATGPT_CH_MODEL;
    // Determine provider from model name
    if (strpos($model, 'anth-') === 0 || strpos($model, 'claude') !== false) {
Consider replacing strpos() with str_contains() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Thu, 14 May 2026 14:14:51 +0000 by clicshopping
                    
        $llmProvider = 'anthropic';
    } elseif (strpos($model, 'mistral') !== false) {
        $llmProvider = 'mistral';
    } elseif (strpos($model, 'ollama:') === 0 || strpos($model, 'mistral:') === 0) {
        $llmProvider = 'ollama';

        $llmProvider = 'anthropic';
    } elseif (strpos($model, 'mistral') !== false) {
        $llmProvider = 'mistral';
    } elseif (strpos($model, 'ollama:') === 0 || strpos($model, 'mistral:') === 0) {
        $llmProvider = 'ollama';
    } elseif (strpos($model, 'openai/') === 0 || strpos($model, 'microsoft/') === 0 || strpos($model, 'qwen/') === 0) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Thu, 14 May 2026 14:14:51 +0000 by clicshopping
                    
        $llmProvider = 'lmstudio';
    } else {
        // Default to OpenAI for gpt-* models
        $llmProvider = 'openai';
    }

    if ($zip->open($filename_localisation) === true) {
      $has_traversal = false;
      for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        // Check for path traversal
        if (strpos($filename, '..') !== false || strpos($filename, '/') === 0 || strpos($filename, '\\') === 0) {
Consider replacing strpos() with str_contains() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
          $has_traversal = true;
          break;
        }
        // Check for absolute paths
        if (preg_match('/^[a-zA-Z]:\\/', $filename)) {

    if ($zip->open($filename_localisation) === true) {
      $has_traversal = false;
      for ($i = 0; $i < $zip->numFiles; $i++) {
        $filename = $zip->getNameIndex($i);
        // Check for path traversal
        if (strpos($filename, '..') !== false || strpos($filename, '/') === 0 || strpos($filename, '\\') === 0) {
Consider replacing strpos() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Thu, 21 May 2026 05:37:05 +0000 by clicshopping
                    
          $has_traversal = true;
          break;
        }
        // Check for absolute paths
        if (preg_match('/^[a-zA-Z]:\\/', $filename)) {

    if ($response === '') {
      return $response;
    }
    // If there are no HTML tags at all, skip the work
    $hasTags = (\strpos($response, '<') !== false);
Consider replacing strpos() with str_contains() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Mon, 25 May 2026 14:30:15 +0000 by clicshopping
                    
    if ($hasTags) {
      $response = \strip_tags($response);
      $response = \html_entity_decode($response, ENT_QUOTES | ENT_HTML5, 'UTF-8');
    }

    }
    $expectedV6 = filter_var($expected, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
    $actualV6   = filter_var($actual,   FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
    if ($expectedV6 !== false && $actualV6 !== false) {
      return substr(inet_pton($expectedV6), 0, 8) === substr(inet_pton($actualV6), 0, 8);
Consider replacing substr() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Wed, 27 May 2026 04:25:38 +0000 by clicshopping
                    
    }
    // Mixed family or unparseable — fall back to strict to avoid silent bypass.
    return $expected === $actual;
  }

    $expectedV6 = filter_var($expected, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
    $actualV6   = filter_var($actual,   FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
    if ($expectedV6 !== false && $actualV6 !== false) {
      // Same /64 — first 8 bytes of the 16-byte packed form.
      return substr(inet_pton($expectedV6), 0, 8) === substr(inet_pton($actualV6), 0, 8);
Consider replacing substr() with str_starts_with() for improved readability.
Time to fix: about 1 hour
Read doc Permalink Copy Prompt

                                    Last edited Wed, 27 May 2026 04:25:38 +0000 by clicshopping
                    
    }
    // Mixed family or unparseable — fall back to strict to avoid silent bypass.
    return $expected === $actual;
  }