This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /** |
||
4 | * OpauthIdentity |
||
5 | * The SS equivalent of "index.php" and "callback.php" in the Opauth package. |
||
6 | * @author Will Morgan <@willmorgan> |
||
7 | * @author Dan Hensby <@dhensby> |
||
8 | * @copyright Copyright (c) 2013, Better Brief LLP |
||
9 | */ |
||
10 | class OpauthIdentity extends DataObject { |
||
0 ignored issues
–
show
|
|||
11 | |||
12 | private static |
||
13 | $db = array( |
||
0 ignored issues
–
show
The visibility should be declared for property
$db .
The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using class A {
var $property;
}
the property is implicitly global. To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2. ![]() |
|||
14 | 'UID' => 'Varchar(255)', |
||
15 | 'Provider' => 'Varchar(45)', |
||
16 | ), |
||
17 | $has_one = array( |
||
0 ignored issues
–
show
|
|||
18 | 'Member' => 'Member', |
||
19 | ), |
||
20 | $summary_fields = array( |
||
0 ignored issues
–
show
|
|||
21 | 'Member.Email' => 'MemberEmail', |
||
22 | 'Provider' => 'Provider', |
||
23 | 'UID' => 'UID', |
||
24 | ); |
||
25 | |||
26 | protected |
||
27 | /** |
||
28 | * @var array source from Opauth |
||
29 | */ |
||
30 | $authSource, |
||
0 ignored issues
–
show
The visibility should be declared for property
$authSource .
The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using class A {
var $property;
}
the property is implicitly global. To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2. ![]() |
|||
31 | /** |
||
32 | * @var array The parsed member record, if any |
||
33 | */ |
||
34 | $parsedRecord; |
||
35 | |||
36 | private |
||
37 | /** |
||
38 | * @var boolean shim for onBeforeCreate |
||
39 | */ |
||
40 | $_isCreating = false; |
||
0 ignored issues
–
show
The visibility should be declared for property
$_isCreating .
The PSR-2 coding standard requires that all properties in a class have their visibility explicitly declared. If you declare a property using class A {
var $property;
}
the property is implicitly global. To learn more about the PSR-2, please see the PHP-FIG site on the PSR-2. ![]() |
|||
41 | |||
42 | /** |
||
43 | * factory |
||
44 | * Returns or creates a fresh OpauthIdentity. |
||
45 | * @param array $oaResponse The response object from Opauth. |
||
46 | * @return OpauthIdentity instance based on $oaResponse. |
||
47 | */ |
||
48 | public static function factory(array $oaResponse) { |
||
49 | |||
50 | if(empty($oaResponse['auth'])) { |
||
51 | throw new InvalidArgumentException('The auth key is required to continue.'); |
||
52 | } |
||
53 | if(empty($oaResponse['auth']['provider'])) { |
||
54 | throw new InvalidArgumentException('Unable to determine provider.'); |
||
55 | } |
||
56 | |||
57 | $auth = $oaResponse['auth']; |
||
58 | |||
59 | $do = OpauthIdentity::get()->filter( |
||
60 | array( |
||
61 | 'Provider' => $auth['provider'], |
||
62 | 'UID' => $auth['uid'], |
||
63 | ) |
||
64 | )->first(); |
||
65 | |||
66 | if(!$do || !$do->exists()) { |
||
67 | $do = new OpauthIdentity(); |
||
68 | $do->Provider = $auth['provider']; |
||
0 ignored issues
–
show
The property
Provider does not exist on object<OpauthIdentity> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
69 | $do->UID = $auth['uid']; |
||
0 ignored issues
–
show
The property
UID does not exist on object<OpauthIdentity> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
70 | } |
||
71 | |||
72 | $do->setAuthSource($auth); |
||
73 | return $do; |
||
74 | } |
||
75 | |||
76 | /** |
||
77 | * Add an extension point for creation and member linking |
||
78 | */ |
||
79 | public function onBeforeWrite() { |
||
80 | parent::onBeforeWrite(); |
||
81 | if(!$this->isInDb()) { |
||
82 | $this->_isCreating = true; |
||
83 | $this->extend('onBeforeCreate'); |
||
84 | } |
||
85 | if($this->isChanged('MemberID')) { |
||
86 | $this->extend('onMemberLinked'); |
||
87 | } |
||
88 | } |
||
89 | |||
90 | /** |
||
91 | * Add an extension point for afterCreate |
||
92 | */ |
||
93 | public function onAfterWrite() { |
||
94 | parent::onAfterWrite(); |
||
95 | if($this->_isCreating === true) { |
||
96 | $this->_isCreating = false; |
||
97 | $this->extend('onAfterCreate'); |
||
98 | } |
||
99 | } |
||
100 | |||
101 | /** |
||
102 | * Finds a member based on this identity. Searches existing records before |
||
103 | * creating a new Member object. |
||
104 | * Note that this method does not write anything, merely sets everything up. |
||
105 | * @param array $usrSettings A map of settings because there are so many. |
||
106 | * @return Member |
||
107 | */ |
||
108 | public function findOrCreateMember($usrSettings = array()) { |
||
109 | |||
110 | $defaults = array( |
||
111 | /** |
||
112 | * Link this identity to any newly discovered member. |
||
113 | */ |
||
114 | 'linkOnMatch' => true, |
||
115 | /** |
||
116 | * True, false, or an array of fields to overwrite if we merge data. |
||
117 | * Exception to this rule is overwriteEmail, which takes precedence. |
||
118 | */ |
||
119 | 'overwriteExistingFields' => false, |
||
120 | /** |
||
121 | * Overwrite the email field if it's different. Effectively changes |
||
122 | * the Member login details, so it's set to false for now. |
||
123 | */ |
||
124 | 'overwriteEmail' => false, |
||
125 | ); |
||
126 | |||
127 | $settings = array_merge($defaults, $usrSettings); |
||
128 | |||
129 | if($this->isInDB()) { |
||
130 | $member = $this->Member(); |
||
0 ignored issues
–
show
|
|||
131 | if($member->exists()) { |
||
132 | return $member; |
||
133 | } |
||
134 | } |
||
135 | |||
136 | $record = $this->getMemberRecordFromAuth(); |
||
137 | |||
138 | if(empty($record['Email'])) { |
||
139 | $member = new Member(); |
||
140 | } |
||
141 | else { |
||
142 | $member = Member::get()->filter('Email', $record['Email'])->first(); |
||
143 | |||
144 | if(!$member) { |
||
145 | $member = new Member(); |
||
146 | } |
||
147 | } |
||
148 | |||
149 | if($settings['linkOnMatch'] && $member->isInDB()) { |
||
150 | $this->MemberID = $member->ID; |
||
0 ignored issues
–
show
The property
MemberID does not exist on object<OpauthIdentity> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
151 | } |
||
152 | |||
153 | // If this is a new member, give it everything we have. |
||
154 | if(!$member->isInDB()) { |
||
155 | $member->update($record); |
||
156 | } |
||
157 | // If not, we update it carefully using the settings described above. |
||
158 | else { |
||
159 | $overwrite = $settings['overwriteExistingFields']; |
||
160 | $overwriteEmail = $settings['overwriteEmail']; |
||
161 | $fieldsToWrite = array(); |
||
162 | |||
163 | // If overwrite is true, take everything (subtract Email later) |
||
164 | if($overwrite === true) { |
||
165 | $fieldsToWrite = $record; |
||
166 | } |
||
167 | else if(is_array($overwrite)) { |
||
168 | $fieldsToWrite = array_intersect_key($record, ArrayLib::valuekey($overwrite)); |
||
169 | } |
||
170 | // If false then fieldsToWrite remains empty, let's coast it out. |
||
171 | |||
172 | // Subtract email if setting is not precisely true: |
||
173 | if($overwriteEmail !== true && isset($fieldsToWrite['Email'])) { |
||
174 | unset($fieldsToWrite['Email']); |
||
175 | } |
||
176 | |||
177 | // Boom, we're so done. |
||
178 | $member->update($fieldsToWrite); |
||
179 | } |
||
180 | |||
181 | return $member; |
||
182 | } |
||
183 | |||
184 | /** |
||
185 | * @param array $auth |
||
186 | */ |
||
187 | public function setAuthSource($auth) { |
||
188 | $this->authSource = $auth; |
||
189 | unset($this->parsedRecord); |
||
190 | return $this; |
||
191 | } |
||
192 | |||
193 | /** |
||
194 | * @return array |
||
195 | */ |
||
196 | public function getAuthSource() { |
||
197 | return $this->authSource; |
||
198 | } |
||
199 | |||
200 | /** |
||
201 | * @return array The mapping arrangement from auth response to Member. |
||
202 | */ |
||
203 | public function getMemberMapper() { |
||
204 | $mapper = Config::inst()->get(__CLASS__, 'member_mapper'); |
||
205 | if(!isset($mapper[$this->Provider])) { |
||
0 ignored issues
–
show
The property
Provider does not exist on object<OpauthIdentity> . Since you implemented __get , maybe consider adding a @property annotation.
Since your code implements the magic getter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
If the property has read access only, you can use the @property-read annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
206 | return array(); |
||
207 | } |
||
208 | return $mapper[$this->Provider]; |
||
0 ignored issues
–
show
The property
Provider does not exist on object<OpauthIdentity> . Since you implemented __get , maybe consider adding a @property annotation.
Since your code implements the magic getter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
If the property has read access only, you can use the @property-read annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
209 | } |
||
210 | |||
211 | /** |
||
212 | * Use dot notation and/or a parser to retrieve information from a provider. |
||
213 | * Examples of simple dot notation: |
||
214 | * - 'FirstName' => 'info.first_name' |
||
215 | * - 'Surname' => 'info.surname' |
||
216 | * Examples of a parser, for example when only a "name" param is present: |
||
217 | * - 'FirstName' => array('OpauthResponseHelper', 'get_first_name') |
||
218 | * - 'Surname' => array('OpauthResponseHelper', 'get_last_name') |
||
219 | * @see OpauthResponseHelper |
||
220 | * @return array The data record to add to a member |
||
221 | */ |
||
222 | public function getMemberRecordFromAuth() { |
||
223 | if(empty($this->parsedRecord)) { |
||
224 | $record = array(); |
||
225 | foreach($this->getMemberMapper() as $memberField => $sourcePath) { |
||
226 | if(is_array($sourcePath)) { |
||
227 | $record[$memberField] = call_user_func($sourcePath, $this->authSource); |
||
228 | } |
||
229 | else if(is_string($sourcePath)) { |
||
230 | $record[$memberField] = OpauthResponseHelper::parse_source_path($sourcePath, $this->authSource); |
||
231 | } |
||
232 | } |
||
233 | $this->parsedRecord = $record; |
||
234 | } |
||
235 | return $this->parsedRecord; |
||
236 | } |
||
237 | |||
238 | } |
||
239 |
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.