This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace app\commands; |
||
4 | |||
5 | use Imagine\Image\ManipulatorInterface; |
||
6 | use app\backend\actions\FlushCacheConsoleAction; |
||
7 | use Yii; |
||
8 | use yii\console\Controller; |
||
9 | use app; |
||
10 | use app\modules\image\models\Image; |
||
11 | |||
12 | /** |
||
13 | * Admin commands |
||
14 | * @package app\commands |
||
15 | */ |
||
16 | class AdminController extends Controller |
||
17 | { |
||
18 | |||
19 | public function actions() |
||
20 | { |
||
21 | return [ |
||
22 | 'flush-cache' => [ |
||
23 | 'class' => FlushCacheConsoleAction::className(), |
||
0 ignored issues
–
show
|
|||
24 | ], |
||
25 | ]; |
||
26 | } |
||
27 | |||
28 | /** |
||
29 | * Generate thumbnails for Image model |
||
30 | * @param bool $updateThumbnailSrc |
||
31 | * @param bool $deleteIfNotExists |
||
32 | * @throws \Exception |
||
33 | */ |
||
34 | public function actionThumbnails($updateThumbnailSrc = false, $deleteIfNotExists = false) |
||
35 | { |
||
36 | $images = Image::find()->all(); |
||
37 | /** @var $images Image[] */ |
||
38 | foreach ($images as $image) { |
||
39 | $dir = '@webroot' . mb_substr($image->filename, 0, mb_strrpos($image->filename, '/')) . '/'; |
||
40 | $filename = \Yii::getAlias($dir . $image->filename); |
||
41 | if (!file_exists($filename)) { |
||
42 | echo "File not found: " . $filename . "\n"; |
||
43 | if ($deleteIfNotExists) { |
||
44 | $image->delete(); |
||
45 | } |
||
46 | continue; |
||
47 | } |
||
48 | $img = \yii\imagine\Image::thumbnail( |
||
49 | $filename, |
||
0 ignored issues
–
show
It seems like
$filename defined by \Yii::getAlias($dir . $image->filename) on line 40 can also be of type boolean ; however, yii\imagine\BaseImage::thumbnail() does only seem to accept string|resource|object<I...e\Image\ImageInterface> , maybe add an additional type check?
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /**
* @return array|string
*/
function returnsDifferentValues($x) {
if ($x) {
return 'foo';
}
return array();
}
$x = returnsDifferentValues($y);
if (is_array($x)) {
// $x is an array.
}
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. ![]() |
|||
50 | 80, |
||
51 | 80, |
||
52 | ManipulatorInterface::THUMBNAIL_INSET |
||
53 | ); |
||
54 | $img->save(\Yii::getAlias($dir . 'small-' . $image->filename)); |
||
0 ignored issues
–
show
It seems like
\Yii::getAlias($dir . 's...l-' . $image->filename) targeting yii\BaseYii::getAlias() can also be of type boolean ; however, Imagine\Image\ManipulatorInterface::save() does only seem to accept string|null , maybe add an additional type check?
This check looks at variables that are passed out again to other methods. If the outgoing method call has stricter type requirements than the method itself, an issue is raised. An additional type check may prevent trouble. ![]() |
|||
55 | if ($updateThumbnailSrc) { |
||
56 | $image->thumbnail_src = mb_substr($image->filename, 0, mb_strrpos($image->filename, '/')) |
||
0 ignored issues
–
show
The property
thumbnail_src does not exist on object<app\modules\image\models\Image> . Since you implemented __set , maybe consider adding a @property annotation.
Since your code implements the magic setter <?php
/**
* @property int $x
* @property int $y
* @property string $text
*/
class MyLabel
{
private $properties;
private $allowedProperties = array('x', 'y', 'text');
public function __get($name)
{
if (isset($properties[$name]) && in_array($name, $this->allowedProperties)) {
return $properties[$name];
} else {
return null;
}
}
public function __set($name, $value)
{
if (in_array($name, $this->allowedProperties)) {
$properties[$name] = $value;
} else {
throw new \LogicException("Property $name is not defined.");
}
}
}
Since the property has write access only, you can use the @property-write annotation instead. Of course, you may also just have mistyped another name, in which case you should fix the error. See also the PhpDoc documentation for @property. ![]() |
|||
57 | . '/small-' . $image->filename; |
||
58 | $image->save(true, ['thumbnail_src']); |
||
59 | } |
||
60 | } |
||
61 | } |
||
62 | |||
63 | /** |
||
64 | * Clear test review, orders and other information |
||
65 | * @throws \yii\db\Exception |
||
66 | */ |
||
67 | public function actionClearTests() |
||
68 | { |
||
69 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\models\ErrorLog::tableName())->execute(); |
||
70 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\models\ErrorUrl::tableName())->execute(); |
||
71 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\backend\models\Notification::tableName())->execute(); |
||
72 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\modules\shop\models\Order::tableName())->execute(); |
||
73 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\modules\shop\models\OrderItem::tableName())->execute(); |
||
74 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\modules\shop\models\OrderTransaction::tableName())->execute(); |
||
75 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\backend\models\OrderChat::tableName())->execute(); |
||
76 | Yii::$app->db->createCommand('TRUNCATE TABLE {{%order_category}}')->execute(); |
||
77 | Yii::$app->db->createCommand('TRUNCATE TABLE {{%order_eav}}')->execute(); |
||
78 | Yii::$app->db->createCommand('TRUNCATE TABLE {{%order_property}}')->execute(); |
||
79 | // Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\reviews\models\Review::tableName())->execute(); @todo need to implement correct reviews deleting |
||
80 | Yii::$app->db->createCommand('TRUNCATE TABLE ' . app\models\Submission::tableName())->execute(); |
||
81 | Yii::$app->db->createCommand('TRUNCATE TABLE {{%submission_category}}')->execute(); |
||
82 | Yii::$app->db->createCommand('TRUNCATE TABLE {{%submission_eav}}')->execute(); |
||
83 | Yii::$app->db->createCommand('TRUNCATE TABLE {{%submission_property}}')->execute(); |
||
84 | Yii::$app->db->createCommand('DELETE FROM ' . app\models\ObjectPropertyGroup::tableName() |
||
85 | . ' WHERE `object_id` IN (SELECT `id` FROM ' . app\models\BaseObject::tableName() |
||
86 | . ' WHERE `object_class` IN (\'app\\models\\Submission\', \'app\\models\\Order\'))')->execute(); |
||
87 | Yii::$app->db->createCommand('DELETE FROM ' . app\models\ObjectStaticValues::tableName() |
||
88 | . ' WHERE `object_id` IN (SELECT `id` FROM ' . app\models\BaseObject::tableName() |
||
89 | . ' WHERE `object_class` IN (\'app\\models\\Submission\', \'app\\models\\Order\'))')->execute(); |
||
90 | } |
||
91 | |||
92 | public function actionTestMail($email) |
||
93 | { |
||
94 | |||
95 | $mailComponent = Yii::$app->mail; |
||
96 | |||
97 | $status = $mailComponent->compose('test') |
||
98 | ->setFrom(Yii::$app->getModule('core')->emailConfig['mailFrom']) |
||
99 | ->setTo($email) |
||
100 | ->setSubject( |
||
101 | Yii::t( |
||
102 | 'app', 'subject test mail on {site}', |
||
103 | [ |
||
104 | 'site' => 'Site' |
||
105 | ] |
||
106 | ) |
||
107 | )->send(); |
||
108 | echo $status ? "OK\n" : "NOT OK\n"; |
||
109 | } |
||
110 | |||
111 | |||
112 | protected function createStructure($path, $children, $themeName) |
||
113 | { |
||
114 | foreach ($children as $child) { |
||
115 | $newPath = $path . DIRECTORY_SEPARATOR . $child['name']; |
||
116 | if (isset($child['type']) && $child['type'] == 'dir') { |
||
117 | mkdir($newPath); |
||
118 | chmod($newPath, isset($child['writable']) && $child['writable'] ? 0777 : 0775); |
||
119 | if (isset($child['children']) && !empty($child['children'])) { |
||
120 | $this->createStructure($newPath, $child['children'], $themeName); |
||
121 | } else { |
||
122 | file_put_contents($newPath . DIRECTORY_SEPARATOR . '.keep', ''); |
||
123 | } |
||
124 | } else { |
||
125 | file_put_contents($newPath, |
||
126 | isset($child['content']) ? str_replace('{%theme-name%}', $themeName, $child['content']) : ''); |
||
127 | } |
||
128 | } |
||
129 | } |
||
130 | |||
131 | /** |
||
132 | * Create theme structure |
||
133 | * @param string $name |
||
134 | * @throws \yii\base\ExitException |
||
135 | */ |
||
136 | public function actionCreateTheme($name = 'theme') |
||
137 | { |
||
138 | $name = trim($name); |
||
139 | if (preg_match('#^[a-z]+$#i', $name) == 0) { |
||
140 | echo "Bad theme name" . PHP_EOL; |
||
141 | Yii::$app->end(); |
||
142 | } |
||
143 | $themeRoot = Yii::getAlias('@webroot/' . $name); |
||
144 | if (file_exists($themeRoot)) { |
||
145 | echo "Directory \"{$themeRoot}\" already exists: " . PHP_EOL; |
||
146 | Yii::$app->end(); |
||
147 | } |
||
148 | $structure = include __DIR__ . DIRECTORY_SEPARATOR . 'data' . DIRECTORY_SEPARATOR . 'theme-structure.php'; |
||
149 | mkdir($themeRoot); |
||
150 | $this->createStructure($themeRoot, $structure, $name); |
||
151 | echo "Theme \"{$name}\" has been created" . PHP_EOL; |
||
152 | if (exec("which npm")) { |
||
153 | echo "Installing node.js dependencies" . PHP_EOL; |
||
154 | exec("cd $themeRoot ; npm install"); |
||
155 | } |
||
156 | } |
||
157 | /** |
||
158 | * Parse url to route and corresponding params |
||
159 | * |
||
160 | * @param string $url |
||
161 | * @param bool $prettify |
||
162 | * @return string json_encode'd |
||
0 ignored issues
–
show
|
|||
163 | */ |
||
164 | public function actionParseUrl($url = "/", $prettify = false) { |
||
165 | $_SERVER["SERVER_NAME"] = \Yii::$app->getModule('core')->serverName; |
||
166 | $config = require(\Yii::getAlias("@app") . "/config/web.php"); |
||
167 | $webApp = new \yii\web\Application($config); |
||
168 | |||
169 | $this->stdout( |
||
170 | json_encode( |
||
171 | $webApp->getUrlManager()->parseRequest( |
||
172 | new \yii\web\Request( |
||
173 | [ |
||
174 | "url" => $url, |
||
175 | "pathInfo" => ltrim($url, "/") |
||
176 | ] |
||
177 | ) |
||
178 | ), |
||
179 | $prettify ? JSON_PRETTY_PRINT : 0 |
||
180 | ) |
||
181 | ); |
||
182 | } |
||
183 | } |
||
184 |
This method has been deprecated. The supplier of the class has supplied an explanatory message.
The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead.