This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace app\components; |
||
4 | |||
5 | use yii\base\InvalidParamException; |
||
6 | use yii\base\Model; |
||
7 | use yii\data\ActiveDataProvider; |
||
8 | use yii\data\Pagination; |
||
9 | use yii\db\ActiveQuery; |
||
10 | use yii\db\ActiveRecord; |
||
11 | |||
12 | /** |
||
13 | * Class SearchModel |
||
14 | * @package app\components |
||
15 | */ |
||
16 | class SearchModel extends Model |
||
17 | { |
||
18 | private $attributes; |
||
19 | private $internalRelations; |
||
20 | /** |
||
21 | * @var ActiveRecord $model |
||
22 | */ |
||
23 | private $model; |
||
24 | private $modelClassName; |
||
25 | private $relationAttributes = []; |
||
26 | private $rules; |
||
27 | private $scenarios; |
||
28 | public $additionalConditions; |
||
29 | public $defaultOrder; |
||
30 | public $groupBy; |
||
31 | public $pageSize = 20; |
||
32 | public $partialMatchAttributes = []; |
||
33 | public $relations = []; |
||
34 | |||
35 | /** |
||
36 | * @param ActiveQuery $query |
||
37 | * @param string $attribute |
||
38 | * @param bool $partialMath |
||
39 | */ |
||
40 | private function addCondition($query, $attribute, $partialMath = false) |
||
41 | { |
||
42 | if (isset($this->relationAttributes[$attribute])) { |
||
43 | $attributeName = $this->relationAttributes[$attribute]; |
||
44 | } else { |
||
45 | $attributeName = call_user_func([$this->modelClassName, 'tableName']) . '.' . $attribute; |
||
46 | } |
||
47 | $value = $this->$attribute; |
||
48 | if ($value === '') { |
||
49 | return; |
||
50 | } |
||
51 | if ($partialMath) { |
||
52 | $query->andWhere(['like', $attributeName, $value]); |
||
53 | } else { |
||
54 | $query->andWhere([$attributeName => $value]); |
||
55 | } |
||
56 | } |
||
57 | |||
58 | /** |
||
59 | * @param array $params |
||
60 | * @throws \yii\base\InvalidParamException |
||
61 | */ |
||
62 | public function __construct($params) |
||
63 | { |
||
64 | $this->scenario = 'search'; |
||
65 | parent::__construct($params); |
||
66 | if ($this->model === null) { |
||
67 | throw new InvalidParamException('Param "model" cannot be empty'); |
||
0 ignored issues
–
show
|
|||
68 | } |
||
69 | $this->rules = $this->model->rules(); |
||
70 | $this->scenarios = $this->model->scenarios(); |
||
71 | foreach ($this->safeAttributes() as $attribute) { |
||
72 | $this->attributes[$attribute] = ''; |
||
73 | } |
||
74 | } |
||
75 | |||
76 | /** |
||
77 | * @param string $name |
||
78 | * @return mixed |
||
79 | */ |
||
80 | public function __get($name) |
||
81 | { |
||
82 | if (isset($this->attributes[$name])) { |
||
83 | return $this->attributes[$name]; |
||
84 | } |
||
85 | return parent::__get($name); |
||
86 | } |
||
87 | |||
88 | /** |
||
89 | * @param string $name |
||
90 | * @param mixed $value |
||
91 | */ |
||
92 | public function __set($name, $value) |
||
93 | { |
||
94 | if (isset($this->attributes[$name])) { |
||
95 | $this->attributes[$name] = $value; |
||
96 | } else { |
||
97 | parent::__set($name, $value); |
||
98 | } |
||
99 | } |
||
100 | |||
101 | /** |
||
102 | * @return Model |
||
0 ignored issues
–
show
|
|||
103 | */ |
||
104 | public function getModel() |
||
105 | { |
||
106 | return $this->model; |
||
107 | } |
||
108 | |||
109 | /** |
||
110 | * @param mixed $value |
||
111 | */ |
||
112 | public function setModel($value) |
||
113 | { |
||
114 | if ($value instanceof Model) { |
||
115 | $this->model = $value; |
||
0 ignored issues
–
show
$value is of type object<yii\base\Model> , but the property $model was declared to be of type object<yii\db\ActiveRecord> . Are you sure that you always receive this specific sub-class here, or does it make sense to add an instanceof check?
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a given class or a super-class is assigned to a property that is type hinted more strictly. Either this assignment is in error or an instanceof check should be added for that assignment. class Alien {}
class Dalek extends Alien {}
class Plot
{
/** @var Dalek */
public $villain;
}
$alien = new Alien();
$plot = new Plot();
if ($alien instanceof Dalek) {
$plot->villain = $alien;
}
![]() |
|||
116 | $this->scenario = $this->model->scenario; |
||
117 | $this->modelClassName = get_class($value); |
||
118 | } else { |
||
119 | $this->model = new $value; |
||
120 | $this->modelClassName = $value; |
||
121 | } |
||
122 | } |
||
123 | |||
124 | /** |
||
125 | * @return array |
||
126 | */ |
||
127 | public function rules() |
||
128 | { |
||
129 | return $this->rules; |
||
130 | } |
||
131 | |||
132 | /** |
||
133 | * @return array |
||
0 ignored issues
–
show
|
|||
134 | */ |
||
135 | public function scenarios() |
||
136 | { |
||
137 | return $this->scenarios; |
||
138 | } |
||
139 | |||
140 | /** |
||
141 | * @param array $params |
||
142 | * @return ActiveDataProvider |
||
143 | */ |
||
144 | public function search($params) |
||
145 | { |
||
146 | /** @var ActiveQuery $query */ |
||
147 | $query = call_user_func([$this->modelClassName, 'find']); |
||
148 | $dataProvider = new ActiveDataProvider( |
||
149 | [ |
||
150 | 'query' => $query, |
||
151 | 'pagination' => new Pagination( |
||
152 | [ |
||
153 | 'forcePageParam' => false, |
||
154 | 'pageSize' => $this->pageSize, |
||
155 | ] |
||
156 | ), |
||
157 | ] |
||
158 | ); |
||
159 | if (is_array($this->relations)) { |
||
160 | foreach ($this->relations as $relation => $attributes) { |
||
161 | $pieces = explode('.', $relation); |
||
162 | $path = ''; |
||
163 | $parentPath = ''; |
||
164 | foreach ($pieces as $i => $piece) { |
||
165 | if ($i == 0) { |
||
166 | $path = $piece; |
||
167 | } else { |
||
168 | $parentPath = $path; |
||
169 | $path .= '.'.$piece; |
||
170 | } |
||
171 | if (!isset($this->internalRelations[$path])) { |
||
172 | if ($i == 0) { |
||
173 | $relationClass = call_user_func([$this->model, 'get'.$piece]); |
||
174 | } else { |
||
175 | $className = $this->internalRelations[$parentPath]['className']; |
||
176 | $relationClass = call_user_func([new $className, 'get'.$piece]); |
||
177 | } |
||
178 | $this->internalRelations[$path] = [ |
||
179 | 'className' => $relationClass->modelClass, |
||
180 | 'tableName' => call_user_func([$relationClass->modelClass, 'tableName']), |
||
181 | ]; |
||
182 | } |
||
183 | } |
||
184 | foreach ((array)$attributes as $attribute) { |
||
185 | $attributeName = str_replace('.', '_', $relation).'_'.$attribute; |
||
186 | $tableAttribute = $this->internalRelations[$relation]['tableName'].'.'.$attribute; |
||
187 | $this->rules[] = [$attributeName, 'safe']; |
||
188 | $this->scenarios[$this->scenario][] = $attributeName; |
||
189 | $this->attributes[$attributeName] = ''; |
||
190 | $this->relationAttributes[$attributeName] = $tableAttribute; |
||
191 | $dataProvider->sort->attributes[$attributeName] = [ |
||
192 | 'asc' => [$tableAttribute => SORT_ASC], |
||
193 | 'desc' => [$tableAttribute => SORT_DESC], |
||
194 | ]; |
||
195 | } |
||
196 | } |
||
197 | $query->joinWith(array_keys($this->relations)); |
||
198 | } |
||
199 | if (is_array($this->defaultOrder)) { |
||
200 | $dataProvider->sort->defaultOrder = $this->defaultOrder; |
||
201 | } |
||
202 | if (is_array($this->groupBy)) { |
||
203 | $query->addGroupBy($this->groupBy); |
||
204 | } |
||
205 | $this->load($params); |
||
206 | foreach ($this->attributes as $name => $value) { |
||
207 | $this->addCondition($query, $name, in_array($name, $this->partialMatchAttributes)); |
||
208 | } |
||
209 | if (!is_null($this->additionalConditions)) { |
||
210 | foreach ((array) $this->additionalConditions as $condition) { |
||
211 | $query->andWhere($condition); |
||
212 | } |
||
213 | } |
||
214 | return $dataProvider; |
||
215 | } |
||
216 | } |
||
217 |
This class, trait or interface has been deprecated. The supplier of the file has supplied an explanatory message.
The explanatory message should give you some clue as to whether and when the type will be removed from the class and what other constant to use instead.