Issues (2687)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Eccube/Controller/CartController.php (25 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/*
3
 * This file is part of EC-CUBE
4
 *
5
 * Copyright(c) 2000-2015 LOCKON CO.,LTD. All Rights Reserved.
6
 *
7
 * http://www.lockon.co.jp/
8
 *
9
 * This program is free software; you can redistribute it and/or
10
 * modify it under the terms of the GNU General Public License
11
 * as published by the Free Software Foundation; either version 2
12
 * of the License, or (at your option) any later version.
13
 *
14
 * This program is distributed in the hope that it will be useful,
15
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17
 * GNU General Public License for more details.
18
 *
19
 * You should have received a copy of the GNU General Public License
20
 * along with this program; if not, write to the Free Software
21
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
22
 */
23
24
25
namespace Eccube\Controller;
26
27
use Eccube\Application;
28
use Eccube\Event\EccubeEvents;
29
use Eccube\Event\EventArgs;
30
use Eccube\Exception\CartException;
31
use Symfony\Component\HttpFoundation\Request;
32
33
class CartController extends AbstractController
34
{
35
    /**
36
     * カート画面.
37
     *
38
     * @param Application $app
39
     * @param Request $request
0 ignored issues
show
Expected 5 spaces after parameter type; 1 found
Loading history...
40
     * @return \Symfony\Component\HttpFoundation\Response
41
     */
42 49
    public function index(Application $app, Request $request)
43
    {
44 49
        $Cart = $app['eccube.service.cart']->getCart();
45
46
        // FRONT_CART_INDEX_INITIALIZE
47 49
        $event = new EventArgs(
48 49
            array(),
49
            $request
50
        );
51 49
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_INDEX_INITIALIZE, $event);
52
53
        /* @var $BaseInfo \Eccube\Entity\BaseInfo */
54
        /* @var $Cart \Eccube\Entity\Cart */
55 49
        $BaseInfo = $app['eccube.repository.base_info']->get();
56
57 49
        $isDeliveryFree = false;
58 49
        $least = 0;
59 49
        $quantity = 0;
60 49
        if ($BaseInfo->getDeliveryFreeAmount()) {
61
            if ($BaseInfo->getDeliveryFreeAmount() <= $Cart->getTotalPrice()) {
62
                // 送料無料(金額)を超えている
63
                $isDeliveryFree = true;
64
            } else {
65
                $least = $BaseInfo->getDeliveryFreeAmount() - $Cart->getTotalPrice();
66
            }
67
        }
68
69 49
        if ($BaseInfo->getDeliveryFreeQuantity()) {
70
            if ($BaseInfo->getDeliveryFreeQuantity() <= $Cart->getTotalQuantity()) {
71
                // 送料無料(個数)を超えている
72
                $isDeliveryFree = true;
73
            } else {
74
                $quantity = $BaseInfo->getDeliveryFreeQuantity() - $Cart->getTotalQuantity();
75
            }
76
        }
77
78
        // FRONT_CART_INDEX_COMPLETE
79 49
        $event = new EventArgs(
80 49
            array(),
81
            $request
82
        );
83 49
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_INDEX_COMPLETE, $event);
84
85 49
        if ($event->hasResponse()) {
86
            return $event->getResponse();
87
        }
88
89 49
        return $app->render(
90 49
            'Cart/index.twig',
91
            array(
92 49
                'Cart' => $Cart,
93 49
                'least' => $least,
94 49
                'quantity' => $quantity,
95 49
                'is_delivery_free' => $isDeliveryFree,
96
            )
97
        );
98
    }
99
100
    /**
101
     * カートに商品を追加する.
102
     *
103
     * @param Application $app
104
     * @param Request $request
0 ignored issues
show
Expected 5 spaces after parameter type; 1 found
Loading history...
105
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
106
     */
107 116
    public function add(Application $app, Request $request)
108
    {
109 116
        $productClassId = $request->get('product_class_id');
110 116
        $quantity = $request->request->has('quantity') ? $request->get('quantity') : 1;
111
112
        // FRONT_CART_ADD_INITIALIZE
113 116
        $event = new EventArgs(
114
            array(
115 116
                'productClassId' => $productClassId,
116 116
                'quantity' => $quantity,
117
            ),
118
            $request
119
        );
120 116
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_ADD_INITIALIZE, $event);
121
122
        try {
123
124 116
            $productClassId = $event->getArgument('productClassId');
125 116
            $quantity = $event->getArgument('quantity');
126
127 116
            log_info('カート追加処理開始', array('product_class_id' => $productClassId, 'quantity' => $quantity));
128
129 116
            $app['eccube.service.cart']->addProduct($productClassId, $quantity)->save();
130
131 115
            log_info('カート追加処理完了', array('product_class_id' => $productClassId, 'quantity' => $quantity));
132
133
            // FRONT_CART_ADD_COMPLETE
134 115
            $event = new EventArgs(
135
                array(
136 115
                    'productClassId' => $productClassId,
137 115
                    'quantity' => $quantity,
138
                ),
139
                $request
140
            );
141 115
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_ADD_COMPLETE, $event);
142
143 115
            if ($event->hasResponse()) {
144 115
                return $event->getResponse();
145
            }
146
0 ignored issues
show
Blank line found at end of control structure
Loading history...
147 1
        } catch (CartException $e) {
148
149 1
            log_info('カート追加エラー', array($e->getMessage()));
150
151
            // FRONT_CART_ADD_EXCEPTION
152 1
            $event = new EventArgs(
153
                array(
154 1
                    'exception' => $e,
155
                ),
156
                $request
157
            );
158 1
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_ADD_EXCEPTION, $event);
159
160 1
            if ($event->hasResponse()) {
161
                return $event->getResponse();
162
            }
163
164 1
            $app->addRequestError($e->getMessage());
165
        }
166
167 116
        return $app->redirect($app->url('cart'));
168
    }
169
170
    /**
0 ignored issues
show
Doc comment for parameter "$productClassId" missing
Loading history...
171
     * カートに入っている商品の個数を1増やす.
172
     *
173
     * @param Application $app
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
174
     * @param Request $request
0 ignored issues
show
Expected 8 spaces after parameter type; 1 found
Loading history...
175
     * @param $productClassId
0 ignored issues
show
Missing parameter name
Loading history...
176
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
177
     */
178 10 View Code Duplication
    public function up(Application $app, Request $request, $productClassId)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
179
    {
180 10
        $this->isTokenValid($app);
181
182
        // FRONT_CART_UP_INITIALIZE
183 10
        $event = new EventArgs(
184
            array(
185 10
                'productClassId' => $productClassId,
186
            ),
187
            $request
188
        );
189 10
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_UP_INITIALIZE, $event);
190
191
        try {
192
193 10
            log_info('カート加算処理開始', array('product_class_id' => $productClassId));
194
195 10
            $productClassId = $event->getArgument('productClassId');
196
197 10
            $app['eccube.service.cart']->upProductQuantity($productClassId)->save();
198
199
            // FRONT_CART_UP_COMPLETE
200 7
            $event = new EventArgs(
201
                array(
202 7
                    'productClassId' => $productClassId,
203
                ),
204
                $request
205
            );
206 7
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_UP_COMPLETE, $event);
207
208 7
            if ($event->hasResponse()) {
209
                return $event->getResponse();
210
            }
211
212 7
            log_info('カート加算処理完了', array('product_class_id' => $productClassId));
213
214 3
        } catch (CartException $e) {
215
216 3
            log_info('カート加算エラー', array($e->getMessage()));
217
218
            // FRONT_CART_UP_EXCEPTION
219 3
            $event = new EventArgs(
220
                array(
221 3
                    'exception' => $e,
222
                ),
223
                $request
224
            );
225 3
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_UP_EXCEPTION, $event);
226
227 3
            if ($event->hasResponse()) {
228
                return $event->getResponse();
229
            }
230
231 3
            $app->addRequestError($e->getMessage());
232
        }
233
234 10
        return $app->redirect($app->url('cart'));
235
    }
236
237
    /**
0 ignored issues
show
Doc comment for parameter "$productClassId" missing
Loading history...
238
     * カートに入っている商品の個数を1減らす.
239
     * マイナスになる場合は, 商品をカートから削除する.
240
     *
241
     * @param Application $app
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
242
     * @param Request $request
0 ignored issues
show
Expected 8 spaces after parameter type; 1 found
Loading history...
243
     * @param $productClassId
0 ignored issues
show
Missing parameter name
Loading history...
244
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
245
     */
246 10 View Code Duplication
    public function down(Application $app, Request $request, $productClassId)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
247
    {
248 10
        $this->isTokenValid($app);
249
250
        // FRONT_CART_DOWN_INITIALIZE
251 10
        $event = new EventArgs(
252
            array(
253 10
                'productClassId' => $productClassId,
254
            ),
255
            $request
256
        );
257 10
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_DOWN_INITIALIZE, $event);
258
259
        try {
260
261 10
            log_info('カート減算処理開始', array('product_class_id' => $productClassId));
262
263 10
            $productClassId = $event->getArgument('productClassId');
264 10
            $app['eccube.service.cart']->downProductQuantity($productClassId)->save();
265
266
            // FRONT_CART_UP_COMPLETE
267 8
            $event = new EventArgs(
268
                array(
269 8
                    'productClassId' => $productClassId,
270
                ),
271
                $request
272
            );
273 8
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_DOWN_COMPLETE, $event);
274
275 8
            if ($event->hasResponse()) {
276
                return $event->getResponse();
277
            }
278
279 8
            log_info('カート減算処理完了', array('product_class_id' => $productClassId));
280
281 2
        } catch (CartException $e) {
282 2
            log_info('カート減算エラー', array($e->getMessage()));
283
284
            // FRONT_CART_DOWN_EXCEPTION
285 2
            $event = new EventArgs(
286
                array(
287 2
                    'exception' => $e,
288
                ),
289
                $request
290
            );
291 2
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_DOWN_EXCEPTION, $event);
292
293 2
            if ($event->hasResponse()) {
294
                return $event->getResponse();
295
            }
296
297 2
            $app->addRequestError($e->getMessage());
298
        }
299
300 10
        return $app->redirect($app->url('cart'));
301
    }
302
303
    /**
0 ignored issues
show
Doc comment for parameter "$productClassId" missing
Loading history...
304
     * カートに入っている商品を削除する.
305
     *
306
     * @param Application $app
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
307
     * @param Request $request
0 ignored issues
show
Expected 8 spaces after parameter type; 1 found
Loading history...
308
     * @param $productClassId
0 ignored issues
show
Missing parameter name
Loading history...
309
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
310
     */
311 2
    public function remove(Application $app, Request $request, $productClassId)
312
    {
313 2
        $this->isTokenValid($app);
314
315 2
        log_info('カート削除処理開始', array('product_class_id' => $productClassId));
316
317
        // FRONT_CART_REMOVE_INITIALIZE
318 2
        $event = new EventArgs(
319
            array(
320 2
                'productClassId' => $productClassId,
321
            ),
322
            $request
323
        );
324 2
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_REMOVE_INITIALIZE, $event);
325
326 2
        $productClassId = $event->getArgument('productClassId');
327 2
        $app['eccube.service.cart']->removeProduct($productClassId)->save();
328
329 2
        log_info('カート削除処理完了', array('product_class_id' => $productClassId));
330
331
        // FRONT_CART_REMOVE_COMPLETE
332 2
        $event = new EventArgs(
333
            array(
334 2
                'productClassId' => $productClassId,
335
            ),
336
            $request
337
        );
338 2
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_REMOVE_COMPLETE, $event);
339
340 2
        if ($event->hasResponse()) {
341
            return $event->getResponse();
342
        }
343
344 2
        return $app->redirect($app->url('cart'));
345
    }
346
347
    /**
0 ignored issues
show
Doc comment for parameter "$quantity" missing
Loading history...
Doc comment for parameter "$productClassId" missing
Loading history...
348
     * カートに商品を個数を指定して設定する.
349
     *
350
     * @param Application $app
0 ignored issues
show
Expected 4 spaces after parameter type; 1 found
Loading history...
351
     * @param Request $request
0 ignored issues
show
Expected 8 spaces after parameter type; 1 found
Loading history...
352
     * @param $productClassId
0 ignored issues
show
Missing parameter name
Loading history...
353
     * @param $quantity
0 ignored issues
show
Missing parameter name
Loading history...
354
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
355
     * @throws CartException
356
     *
357
     * @deprecated since 3.0.0, to be removed in 3.1
358
     */
359
    public function setQuantity(Application $app, Request $request, $productClassId, $quantity)
0 ignored issues
show
The parameter $request is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
360
    {
361
        $this->isTokenValid($app);
362
363
        $app['eccube.service.cart']->setProductQuantity($productClassId, $quantity)->save();
364
365
        return $app->redirect($app->url('cart'));
366
    }
367
368
    /**
369
     * カートをロック状態に設定し、購入確認画面へ遷移する.
370
     *
371
     * @param Application $app
372
     * @param Request $request
0 ignored issues
show
Expected 5 spaces after parameter type; 1 found
Loading history...
373
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
374
     */
375 23
    public function buystep(Application $app, Request $request)
376
    {
377
        // FRONT_CART_BUYSTEP_INITIALIZE
378 23
        $event = new EventArgs(
379 23
            array(),
380
            $request
381
        );
382 23
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_BUYSTEP_INITIALIZE, $event);
383
384 23
        $app['eccube.service.cart']->lock();
385 23
        $app['eccube.service.cart']->save();
386
387
        // FRONT_CART_BUYSTEP_COMPLETE
388 23
        $event = new EventArgs(
389 23
            array(),
390
            $request
391
        );
392 23
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_BUYSTEP_COMPLETE, $event);
393
394 23
        if ($event->hasResponse()) {
395
            return $event->getResponse();
396
        }
397
398 23
        return $app->redirect($app->url('shopping'));
399
    }
400
}
401