This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /* |
||
3 | * This file is part of EC-CUBE |
||
4 | * |
||
5 | * Copyright(c) 2000-2015 LOCKON CO.,LTD. All Rights Reserved. |
||
6 | * |
||
7 | * http://www.lockon.co.jp/ |
||
8 | * |
||
9 | * This program is free software; you can redistribute it and/or |
||
10 | * modify it under the terms of the GNU General Public License |
||
11 | * as published by the Free Software Foundation; either version 2 |
||
12 | * of the License, or (at your option) any later version. |
||
13 | * |
||
14 | * This program is distributed in the hope that it will be useful, |
||
15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
17 | * GNU General Public License for more details. |
||
18 | * |
||
19 | * You should have received a copy of the GNU General Public License |
||
20 | * along with this program; if not, write to the Free Software |
||
21 | * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. |
||
22 | */ |
||
23 | |||
24 | |||
25 | namespace Eccube\Controller; |
||
26 | |||
27 | use Eccube\Application; |
||
28 | use Eccube\Entity\Master\CustomerStatus; |
||
29 | use Eccube\Event\EccubeEvents; |
||
30 | use Eccube\Event\EventArgs; |
||
31 | use Symfony\Component\HttpFoundation\Request; |
||
32 | use Symfony\Component\HttpKernel\Exception as HttpException; |
||
33 | use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken; |
||
34 | use Symfony\Component\Validator\Constraints as Assert; |
||
35 | |||
36 | class EntryController extends AbstractController |
||
37 | { |
||
38 | |||
39 | /** |
||
40 | * 会員登録画面. |
||
41 | * |
||
42 | * @param Application $app |
||
43 | * @param Request $request |
||
44 | * @return \Symfony\Component\HttpFoundation\Response |
||
45 | */ |
||
46 | 8 | public function index(Application $app, Request $request) |
|
47 | { |
||
48 | 8 | if ($app->isGranted('ROLE_USER')) { |
|
49 | log_info('認証済のためログイン処理をスキップ'); |
||
50 | |||
51 | return $app->redirect($app->url('mypage')); |
||
52 | } |
||
53 | |||
54 | /** @var $Customer \Eccube\Entity\Customer */ |
||
55 | 8 | $Customer = $app['eccube.repository.customer']->newCustomer(); |
|
56 | |||
57 | /* @var $builder \Symfony\Component\Form\FormBuilderInterface */ |
||
58 | 8 | $builder = $app['form.factory']->createBuilder('entry', $Customer); |
|
59 | |||
60 | 8 | $event = new EventArgs( |
|
61 | array( |
||
62 | 8 | 'builder' => $builder, |
|
63 | 8 | 'Customer' => $Customer, |
|
64 | ), |
||
65 | $request |
||
66 | ); |
||
67 | 8 | $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_ENTRY_INDEX_INITIALIZE, $event); |
|
68 | |||
69 | /* @var $form \Symfony\Component\Form\FormInterface */ |
||
70 | 8 | $form = $builder->getForm(); |
|
71 | |||
72 | 8 | $form->handleRequest($request); |
|
73 | |||
74 | 8 | if ($form->isSubmitted() && $form->isValid()) { |
|
75 | 5 | switch ($request->get('mode')) { |
|
76 | 5 | case 'confirm': |
|
77 | 2 | log_info('会員登録確認開始'); |
|
78 | 2 | $builder->setAttribute('freeze', true); |
|
79 | 2 | $form = $builder->getForm(); |
|
80 | 2 | $form->handleRequest($request); |
|
81 | 2 | log_info('会員登録確認完了'); |
|
82 | |||
83 | 2 | return $app->render('Entry/confirm.twig', array( |
|
84 | 2 | 'form' => $form->createView(), |
|
85 | )); |
||
86 | |||
87 | 3 | case 'complete': |
|
88 | 2 | log_info('会員登録開始'); |
|
89 | $Customer |
||
90 | 2 | ->setSalt( |
|
91 | 2 | $app['eccube.repository.customer']->createSalt(5) |
|
92 | ) |
||
93 | 2 | ->setPassword( |
|
94 | 2 | $app['eccube.repository.customer']->encryptPassword($app, $Customer) |
|
95 | ) |
||
96 | 2 | ->setSecretKey( |
|
97 | 2 | $app['eccube.repository.customer']->getUniqueSecretKey($app) |
|
98 | ); |
||
99 | |||
100 | 2 | $CustomerAddress = new \Eccube\Entity\CustomerAddress(); |
|
101 | $CustomerAddress |
||
102 | 2 | ->setFromCustomer($Customer); |
|
103 | |||
104 | 2 | $app['orm.em']->persist($Customer); |
|
105 | 2 | $app['orm.em']->persist($CustomerAddress); |
|
106 | 2 | $app['orm.em']->flush(); |
|
107 | |||
108 | 2 | log_info('会員登録完了'); |
|
109 | |||
110 | 2 | $event = new EventArgs( |
|
111 | array( |
||
112 | 2 | 'form' => $form, |
|
113 | 2 | 'Customer' => $Customer, |
|
114 | 2 | 'CustomerAddress' => $CustomerAddress, |
|
115 | ), |
||
116 | $request |
||
117 | ); |
||
118 | 2 | $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_ENTRY_INDEX_COMPLETE, $event); |
|
119 | |||
120 | 2 | $activateUrl = $app->url('entry_activate', array('secret_key' => $Customer->getSecretKey())); |
|
121 | |||
122 | /** @var $BaseInfo \Eccube\Entity\BaseInfo */ |
||
123 | 2 | $BaseInfo = $app['eccube.repository.base_info']->get(); |
|
124 | 2 | $activateFlg = $BaseInfo->getOptionCustomerActivate(); |
|
125 | |||
126 | // 仮会員設定が有効な場合は、確認メールを送信し完了画面表示. |
||
127 | 2 | if ($activateFlg) { |
|
128 | // メール送信 |
||
129 | 2 | $app['eccube.service.mail']->sendCustomerConfirmMail($Customer, $activateUrl); |
|
130 | |||
131 | 2 | if ($event->hasResponse()) { |
|
132 | return $event->getResponse(); |
||
133 | } |
||
134 | |||
135 | 2 | log_info('仮会員登録完了画面へリダイレクト'); |
|
136 | |||
137 | 2 | return $app->redirect($app->url('entry_complete')); |
|
138 | // 仮会員設定が無効な場合は認証URLへ遷移させ、会員登録を完了させる. |
||
139 | } else { |
||
140 | log_info('本会員登録画面へリダイレクト'); |
||
141 | |||
142 | 1 | return $app->redirect($activateUrl); |
|
143 | } |
||
144 | } |
||
145 | } |
||
146 | |||
147 | 4 | return $app->render('Entry/index.twig', array( |
|
148 | 4 | 'form' => $form->createView(), |
|
149 | )); |
||
150 | } |
||
151 | |||
152 | /** |
||
153 | * 会員登録完了画面. |
||
154 | * |
||
155 | * @param Application $app |
||
156 | * @return \Symfony\Component\HttpFoundation\Response |
||
157 | */ |
||
158 | 1 | public function complete(Application $app) |
|
159 | { |
||
160 | 1 | return $app->render('Entry/complete.twig', array()); |
|
161 | } |
||
162 | |||
163 | /** |
||
0 ignored issues
–
show
introduced
by
Loading history...
|
|||
164 | * 会員のアクティベート(本会員化)を行う. |
||
165 | * |
||
166 | * @param Application $app |
||
167 | * @param Request $request |
||
168 | * @param $secret_key |
||
169 | * @return \Symfony\Component\HttpFoundation\Response |
||
170 | */ |
||
171 | 4 | public function activate(Application $app, Request $request, $secret_key) |
|
172 | { |
||
173 | 4 | $errors = $app['validator']->validateValue($secret_key, array( |
|
0 ignored issues
–
show
|
|||
174 | 4 | new Assert\NotBlank(), |
|
175 | 4 | new Assert\Regex(array( |
|
176 | 4 | 'pattern' => '/^[a-zA-Z0-9]+$/', |
|
177 | )) |
||
178 | ) |
||
179 | ); |
||
180 | |||
181 | 4 | if ($request->getMethod() === 'GET' && count($errors) === 0) { |
|
182 | 3 | log_info('本会員登録開始'); |
|
183 | try { |
||
184 | 3 | $Customer = $app['eccube.repository.customer'] |
|
185 | 3 | ->getNonActiveCustomerBySecretKey($secret_key); |
|
186 | 1 | } catch (\Exception $e) { |
|
187 | 1 | throw new HttpException\NotFoundHttpException('※ 既に会員登録が完了しているか、無効なURLです。'); |
|
188 | } |
||
189 | |||
190 | 2 | $CustomerStatus = $app['eccube.repository.customer_status']->find(CustomerStatus::ACTIVE); |
|
191 | 2 | $Customer->setStatus($CustomerStatus); |
|
192 | 2 | $app['orm.em']->persist($Customer); |
|
193 | 2 | $app['orm.em']->flush(); |
|
194 | |||
195 | 2 | log_info('本会員登録完了'); |
|
196 | |||
197 | 2 | $event = new EventArgs( |
|
198 | array( |
||
199 | 2 | 'Customer' => $Customer, |
|
200 | ), |
||
201 | $request |
||
202 | ); |
||
203 | 2 | $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_ENTRY_ACTIVATE_COMPLETE, $event); |
|
204 | |||
205 | // メール送信 |
||
206 | 2 | $app['eccube.service.mail']->sendCustomerCompleteMail($Customer); |
|
207 | |||
208 | // 本会員登録してログイン状態にする |
||
209 | 2 | $token = new UsernamePasswordToken($Customer, null, 'customer', array('ROLE_USER')); |
|
210 | 2 | $this->getSecurity($app)->setToken($token); |
|
211 | |||
212 | 2 | log_info('ログイン済に変更', array($app->user()->getId())); |
|
213 | |||
214 | 2 | return $app->render('Entry/activate.twig'); |
|
215 | } else { |
||
216 | 1 | throw new HttpException\AccessDeniedHttpException('不正なアクセスです。'); |
|
217 | } |
||
218 | } |
||
219 | } |
||
220 |