Issues (564)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/Eccube/Controller/CartController.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/*
3
 * This file is part of EC-CUBE
4
 *
5
 * Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
6
 *
7
 * http://www.ec-cube.co.jp/
8
 *
9
 * This program is free software; you can redistribute it and/or
10
 * modify it under the terms of the GNU General Public License
11
 * as published by the Free Software Foundation; either version 2
12
 * of the License, or (at your option) any later version.
13
 *
14
 * This program is distributed in the hope that it will be useful,
15
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17
 * GNU General Public License for more details.
18
 *
19
 * You should have received a copy of the GNU General Public License
20
 * along with this program; if not, write to the Free Software
21
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
22
 */
23
24
25
namespace Eccube\Controller;
26
27
use Eccube\Application;
28
use Eccube\Event\EccubeEvents;
29
use Eccube\Event\EventArgs;
30
use Eccube\Exception\CartException;
31
use Symfony\Component\HttpFoundation\Request;
32
33
class CartController extends AbstractController
34
{
35
    /**
36
     * カート画面.
37
     *
38
     * @param Application $app
39
     * @param Request $request
40
     * @return \Symfony\Component\HttpFoundation\Response
41
     */
42
    public function index(Application $app, Request $request)
43
    {
44
        $Cart = $app['eccube.service.cart']->getCart();
45
46
        // FRONT_CART_INDEX_INITIALIZE
47
        $event = new EventArgs(
48
            array(),
49
            $request
50
        );
51
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_INDEX_INITIALIZE, $event);
52
53
        /* @var $BaseInfo \Eccube\Entity\BaseInfo */
54
        /* @var $Cart \Eccube\Entity\Cart */
55
        $BaseInfo = $app['eccube.repository.base_info']->get();
56
57
        $isDeliveryFree = false;
58
        $least = 0;
59
        $quantity = 0;
60
        if ($BaseInfo->getDeliveryFreeAmount()) {
61
            if ($BaseInfo->getDeliveryFreeAmount() <= $Cart->getTotalPrice()) {
62
                // 送料無料(金額)を超えている
63
                $isDeliveryFree = true;
64
            } else {
65
                $least = $BaseInfo->getDeliveryFreeAmount() - $Cart->getTotalPrice();
66
            }
67
        }
68
69
        if ($BaseInfo->getDeliveryFreeQuantity()) {
70
            if ($BaseInfo->getDeliveryFreeQuantity() <= $Cart->getTotalQuantity()) {
71
                // 送料無料(個数)を超えている
72
                $isDeliveryFree = true;
73
            } else {
74
                $quantity = $BaseInfo->getDeliveryFreeQuantity() - $Cart->getTotalQuantity();
75
            }
76
        }
77
78
        // FRONT_CART_INDEX_COMPLETE
79
        $event = new EventArgs(
80
            array(),
81
            $request
82
        );
83
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_INDEX_COMPLETE, $event);
84
85
        if ($event->hasResponse()) {
86
            return $event->getResponse();
87
        }
88
89
        return $app->render(
90
            'Cart/index.twig',
91
            array(
92
                'Cart' => $Cart,
93
                'least' => $least,
94
                'quantity' => $quantity,
95
                'is_delivery_free' => $isDeliveryFree,
96
            )
97
        );
98
    }
99
100
    /**
101
     * カートに商品を追加する.
102
     *
103
     * @param Application $app
104
     * @param Request $request
105
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
106
     */
107
    public function add(Application $app, Request $request)
108
    {
109
        $productClassId = $request->get('product_class_id');
110
        $quantity = $request->request->has('quantity') ? $request->get('quantity') : 1;
111
112
        // FRONT_CART_ADD_INITIALIZE
113
        $event = new EventArgs(
114
            array(
115
                'productClassId' => $productClassId,
116
                'quantity' => $quantity,
117
            ),
118
            $request
119
        );
120
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_ADD_INITIALIZE, $event);
121
122
        try {
123
124
            $productClassId = $event->getArgument('productClassId');
125
            $quantity = $event->getArgument('quantity');
126
127
            log_info('カート追加処理開始', array('product_class_id' => $productClassId, 'quantity' => $quantity));
128
129
            $app['eccube.service.cart']->addProduct($productClassId, $quantity)->save();
130
131
            log_info('カート追加処理完了', array('product_class_id' => $productClassId, 'quantity' => $quantity));
132
133
            // FRONT_CART_ADD_COMPLETE
134
            $event = new EventArgs(
135
                array(
136
                    'productClassId' => $productClassId,
137
                    'quantity' => $quantity,
138
                ),
139
                $request
140
            );
141
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_ADD_COMPLETE, $event);
142
143
            if ($event->hasResponse()) {
144
                return $event->getResponse();
145
            }
146
147
        } catch (CartException $e) {
148
149
            log_info('カート追加エラー', array($e->getMessage()));
150
151
            // FRONT_CART_ADD_EXCEPTION
152
            $event = new EventArgs(
153
                array(
154
                    'exception' => $e,
155
                ),
156
                $request
157
            );
158
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_ADD_EXCEPTION, $event);
159
160
            if ($event->hasResponse()) {
161
                return $event->getResponse();
162
            }
163
164
            $app->addRequestError($e->getMessage());
165
        }
166
167
        return $app->redirect($app->url('cart'));
168
    }
169
170
    /**
171
     * カートに入っている商品の個数を1増やす.
172
     *
173
     * @param Application $app
174
     * @param Request $request
175
     * @param $productClassId
176
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
177
     */
178 View Code Duplication
    public function up(Application $app, Request $request, $productClassId)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
179
    {
180
        $this->isTokenValid($app);
181
182
        // FRONT_CART_UP_INITIALIZE
183
        $event = new EventArgs(
184
            array(
185
                'productClassId' => $productClassId,
186
            ),
187
            $request
188
        );
189
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_UP_INITIALIZE, $event);
190
191
        try {
192
193
            log_info('カート加算処理開始', array('product_class_id' => $productClassId));
194
195
            $productClassId = $event->getArgument('productClassId');
196
197
            $app['eccube.service.cart']->upProductQuantity($productClassId)->save();
198
199
            // FRONT_CART_UP_COMPLETE
200
            $event = new EventArgs(
201
                array(
202
                    'productClassId' => $productClassId,
203
                ),
204
                $request
205
            );
206
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_UP_COMPLETE, $event);
207
208
            if ($event->hasResponse()) {
209
                return $event->getResponse();
210
            }
211
212
            log_info('カート加算処理完了', array('product_class_id' => $productClassId));
213
214
        } catch (CartException $e) {
215
216
            log_info('カート加算エラー', array($e->getMessage()));
217
218
            // FRONT_CART_UP_EXCEPTION
219
            $event = new EventArgs(
220
                array(
221
                    'exception' => $e,
222
                ),
223
                $request
224
            );
225
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_UP_EXCEPTION, $event);
226
227
            if ($event->hasResponse()) {
228
                return $event->getResponse();
229
            }
230
231
            $app->addRequestError($e->getMessage());
232
        }
233
234
        return $app->redirect($app->url('cart'));
235
    }
236
237
    /**
238
     * カートに入っている商品の個数を1減らす.
239
     * マイナスになる場合は, 商品をカートから削除する.
240
     *
241
     * @param Application $app
242
     * @param Request $request
243
     * @param $productClassId
244
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
245
     */
246 View Code Duplication
    public function down(Application $app, Request $request, $productClassId)
0 ignored issues
show
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
247
    {
248
        $this->isTokenValid($app);
249
250
        // FRONT_CART_DOWN_INITIALIZE
251
        $event = new EventArgs(
252
            array(
253
                'productClassId' => $productClassId,
254
            ),
255
            $request
256
        );
257
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_DOWN_INITIALIZE, $event);
258
259
        try {
260
261
            log_info('カート減算処理開始', array('product_class_id' => $productClassId));
262
263
            $productClassId = $event->getArgument('productClassId');
264
            $app['eccube.service.cart']->downProductQuantity($productClassId)->save();
265
266
            // FRONT_CART_UP_COMPLETE
267
            $event = new EventArgs(
268
                array(
269
                    'productClassId' => $productClassId,
270
                ),
271
                $request
272
            );
273
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_DOWN_COMPLETE, $event);
274
275
            if ($event->hasResponse()) {
276
                return $event->getResponse();
277
            }
278
279
            log_info('カート減算処理完了', array('product_class_id' => $productClassId));
280
281
        } catch (CartException $e) {
282
            log_info('カート減算エラー', array($e->getMessage()));
283
284
            // FRONT_CART_DOWN_EXCEPTION
285
            $event = new EventArgs(
286
                array(
287
                    'exception' => $e,
288
                ),
289
                $request
290
            );
291
            $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_DOWN_EXCEPTION, $event);
292
293
            if ($event->hasResponse()) {
294
                return $event->getResponse();
295
            }
296
297
            $app->addRequestError($e->getMessage());
298
        }
299
300
        return $app->redirect($app->url('cart'));
301
    }
302
303
    /**
304
     * カートに入っている商品を削除する.
305
     *
306
     * @param Application $app
307
     * @param Request $request
308
     * @param $productClassId
309
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
310
     */
311
    public function remove(Application $app, Request $request, $productClassId)
312
    {
313
        $this->isTokenValid($app);
314
315
        log_info('カート削除処理開始', array('product_class_id' => $productClassId));
316
317
        // FRONT_CART_REMOVE_INITIALIZE
318
        $event = new EventArgs(
319
            array(
320
                'productClassId' => $productClassId,
321
            ),
322
            $request
323
        );
324
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_REMOVE_INITIALIZE, $event);
325
326
        $productClassId = $event->getArgument('productClassId');
327
        $app['eccube.service.cart']->removeProduct($productClassId)->save();
328
329
        log_info('カート削除処理完了', array('product_class_id' => $productClassId));
330
331
        // FRONT_CART_REMOVE_COMPLETE
332
        $event = new EventArgs(
333
            array(
334
                'productClassId' => $productClassId,
335
            ),
336
            $request
337
        );
338
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_REMOVE_COMPLETE, $event);
339
340
        if ($event->hasResponse()) {
341
            return $event->getResponse();
342
        }
343
344
        return $app->redirect($app->url('cart'));
345
    }
346
347
    /**
348
     * カートに商品を個数を指定して設定する.
349
     *
350
     * @param Application $app
351
     * @param Request $request
352
     * @param $productClassId
353
     * @param $quantity
354
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
355
     * @throws CartException
356
     *
357
     * @deprecated since 3.0.0, to be removed in 3.1
358
     */
359
    public function setQuantity(Application $app, Request $request, $productClassId, $quantity)
0 ignored issues
show
The parameter $request is not used and could be removed.

This check looks from parameters that have been defined for a function or method, but which are not used in the method body.

Loading history...
360
    {
361
        $this->isTokenValid($app);
362
363
        $app['eccube.service.cart']->setProductQuantity($productClassId, $quantity)->save();
364
365
        return $app->redirect($app->url('cart'));
366
    }
367
368
    /**
369
     * カートをロック状態に設定し、購入確認画面へ遷移する.
370
     *
371
     * @param Application $app
372
     * @param Request $request
373
     * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response
374
     */
375
    public function buystep(Application $app, Request $request)
376
    {
377
        // FRONT_CART_BUYSTEP_INITIALIZE
378
        $event = new EventArgs(
379
            array(),
380
            $request
381
        );
382
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_BUYSTEP_INITIALIZE, $event);
383
384
        $app['eccube.service.cart']->lock();
385
        $app['eccube.service.cart']->save();
386
387
        // FRONT_CART_BUYSTEP_COMPLETE
388
        $event = new EventArgs(
389
            array(),
390
            $request
391
        );
392
        $app['eccube.event.dispatcher']->dispatch(EccubeEvents::FRONT_CART_BUYSTEP_COMPLETE, $event);
393
394
        if ($event->hasResponse()) {
395
            return $event->getResponse();
396
        }
397
398
        return $app->redirect($app->url('shopping'));
399
    }
400
}
401