HaaseIT /
HCSF
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | /* |
||
| 4 | HCSF - A multilingual CMS and Shopsystem |
||
| 5 | Copyright (C) 2014 Marcus Haase - [email protected] |
||
| 6 | |||
| 7 | This program is free software: you can redistribute it and/or modify |
||
| 8 | it under the terms of the GNU General Public License as published by |
||
| 9 | the Free Software Foundation, either version 3 of the License, or |
||
| 10 | (at your option) any later version. |
||
| 11 | |||
| 12 | This program is distributed in the hope that it will be useful, |
||
| 13 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 15 | GNU General Public License for more details. |
||
| 16 | |||
| 17 | You should have received a copy of the GNU General Public License |
||
| 18 | along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
| 19 | */ |
||
| 20 | |||
| 21 | namespace HaaseIT\HCSF; |
||
| 22 | |||
| 23 | |||
| 24 | use Zend\ServiceManager\ServiceManager; |
||
| 25 | |||
| 26 | /** |
||
| 27 | * Class UserPage |
||
| 28 | * @package HaaseIT\HCSF |
||
| 29 | */ |
||
| 30 | class UserPage extends Page |
||
| 31 | { |
||
| 32 | /** |
||
| 33 | * @var bool |
||
| 34 | */ |
||
| 35 | protected $bReturnRaw; |
||
| 36 | |||
| 37 | /** |
||
| 38 | * @var int|string |
||
| 39 | */ |
||
| 40 | public $cb_id; |
||
| 41 | |||
| 42 | /** |
||
| 43 | * @var string |
||
| 44 | */ |
||
| 45 | public $cb_key; |
||
| 46 | |||
| 47 | /** |
||
| 48 | * @var int |
||
| 49 | */ |
||
| 50 | public $cb_group; |
||
| 51 | |||
| 52 | /** |
||
| 53 | * @var bool |
||
| 54 | */ |
||
| 55 | public $cb_html_from_file; |
||
| 56 | |||
| 57 | /** |
||
| 58 | * @var \HTMLPurifier |
||
| 59 | */ |
||
| 60 | public $purifier; |
||
| 61 | |||
| 62 | /** |
||
| 63 | * @var \Doctrine\DBAL\Connection |
||
| 64 | */ |
||
| 65 | protected $dbal; |
||
| 66 | |||
| 67 | /** |
||
| 68 | * UserPage constructor. |
||
| 69 | * @param ServiceManager $serviceManager |
||
| 70 | * @param $sPagekey |
||
| 71 | * @param bool $bReturnRaw |
||
| 72 | */ |
||
| 73 | public function __construct(ServiceManager $serviceManager, $sPagekey, $bReturnRaw = false) |
||
| 74 | { |
||
| 75 | //if (!$bReturnRaw) $this->container = $container; |
||
| 76 | $this->serviceManager = $serviceManager; |
||
| 77 | $this->status = 200; |
||
| 78 | $this->bReturnRaw = $bReturnRaw; |
||
| 79 | $this->dbal = $this->serviceManager->get('dbal'); |
||
| 80 | |||
| 81 | if ($sPagekey === '/_misc/index.html') { |
||
| 82 | $this->cb_id = $sPagekey; |
||
| 83 | $this->cb_key = $sPagekey; |
||
| 84 | $this->cb_pagetype = 'itemoverview'; |
||
| 85 | $this->oPayload = $this->getPayload(); |
||
| 86 | $this->cb_pageconfig = (object) []; |
||
| 87 | } else { |
||
| 88 | // first get base data |
||
| 89 | $querybuilder = $this->dbal->createQueryBuilder(); |
||
| 90 | $querybuilder |
||
| 91 | ->select('cb_id, cb_key, cb_group, cb_pagetype, cb_pageconfig, cb_subnav, cb_html_from_file') |
||
| 92 | ->from('content_base') |
||
| 93 | ->where('cb_key = ?') |
||
| 94 | ->setParameter(0, $sPagekey) |
||
| 95 | ; |
||
| 96 | $stmt = $querybuilder->execute(); |
||
| 97 | $stmt->setFetchMode(\PDO::FETCH_INTO, $this); |
||
| 98 | |||
| 99 | if ($stmt->rowCount() === 1) { |
||
| 100 | $stmt->fetch(); |
||
| 101 | |||
| 102 | if ($this->cb_pagetype !== 'shorturl') { |
||
| 103 | if (!$bReturnRaw) { |
||
| 104 | $this->cb_pageconfig = json_decode($this->cb_pageconfig); |
||
| 105 | } |
||
| 106 | $this->oPayload = $this->getPayload(); |
||
| 107 | } |
||
| 108 | } |
||
| 109 | } |
||
| 110 | } |
||
| 111 | |||
| 112 | /** |
||
| 113 | * @return UserPagePayload |
||
| 114 | */ |
||
| 115 | protected function getPayload() |
||
| 116 | { |
||
| 117 | return new UserPagePayload($this->serviceManager, $this->cb_id, $this->bReturnRaw, $this); |
||
| 118 | } |
||
| 119 | |||
| 120 | /** |
||
| 121 | * @return bool |
||
| 122 | */ |
||
| 123 | public function write() |
||
| 124 | { |
||
| 125 | $querybuilder = $this->dbal->createQueryBuilder(); |
||
| 126 | $querybuilder |
||
| 127 | ->update('content_base') |
||
| 128 | ->set('cb_pagetype', '?') |
||
| 129 | ->set('cb_group', '?') |
||
| 130 | ->set('cb_pageconfig', '?') |
||
| 131 | ->set('cb_subnav', '?') |
||
| 132 | ->set('cb_html_from_file', '?') |
||
| 133 | ->where('cb_key = ?') |
||
| 134 | ->setParameter(0, filter_var($this->cb_pagetype, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW)) |
||
| 135 | ->setParameter(1, filter_var($this->cb_group, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW)) |
||
| 136 | ->setParameter(2, $this->cb_pageconfig) |
||
| 137 | ->setParameter(3, filter_var($this->cb_subnav, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW)) |
||
| 138 | ->setParameter(4, ($this->cb_html_from_file) ? 'Y' : 'N') |
||
| 139 | ->setParameter(5, $this->cb_key) |
||
| 140 | ; |
||
| 141 | |||
| 142 | return $querybuilder->execute(); |
||
| 143 | } |
||
| 144 | |||
| 145 | /** |
||
| 146 | * @param string $sPagekeytoadd |
||
| 147 | * @return mixed |
||
| 148 | */ |
||
| 149 | public function insert($sPagekeytoadd) |
||
| 150 | { |
||
| 151 | $querybuilder = $this->dbal->createQueryBuilder(); |
||
| 152 | $querybuilder |
||
| 153 | ->insert('content_base') |
||
| 154 | ->setValue('cb_key', '?') |
||
| 155 | ->setParameter(0, $sPagekeytoadd) |
||
| 156 | ; |
||
| 157 | |||
| 158 | return $querybuilder->execute(); |
||
| 159 | } |
||
| 160 | |||
| 161 | /** |
||
| 162 | * @return \Doctrine\DBAL\Driver\Statement|int |
||
| 163 | */ |
||
| 164 | public function remove() |
||
| 165 | { |
||
| 166 | // delete children |
||
| 167 | $this->oPayload->remove($this->cb_id); |
||
|
0 ignored issues
–
show
|
|||
| 168 | |||
| 169 | // then delete base row |
||
| 170 | $queryBuilder = $this->dbal->createQueryBuilder(); |
||
| 171 | $queryBuilder |
||
| 172 | ->delete('content_base') |
||
| 173 | ->where('cb_id = '.$queryBuilder->createNamedParameter($this->cb_id)) |
||
| 174 | ; |
||
| 175 | |||
| 176 | return $queryBuilder->execute(); |
||
| 177 | } |
||
| 178 | } |
||
| 179 |
Let’s take a look at an example:
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break.
Available Fixes
Change the type-hint for the parameter:
Add an additional type-check:
Add the method to the parent class: