This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | HCSF - A multilingual CMS and Shopsystem |
||
5 | Copyright (C) 2014 Marcus Haase - [email protected] |
||
6 | |||
7 | This program is free software: you can redistribute it and/or modify |
||
8 | it under the terms of the GNU General Public License as published by |
||
9 | the Free Software Foundation, either version 3 of the License, or |
||
10 | (at your option) any later version. |
||
11 | |||
12 | This program is distributed in the hope that it will be useful, |
||
13 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
15 | GNU General Public License for more details. |
||
16 | |||
17 | You should have received a copy of the GNU General Public License |
||
18 | along with this program. If not, see <http://www.gnu.org/licenses/>. |
||
19 | */ |
||
20 | |||
21 | namespace HaaseIT\HCSF; |
||
22 | |||
23 | |||
24 | use Zend\ServiceManager\ServiceManager; |
||
25 | |||
26 | /** |
||
27 | * Class UserPage |
||
28 | * @package HaaseIT\HCSF |
||
29 | */ |
||
30 | class UserPage extends Page |
||
31 | { |
||
32 | /** |
||
33 | * @var bool |
||
34 | */ |
||
35 | protected $bReturnRaw; |
||
36 | |||
37 | /** |
||
38 | * @var int|string |
||
39 | */ |
||
40 | public $cb_id; |
||
41 | |||
42 | /** |
||
43 | * @var string |
||
44 | */ |
||
45 | public $cb_key; |
||
46 | |||
47 | /** |
||
48 | * @var int |
||
49 | */ |
||
50 | public $cb_group; |
||
51 | |||
52 | /** |
||
53 | * @var bool |
||
54 | */ |
||
55 | public $cb_html_from_file; |
||
56 | |||
57 | /** |
||
58 | * @var \HTMLPurifier |
||
59 | */ |
||
60 | public $purifier; |
||
61 | |||
62 | /** |
||
63 | * @var \Doctrine\DBAL\Connection |
||
64 | */ |
||
65 | protected $dbal; |
||
66 | |||
67 | /** |
||
68 | * UserPage constructor. |
||
69 | * @param ServiceManager $serviceManager |
||
70 | * @param $sPagekey |
||
71 | * @param bool $bReturnRaw |
||
72 | */ |
||
73 | public function __construct(ServiceManager $serviceManager, $sPagekey, $bReturnRaw = false) |
||
74 | { |
||
75 | //if (!$bReturnRaw) $this->container = $container; |
||
76 | $this->serviceManager = $serviceManager; |
||
77 | $this->status = 200; |
||
78 | $this->bReturnRaw = $bReturnRaw; |
||
79 | $this->dbal = $this->serviceManager->get('dbal'); |
||
80 | |||
81 | if ($sPagekey === '/_misc/index.html') { |
||
82 | $this->cb_id = $sPagekey; |
||
83 | $this->cb_key = $sPagekey; |
||
84 | $this->cb_pagetype = 'itemoverview'; |
||
85 | $this->oPayload = $this->getPayload(); |
||
86 | $this->cb_pageconfig = (object) []; |
||
87 | } else { |
||
88 | // first get base data |
||
89 | $querybuilder = $this->dbal->createQueryBuilder(); |
||
90 | $querybuilder |
||
91 | ->select('cb_id, cb_key, cb_group, cb_pagetype, cb_pageconfig, cb_subnav, cb_html_from_file') |
||
92 | ->from('content_base') |
||
93 | ->where('cb_key = ?') |
||
94 | ->setParameter(0, $sPagekey) |
||
95 | ; |
||
96 | $stmt = $querybuilder->execute(); |
||
97 | $stmt->setFetchMode(\PDO::FETCH_INTO, $this); |
||
98 | |||
99 | if ($stmt->rowCount() === 1) { |
||
100 | $stmt->fetch(); |
||
101 | |||
102 | if ($this->cb_pagetype !== 'shorturl') { |
||
103 | if (!$bReturnRaw) { |
||
104 | $this->cb_pageconfig = json_decode($this->cb_pageconfig); |
||
105 | } |
||
106 | $this->oPayload = $this->getPayload(); |
||
107 | } |
||
108 | } |
||
109 | } |
||
110 | } |
||
111 | |||
112 | /** |
||
113 | * @return UserPagePayload |
||
114 | */ |
||
115 | protected function getPayload() |
||
116 | { |
||
117 | return new UserPagePayload($this->serviceManager, $this->cb_id, $this->bReturnRaw, $this); |
||
118 | } |
||
119 | |||
120 | /** |
||
121 | * @return bool |
||
122 | */ |
||
123 | public function write() |
||
124 | { |
||
125 | $querybuilder = $this->dbal->createQueryBuilder(); |
||
126 | $querybuilder |
||
127 | ->update('content_base') |
||
128 | ->set('cb_pagetype', '?') |
||
129 | ->set('cb_group', '?') |
||
130 | ->set('cb_pageconfig', '?') |
||
131 | ->set('cb_subnav', '?') |
||
132 | ->set('cb_html_from_file', '?') |
||
133 | ->where('cb_key = ?') |
||
134 | ->setParameter(0, filter_var($this->cb_pagetype, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW)) |
||
135 | ->setParameter(1, filter_var($this->cb_group, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW)) |
||
136 | ->setParameter(2, $this->cb_pageconfig) |
||
137 | ->setParameter(3, filter_var($this->cb_subnav, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW)) |
||
138 | ->setParameter(4, ($this->cb_html_from_file) ? 'Y' : 'N') |
||
139 | ->setParameter(5, $this->cb_key) |
||
140 | ; |
||
141 | |||
142 | return $querybuilder->execute(); |
||
143 | } |
||
144 | |||
145 | /** |
||
146 | * @param string $sPagekeytoadd |
||
147 | * @return mixed |
||
148 | */ |
||
149 | public function insert($sPagekeytoadd) |
||
150 | { |
||
151 | $querybuilder = $this->dbal->createQueryBuilder(); |
||
152 | $querybuilder |
||
153 | ->insert('content_base') |
||
154 | ->setValue('cb_key', '?') |
||
155 | ->setParameter(0, $sPagekeytoadd) |
||
156 | ; |
||
157 | |||
158 | return $querybuilder->execute(); |
||
159 | } |
||
160 | |||
161 | /** |
||
162 | * @return \Doctrine\DBAL\Driver\Statement|int |
||
163 | */ |
||
164 | public function remove() |
||
165 | { |
||
166 | // delete children |
||
167 | $this->oPayload->remove($this->cb_id); |
||
0 ignored issues
–
show
|
|||
168 | |||
169 | // then delete base row |
||
170 | $queryBuilder = $this->dbal->createQueryBuilder(); |
||
171 | $queryBuilder |
||
172 | ->delete('content_base') |
||
173 | ->where('cb_id = '.$queryBuilder->createNamedParameter($this->cb_id)) |
||
174 | ; |
||
175 | |||
176 | return $queryBuilder->execute(); |
||
177 | } |
||
178 | } |
||
179 |
Let’s take a look at an example:
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break.
Available Fixes
Change the type-hint for the parameter:
Add an additional type-check:
Add the method to the parent class: