This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Pgs\RestfonyBundle\Controller; |
||
4 | |||
5 | use FOS\RestBundle\Request\ParamFetcherInterface; |
||
6 | use FOS\RestBundle\View\View; |
||
7 | use FOS\RestBundle\View\ViewHandler; |
||
8 | use Pgs\RestfonyBundle\Doctrine\FilterQueryBuilder; |
||
9 | use Pgs\RestfonyBundle\Event\FormViewEvent; |
||
10 | use Pgs\RestfonyBundle\Event\PostFormEvent; |
||
11 | use Pgs\RestfonyBundle\Event\PutFormEvent; |
||
12 | use Pgs\RestfonyBundle\Event\QueryListEvent; |
||
13 | use Pgs\RestfonyBundle\Event\ResultListEvent; |
||
14 | use Pgs\RestfonyBundle\RestEvents; |
||
15 | use Pgs\RestfonyBundle\Service\RestPaginatorFactory; |
||
16 | use Symfony\Component\EventDispatcher\EventDispatcherInterface; |
||
17 | use Symfony\Component\EventDispatcher\GenericEvent; |
||
18 | use Symfony\Component\Form\FormInterface; |
||
19 | use Symfony\Component\HttpFoundation\Request; |
||
20 | use Symfony\Component\HttpFoundation\Response; |
||
21 | use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; |
||
22 | use Symfony\Component\PropertyAccess\Exception\NoSuchPropertyException; |
||
23 | use Symfony\Component\PropertyAccess\PropertyAccess; |
||
24 | |||
25 | /** |
||
26 | * RestController is responsible for execute CRUD action. |
||
27 | * |
||
28 | * @author Michał Sikora |
||
29 | */ |
||
30 | abstract class RestController |
||
31 | { |
||
32 | /** |
||
33 | * @var RestPaginatorFactory |
||
34 | */ |
||
35 | private $paginatorFactory; |
||
36 | |||
37 | /** |
||
38 | * @var EventDispatcherInterface |
||
39 | */ |
||
40 | private $eventDispatcher; |
||
41 | |||
42 | /** |
||
43 | * @var array |
||
44 | */ |
||
45 | private $sortConfiguration = []; |
||
46 | |||
47 | /** |
||
48 | * @var ViewHandler |
||
49 | */ |
||
50 | private $viewHandler; |
||
51 | |||
52 | /** |
||
53 | * @var FilterQueryBuilder |
||
54 | */ |
||
55 | private $filterQueryBuilder; |
||
56 | |||
57 | /** |
||
58 | * @param RestManager $restManager |
||
59 | * @param FilterQueryBuilder $filterQueryBuilder |
||
60 | * @param RestPaginatorFactory $paginatorFactory |
||
61 | * @param EventDispatcherInterface $eventDispatcher |
||
62 | * @param ViewHandler $viewHandler |
||
63 | */ |
||
64 | 12 | public function __construct( |
|
65 | RestManager $restManager, |
||
66 | FilterQueryBuilder $filterQueryBuilder, |
||
67 | RestPaginatorFactory $paginatorFactory, |
||
68 | EventDispatcherInterface $eventDispatcher, |
||
69 | ViewHandler $viewHandler |
||
70 | ) { |
||
71 | 12 | $this->restManager = $restManager; |
|
72 | 12 | $this->paginatorFactory = $paginatorFactory; |
|
73 | 12 | $this->eventDispatcher = $eventDispatcher; |
|
74 | 12 | $this->viewHandler = $viewHandler; |
|
75 | 12 | $this->filterQueryBuilder = $filterQueryBuilder; |
|
76 | 12 | } |
|
77 | |||
78 | /** |
||
79 | * @param array $sortConfiguration |
||
80 | */ |
||
81 | 1 | public function setSortConfiguration(array $sortConfiguration) |
|
82 | { |
||
83 | 1 | $this->sortConfiguration = $sortConfiguration; |
|
84 | 1 | } |
|
85 | |||
86 | /** |
||
87 | * List action for crud module. |
||
88 | * |
||
89 | * @param Request $request |
||
90 | * @param ParamFetcherInterface $paramFetcher |
||
91 | * |
||
92 | * @return Response |
||
93 | */ |
||
94 | 1 | protected function getList(Request $request, ParamFetcherInterface $paramFetcher) |
|
95 | { |
||
96 | 1 | $sortQuery = $paramFetcher->get('sorts'); |
|
97 | 1 | $query = $this->restManager->getManager()->getListQuery($this->sortConfiguration, $sortQuery); |
|
98 | 1 | $formFilter = $this->restManager->getRestFilterFactory()->create(); |
|
99 | 1 | $this->filterQueryBuilder->createQueryForListAction($query, $formFilter, $request); |
|
100 | 1 | $this->eventDispatcher->dispatch( |
|
101 | 1 | RestEvents::LIST_ACTION_BEFORE_PAGINATION, |
|
102 | 1 | new QueryListEvent($paramFetcher, $query, $request) |
|
103 | ); |
||
104 | 1 | $results = $this->paginatorFactory->create( |
|
105 | $query, |
||
106 | $request, |
||
107 | $paramFetcher, |
||
108 | 1 | $this->restManager->getModuleName() |
|
109 | ); |
||
110 | 1 | $this->eventDispatcher->dispatch( |
|
111 | 1 | RestEvents::LIST_ACTION_AFTER_PAGINATION, |
|
112 | 1 | new ResultListEvent($paramFetcher, $results) |
|
113 | ); |
||
114 | |||
115 | 1 | return $this->handleWithGroups($results, [ |
|
116 | 1 | $this->getSerializationGroup('list'), |
|
117 | 1 | 'list', |
|
118 | ]); |
||
119 | } |
||
120 | |||
121 | /** |
||
122 | * Get entity from given id. |
||
123 | * |
||
124 | * @param Request $request |
||
125 | * @param int $id |
||
126 | * |
||
127 | * @return Response |
||
128 | */ |
||
129 | 1 | protected function getOne(Request $request, $id) |
|
130 | { |
||
131 | 1 | $entity = $this->findOr404($id); |
|
132 | 1 | $this->eventDispatcher->dispatch(RestEvents::GET_ACTION_POST_LOAD, new GenericEvent($entity, [ |
|
133 | 1 | 'request' => $request, |
|
134 | ])); |
||
135 | |||
136 | 1 | return $this->handleWithGroups($entity, [ |
|
137 | 1 | $this->getSerializationGroup('get'), |
|
138 | ]); |
||
139 | } |
||
140 | |||
141 | /** |
||
142 | * Create entity from form. |
||
143 | * |
||
144 | * @param Request $request |
||
145 | * |
||
146 | * @return FormInterface|Response |
||
147 | */ |
||
148 | 2 | protected function post(Request $request) |
|
149 | { |
||
150 | 2 | $form = $this->restManager->getRestFormFactory()->create($this->restManager->getManager()->create()); |
|
151 | 2 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_PRE_SUBMIT, new PostFormEvent($form, $request)); |
|
152 | 2 | $form->submit($request->request->all()); |
|
153 | |||
154 | 2 | View Code Duplication | if ($form->isValid()) { |
155 | 1 | $entity = $form->getData(); |
|
156 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_POST_VALIDATION, new GenericEvent($entity)); |
|
157 | 1 | $this->restManager->getManager()->persist($entity, true); |
|
158 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_POST_PERSIST, new GenericEvent($entity)); |
|
159 | |||
160 | 1 | return $this->handleWithGroups($entity, [ |
|
161 | 1 | $this->getSerializationGroup('post'), |
|
162 | ]); |
||
163 | } |
||
164 | |||
165 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_VALIDATION_ERROR, new PostFormEvent($form, $request)); |
|
166 | |||
167 | 1 | return $this->handleWithGroups($form, [ |
|
168 | 1 | $this->getSerializationGroup('post'), |
|
169 | ]); |
||
170 | } |
||
171 | |||
172 | /** |
||
173 | * Update entity from form. |
||
174 | * |
||
175 | * @param Request $request |
||
176 | * @param int $id |
||
177 | * |
||
178 | * @return Response |
||
179 | */ |
||
180 | 2 | protected function put(Request $request, $id) |
|
181 | { |
||
182 | 2 | $entity = $this->findOr404($id); |
|
183 | 2 | $form = $this->restManager->getRestFormFactory()->create($entity); |
|
184 | 2 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_PRE_SUBMIT, new PutFormEvent($form, $request)); |
|
185 | 2 | $form->submit($request->request->all()); |
|
186 | |||
187 | 2 | View Code Duplication | if ($form->isValid()) { |
188 | 1 | $entity = $form->getData(); |
|
189 | 1 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_POST_VALIDATION, new GenericEvent($entity)); |
|
190 | 1 | $this->restManager->getManager()->merge($entity, true); |
|
191 | 1 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_POST_PERSIST, new GenericEvent($entity)); |
|
192 | |||
193 | 1 | return $this->handleWithGroups($entity, [ |
|
194 | 1 | $this->getSerializationGroup('put'), |
|
195 | ]); |
||
196 | } |
||
197 | |||
198 | 1 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_VALIDATION_ERROR, new PutFormEvent($form, $request)); |
|
199 | |||
200 | 1 | return $this->handleWithGroups($form, [ |
|
201 | 1 | $this->getSerializationGroup('put'), |
|
202 | ]); |
||
203 | } |
||
204 | |||
205 | /** |
||
206 | * Delete entity from given id. |
||
207 | * |
||
208 | * @param Request $request |
||
209 | * @param int $id |
||
210 | * |
||
211 | * @return Response |
||
212 | */ |
||
213 | 1 | protected function delete(Request $request, $id) |
|
214 | { |
||
215 | 1 | $entity = $this->findOr404($id); |
|
216 | 1 | $this->eventDispatcher->dispatch(RestEvents::DELETE_ACTION_PRE_DELETE, new GenericEvent($entity, [ |
|
217 | 1 | 'request' => $request, |
|
218 | ])); |
||
219 | 1 | $this->restManager->getManager()->remove($entity, true); |
|
220 | 1 | $this->eventDispatcher->dispatch(RestEvents::DELETE_ACTION_POST_DELETE, new GenericEvent($entity, [ |
|
221 | 1 | 'request' => $request, |
|
222 | ])); |
||
223 | |||
224 | 1 | return $this->handleWithGroups(null, [ |
|
0 ignored issues
–
show
|
|||
225 | 1 | $this->getSerializationGroup('delete'), |
|
226 | ]); |
||
227 | } |
||
228 | |||
229 | /** |
||
230 | * Show new form schema for crud entity. |
||
231 | * |
||
232 | * @param Request $request |
||
233 | * |
||
234 | * @return Response |
||
235 | */ |
||
236 | 1 | protected function newForm(Request $request) |
|
237 | { |
||
238 | 1 | $form = $this->restManager->getRestFormFactory()->create($this->restManager->getManager()->create()); |
|
239 | 1 | $this->eventDispatcher->dispatch(RestEvents::NEW_ACTION_LOAD, new FormViewEvent($form, $request)); |
|
240 | |||
241 | 1 | return $this->handleWithGroups($form, [ |
|
242 | 1 | $this->getSerializationGroup('new'), |
|
243 | ]); |
||
244 | } |
||
245 | |||
246 | /** |
||
247 | * Show edit form for crud entity. |
||
248 | * |
||
249 | * @param Request $request |
||
250 | * @param int $id |
||
251 | * |
||
252 | * @return FormInterface |
||
253 | */ |
||
254 | 1 | protected function editForm(Request $request, $id) |
|
255 | { |
||
256 | 1 | $entity = $this->findOr404($id); |
|
257 | 1 | $form = $this->restManager->getRestFormFactory()->create($entity); |
|
258 | 1 | $this->eventDispatcher->dispatch(RestEvents::EDIT_ACTION_LOAD, new FormViewEvent($form, $request)); |
|
259 | |||
260 | 1 | return $this->handleWithGroups($form, [ |
|
261 | 1 | $this->getSerializationGroup('edit'), |
|
262 | ]); |
||
263 | } |
||
264 | |||
265 | /** |
||
266 | * This method is responsible for patching field for resource |
||
267 | * it should be decorating by child controller and defined as patch[field]Action. |
||
268 | * |
||
269 | * @param int $id |
||
270 | * @param string $fieldName |
||
271 | * @param mixed $value |
||
272 | * |
||
273 | * @return Response |
||
274 | */ |
||
275 | 2 | protected function patch($id, $fieldName, $value) |
|
276 | { |
||
277 | 2 | $entity = $this->findOr404($id); |
|
278 | |||
279 | try { |
||
280 | 2 | $accessor = PropertyAccess::createPropertyAccessor(); |
|
281 | 2 | $accessor->setValue($entity, $fieldName, $value); |
|
282 | 1 | $this->eventDispatcher->dispatch(RestEvents::PRE_PATCHED_ACTION, new GenericEvent($entity)); |
|
283 | 1 | $this->restManager->getManager()->persist($entity, true); |
|
284 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_PATCHED_ACTION, new GenericEvent($entity)); |
|
285 | 1 | } catch (NoSuchPropertyException $ex) { |
|
286 | 1 | throw new $ex(); |
|
287 | } |
||
288 | |||
289 | 1 | return $this->handleWithGroups($entity, [ |
|
290 | 1 | $this->getSerializationGroup('patch'), |
|
291 | ]); |
||
292 | } |
||
293 | |||
294 | /** |
||
295 | * Apply serialization rules on response object. |
||
296 | * |
||
297 | * @param object $result |
||
298 | * @param array $groups |
||
299 | * @param int $statusCode |
||
300 | * |
||
301 | * @return Response |
||
302 | */ |
||
303 | 10 | protected function handleWithGroups($result, array $groups, $statusCode = Response::HTTP_OK) |
|
304 | { |
||
305 | 10 | $view = View::create($result, $statusCode); |
|
306 | 10 | $view->getContext()->setGroups($groups); |
|
307 | 10 | $this->eventDispatcher->dispatch(RestEvents::HANDLE_VIEW, new GenericEvent($view)); |
|
308 | |||
309 | 10 | return $this->viewHandler->handle($view); |
|
310 | } |
||
311 | |||
312 | /** |
||
313 | * Fetch entity from given PK. |
||
314 | * |
||
315 | * @param int $id |
||
316 | * |
||
317 | * @return object |
||
318 | * |
||
319 | * @throws NotFoundHttpException |
||
320 | */ |
||
321 | 8 | protected function findOr404($id) |
|
322 | { |
||
323 | 8 | $object = $this->restManager->getManager()->find($id); |
|
324 | |||
325 | 8 | if ($object) { |
|
326 | 7 | return $object; |
|
327 | } |
||
328 | |||
329 | 1 | throw new NotFoundHttpException(); |
|
330 | } |
||
331 | |||
332 | /** |
||
333 | * @param string $actionName |
||
334 | * |
||
335 | * @return string |
||
336 | */ |
||
337 | 10 | protected function getSerializationGroup($actionName) |
|
338 | { |
||
339 | 10 | return sprintf('%s_%s', $this->restManager->getModuleName(), $actionName); |
|
340 | } |
||
341 | } |
||
342 |
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: