PGSSoft /
PgsRestfonyBundle
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Pgs\RestfonyBundle\Controller; |
||
| 4 | |||
| 5 | use FOS\RestBundle\Request\ParamFetcherInterface; |
||
| 6 | use FOS\RestBundle\View\View; |
||
| 7 | use FOS\RestBundle\View\ViewHandler; |
||
| 8 | use Pgs\RestfonyBundle\Doctrine\FilterQueryBuilder; |
||
| 9 | use Pgs\RestfonyBundle\Event\FormViewEvent; |
||
| 10 | use Pgs\RestfonyBundle\Event\PostFormEvent; |
||
| 11 | use Pgs\RestfonyBundle\Event\PutFormEvent; |
||
| 12 | use Pgs\RestfonyBundle\Event\QueryListEvent; |
||
| 13 | use Pgs\RestfonyBundle\Event\ResultListEvent; |
||
| 14 | use Pgs\RestfonyBundle\RestEvents; |
||
| 15 | use Pgs\RestfonyBundle\Service\RestPaginatorFactory; |
||
| 16 | use Symfony\Component\EventDispatcher\EventDispatcherInterface; |
||
| 17 | use Symfony\Component\EventDispatcher\GenericEvent; |
||
| 18 | use Symfony\Component\Form\FormInterface; |
||
| 19 | use Symfony\Component\HttpFoundation\Request; |
||
| 20 | use Symfony\Component\HttpFoundation\Response; |
||
| 21 | use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; |
||
| 22 | use Symfony\Component\PropertyAccess\Exception\NoSuchPropertyException; |
||
| 23 | use Symfony\Component\PropertyAccess\PropertyAccess; |
||
| 24 | |||
| 25 | /** |
||
| 26 | * RestController is responsible for execute CRUD action. |
||
| 27 | * |
||
| 28 | * @author Michał Sikora |
||
| 29 | */ |
||
| 30 | abstract class RestController |
||
| 31 | { |
||
| 32 | /** |
||
| 33 | * @var RestPaginatorFactory |
||
| 34 | */ |
||
| 35 | private $paginatorFactory; |
||
| 36 | |||
| 37 | /** |
||
| 38 | * @var EventDispatcherInterface |
||
| 39 | */ |
||
| 40 | private $eventDispatcher; |
||
| 41 | |||
| 42 | /** |
||
| 43 | * @var array |
||
| 44 | */ |
||
| 45 | private $sortConfiguration = []; |
||
| 46 | |||
| 47 | /** |
||
| 48 | * @var ViewHandler |
||
| 49 | */ |
||
| 50 | private $viewHandler; |
||
| 51 | |||
| 52 | /** |
||
| 53 | * @var FilterQueryBuilder |
||
| 54 | */ |
||
| 55 | private $filterQueryBuilder; |
||
| 56 | |||
| 57 | /** |
||
| 58 | * @param RestManager $restManager |
||
| 59 | * @param FilterQueryBuilder $filterQueryBuilder |
||
| 60 | * @param RestPaginatorFactory $paginatorFactory |
||
| 61 | * @param EventDispatcherInterface $eventDispatcher |
||
| 62 | * @param ViewHandler $viewHandler |
||
| 63 | */ |
||
| 64 | 12 | public function __construct( |
|
| 65 | RestManager $restManager, |
||
| 66 | FilterQueryBuilder $filterQueryBuilder, |
||
| 67 | RestPaginatorFactory $paginatorFactory, |
||
| 68 | EventDispatcherInterface $eventDispatcher, |
||
| 69 | ViewHandler $viewHandler |
||
| 70 | ) { |
||
| 71 | 12 | $this->restManager = $restManager; |
|
|
0 ignored issues
–
show
|
|||
| 72 | 12 | $this->paginatorFactory = $paginatorFactory; |
|
| 73 | 12 | $this->eventDispatcher = $eventDispatcher; |
|
| 74 | 12 | $this->viewHandler = $viewHandler; |
|
| 75 | 12 | $this->filterQueryBuilder = $filterQueryBuilder; |
|
| 76 | 12 | } |
|
| 77 | |||
| 78 | /** |
||
| 79 | * @param array $sortConfiguration |
||
| 80 | */ |
||
| 81 | 1 | public function setSortConfiguration(array $sortConfiguration) |
|
| 82 | { |
||
| 83 | 1 | $this->sortConfiguration = $sortConfiguration; |
|
| 84 | 1 | } |
|
| 85 | |||
| 86 | /** |
||
| 87 | * List action for crud module. |
||
| 88 | * |
||
| 89 | * @param Request $request |
||
| 90 | * @param ParamFetcherInterface $paramFetcher |
||
| 91 | * |
||
| 92 | * @return Response |
||
| 93 | */ |
||
| 94 | 1 | protected function getList(Request $request, ParamFetcherInterface $paramFetcher) |
|
| 95 | { |
||
| 96 | 1 | $sortQuery = $paramFetcher->get('sorts'); |
|
| 97 | 1 | $query = $this->restManager->getManager()->getListQuery($this->sortConfiguration, $sortQuery); |
|
| 98 | 1 | $formFilter = $this->restManager->getRestFilterFactory()->create(); |
|
| 99 | 1 | $this->filterQueryBuilder->createQueryForListAction($query, $formFilter, $request); |
|
| 100 | 1 | $this->eventDispatcher->dispatch( |
|
| 101 | 1 | RestEvents::LIST_ACTION_BEFORE_PAGINATION, |
|
| 102 | 1 | new QueryListEvent($paramFetcher, $query, $request) |
|
| 103 | ); |
||
| 104 | 1 | $results = $this->paginatorFactory->create( |
|
| 105 | $query, |
||
| 106 | $request, |
||
| 107 | $paramFetcher, |
||
| 108 | 1 | $this->restManager->getModuleName() |
|
| 109 | ); |
||
| 110 | 1 | $this->eventDispatcher->dispatch( |
|
| 111 | 1 | RestEvents::LIST_ACTION_AFTER_PAGINATION, |
|
| 112 | 1 | new ResultListEvent($paramFetcher, $results) |
|
| 113 | ); |
||
| 114 | |||
| 115 | 1 | return $this->handleWithGroups($results, [ |
|
| 116 | 1 | $this->getSerializationGroup('list'), |
|
| 117 | 1 | 'list', |
|
| 118 | ]); |
||
| 119 | } |
||
| 120 | |||
| 121 | /** |
||
| 122 | * Get entity from given id. |
||
| 123 | * |
||
| 124 | * @param Request $request |
||
| 125 | * @param int $id |
||
| 126 | * |
||
| 127 | * @return Response |
||
| 128 | */ |
||
| 129 | 1 | protected function getOne(Request $request, $id) |
|
| 130 | { |
||
| 131 | 1 | $entity = $this->findOr404($id); |
|
| 132 | 1 | $this->eventDispatcher->dispatch(RestEvents::GET_ACTION_POST_LOAD, new GenericEvent($entity, [ |
|
| 133 | 1 | 'request' => $request, |
|
| 134 | ])); |
||
| 135 | |||
| 136 | 1 | return $this->handleWithGroups($entity, [ |
|
| 137 | 1 | $this->getSerializationGroup('get'), |
|
| 138 | ]); |
||
| 139 | } |
||
| 140 | |||
| 141 | /** |
||
| 142 | * Create entity from form. |
||
| 143 | * |
||
| 144 | * @param Request $request |
||
| 145 | * |
||
| 146 | * @return FormInterface|Response |
||
| 147 | */ |
||
| 148 | 2 | protected function post(Request $request) |
|
| 149 | { |
||
| 150 | 2 | $form = $this->restManager->getRestFormFactory()->create($this->restManager->getManager()->create()); |
|
| 151 | 2 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_PRE_SUBMIT, new PostFormEvent($form, $request)); |
|
| 152 | 2 | $form->submit($request->request->all()); |
|
| 153 | |||
| 154 | 2 | View Code Duplication | if ($form->isValid()) { |
| 155 | 1 | $entity = $form->getData(); |
|
| 156 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_POST_VALIDATION, new GenericEvent($entity)); |
|
| 157 | 1 | $this->restManager->getManager()->persist($entity, true); |
|
| 158 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_POST_PERSIST, new GenericEvent($entity)); |
|
| 159 | |||
| 160 | 1 | return $this->handleWithGroups($entity, [ |
|
| 161 | 1 | $this->getSerializationGroup('post'), |
|
| 162 | ]); |
||
| 163 | } |
||
| 164 | |||
| 165 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_ACTION_VALIDATION_ERROR, new PostFormEvent($form, $request)); |
|
| 166 | |||
| 167 | 1 | return $this->handleWithGroups($form, [ |
|
| 168 | 1 | $this->getSerializationGroup('post'), |
|
| 169 | ]); |
||
| 170 | } |
||
| 171 | |||
| 172 | /** |
||
| 173 | * Update entity from form. |
||
| 174 | * |
||
| 175 | * @param Request $request |
||
| 176 | * @param int $id |
||
| 177 | * |
||
| 178 | * @return Response |
||
| 179 | */ |
||
| 180 | 2 | protected function put(Request $request, $id) |
|
| 181 | { |
||
| 182 | 2 | $entity = $this->findOr404($id); |
|
| 183 | 2 | $form = $this->restManager->getRestFormFactory()->create($entity); |
|
| 184 | 2 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_PRE_SUBMIT, new PutFormEvent($form, $request)); |
|
| 185 | 2 | $form->submit($request->request->all()); |
|
| 186 | |||
| 187 | 2 | View Code Duplication | if ($form->isValid()) { |
| 188 | 1 | $entity = $form->getData(); |
|
| 189 | 1 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_POST_VALIDATION, new GenericEvent($entity)); |
|
| 190 | 1 | $this->restManager->getManager()->merge($entity, true); |
|
| 191 | 1 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_POST_PERSIST, new GenericEvent($entity)); |
|
| 192 | |||
| 193 | 1 | return $this->handleWithGroups($entity, [ |
|
| 194 | 1 | $this->getSerializationGroup('put'), |
|
| 195 | ]); |
||
| 196 | } |
||
| 197 | |||
| 198 | 1 | $this->eventDispatcher->dispatch(RestEvents::PUT_ACTION_VALIDATION_ERROR, new PutFormEvent($form, $request)); |
|
| 199 | |||
| 200 | 1 | return $this->handleWithGroups($form, [ |
|
| 201 | 1 | $this->getSerializationGroup('put'), |
|
| 202 | ]); |
||
| 203 | } |
||
| 204 | |||
| 205 | /** |
||
| 206 | * Delete entity from given id. |
||
| 207 | * |
||
| 208 | * @param Request $request |
||
| 209 | * @param int $id |
||
| 210 | * |
||
| 211 | * @return Response |
||
| 212 | */ |
||
| 213 | 1 | protected function delete(Request $request, $id) |
|
| 214 | { |
||
| 215 | 1 | $entity = $this->findOr404($id); |
|
| 216 | 1 | $this->eventDispatcher->dispatch(RestEvents::DELETE_ACTION_PRE_DELETE, new GenericEvent($entity, [ |
|
| 217 | 1 | 'request' => $request, |
|
| 218 | ])); |
||
| 219 | 1 | $this->restManager->getManager()->remove($entity, true); |
|
| 220 | 1 | $this->eventDispatcher->dispatch(RestEvents::DELETE_ACTION_POST_DELETE, new GenericEvent($entity, [ |
|
| 221 | 1 | 'request' => $request, |
|
| 222 | ])); |
||
| 223 | |||
| 224 | 1 | return $this->handleWithGroups(null, [ |
|
| 225 | 1 | $this->getSerializationGroup('delete'), |
|
| 226 | ]); |
||
| 227 | } |
||
| 228 | |||
| 229 | /** |
||
| 230 | * Show new form schema for crud entity. |
||
| 231 | * |
||
| 232 | * @param Request $request |
||
| 233 | * |
||
| 234 | * @return Response |
||
| 235 | */ |
||
| 236 | 1 | protected function newForm(Request $request) |
|
| 237 | { |
||
| 238 | 1 | $form = $this->restManager->getRestFormFactory()->create($this->restManager->getManager()->create()); |
|
| 239 | 1 | $this->eventDispatcher->dispatch(RestEvents::NEW_ACTION_LOAD, new FormViewEvent($form, $request)); |
|
| 240 | |||
| 241 | 1 | return $this->handleWithGroups($form, [ |
|
| 242 | 1 | $this->getSerializationGroup('new'), |
|
| 243 | ]); |
||
| 244 | } |
||
| 245 | |||
| 246 | /** |
||
| 247 | * Show edit form for crud entity. |
||
| 248 | * |
||
| 249 | * @param Request $request |
||
| 250 | * @param int $id |
||
| 251 | * |
||
| 252 | * @return FormInterface |
||
| 253 | */ |
||
| 254 | 1 | protected function editForm(Request $request, $id) |
|
| 255 | { |
||
| 256 | 1 | $entity = $this->findOr404($id); |
|
| 257 | 1 | $form = $this->restManager->getRestFormFactory()->create($entity); |
|
| 258 | 1 | $this->eventDispatcher->dispatch(RestEvents::EDIT_ACTION_LOAD, new FormViewEvent($form, $request)); |
|
| 259 | |||
| 260 | 1 | return $this->handleWithGroups($form, [ |
|
| 261 | 1 | $this->getSerializationGroup('edit'), |
|
| 262 | ]); |
||
| 263 | } |
||
| 264 | |||
| 265 | /** |
||
| 266 | * This method is responsible for patching field for resource |
||
| 267 | * it should be decorating by child controller and defined as patch[field]Action. |
||
| 268 | * |
||
| 269 | * @param int $id |
||
| 270 | * @param string $fieldName |
||
| 271 | * @param mixed $value |
||
| 272 | * |
||
| 273 | * @return Response |
||
| 274 | */ |
||
| 275 | 2 | protected function patch($id, $fieldName, $value) |
|
| 276 | { |
||
| 277 | 2 | $entity = $this->findOr404($id); |
|
| 278 | |||
| 279 | try { |
||
| 280 | 2 | $accessor = PropertyAccess::createPropertyAccessor(); |
|
| 281 | 2 | $accessor->setValue($entity, $fieldName, $value); |
|
| 282 | 1 | $this->eventDispatcher->dispatch(RestEvents::PRE_PATCHED_ACTION, new GenericEvent($entity)); |
|
| 283 | 1 | $this->restManager->getManager()->persist($entity, true); |
|
| 284 | 1 | $this->eventDispatcher->dispatch(RestEvents::POST_PATCHED_ACTION, new GenericEvent($entity)); |
|
| 285 | 1 | } catch (NoSuchPropertyException $ex) { |
|
| 286 | 1 | throw new $ex(); |
|
| 287 | } |
||
| 288 | |||
| 289 | 1 | return $this->handleWithGroups($entity, [ |
|
| 290 | 1 | $this->getSerializationGroup('patch'), |
|
| 291 | ]); |
||
| 292 | } |
||
| 293 | |||
| 294 | /** |
||
| 295 | * Apply serialization rules on response object. |
||
| 296 | * |
||
| 297 | * @param object $result |
||
| 298 | * @param array $groups |
||
| 299 | * @param int $statusCode |
||
| 300 | * |
||
| 301 | * @return Response |
||
| 302 | */ |
||
| 303 | 10 | protected function handleWithGroups($result, array $groups, $statusCode = Response::HTTP_OK) |
|
| 304 | { |
||
| 305 | 10 | $view = View::create($result, $statusCode); |
|
| 306 | 10 | $view->getContext()->setGroups($groups); |
|
| 307 | 10 | $this->eventDispatcher->dispatch(RestEvents::HANDLE_VIEW, new GenericEvent($view)); |
|
| 308 | |||
| 309 | 10 | return $this->viewHandler->handle($view); |
|
| 310 | } |
||
| 311 | |||
| 312 | /** |
||
| 313 | * Fetch entity from given PK. |
||
| 314 | * |
||
| 315 | * @param int $id |
||
| 316 | * |
||
| 317 | * @return object |
||
| 318 | * |
||
| 319 | * @throws NotFoundHttpException |
||
| 320 | */ |
||
| 321 | 8 | protected function findOr404($id) |
|
| 322 | { |
||
| 323 | 8 | $object = $this->restManager->getManager()->find($id); |
|
| 324 | |||
| 325 | 8 | if ($object) { |
|
| 326 | 7 | return $object; |
|
| 327 | } |
||
| 328 | |||
| 329 | 1 | throw new NotFoundHttpException(); |
|
| 330 | } |
||
| 331 | |||
| 332 | /** |
||
| 333 | * @param string $actionName |
||
| 334 | * |
||
| 335 | * @return string |
||
| 336 | */ |
||
| 337 | 10 | protected function getSerializationGroup($actionName) |
|
| 338 | { |
||
| 339 | 10 | return sprintf('%s_%s', $this->restManager->getModuleName(), $actionName); |
|
| 340 | } |
||
| 341 | } |
||
| 342 |
In PHP it is possible to write to properties without declaring them. For example, the following is perfectly valid PHP code:
Generally, it is a good practice to explictly declare properties to avoid accidental typos and provide IDE auto-completion: