Issues (32)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

View.php (10 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * View.php
4
 * @author Revin Roman
5
 * @link https://processfast.ru
6
 */
7
8
namespace processfast\yii\minify;
9
10
use yii\base\Event;
11
use yii\helpers\FileHelper;
12
use yii\web\AssetBundle;
13
use yii\web\Response;
14
15
16
17
/**
18
 * Class View
19
 * @package processfast\yii\minify
20
 */
21
class View extends \yii\web\View
22
{
23
24
    /**
25
     * @var bool
26
     */
27
    public $enableMinify = true;
28
29
    /**
30
     * @var string filemtime or sha1
31
     */
32
    public $fileCheckAlgorithm = 'sha1';
33
34
    /**
35
     * @var bool
36
     */
37
    public $concatCss = true;
38
39
    /**
40
     * @var bool
41
     */
42
    public $minifyCss = true;
43
44
    /**
45
     * @var bool
46
     */
47
    public $concatJs = true;
48
49
    /**
50
     * @var bool
51
     */
52
    public $minifyJs = true;
53
54
    /**
55
     * @var bool
56
     */
57
    public $minifyOutput = false;
58
59
    /**
60
     * @var bool
61
     */
62
    public $removeComments = true;
63
64
    /**
65
     * @deprecated
66
     * @var string path alias to web base (in url)
67
     */
68
    public $web_path = '@web';
69
70
    /**
71
     * @var string path alias to web base (in url)
72
     */
73
    public $webPath;
74
75
    /**
76
     * @deprecated
77
     * @var string path alias to web base (absolute)
78
     */
79
    public $base_path = '@webroot';
80
81
    /**
82
     * @var string path alias to web base (absolute)
83
     */
84
    public $basePath;
85
86
    /**
87
     * @deprecated
88
     * @var string path alias to save minify result
89
     */
90
    public $minify_path = '@webroot/minify';
91
92
    /**
93
     * @var string path alias to save minify result
94
     */
95
    public $minifyPath;
96
97
    /**
98
     * @deprecated
99
     * @var array positions of js files to be minified
100
     */
101
    public $js_position = [self::POS_END, self::POS_HEAD];
102
103
    /**
104
     * @var array positions of js files to be minified
105
     */
106
    public $jsPosition;
107
108
    /**
109
     * @var array options of minified js files
110
     */
111
    public $jsOptions = [];
112
113
    /**
114
     * @deprecated
115
     * @var bool|string charset forcibly assign, otherwise will use all of the files found charset
116
     */
117
    public $force_charset = false;
118
119
    /**
120
     * @var bool|string charset forcibly assign, otherwise will use all of the files found charset
121
     */
122
    public $forceCharset;
123
124
    /**
125
     * @deprecated
126
     * @var bool whether to change @import on content
127
     */
128
    public $expand_imports = true;
129
130
    /**
131
     * @var bool whether to change @import on content
132
     */
133
    public $expandImports;
134
135
    /**
136
     * @deprecated
137
     * @var int
138
     */
139
    public $css_linebreak_pos = 2048;
140
141
    /**
142
     * @var int
143
     */
144
    public $cssLinebreakPos;
145
146
    /**
147
     * @deprecated
148
     * @var int|bool chmod of minified file. If false chmod not set
149
     */
150
    public $file_mode = 0664;
151
152
    /**
153
     * @var int|bool chmod of minified file. If false chmod not set
154
     */
155
    public $fileMode;
156
157
    /**
158
     * @var array schemes that will be ignored during normalization url
159
     */
160
    public $schemas = ['//', 'http://', 'https://', 'ftp://'];
161
162
    /**
163
     * @deprecated
164
     * @var bool do I need to compress the result html page.
165
     */
166
    public $compress_output = false;
167
168
    /**
169
     * @deprecated
170
     * @var array options for compressing output result
171
     *   * extra - use more compact algorithm
172
     *   * no-comments - cut all the html comments
173
     */
174
    public $compress_options = ['extra' => true];
175
176
    /**
177
     * @var array options for compressing output result
178
     *   * extra - use more compact algorithm
179
     *   * no-comments - cut all the html comments
180
     */
181
    public $compressOptions;
182
183
    /**
184
     * @var array
185
     */
186
    public $excludeBundles = [];
187
188
    /**
189
     * @var array
190
     */
191
    public $excludeFiles = [];
192
193
    /**
194
     * @var boolean
195
     */
196
    public $S3Upload = false ;
197
198
199
    /**
200
     * @var boolean
201
     */
202
    public $awsBucket = null ;
203
204
    /**
205
     * @var boolean
206
     * It is for linking Resource folder to asset files
207
     * if Resources like images above one folder it should be "../" if two folders above "../../"
208
     */
209
    public $assetsFolderPathPatch = null ;
210
211
212
    /*
213
     * boolean
214
     * backend checke will help keep assets into root/minify folder instead of root/backend/minifiy for backend
215
     */
216
    public $backendCheck = false ;
217
    /*
218
     * Folder name where minified files will be kept
219
     */
220
    public $folderName = 'minify' ;
221
    /*
222
     * will be used at _getSummaryFilesHash will fix path to have same hash value as frontend or backend when files generated from console.
223
     */
224
    public $modifyPath = false  ;
225
    public $modifyPathData = "" ;
226
227
    /**
228
     * This one will be added as JS file prefix while it will be uploaded to S3 bucket
229
     * @var string
230
     */
231
    public $prefixJsFile = "" ;
232
233
    /**
234
     * This one will be added as CSS file prefix while it will be uploaded to S3 bucket
235
     * @var string
236
     */
237
    public $prefixCssFile = "" ;
238
239
    /**
240
     * by the param it will be decided whether to encode content of js files into gzip or not
241
     * @var bool
242
     */
243
    public $gzipEncodeJs = false ;
244
245
    /**
246
     * by the param it will be decided whether to encode content of css files into gzip or not
247
     * @var bool
248
     */
249
    public $gzipEncodeCss = false ;
250
251
252
    /**
253
     * this will tell the versionNumber of app. It will be included in filename while it will be uploaded to S3 bucket
254
     * @var string
255
     */
256
    public $versionNumber = "";
257
258
    /**
259
     * @throws \processfast\yii\minify\Exception
260
     */
261 10
    public function init()
262
    {
263 10
        parent::init();
264
265 10
        $this->webPath = empty($this->webPath) ? $this->web_path : $this->webPath;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$web_path has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
266 10
        $this->basePath = empty($this->basePath) ? $this->base_path : $this->basePath;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$base_path has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
267 10
        $this->minifyPath = empty($this->minifyPath) ? $this->minify_path : $this->minifyPath;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$minify_path has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
268 10
        $this->jsPosition = empty($this->jsPosition) ? $this->js_position : $this->jsPosition;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$js_position has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
269 10
        $this->forceCharset = empty($this->forceCharset) ? $this->force_charset : $this->forceCharset;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$force_charset has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
270 10
        $this->expandImports = empty($this->expandImports) ? $this->expand_imports : $this->expandImports;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$expand_imports has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
271 10
        $this->cssLinebreakPos = empty($this->cssLinebreakPos) ? $this->css_linebreak_pos : $this->cssLinebreakPos;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$css_linebreak_pos has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
272 10
        $this->fileMode = empty($this->fileMode) ? $this->file_mode : $this->fileMode;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$file_mode has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
273 10
        $this->compressOptions = empty($this->compressOptions) ? $this->compress_options : $this->compressOptions;
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$compress_options has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
274
275 10
        if( $this->backendCheck )
276 10
        {
277
            $appId = \Yii::$app->id ;
278
            if( $appId == "app-frontend" )
279
            {
280
                $this->minifyPath = $this->minifyPath."/".$this->folderName;
281
            }
282
            else if( $appId == "app-backend" )
283
            {
284
                $this->minifyPath = $this->minifyPath."/../".$this->folderName;
285
            }
286
        }
287
288 10
        $excludeBundles = $this->excludeBundles;
289 10
        if (!empty($excludeBundles)) {
290 1
            foreach ($excludeBundles as $bundle) {
291 1
                if (!class_exists($bundle)) {
292
                    continue;
293
                }
294
295
                /** @var AssetBundle $Bundle */
296 1
                $Bundle = new $bundle;
297
298 1
                if (!empty($Bundle->css)) {
299 1
                    $this->excludeFiles = array_merge($this->excludeFiles, $Bundle->css);
300 1
                }
301
302 1
                if (!empty($Bundle->js)) {
303 1
                    $this->excludeFiles = array_merge($this->excludeFiles, $Bundle->js);
304 1
                }
305 1
            }
306 1
        }
307
308 10
        $minify_path = $this->minifyPath = (string)\Yii::getAlias($this->minifyPath);
309 10
        if (!file_exists($minify_path)) {
310 10
            FileHelper::createDirectory($minify_path);
311 10
        }
312
313 10
        if (!is_readable($minify_path)) {
314
            throw new Exception('Directory for compressed assets is not readable.');
315
        }
316
317 10
        if (!is_writable($minify_path)) {
318
            throw new Exception('Directory for compressed assets is not writable.');
319
        }
320
321 10
        if (true === $this->enableMinify && (true === $this->minifyOutput || true === $this->compress_output)) {
0 ignored issues
show
Deprecated Code introduced by
The property processfast\yii\minify\View::$compress_output has been deprecated.

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
322
            \Yii::$app->response->on(Response::EVENT_BEFORE_SEND, function (Event $Event) {
323
                /** @var Response $Response */
324
                $Response = $Event->sender;
325
326
                if ($Response->format === Response::FORMAT_HTML) {
327
                    if (!empty($Response->data)) {
328
                        $Response->data = HtmlCompressor::compress($Response->data, $this->compressOptions);
329
                    }
330
331
                    if (!empty($Response->content)) {
332
                        $Response->content = HtmlCompressor::compress($Response->content, $this->compressOptions);
333
                    }
334
                }
335
            });
336
        }
337 10
    }
338
339
    /**
340
     * @inheritdoc
341
     */
342 8
    public function endBody()
343
    {
344 8
        $this->trigger(self::EVENT_END_BODY);
345 8
        echo self::PH_BODY_END;
346
347 8
        foreach (array_keys($this->assetBundles) as $bundle) {
348 8
            $this->registerAssetFiles($bundle);
349 8
        }
350
351 8
        if (true === $this->enableMinify) {
352 8
            (new components\CSS($this))->export();
353 8
            (new components\JS($this))->export();
354 8
        }
355 8
    }
356
}
357