SierraTecnologia /
fabrica
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace Fabrica\Http\Api; |
||
| 4 | |||
| 5 | use Illuminate\Http\Request; |
||
| 6 | use Illuminate\Support\Facades\Event; |
||
| 7 | |||
| 8 | use Fabrica\Http\Requests; |
||
| 9 | use Fabrica\Http\Api\Controller; |
||
| 10 | |||
| 11 | use Fabrica\Project\Eloquent\Board; |
||
| 12 | use Fabrica\Project\Eloquent\BoardRankMap; |
||
| 13 | use Fabrica\Project\Eloquent\AccessBoardLog; |
||
| 14 | use Fabrica\Project\Eloquent\Sprint; |
||
| 15 | use Fabrica\Project\Eloquent\Epic; |
||
| 16 | use Fabrica\Project\Eloquent\Version; |
||
| 17 | use Fabrica\Project\Provider; |
||
| 18 | |||
| 19 | class BoardController extends Controller |
||
| 20 | { |
||
| 21 | public function __construct() |
||
| 22 | { |
||
| 23 | $this->middleware('privilege:manage_project', [ 'only' => [ 'store', 'update', 'destroy' ] ]); |
||
| 24 | parent::__construct(); |
||
| 25 | } |
||
| 26 | |||
| 27 | /** |
||
| 28 | * get user accessed board list |
||
| 29 | * |
||
| 30 | * @param string $project_key |
||
| 31 | * @return response |
||
| 32 | */ |
||
| 33 | public function index($project_key) |
||
| 34 | { |
||
| 35 | // get all boards |
||
| 36 | $boards = Board::Where('project_key', $project_key) |
||
| 37 | ->orderBy('_id', 'asc') |
||
| 38 | ->get(); |
||
| 39 | |||
| 40 | $access_records = AccessBoardLog::where('project_key', $project_key) |
||
| 41 | ->where('user_id', $this->user->id) |
||
| 42 | ->orderBy('latest_access_time', 'desc') |
||
| 43 | ->get(); |
||
| 44 | |||
| 45 | $list = []; |
||
| 46 | $accessed_boards = []; |
||
| 47 | foreach($access_records as $record) |
||
| 48 | { |
||
| 49 | foreach($boards as $board) |
||
| 50 | { |
||
| 51 | if ($board->id == $record->board_id) { |
||
| 52 | $accessed_boards[] = $record->board_id; |
||
| 53 | break; |
||
| 54 | } |
||
| 55 | } |
||
| 56 | if (in_array($record->board_id, $accessed_boards)) { |
||
| 57 | $list[] = $board; |
||
|
0 ignored issues
–
show
|
|||
| 58 | } |
||
| 59 | } |
||
| 60 | |||
| 61 | foreach ($boards as $board) |
||
| 62 | { |
||
| 63 | if (!in_array($board->id, $accessed_boards)) { |
||
| 64 | $list[] = $board; |
||
| 65 | } |
||
| 66 | } |
||
| 67 | |||
| 68 | $sprints = Sprint::where('project_key', $project_key) |
||
| 69 | ->whereIn('status', [ 'active', 'waiting' ]) |
||
| 70 | ->orderBy('no', 'asc') |
||
| 71 | ->get(); |
||
| 72 | // compatible with old data |
||
| 73 | foreach ($sprints as $sprint) |
||
| 74 | { |
||
| 75 | if (!$sprint->name) { |
||
| 76 | $sprint->name = 'Sprint ' . $sprint->no; |
||
| 77 | } |
||
| 78 | } |
||
| 79 | |||
| 80 | $epics = Epic::where('project_key', $project_key) |
||
| 81 | ->orderBy('sn', 'asc') |
||
| 82 | ->get(['bgColor', 'name']); |
||
| 83 | |||
| 84 | $versions = Version::where('project_key', $project_key) |
||
| 85 | ->orderBy('created_at', 'desc') |
||
| 86 | ->get(['name']); |
||
| 87 | |||
| 88 | $completed_sprint_num = Sprint::where('project_key', $project_key) |
||
| 89 | ->where('status', 'completed') |
||
| 90 | ->max('no'); |
||
| 91 | |||
| 92 | return response()->json([ 'ecode' => 0, 'data' => $list, 'options' => [ 'epics' => $epics, 'sprints' => $sprints, 'versions' => $versions, 'completed_sprint_num' => $completed_sprint_num ] ]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Illuminate\Contracts\Routing\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 93 | |||
| 94 | /* |
||
| 95 | $example = [ |
||
| 96 | 'id' => '111', |
||
| 97 | 'name' => '1111111111', |
||
| 98 | 'type' => 'kanban', |
||
| 99 | 'query' => [ 'type' => [ '59af4ad51d41c85e9108a8a7' ], 'subtask' => true ], |
||
| 100 | 'last_access_time' => 11111111, |
||
| 101 | 'columns' => [ |
||
| 102 | [ 'no' => 1, 'name' => '待处理', 'states' => [ 'Open', 'Reopened' ] ], |
||
| 103 | [ 'no' => 2, 'name' => '处理中', 'states' => [ 'In Progess' ] ], |
||
| 104 | [ 'no' => 3, 'name' => '关闭', 'states' => [ 'Resolved', 'Closed' ] ] |
||
| 105 | ], |
||
| 106 | 'filters' => [ |
||
| 107 | [ 'no' => 1, 'id' => '11111', 'name' => '111111', 'query' => [ 'updated_at' => '1m' ] ], |
||
| 108 | [ 'no' => 2, 'id' => '22222', 'name' => '222222' ], |
||
| 109 | [ 'no' => 3, 'id' => '33333', 'name' => '333333' ], |
||
| 110 | ], |
||
| 111 | ]; |
||
| 112 | return response()->json([ 'ecode' => 0, 'data' => [ $example ] ]); |
||
| 113 | */ |
||
| 114 | } |
||
| 115 | |||
| 116 | /** |
||
| 117 | * Store a newly created resource in storage. |
||
| 118 | * |
||
| 119 | * @param \Illuminate\Http\Request $request |
||
| 120 | * @return \Illuminate\Http\Response |
||
| 121 | */ |
||
| 122 | public function store(Request $request, $project_key) |
||
| 123 | { |
||
| 124 | $name = $request->input('name'); |
||
| 125 | if (!$name) { |
||
| 126 | throw new \UnexpectedValueException('the name can not be empty.', -11600); |
||
| 127 | } |
||
| 128 | |||
| 129 | $type = $request->input('type'); |
||
| 130 | if (!$type || ($type != 'kanban' && $type != 'scrum')) { |
||
| 131 | throw new \UnexpectedValueException('the type value has error.', -11608); |
||
| 132 | } |
||
| 133 | |||
| 134 | $columns = [ |
||
| 135 | [ 'no' => 1, 'name' => '开始', 'states' => [] ], |
||
| 136 | [ 'no' => 2, 'name' => '处理中', 'states' => [] ], |
||
| 137 | [ 'no' => 3, 'name' => '完成', 'states' => [] ], |
||
| 138 | ]; |
||
| 139 | $states = Provider::getStateOptions($project_key); |
||
| 140 | foreach ($states as $state) |
||
| 141 | { |
||
| 142 | $state_val = $state['_id']; |
||
| 143 | if ($state['category'] === 'new') { |
||
| 144 | array_push($columns[0]['states'], $state_val); |
||
| 145 | } |
||
| 146 | else if ($state['category'] === 'inprogress') { |
||
| 147 | array_push($columns[1]['states'], $state_val); |
||
| 148 | } |
||
| 149 | else if ($state['category'] === 'completed') { |
||
| 150 | array_push($columns[2]['states'], $state_val); |
||
| 151 | } |
||
| 152 | } |
||
| 153 | |||
| 154 | // only support for kanban type, fix me |
||
| 155 | $board = Board::create( |
||
| 156 | [ |
||
| 157 | 'project_key' => $project_key, |
||
| 158 | 'query' => [ 'subtask' => true ], |
||
| 159 | 'columns' => $columns ] + $request->all() |
||
| 160 | ); |
||
| 161 | |||
| 162 | return response()->json(['ecode' => 0, 'data' => $board]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Illuminate\Contracts\Routing\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 163 | } |
||
| 164 | |||
| 165 | /** |
||
| 166 | * Update the specified resource in storage. |
||
| 167 | * |
||
| 168 | * @param \Illuminate\Http\Request $request |
||
| 169 | * @param int $id |
||
| 170 | * @return \Illuminate\Http\Response |
||
| 171 | */ |
||
| 172 | public function update(Request $request, $project_key, $id) |
||
| 173 | { |
||
| 174 | $board = Board::find($id); |
||
| 175 | if (!$board || $project_key != $board->project_key) { |
||
| 176 | throw new \UnexpectedValueException('the board does not exist or is not in the project.', -11601); |
||
| 177 | } |
||
| 178 | |||
| 179 | $updValues = []; |
||
| 180 | $name = $request->input('name'); |
||
| 181 | View Code Duplication | if (isset($name)) { |
|
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
|
|||
| 182 | if (!$name) { |
||
| 183 | throw new \UnexpectedValueException('the name can not be empty.', -11600); |
||
| 184 | } |
||
| 185 | $updValues['name'] = $name; |
||
| 186 | } |
||
| 187 | |||
| 188 | $description = $request->input('description'); |
||
| 189 | if (isset($description)) { |
||
| 190 | $updValues['description'] = $description; |
||
| 191 | } |
||
| 192 | |||
| 193 | $query = $request->input('query'); |
||
| 194 | if (isset($query)) { |
||
| 195 | // defaultly display subtask issue |
||
| 196 | $updValues['query'] = [ 'subtask' => true ] + $query; |
||
| 197 | } |
||
| 198 | |||
| 199 | $filters = $request->input('filters'); |
||
| 200 | if (isset($filters)) { |
||
| 201 | $updValues['filters'] = $filters; |
||
| 202 | } |
||
| 203 | |||
| 204 | $columns = $request->input('columns'); |
||
| 205 | if (isset($columns)) { |
||
| 206 | $updValues['columns'] = $columns; |
||
| 207 | } |
||
| 208 | |||
| 209 | $display_fields = $request->input('display_fields'); |
||
| 210 | if (isset($display_fields)) { |
||
| 211 | $updValues['display_fields'] = $display_fields ?: []; |
||
| 212 | } |
||
| 213 | |||
| 214 | //$subtask = $request->input('subtask'); |
||
| 215 | //if (isset($subtask)) |
||
| 216 | //{ |
||
| 217 | // $updValues['subtask'] = $subtask; |
||
| 218 | //} |
||
| 219 | |||
| 220 | $board->fill($updValues)->save(); |
||
| 221 | return response()->json(['ecode' => 0, 'data' => Board::find($id)]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Illuminate\Contracts\Routing\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 222 | } |
||
| 223 | |||
| 224 | /** |
||
| 225 | * Display the specified resource. |
||
| 226 | * |
||
| 227 | * @param int $id |
||
| 228 | * @return \Illuminate\Http\Response |
||
| 229 | */ |
||
| 230 | public function show($project_key, $id) |
||
| 231 | { |
||
| 232 | $board = Board::find($id); |
||
|
0 ignored issues
–
show
$board is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the Loading history...
|
|||
| 233 | //if (!$board || $project_key != $board->project_key) |
||
| 234 | //{ |
||
| 235 | // throw new \UnexpectedValueException('the board does not exist or is not in the project.', -10002); |
||
| 236 | //} |
||
| 237 | return response()->json(['ecode' => 0, 'data' => $state]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Illuminate\Contracts\Routing\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 238 | } |
||
| 239 | |||
| 240 | /** |
||
| 241 | * rank the column issues |
||
| 242 | * |
||
| 243 | * @param string $project_key |
||
| 244 | * @param string $id |
||
| 245 | * @return void |
||
| 246 | */ |
||
| 247 | public function setRank(Request $request, $project_key, $id) |
||
| 248 | { |
||
| 249 | $current = $request->input('current') ?: ''; |
||
| 250 | if (!$current) { |
||
| 251 | throw new \UnexpectedValueException('the ranked issue not be empty.', -11603); |
||
| 252 | } |
||
| 253 | |||
| 254 | $up = $request->input('up') ?: -1; |
||
| 255 | $down = $request->input('down') ?: -1; |
||
| 256 | if ($up == -1 && $down == -1) { |
||
| 257 | throw new \UnexpectedValueException('the ranked position can not be empty.', -11604); |
||
| 258 | } |
||
| 259 | |||
| 260 | $rankmap = BoardRankMap::where([ 'board_id' => $id ])->first(); |
||
| 261 | if (!$rankmap || !isset($rankmap->rank)) { |
||
| 262 | throw new \UnexpectedValueException('the rank list is not exist.', -11605); |
||
| 263 | } |
||
| 264 | |||
| 265 | $rank = $rankmap->rank; |
||
| 266 | $curInd = array_search($current, $rank); |
||
| 267 | if ($curInd === false) { |
||
| 268 | throw new \UnexpectedValueException('the issue is not found in the rank list.', -11606); |
||
| 269 | } |
||
| 270 | |||
| 271 | $blocks = [ $current ]; |
||
| 272 | $subtasks = Provider::getChildrenByParentNo($project_key, $current); |
||
| 273 | if ($subtasks) { |
||
|
0 ignored issues
–
show
The expression
$subtasks of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using Loading history...
|
|||
| 274 | $rankedSubtasks = array_intersect($rank, $subtasks); |
||
| 275 | $blocks = array_merge($blocks, $rankedSubtasks); |
||
| 276 | } |
||
| 277 | |||
| 278 | // delete current issue from the rank |
||
| 279 | array_splice($rank, $curInd, count($blocks)); |
||
| 280 | |||
| 281 | if ($up != -1) { |
||
| 282 | $upInd = array_search($up, $rank); |
||
| 283 | |||
| 284 | $subtasks = Provider::getChildrenByParentNo($project_key, $up); |
||
| 285 | $intersects = array_intersect($rank, $subtasks); |
||
| 286 | |||
| 287 | if ($upInd === false && !$intersects) { |
||
|
0 ignored issues
–
show
The expression
$intersects of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using Loading history...
|
|||
| 288 | throw new \UnexpectedValueException('the ranked position is not found.', -11607); |
||
| 289 | } |
||
| 290 | else |
||
| 291 | { |
||
| 292 | $realUpInd = -1; |
||
|
0 ignored issues
–
show
$realUpInd is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the Loading history...
|
|||
| 293 | if ($intersects) { |
||
|
0 ignored issues
–
show
The expression
$intersects of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using Loading history...
|
|||
| 294 | $realUpInd = array_search(array_pop($intersects), $rank); |
||
| 295 | } |
||
| 296 | else |
||
| 297 | { |
||
| 298 | $realUpInd = $upInd; |
||
| 299 | } |
||
| 300 | // insert current issue into the rank |
||
| 301 | array_splice($rank, $realUpInd + 1, 0, $blocks); |
||
| 302 | } |
||
| 303 | } |
||
| 304 | else |
||
| 305 | { |
||
| 306 | $downInd = array_search($down, $rank); |
||
| 307 | if ($downInd !== false) { |
||
| 308 | // insert current issue into the rank |
||
| 309 | array_splice($rank, $downInd, 0, $blocks); |
||
| 310 | } |
||
| 311 | else |
||
| 312 | { |
||
| 313 | $subtasks = Provider::getChildrenByParentNo($project_key, $down); |
||
| 314 | $intersects = array_intersect($rank, $subtasks); |
||
| 315 | |||
| 316 | if (!$intersects) { |
||
|
0 ignored issues
–
show
The expression
$intersects of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using Loading history...
|
|||
| 317 | throw new \UnexpectedValueException('the ranked position is not found.', -11607); |
||
| 318 | } |
||
| 319 | $realDownInd = array_search(array_shift($intersects), $rank); |
||
| 320 | // insert current issue into the rank |
||
| 321 | array_splice($rank, $realDownInd, 0, $blocks); |
||
| 322 | } |
||
| 323 | } |
||
| 324 | |||
| 325 | $old_rank = BoardRankMap::where([ 'board_id' => $id ])->first(); |
||
| 326 | $old_rank && $old_rank->delete(); |
||
| 327 | |||
| 328 | BoardRankMap::create([ 'board_id' => $id, 'rank' => $rank ]); |
||
| 329 | |||
| 330 | $rankmap = BoardRankMap::where([ 'board_id' => $id ])->first(); |
||
| 331 | return response()->json([ 'ecode' => 0, 'data' => $rankmap ]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Illuminate\Contracts\Routing\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 332 | } |
||
| 333 | |||
| 334 | /** |
||
| 335 | * record user access board |
||
| 336 | * |
||
| 337 | * @param string $project_key |
||
| 338 | * @param string $id |
||
| 339 | * @return void |
||
| 340 | */ |
||
| 341 | public function recordAccess($project_key, $id) |
||
| 342 | { |
||
| 343 | $record = AccessBoardLog::where([ 'board_id' => $id, 'user_id' => $this->user->id ])->first(); |
||
| 344 | $record && $record->delete(); |
||
| 345 | |||
| 346 | AccessBoardLog::create( |
||
| 347 | [ |
||
| 348 | 'project_key' => $project_key, |
||
| 349 | 'user_id' => $this->user->id, |
||
| 350 | 'board_id' => $id, |
||
| 351 | 'latest_access_time' => time() ] |
||
| 352 | ); |
||
| 353 | return response()->json(['ecode' => 0, 'data' => [ 'id' => $id ] ]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Illuminate\Contracts\Routing\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 354 | } |
||
| 355 | |||
| 356 | /** |
||
| 357 | * Remove the specified resource from storage. |
||
| 358 | * |
||
| 359 | * @param int $id |
||
| 360 | * @return \Illuminate\Http\Response |
||
| 361 | */ |
||
| 362 | public function destroy($project_key, $id) |
||
| 363 | { |
||
| 364 | $board = Board::find($id); |
||
| 365 | if (!$board || $project_key != $board->project_key) { |
||
| 366 | throw new \UnexpectedValueException('the board does not exist or is not in the project.', -11601); |
||
| 367 | } |
||
| 368 | |||
| 369 | // delete access log |
||
| 370 | AccessBoardLog::where('board_id', $id)->delete(); |
||
| 371 | |||
| 372 | // delete board rank |
||
| 373 | BoardRankMap::where('board_id', $id)->delete(); |
||
| 374 | |||
| 375 | Board::destroy($id); |
||
| 376 | return response()->json(['ecode' => 0, 'data' => ['id' => $id]]); |
||
|
0 ignored issues
–
show
The method
json does only exist in Illuminate\Contracts\Routing\ResponseFactory, but not in Illuminate\Http\Response.
It seems like the method you are trying to call exists only in some of the possible types. Let’s take a look at an example: class A
{
public function foo() { }
}
class B extends A
{
public function bar() { }
}
/**
* @param A|B $x
*/
function someFunction($x)
{
$x->foo(); // This call is fine as the method exists in A and B.
$x->bar(); // This method only exists in B and might cause an error.
}
Available Fixes
Loading history...
|
|||
| 377 | |||
| 378 | } |
||
| 379 | } |
||
| 380 |
It seems like you are relying on a variable being defined by an iteration: