This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
1 | <?php |
||||
2 | |||||
3 | /* |
||||
4 | * This file is part of the TheAlternativeZurich/events project. |
||||
5 | * |
||||
6 | * (c) Florian Moser <[email protected]> |
||||
7 | * |
||||
8 | * For the full copyright and license information, please view the LICENSE |
||||
9 | * file that was distributed with this source code. |
||||
10 | */ |
||||
11 | |||||
12 | namespace App\Controller; |
||||
13 | |||||
14 | use App\Controller\Base\BaseDoctrineController; |
||||
15 | use App\Entity\Attendance; |
||||
16 | use App\Entity\Event; |
||||
17 | use App\Entity\Registration; |
||||
18 | use App\Form\Event\EditType; |
||||
19 | use App\Security\Voter\EventVoter; |
||||
20 | use App\Service\Interfaces\CsvServiceInterface; |
||||
21 | use App\Service\Interfaces\EmailServiceInterface; |
||||
22 | use Symfony\Component\Form\Extension\Core\Type\SubmitType; |
||||
23 | use Symfony\Component\HttpFoundation\Request; |
||||
24 | use Symfony\Component\HttpFoundation\Response; |
||||
25 | use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; |
||||
26 | use Symfony\Component\Routing\Annotation\Route; |
||||
27 | use Symfony\Contracts\Translation\TranslatorInterface; |
||||
28 | |||||
29 | /** |
||||
30 | * @Route("/event") |
||||
31 | */ |
||||
32 | class EventController extends BaseDoctrineController |
||||
33 | { |
||||
34 | /** |
||||
35 | * @Route("/create", name="event_create") |
||||
36 | * |
||||
37 | * @return Response |
||||
38 | */ |
||||
39 | public function createAction(Request $request, TranslatorInterface $translator, EmailServiceInterface $emailService) |
||||
40 | { |
||||
41 | if (!$this->getUser()->getIsEmailConfirmed()) { |
||||
42 | $message = $translator->trans('create.error.email_not_yet_confirmed', [], 'event'); |
||||
43 | $this->displayDanger($message); |
||||
44 | |||||
45 | $emailService->sendAuthenticateLink(/* @scrutinizer ignore-type */ $this->getUser()); |
||||
46 | |||||
47 | return $this->redirectToRoute('index'); |
||||
48 | } |
||||
49 | |||||
50 | $this->denyAccessUnlessGranted(EventVoter::EVENT_CREATE, new Event()); |
||||
51 | |||||
52 | $event = new Event(); |
||||
53 | $form = $this->createForm(EditType::class, $event) |
||||
54 | ->add('submit', SubmitType::class, ['translation_domain' => 'event', 'label' => 'create.submit']); |
||||
55 | $form->handleRequest($request); |
||||
56 | if ($form->isSubmitted() && $form->isValid()) { |
||||
57 | $eventRepository = $this->getDoctrine()->getRepository(Event::class); |
||||
0 ignored issues
–
show
|
|||||
58 | $eventRepository->save($event); |
||||
59 | |||||
60 | $registration = Registration::createFromUser($event, /* @scrutinizer ignore-type */ $this->getUser(), true); |
||||
61 | $registrationRepository = $this->getDoctrine()->getRepository(Registration::class); |
||||
0 ignored issues
–
show
The function
Symfony\Bundle\Framework...ntroller::getDoctrine() has been deprecated: since Symfony 5.4, inject an instance of ManagerRegistry in your controller instead
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This function has been deprecated. The supplier of the function has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead. ![]() |
|||||
62 | $registrationRepository->save($registration); |
||||
63 | |||||
64 | $message = $translator->trans('create.success.created', [], 'event'); |
||||
65 | $this->displaySuccess($message); |
||||
66 | |||||
67 | return $this->redirectToRoute('event_view', ['event' => $event->getId()]); |
||||
68 | } |
||||
69 | |||||
70 | return $this->render('event/create.html.twig', ['form' => $form->createView()]); |
||||
71 | } |
||||
72 | |||||
73 | /** |
||||
74 | * @Route("/{event}", name="event_view") |
||||
75 | * |
||||
76 | * @return Response |
||||
77 | */ |
||||
78 | public function viewAction(Event $event) |
||||
79 | { |
||||
80 | $this->denyAccessUnlessGranted(EventVoter::EVENT_VIEW, $event); |
||||
81 | |||||
82 | $ownRegistration = $this->getUser()->getRegistrationFor($event); |
||||
83 | $participantRegistrations = $event->getParticipantRegistrations(); |
||||
84 | $organizerRegistrations = $event->getOrganizerRegistrations(); |
||||
85 | |||||
86 | return $this->render('event/view.html.twig', ['event' => $event, 'participant_registrations' => $participantRegistrations, 'organizer_registrations' => $organizerRegistrations, 'own_registration' => $ownRegistration]); |
||||
87 | } |
||||
88 | |||||
89 | /** |
||||
90 | * @Route("/{event}/attendance", name="event_attendance") |
||||
91 | * |
||||
92 | * @return Response |
||||
93 | */ |
||||
94 | public function attendanceAction(Event $event) |
||||
95 | { |
||||
96 | $this->denyAccessUnlessGranted(EventVoter::EVENT_VIEW, $event); |
||||
97 | |||||
98 | $registrations = $this->getDoctrine()->getRepository(Registration::class)->findAllWithAttendance($event); |
||||
0 ignored issues
–
show
The function
Symfony\Bundle\Framework...ntroller::getDoctrine() has been deprecated: since Symfony 5.4, inject an instance of ManagerRegistry in your controller instead
(
Ignorable by Annotation
)
If this is a false-positive, you can also ignore this issue in your code via the
This function has been deprecated. The supplier of the function has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead. ![]() |
|||||
99 | |||||
100 | return $this->render('event/attendance.html.twig', ['event' => $event, 'registrations' => $registrations]); |
||||
101 | } |
||||
102 | |||||
103 | /** |
||||
104 | * @Route("/{event}/{registration}/join", name="event_join") |
||||
105 | * |
||||
106 | * @return Response |
||||
107 | */ |
||||
108 | public function joinAction(Event $event, Registration $registration, TranslatorInterface $translator) |
||||
109 | { |
||||
110 | $this->denyAccessUnlessGranted(EventVoter::EVENT_VIEW, $event); |
||||
111 | if ($registration->getEvent() !== $event) { |
||||
112 | throw new NotFoundHttpException(); |
||||
113 | } |
||||
114 | |||||
115 | if (null !== $registration->getActiveAttendance()) { |
||||
116 | $message = $translator->trans('join.error.already_attending', [], 'event'); |
||||
117 | $this->displayError($message); |
||||
118 | } else { |
||||
119 | $attendance = Attendance::create($event, $registration); |
||||
120 | $this->fastSave($attendance); |
||||
121 | } |
||||
122 | |||||
123 | return $this->redirectToRoute('event_attendance', ['event' => $event->getId()]); |
||||
124 | } |
||||
125 | |||||
126 | /** |
||||
127 | * @Route("/{event}/{attendance}/leave", name="event_leave") |
||||
128 | * |
||||
129 | * @return Response |
||||
130 | */ |
||||
131 | public function leaveAction(Event $event, Attendance $attendance, TranslatorInterface $translator) |
||||
132 | { |
||||
133 | $this->denyAccessUnlessGranted(EventVoter::EVENT_VIEW, $event); |
||||
134 | if ($attendance->getEvent() !== $event) { |
||||
135 | throw new NotFoundHttpException(); |
||||
136 | } |
||||
137 | |||||
138 | if ($attendance->getLeaveDate()) { |
||||
139 | $message = $translator->trans('leave.error.already_left', [], 'event'); |
||||
140 | $this->displayError($message); |
||||
141 | } else { |
||||
142 | $attendance->setLeaveDate(new \DateTime()); |
||||
143 | $this->fastSave($attendance); |
||||
144 | } |
||||
145 | |||||
146 | return $this->redirectToRoute('event_attendance', ['event' => $event->getId()]); |
||||
147 | } |
||||
148 | |||||
149 | /** |
||||
150 | * @Route("/{event}/attendance/export", name="event_attendance_export") |
||||
151 | * |
||||
152 | * @return Response |
||||
153 | */ |
||||
154 | public function attendanceExportAction(Event $event, TranslatorInterface $translator, CsvServiceInterface $csvService) |
||||
155 | { |
||||
156 | $this->denyAccessUnlessGranted(EventVoter::EVENT_VIEW, $event); |
||||
157 | |||||
158 | if (0 === $event->getAttendances()->count()) { |
||||
159 | $message = $translator->trans('attendance.error.no_attendance_yet', [], 'event'); |
||||
160 | $this->displayError($message); |
||||
161 | |||||
162 | return $this->redirectToRoute('event_view', ['event' => $event->getId()]); |
||||
163 | } |
||||
164 | |||||
165 | $now = new \DateTime(); |
||||
166 | $eventPrefix = $event->getOrganizer().' - '.$event->getName(); |
||||
167 | $filename = $eventPrefix.'- '.$now->format('c').'.csv'; |
||||
168 | |||||
169 | $header = array_keys($event->getAttendances()[0]->toArray()); |
||||
170 | $values = []; |
||||
171 | foreach ($event->getAttendances() as $attendance) { |
||||
172 | $values[] = array_values($attendance->toArray()); |
||||
173 | } |
||||
174 | |||||
175 | return $csvService->streamCsv($filename, $values, $header); |
||||
176 | } |
||||
177 | |||||
178 | /** |
||||
179 | * @Route("/{event}/deregister/{registration}", name="event_deregister") |
||||
180 | * |
||||
181 | * @return Response |
||||
182 | */ |
||||
183 | public function deregisterAction(Request $request, Event $event, Registration $registration, TranslatorInterface $translator) |
||||
184 | { |
||||
185 | $this->denyAccessUnlessGranted(EventVoter::EVENT_VIEW, $event); |
||||
186 | |||||
187 | if ($registration->getEvent() !== $event) { |
||||
188 | throw new NotFoundHttpException(); |
||||
189 | } |
||||
190 | |||||
191 | // owners have to deregister themselves |
||||
192 | if ($registration->getIsOrganizer()) { |
||||
193 | throw new NotFoundHttpException(); |
||||
194 | } |
||||
195 | |||||
196 | if ($request->query->has('confirm')) { |
||||
197 | $this->fastRemove($registration); |
||||
198 | |||||
199 | $message = $translator->trans('deregister.success.deregistered', [], 'event'); |
||||
200 | $this->displaySuccess($message); |
||||
201 | |||||
202 | return $this->redirectToRoute('event_view', ['id' => $event->getId()]); |
||||
203 | } |
||||
204 | |||||
205 | return $this->render('event/deregister.html.twig', ['registration' => $registration]); |
||||
206 | } |
||||
207 | |||||
208 | /** |
||||
209 | * @Route("/{event}/update", name="event_update") |
||||
210 | * |
||||
211 | * @return Response |
||||
212 | */ |
||||
213 | public function updateAction(Request $request, Event $event, TranslatorInterface $translator) |
||||
214 | { |
||||
215 | $this->denyAccessUnlessGranted(EventVoter::EVENT_UPDATE, $event); |
||||
216 | |||||
217 | $form = $this->createForm(EditType::class, $event) |
||||
218 | ->add('submit', SubmitType::class, ['translation_domain' => 'event', 'label' => 'update.submit']); |
||||
219 | $form->handleRequest($request); |
||||
220 | if ($form->isSubmitted() && $form->isValid()) { |
||||
221 | $this->fastSave($event); |
||||
222 | |||||
223 | $message = $translator->trans('update.success.updated', [], 'event'); |
||||
224 | $this->displaySuccess($message); |
||||
225 | |||||
226 | return $this->redirectToRoute('event_view', ['event' => $event->getId()]); |
||||
227 | } |
||||
228 | |||||
229 | return $this->render('event/update.html.twig', ['form' => $form->createView()]); |
||||
230 | } |
||||
231 | } |
||||
232 |
This function has been deprecated. The supplier of the function has supplied an explanatory message.
The explanatory message should give you some clue as to whether and when the function will be removed and what other function to use instead.