Issues (1704)

Branch: master

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Controller/BusinessTemplateController.php (10 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Victoire\Bundle\BusinessPageBundle\Controller;
4
5
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Method;
6
use Sensio\Bundle\FrameworkExtraBundle\Configuration\ParamConverter;
7
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Route;
8
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Template;
9
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
10
use Symfony\Component\HttpFoundation\JsonResponse;
11
use Symfony\Component\HttpFoundation\Request;
12
use Symfony\Component\HttpFoundation\Response;
13
use Victoire\Bundle\BusinessPageBundle\Entity\BusinessTemplate;
14
use Victoire\Bundle\BusinessPageBundle\Form\BusinessTemplateType;
15
use Victoire\Bundle\CoreBundle\Controller\VictoireAlertifyControllerTrait;
16
use Victoire\Bundle\CoreBundle\Entity\View;
17
use Victoire\Bundle\ViewReferenceBundle\ViewReference\ViewReference;
18
19
/**
20
 * BusinessTemplate controller.
21
 *
22
 * @Route("/victoire-dcms/business-template")
23
 */
24
class BusinessTemplateController extends Controller
25
{
26
    use VictoireAlertifyControllerTrait;
27
28
    /**
29
     * List all business entity page pattern.
30
     *
31
     * @Route("/", name="victoire_business_template_index")
32
     *
33
     * @return JsonResponse
34
     */
35
    public function indexAction()
36
    {
37
        $repository = $this->get('doctrine.orm.entity_manager')->getRepository('VictoireBusinessPageBundle:BusinessTemplate');
38
39
        $BusinessTemplates = [];
0 ignored issues
show
Variable "BusinessTemplates" is not in valid camel caps format
Loading history...
40
41
        $businessEntities = $this->get('victoire_core.entity.business_entity_repository')->findAll();
42
43
        foreach ($businessEntities as $businessEntity) {
44
            $name = $businessEntity->getName();
45
46
            //retrieve the pagePatterns
47
            $pagePatterns = $repository->findPagePatternByBusinessEntity($businessEntity);
48
49
            $BusinessTemplates[$name] = $pagePatterns;
0 ignored issues
show
Variable "BusinessTemplates" is not in valid camel caps format
Loading history...
50
        }
51
52
        return new JsonResponse([
53
                'html' => $this->container->get('templating')->render(
54
                    'VictoireBusinessPageBundle:BusinessEntity:index.html.twig',
55
                    [
56
                        'businessEntities'  => $businessEntities,
57
                        'BusinessTemplates' => $BusinessTemplates,
0 ignored issues
show
Variable "BusinessTemplates" is not in valid camel caps format
Loading history...
58
                    ]
59
                ),
60
                'success' => true,
61
            ]);
0 ignored issues
show
This line of the multi-line function call does not seem to be indented correctly. Expected 8 spaces, but found 12.
Loading history...
62
    }
63
64
    /**
65
     * Show BusinessTemplate.
66
     *
67
     * @param BusinessTemplate $view
68
     *
69
     * @Route("/show/{id}", name="victoire_business_template_show")
70
     * @ParamConverter("template", class="VictoireBusinessPageBundle:BusinessTemplate")
71
     *
72
     * @return Response
73
     */
74
    public function showAction(BusinessTemplate $view)
75
    {
76
        //add the view to twig
77
        $this->get('twig')->addGlobal('view', $view);
78
        $view->setReference(new ViewReference($view->getId()));
79
80
        return $this->container->get('victoire_page.page_helper')->renderPage($view);
81
    }
82
83
    /**
84
     * Creates a new BusinessTemplate entity.
85
     *
86
     * @param Request $request
87
     * @param int     $id
88
     *
89
     * @Route("{id}/create", name="victoire_business_template_create")
90
     * @Method("POST")
91
     * @Template("VictoireBusinessPageBundle:BusinessTemplate:new.html.twig")
92
     *
93
     * @return JsonResponse
94
     */
95
    public function createAction(Request $request, $id)
96
    {
97
        //get the business entity
98
        $businessEntity = $this->getBusinessEntity($id);
99
100
        /** @var BusinessTemplate $view */
101
        $view = $this->get('victoire_business_page.BusinessTemplate_chain')->getBusinessTemplate($id);
102
        $view->setBusinessEntity($businessEntity);
103
104
        $form = $this->createCreateForm($view);
105
106
        $form->handleRequest($request);
107
108
        $params = [
109
            'success' => false,
110
        ];
111
112
        if ($form->isValid()) {
113
            $em = $this->getDoctrine()->getManager();
114
            $em->persist($view);
115
            $em->flush();
116
117
            //redirect to the page of the pagePattern
118
            $params['url'] = $this->generateUrl('victoire_business_template_show', ['id' => $view->getId()]);
119
            $params['success'] = true;
120
121
            $this->congrat($this->get('translator')->trans('victoire.business_template.create.success', [], 'victoire'));
122
        } else {
123
            //get the errors as a string
124
            $params['message'] = $this->container->get('victoire_form.error_helper')->getRecursiveReadableErrors($form);
125
        }
126
127
        return new JsonResponse($params);
128
    }
129
130
    /**
131
     * Creates a form to create a BusinessTemplate entity.
132
     *
133
     * @param BusinessTemplate $view The entity
134
     *
135
     * @return \Symfony\Component\Form\Form The form
136
     * @return Form
137
     */
138
    private function createCreateForm(BusinessTemplate $view)
139
    {
140
        $id = $view->getBusinessEntityName();
141
142
        $businessProperties = $this->getBusinessProperties($view);
143
        $form = $this->createForm(
144
            BusinessTemplateType::class,
145
            $view,
146
            [
147
                'action'                  => $this->generateUrl('victoire_business_template_create', ['id' => $id]),
148
                'method'                  => 'POST',
149
                'vic_business_properties' => $businessProperties,
150
            ]
151
        );
152
153
        return $form;
154
    }
155
156
    /**
157
     * Displays a form to create a new BusinessTemplate entity.
158
     *
159
     * @param string $id The id of the businessEntity
160
     *
161
     * @Route("/{id}/new", name="victoire_business_template_new")
162
     * @Method("GET")
163
     * @Template()
164
     *
165
     * @return JsonResponse The entity and the form
166
     */
167
    public function newAction($id)
0 ignored issues
show
Declare public methods first,then protected ones and finally private ones
Loading history...
168
    {
169
        //get the business entity
170
        $businessEntity = $this->getBusinessEntity($id);
171
172
        /** @var BusinessTemplate $view */
173
        $view = $this->get('victoire_business_page.BusinessTemplate_chain')->getBusinessTemplate($id);
174
        $view->setBusinessEntity($businessEntity);
175
176
        $form = $this->createCreateForm($view);
177
178
        $parameters = [
179
            'entity' => $view,
180
            'form'   => $form->createView(),
181
        ];
182
183
        return new JsonResponse([
184
            'html' => $this->container->get('templating')->render(
185
                'VictoireBusinessPageBundle:BusinessTemplate:new.html.twig',
186
                $parameters
187
            ),
188
            'success' => true,
189
        ]);
190
    }
191
192
    /**
0 ignored issues
show
Doc comment for parameter "$view" missing
Loading history...
193
     * Displays a form to edit an existing BusinessTemplate entity.
194
     *
195
     * @Route("/{id}/edit", name="victoire_business_template_edit")
196
     * @Method("GET")
197
     * @Template()
198
     * @ParamConverter("id", class="VictoireCoreBundle:View")
199
     *
200
     * @throws \Exception
201
     *
202
     * @return JsonResponse The entity and the form
203
     */
204
    public function editAction(View $view)
205
    {
206
        $editForm = $this->createEditForm($view);
0 ignored issues
show
$view of type object<Victoire\Bundle\CoreBundle\Entity\View> is not a sub-type of object<Victoire\Bundle\B...ntity\BusinessTemplate>. It seems like you assume a child class of the class Victoire\Bundle\CoreBundle\Entity\View to be always present.

This check looks for parameters that are defined as one type in their type hint or doc comment but seem to be used as a narrower type, i.e an implementation of an interface or a subclass.

Consider changing the type of the parameter or doing an instanceof check before assuming your parameter is of the expected type.

Loading history...
207
        $deleteForm = $this->createDeleteForm($view->getId());
208
209
        $parameters = [
210
            'entity'      => $view,
211
            'form'        => $editForm->createView(),
212
            'delete_form' => $deleteForm->createView(),
213
        ];
214
215
        return new JsonResponse([
216
            'html' => $this->container->get('templating')->render(
217
                'VictoireBusinessPageBundle:BusinessTemplate:edit.html.twig',
218
                $parameters
219
            ),
220
            'success' => true,
221
        ]);
222
    }
223
224
    /**
225
     * Creates a form to edit a BusinessTemplate entity.
226
     *
227
     * @param BusinessTemplate $view The entity
228
     *
229
     * @return \Symfony\Component\Form\Form The form
230
     */
231
    private function createEditForm(BusinessTemplate $view)
232
    {
233
        $businessProperties = $this->getBusinessProperties($view);
234
235
        $form = $this->createForm(BusinessTemplateType::class, $view, [
236
            'action'                  => $this->generateUrl('victoire_business_template_update', ['id' => $view->getId()]),
237
            'method'                  => 'PUT',
238
            'vic_business_properties' => $businessProperties,
239
        ]);
240
241
        return $form;
242
    }
243
244
    /**
245
     * Edits an existing BusinessTemplate entity.
246
     *
247
     * @param Request $request
248
     * @param string  $id
249
     *
250
     * @Route("/{id}", name="victoire_business_template_update")
251
     * @Method("PUT")
252
     * @Template("VictoireBusinessPageBundle:BusinessTemplate:edit.html.twig")
253
     *
254
     * @throws \Exception
255
     *
256
     * @return JsonResponse The parameter for the response
257
     */
258
    public function updateAction(Request $request, $id)
0 ignored issues
show
Declare public methods first,then protected ones and finally private ones
Loading history...
259
    {
260
        $em = $this->getDoctrine()->getManager();
261
262
        /** @var BusinessTemplate $pagePattern */
263
        $pagePattern = $em->getRepository('VictoireBusinessPageBundle:BusinessTemplate')->find($id);
264
265
        if (!$pagePattern) {
266
            throw $this->createNotFoundException('Unable to find BusinessTemplate entity.');
267
        }
268
269
        $editForm = $this->createEditForm($pagePattern);
270
        $editForm->handleRequest($request);
271
272
        if ($editForm->isValid()) {
273
            $em->flush();
274
275
            //redirect to the page of the template
276
            $completeUrl = $this->generateUrl('victoire_business_template_show', ['id' => $pagePattern->getId()]);
277
            $message = $this->get('translator')->trans('victoire.business_template.edit.success', [], 'victoire');
278
279
            $success = true;
280
        } else {
281
            $success = false;
282
            $completeUrl = null;
283
            $message = $this->get('translator')->trans('victoire.business_template.edit.error', [], 'victoire');
284
        }
285
286
        return new JsonResponse([
287
            'success' => $success,
288
            'url'     => $completeUrl,
289
            'message' => $message,
290
        ]);
291
    }
292
293
    /**
294
     * Deletes a BusinessTemplate entity.
295
     *
296
     * @param Request $request
297
     * @param string  $id
298
     *
299
     * @Route("/{id}", name="victoire_business_template_delete")
300
     * @Method("DELETE")
301
     *
302
     * @throws \Exception
303
     *
304
     * @return \Symfony\Component\HttpFoundation\RedirectResponse
305
     */
306
    public function deleteAction(Request $request, $id)
307
    {
308
        $form = $this->createDeleteForm($id);
309
        $form->handleRequest($request);
310
311
        if ($form->isValid()) {
312
            $em = $this->getDoctrine()->getManager();
313
            $view = $em->getRepository('VictoireBusinessPageBundle:BusinessTemplate')->find($id);
314
315
            if (!$view) {
316
                throw $this->createNotFoundException('Unable to find BusinessTemplate entity.');
317
            }
318
319
            $em->remove($view);
320
            $em->flush();
321
        }
322
323
        return $this->redirect($this->generateUrl('victoire_business_template_index'));
324
    }
325
326
    /**
327
     * Creates a form to delete a BusinessTemplate entity by id.
328
     *
329
     * @param string $id The entity id
330
     *
331
     * @return \Symfony\Component\Form\Form The form
332
     */
333
    private function createDeleteForm($id)
334
    {
335
        return $this->createFormBuilder()
336
            ->setAction($this->generateUrl('victoire_business_template_delete', ['id' => $id]))
337
            ->setMethod('DELETE')
338
            ->add('submit', 'submit', ['label' => 'Delete'])
339
            ->getForm();
340
    }
341
342
    /**
343
     * List the entities that matches the query of the BusinessTemplate.
344
     *
345
     * @param BusinessTemplate $view
346
     *
347
     * @Route("/listEntities/{id}", name="victoire_business_template_listentities")
348
     * @ParamConverter("id", class="VictoireBusinessPageBundle:BusinessTemplate")
349
     * @Template
350
     *
351
     * @throws Exception
352
     *
353
     * @return array|Response The list of items for this template
354
     */
355
    public function listEntitiesAction(BusinessTemplate $view)
0 ignored issues
show
Declare public methods first,then protected ones and finally private ones
Loading history...
356
    {
357
        //services
358
        $bepHelper = $this->get('victoire_business_page.business_page_helper');
359
360
        //parameters for the view
361
        return [
362
            'BusinessTemplate' => $view,
363
            'items'            => $bepHelper->getEntitiesAllowed($view, $this->get('doctrine.orm.entity_manager')),
364
        ];
365
    }
366
367
    /**
368
     * Get an array of business properties by the business entity page pattern.
369
     *
370
     * @param BusinessTemplate $view
371
     *
372
     * @return array of business properties
373
     */
374
    private function getBusinessProperties(BusinessTemplate $view)
375
    {
376
        $businessTemplateHelper = $this->get('victoire_business_page.business_page_helper');
377
        //the business property link to the page
378
        $businessEntityId = $view->getBusinessEntityName();
379
        $businessEntity = $this->get('victoire_core.entity.business_entity_repository')->findOneBy(['name' => $businessEntityId]);
380
381
        $businessProperties = $businessTemplateHelper->getBusinessProperties($businessEntity);
382
383
        return $businessProperties;
384
    }
385
386
    /**
387
     * @param string $id The id of the business entity
388
     *
389
     * @throws Exception If the business entity was not found
390
     *
391
     * @return \Victoire\Bundle\BusinessEntityBundle\Entity\BusinessEntity
392
     */
393
    private function getBusinessEntity($id)
394
    {
395
        //services
396
        $businessEntityManager = $this->get('victoire_core.helper.business_entity_helper');
0 ignored issues
show
$businessEntityManager is not used, you could remove the assignment.

This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently.

$myVar = 'Value';
$higher = false;

if (rand(1, 6) > 3) {
    $higher = true;
} else {
    $higher = false;
}

Both the $myVar assignment in line 1 and the $higher assignment in line 2 are dead. The first because $myVar is never used and the second because $higher is always overwritten for every possible time line.

Loading history...
397
398
        //get the businessEntity
399
        $businessEntity = $this->get('victoire_core.entity.business_entity_repository')->findOneBy(['name' => $id]);
400
401
        //test the result
402
        if ($businessEntity === null) {
403
            throw new \Exception('The business entity ['.$id.'] was not found.');
404
        }
405
406
        return $businessEntity;
407
    }
408
}
409