Issues (1704)

Branch: master

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

Bundle/WidgetMapBundle/Entity/WidgetMap.php (12 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
3
namespace Victoire\Bundle\WidgetMapBundle\Entity;
4
5
use Doctrine\Common\Collections\ArrayCollection;
6
use Doctrine\Common\Collections\Collection;
7
use Doctrine\ORM\Mapping as ORM;
8
use Victoire\Bundle\CoreBundle\Entity\View;
9
use Victoire\Bundle\WidgetBundle\Entity\Widget;
10
11
/**
12
 * @ORM\Table("vic_widget_map")
13
 * @ORM\Entity()
14
 */
15
class WidgetMap
16
{
17
    const ACTION_CREATE = 'create';
18
    const ACTION_OVERWRITE = 'overwrite';
19
    const ACTION_DELETE = 'delete';
20
21
    const POSITION_BEFORE = 'before';
22
    const POSITION_AFTER = 'after';
23
24
    /**
25
     * @var int
26
     *
27
     * @ORM\Column(name="id", type="integer")
28
     * @ORM\Id
29
     * @ORM\GeneratedValue(strategy="AUTO")
30
     */
31
    protected $id;
32
33
    /**
34
     * @var string
35
     *
36
     * @ORM\Column(name="action", type="string", length=255)
37
     */
38
    protected $action = null;
39
40
    /**
41
     * @var View
42
     *
43
     * @ORM\ManyToOne(targetEntity="\Victoire\Bundle\CoreBundle\Entity\View", inversedBy="widgetMaps")
44
     * @ORM\JoinColumn(name="view_id", referencedColumnName="id", onDelete="cascade")
45
     */
46
    protected $view;
47
48
    /**
49
     * A WidgetMap has a View but also a contextualView (not persisted).
50
     * This contextualView is set when WidgetMap is build.
51
     * When getChilds and getSubstitutes are called, we use this contextualView to retrieve
52
     * concerned WidgetMaps in order to avoid useless Doctrine queries.
53
     *
54
     * @var View
55
     */
56
    protected $contextualView;
57
58
    /**
59
     * @var [Widget]
60
     *
61
     * @ORM\OneToMany(targetEntity="\Victoire\Bundle\WidgetBundle\Entity\Widget", mappedBy="widgetMap", orphanRemoval=true, cascade={"persist", "remove"})
62
     */
63
    protected $widgets;
64
65
    /**
66
     * @deprecated Remove Doctrine mapping and property
67
     *
68
     * @var Widget
69
     *
70
     * @ORM\ManyToOne(targetEntity="\Victoire\Bundle\WidgetBundle\Entity\Widget")
71
     * @ORM\JoinColumn(name="widget_id", referencedColumnName="id", onDelete="SET NULL")
72
     */
73
    protected $widget;
74
75
    /**
76
     * @ORM\ManyToOne(targetEntity="\Victoire\Bundle\WidgetMapBundle\Entity\WidgetMap", inversedBy="substitutes")
77
     * @ORM\JoinColumn(name="replaced_id", referencedColumnName="id")
78
     */
79
    protected $replaced;
80
81
    /**
82
     * @var ArrayCollection
83
     * @ORM\OneToMany(targetEntity="\Victoire\Bundle\WidgetMapBundle\Entity\WidgetMap", mappedBy="replaced")
84
     */
85
    protected $substitutes;
86
87
    /**
88
     * @var string
89
     *
90
     * @ORM\Column(name="asynchronous", type="boolean")
91
     */
92
    protected $asynchronous = false;
93
94
    /**
95
     * @ORM\ManyToOne(targetEntity="\Victoire\Bundle\WidgetMapBundle\Entity\WidgetMap", inversedBy="children")
96
     * @ORM\JoinColumn(name="parent_id", referencedColumnName="id", onDelete="SET NULL")
97
     */
98
    protected $parent;
99
100
    /**
101
     * @var string
102
     *
103
     * @ORM\Column(name="position", type="string", nullable=true)
104
     */
105
    protected $position;
106
107
    /**
108
     * @var Collection
109
     * @ORM\OneToMany(targetEntity="\Victoire\Bundle\WidgetMapBundle\Entity\WidgetMap", mappedBy="parent")
110
     */
111
    protected $children;
112
113
    /**
114
     * @var string
115
     *
116
     * @ORM\Column(name="slot", type="string", length=255, nullable=true)
117
     */
118
    protected $slot;
119
120
    public function __construct()
0 ignored issues
show
Missing function doc comment
Loading history...
121
    {
122
        $this->children = new ArrayCollection();
123
        $this->substitutes = new ArrayCollection();
124
        $this->widgets = new ArrayCollection();
125
    }
126
127
    /**
128
     * @return int
129
     */
130
    public function getId()
131
    {
132
        return $this->id;
133
    }
134
135
    public function setId($id)
0 ignored issues
show
Missing function doc comment
Loading history...
136
    {
137
        $this->id = $id;
138
    }
139
140
    /**
141
     * @return string
142
     */
143
    public function isAsynchronous()
144
    {
145
        return $this->asynchronous;
146
    }
147
148
    /**
149
     * @param bool|string $asynchronous
150
     */
151
    public function setAsynchronous($asynchronous)
152
    {
153
        $this->asynchronous = $asynchronous;
0 ignored issues
show
Documentation Bug introduced by
It seems like $asynchronous can also be of type boolean. However, the property $asynchronous is declared as type string. Maybe add an additional type check?

Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.

For example, imagine you have a variable $accountId that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the id property of an instance of the Account class. This class holds a proper account, so the id value must no longer be false.

Either this assignment is in error or a type check should be added for that assignment.

class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
Loading history...
154
    }
155
156
    /**
157
     * Set the action.
158
     *
159
     * @param string $action
160
     *
161
     * @throws \Exception The action is not valid
162
     */
163
    public function setAction($action)
164
    {
165
        //test validity of the action
166
        if ($action !== self::ACTION_CREATE && $action !== self::ACTION_OVERWRITE && $action !== self::ACTION_DELETE) {
167
            throw new \Exception('The action of the widget map is not valid. Action: ['.$action.']');
168
        }
169
170
        $this->action = $action;
171
    }
172
173
    /**
174
     * Get the action.
175
     *
176
     * @return string The action
177
     */
178
    public function getAction()
179
    {
180
        return $this->action;
181
    }
182
183
    /**
184
     * @return [Widget]
0 ignored issues
show
The doc-type [Widget] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
185
     */
186
    public function getWidgets()
187
    {
188
        return $this->widgets;
189
    }
190
191
    /**
192
     * @param Widget $widget
193
     *
194
     * @return $this
195
     */
196
    public function addWidget(Widget $widget)
197
    {
198
        if (!$this->widgets->contains($widget)) {
199
            $this->widgets->add($widget);
200
        }
201
202
        return $this;
203
    }
204
205
    /**
206
     * @param [Widget] $widgets
0 ignored issues
show
The doc-type [Widget] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
207
     *
208
     * @return $this
209
     */
210
    public function setWidgets($widgets)
211
    {
212
        $this->widgets = $widgets;
213
214
        return $this;
215
    }
216
217
    /**
218
     * @return View
219
     */
220
    public function getView()
221
    {
222
        return $this->view;
223
    }
224
225
    /**
226
     * @param View $view
227
     */
228
    public function setView(View $view)
229
    {
230
        $this->view = $view;
231
    }
232
233
    /**
234
     * Get the current View context.
235
     *
236
     * @return View
237
     */
238
    public function getContextualView()
239
    {
240
        return $this->contextualView;
241
    }
242
243
    /**
244
     * Store the current View context.
245
     *
246
     * @param View $contextualView
247
     *
248
     * @return $this
249
     */
250
    public function setContextualView(View $contextualView)
251
    {
252
        $this->contextualView = $contextualView;
253
254
        return $this;
255
    }
256
257
    /**
258
     * @return WidgetMap
259
     */
260
    public function getReplaced()
261
    {
262
        return $this->replaced;
263
    }
264
265
    /**
266
     * @param WidgetMap $replaced
267
     */
268
    public function setReplaced($replaced)
269
    {
270
        if ($replaced) {
271
            $replaced->addSubstitute($this);
272
        }
273
        $this->replaced = $replaced;
274
    }
275
276
    /**
277
     * @return string
278
     */
279
    public function getSlot()
280
    {
281
        return $this->slot;
282
    }
283
284
    /**
285
     * @param string $slot
286
     */
287
    public function setSlot($slot)
288
    {
289
        $this->slot = $slot;
290
    }
291
292
    /**
0 ignored issues
show
Doc comment for parameter "$position" missing
Loading history...
293
     * @return WidgetMap|null
294
     */
295
    public function getChild($position)
296
    {
297
        $child = null;
298
        foreach ($this->children as $_child) {
299
            if ($_child && $_child->getPosition() == $position) {
300
                $child = $_child;
301
            }
302
        }
303
304
        return $child;
305
    }
306
307
    /**
0 ignored issues
show
Doc comment for parameter "$position" missing
Loading history...
308
     * Return all children from contextual View (already loaded WidgetMaps)
309
     * for a given position.
310
     *
311
     * @return WidgetMap[]
312
     */
313
    public function getContextualChildren($position)
314
    {
315
        $widgetMapChildren = [];
316
        $viewWidgetMaps = $this->getContextualView()->getWidgetMapsForViewAndTemplates();
317
318
        foreach ($viewWidgetMaps as $viewWidgetMap) {
319
            if ($viewWidgetMap->getParent() == $this && $viewWidgetMap->getPosition() == $position) {
320
                $widgetMapChildren[] = $viewWidgetMap;
321
            }
322
        }
323
324
        return $widgetMapChildren;
325
    }
326
327
    /**
328
     * @return WidgetMap[]
329
     */
330
    public function getChildren()
331
    {
332
        return $this->children;
333
    }
334
335
    /**
336
     * @param WidgetMap[] $children
337
     */
338
    public function setChildren($children)
339
    {
340
        $this->children = $children;
0 ignored issues
show
Documentation Bug introduced by
It seems like $children of type array<integer,object<Vic...ndle\Entity\WidgetMap>> is incompatible with the declared type object<Doctrine\Common\Collections\Collection> of property $children.

Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property.

Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property..

Loading history...
341
    }
342
343
    /**
344
     * @param WidgetMap $child
345
     */
346
    public function addChild($child)
347
    {
348
        $this->children->add($child);
349
    }
350
351
    /**
352
     * @param WidgetMap $child
353
     */
354
    public function removeChild($child)
355
    {
356
        $this->children->removeElement($child);
357
    }
358
359
    /**
360
     * @return WidgetMap|null
361
     */
362
    public function getParent()
363
    {
364
        return $this->parent;
365
    }
366
367
    /**
368
     * @param null|WidgetMap $parent
369
     */
370
    public function setParent(WidgetMap $parent = null)
371
    {
372
        if ($this->parent) {
373
            $this->parent->removeChild($this);
374
        }
375
        if ($parent) {
376
            $parent->addChild($this);
377
        }
378
        $this->parent = $parent;
379
    }
380
381
    /**
382
     * @return string
383
     */
384
    public function getPosition()
385
    {
386
        return $this->position;
387
    }
388
389
    /**
390
     * @param string $position
391
     */
392
    public function setPosition($position)
393
    {
394
        $this->position = $position;
395
    }
396
397
    /**
398
     * Return all substitutes from contextual View (already loaded WidgetMaps)
399
     * Ideally must return only one WidgetMap per View.
400
     *
401
     * @return WidgetMap[]
402
     */
403
    public function getContextualSubstitutes()
404
    {
405
        $substitutesWidgetMaps = [];
406
        $viewWidgetMaps = $this->getContextualView()->getWidgetMapsForViewAndTemplates();
407
408
        foreach ($viewWidgetMaps as $viewWidgetMap) {
409
            if ($viewWidgetMap->getReplaced() == $this) {
410
                $substitutesWidgetMaps[] = $viewWidgetMap;
411
            }
412
        }
413
414
        return $substitutesWidgetMaps;
415
    }
416
417
    /**
0 ignored issues
show
Doc comment for parameter "$view" missing
Loading history...
418
     * Return substitute if used in View or in one of its inherited Template.
419
     *
420
     * @return WidgetMap|null
421
     */
422
    public function getSubstituteForView(View $view)
423
    {
424
        foreach ($this->getContextualSubstitutes() as $substitute) {
425
            if ($substitute->getView() === $view) {
426
                return $substitute;
427
            }
428
429
            while ($template = $view->getTemplate()) {
430
                if ($substitute->getView() === $template) {
431
                    return $substitute;
432
                }
433
            }
434
        }
435
    }
436
437
    /**
438
     * Return all Substitutes (not based on contextual View).
439
     *
440
     * @return ArrayCollection
441
     */
442
    public function getAllSubstitutes()
443
    {
444
        return $this->substitutes;
445
    }
446
447
    /**
448
     * @param WidgetMap $substitute
449
     */
450
    public function addSubstitute(WidgetMap $substitute)
451
    {
452
        $this->substitutes->add($substitute);
453
    }
454
455
    /**
456
     * @param [WidgetMap] $substitutes
0 ignored issues
show
The doc-type [WidgetMap] could not be parsed: Unknown type name "" at position 0. [(view supported doc-types)

This check marks PHPDoc comments that could not be parsed by our parser. To see which comment annotations we can parse, please refer to our documentation on supported doc-types.

Loading history...
457
     */
458
    public function setSubstitutes($substitutes)
459
    {
460
        $this->substitutes = $substitutes;
461
    }
462
463
    /**
464
     * @deprecated
465
     *
466
     * @return Widget
467
     */
468
    public function getWidget()
469
    {
470
        return $this->widget;
0 ignored issues
show
Deprecated Code introduced by
The property Victoire\Bundle\WidgetMa...tity\WidgetMap::$widget has been deprecated with message: Remove Doctrine mapping and property

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
471
    }
472
473
    /**
474
     * @deprecated
475
     *
476
     * @param Widget $widget
477
     *
478
     * @return WidgetMap
479
     */
480
    public function setWidget(Widget $widget = null)
481
    {
482
        $this->widget = $widget;
0 ignored issues
show
Deprecated Code introduced by
The property Victoire\Bundle\WidgetMa...tity\WidgetMap::$widget has been deprecated with message: Remove Doctrine mapping and property

This property has been deprecated. The supplier of the class has supplied an explanatory message.

The explanatory message should give you some clue as to whether and when the property will be removed from the class and what other property to use instead.

Loading history...
483
484
        return $this;
485
    }
486
}
487